?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
amd64 - add kvtop and add back ed(4) to AMD64_GENERIC
[dragonfly.git] / sys / netinet / sctp_output.c
blobd09eb4b25da3c2674867f448a0646ef4ca2294f9
1 /* $KAME: sctp_output.c,v 1.46 2005/03/06 16:04:17 itojun Exp $ */
2 /* $DragonFly: src/sys/netinet/sctp_output.c,v 1.14 2008/04/20 13:44:25 swildner Exp $ */
3
4 /*
5 * Copyright (C) 2002, 2003, 2004 Cisco Systems Inc,
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the project nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33 #if !(defined(__OpenBSD__) || defined (__APPLE__))
34 #include "opt_ipsec.h"
35 #endif
36 #if defined(__FreeBSD__) || defined(__DragonFly__)
37 #include "opt_compat.h"
38 #include "opt_inet6.h"
39 #include "opt_inet.h"
40 #endif
41 #if defined(__NetBSD__)
42 #include "opt_inet.h"
43 #endif
44 #ifdef __APPLE__
45 #include <sctp.h>
46 #elif !defined(__OpenBSD__)
47 #include "opt_sctp.h"
48 #endif
49 #include <sys/param.h>
50 #include <sys/systm.h>
51 #include <sys/malloc.h>
52 #include <sys/mbuf.h>
53 #ifndef __OpenBSD__
54 #include <sys/domain.h>
55 #endif
56 #include <sys/protosw.h>
57 #include <sys/socket.h>
58 #include <sys/socketvar.h>
59 #include <sys/proc.h>
60 #include <sys/kernel.h>
61 #include <sys/sysctl.h>
62 #include <sys/resourcevar.h>
63 #include <sys/uio.h>
64 #ifdef INET6
65 #include <sys/domain.h>
66 #endif
67 #include <sys/thread2.h>
68 #include <sys/socketvar2.h>
69
70 #if (defined(__FreeBSD__) && __FreeBSD_version >= 500000)
71 #include <sys/limits.h>
72 #else
73 #include <machine/limits.h>
74 #endif
75 #include <machine/cpu.h>
76
77 #include <net/if.h>
78 #include <net/if_types.h>
79
80 #if defined(__FreeBSD__) || defined(__DragonFly__)
81 #include <net/if_var.h>
82 #endif
83
84 #include <net/route.h>
85
86 #include <netinet/in.h>
87 #include <netinet/in_systm.h>
88 #include <netinet/ip.h>
89 #include <netinet/in_pcb.h>
90 #include <netinet/in_var.h>
91 #include <netinet/ip_var.h>
92
93 #ifdef INET6
94 #include <netinet/ip6.h>
95 #include <netinet6/ip6_var.h>
96 #include <netinet6/scope6_var.h>
97 #include <netinet6/nd6.h>
98
99 #if defined(__FreeBSD__) || defined(__NetBSD__) || defined(__DragonFly__)
100 #include <netinet6/in6_pcb.h>
101 #elif defined(__OpenBSD__)
102 #include <netinet/in_pcb.h>
103 #endif
104
105 #include <netinet/icmp6.h>
106
107 #endif /* INET6 */
108
109 #include <net/net_osdep.h>
110
111 #if defined(HAVE_NRL_INPCB) || defined(__FreeBSD__) || defined(__DragonFly__)
112 #ifndef in6pcb
113 #define in6pcb inpcb
114 #endif
115 #endif
116
117 #include <netinet/sctp_pcb.h>
118
119 #ifdef IPSEC
120 #ifndef __OpenBSD__
121 #include <netinet6/ipsec.h>
122 #include <netproto/key/key.h>
123 #else
124 #undef IPSEC
125 #endif
126 #endif /* IPSEC */
127
128 #include <netinet/sctp_var.h>
129 #include <netinet/sctp_header.h>
130 #include <netinet/sctputil.h>
131 #include <netinet/sctp_pcb.h>
132 #include <netinet/sctp_output.h>
133 #include <netinet/sctp_uio.h>
134 #include <netinet/sctputil.h>
135 #include <netinet/sctp_hashdriver.h>
136 #include <netinet/sctp_timer.h>
137 #include <netinet/sctp_asconf.h>
138 #include <netinet/sctp_indata.h>
139
140 #ifdef SCTP_DEBUG
141 extern uint32_t sctp_debug_on;
142 #endif
143
144 extern int sctp_peer_chunk_oh;
145
146 static int
147 sctp_find_cmsg(int c_type, void *data, struct mbuf *control, int cpsize)
148 {
149 struct cmsghdr cmh;
150 int tlen, at;
151
152 tlen = control->m_len;
153 at = 0;
154 /*
155 * Independent of how many mbufs, find the c_type inside the control
156 * structure and copy out the data.
157 */
158 while (at < tlen) {
159 if ((tlen-at) < (int)CMSG_ALIGN(sizeof(cmh))) {
160 /* not enough room for one more we are done. */
161 return (0);
162 }
163 m_copydata(control, at, sizeof(cmh), (caddr_t)&cmh);
164 if ((cmh.cmsg_len + at) > tlen) {
165 /*
166 * this is real messed up since there is not enough
167 * data here to cover the cmsg header. We are done.
168 */
169 return (0);
170 }
171 if ((cmh.cmsg_level == IPPROTO_SCTP) &&
172 (c_type == cmh.cmsg_type)) {
173 /* found the one we want, copy it out */
174 at += CMSG_ALIGN(sizeof(struct cmsghdr));
175 if ((int)(cmh.cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr))) < cpsize) {
176 /*
177 * space of cmsg_len after header not
178 * big enough
179 */
180 return (0);
181 }
182 m_copydata(control, at, cpsize, data);
183 return (1);
184 } else {
185 at += CMSG_ALIGN(cmh.cmsg_len);
186 if (cmh.cmsg_len == 0) {
187 break;
188 }
189 }
190 }
191 /* not found */
192 return (0);
193 }
194
195 static struct mbuf *
196 sctp_add_addr_to_mbuf(struct mbuf *m, struct ifaddr *ifa)
197 {
198 struct sctp_paramhdr *parmh;
199 struct mbuf *mret;
200 int len;
201 if (ifa->ifa_addr->sa_family == AF_INET) {
202 len = sizeof(struct sctp_ipv4addr_param);
203 } else if (ifa->ifa_addr->sa_family == AF_INET6) {
204 len = sizeof(struct sctp_ipv6addr_param);
205 } else {
206 /* unknown type */
207 return (m);
208 }
209
210 if (M_TRAILINGSPACE(m) >= len) {
211 /* easy side we just drop it on the end */
212 parmh = (struct sctp_paramhdr *)(m->m_data + m->m_len);
213 mret = m;
214 } else {
215 /* Need more space */
216 mret = m;
217 while (mret->m_next != NULL) {
218 mret = mret->m_next;
219 }
220 MGET(mret->m_next, MB_DONTWAIT, MT_DATA);
221 if (mret->m_next == NULL) {
222 /* We are hosed, can't add more addresses */
223 return (m);
224 }
225 mret = mret->m_next;
226 parmh = mtod(mret, struct sctp_paramhdr *);
227 }
228 /* now add the parameter */
229 if (ifa->ifa_addr->sa_family == AF_INET) {
230 struct sctp_ipv4addr_param *ipv4p;
231 struct sockaddr_in *sin;
232 sin = (struct sockaddr_in *)ifa->ifa_addr;
233 ipv4p = (struct sctp_ipv4addr_param *)parmh;
234 parmh->param_type = htons(SCTP_IPV4_ADDRESS);
235 parmh->param_length = htons(len);
236 ipv4p->addr = sin->sin_addr.s_addr;
237 mret->m_len += len;
238 } else if (ifa->ifa_addr->sa_family == AF_INET6) {
239 struct sctp_ipv6addr_param *ipv6p;
240 struct sockaddr_in6 *sin6;
241 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
242 ipv6p = (struct sctp_ipv6addr_param *)parmh;
243 parmh->param_type = htons(SCTP_IPV6_ADDRESS);
244 parmh->param_length = htons(len);
245 memcpy(ipv6p->addr, &sin6->sin6_addr,
246 sizeof(ipv6p->addr));
247 /* clear embedded scope in the address */
248 in6_clearscope((struct in6_addr *)ipv6p->addr);
249 mret->m_len += len;
250 } else {
251 return (m);
252 }
253 return (mret);
254 }
255
256
257
258 static struct mbuf *
259 sctp_add_cookie(struct sctp_inpcb *inp, struct mbuf *init, int init_offset,
260 struct mbuf *initack, int initack_offset, struct sctp_state_cookie *stc_in)
261 {
262 struct mbuf *copy_init, *copy_initack, *m_at, *sig, *mret;
263 struct sctp_state_cookie *stc;
264 struct sctp_paramhdr *ph;
265 uint8_t *signature;
266 int sig_offset;
267 uint16_t cookie_sz;
268
269 mret = NULL;
270
271 MGET(mret, MB_DONTWAIT, MT_DATA);
272 if (mret == NULL) {
273 return (NULL);
274 }
275 copy_init = sctp_m_copym(init, init_offset, M_COPYALL, MB_DONTWAIT);
276 if (copy_init == NULL) {
277 sctp_m_freem(mret);
278 return (NULL);
279 }
280 copy_initack = sctp_m_copym(initack, initack_offset, M_COPYALL,
281 MB_DONTWAIT);
282 if (copy_initack == NULL) {
283 sctp_m_freem(mret);
284 sctp_m_freem(copy_init);
285 return (NULL);
286 }
287 /* easy side we just drop it on the end */
288 ph = mtod(mret, struct sctp_paramhdr *);
289 mret->m_len = sizeof(struct sctp_state_cookie) +
290 sizeof(struct sctp_paramhdr);
291 stc = (struct sctp_state_cookie *)((caddr_t)ph +
292 sizeof(struct sctp_paramhdr));
293 ph->param_type = htons(SCTP_STATE_COOKIE);
294 ph->param_length = 0; /* fill in at the end */
295 /* Fill in the stc cookie data */
296 *stc = *stc_in;
297
298 /* tack the INIT and then the INIT-ACK onto the chain */
299 cookie_sz = 0;
300 m_at = mret;
301 for (m_at = mret; m_at; m_at = m_at->m_next) {
302 cookie_sz += m_at->m_len;
303 if (m_at->m_next == NULL) {
304 m_at->m_next = copy_init;
305 break;
306 }
307 }
308
309 for (m_at = copy_init; m_at; m_at = m_at->m_next) {
310 cookie_sz += m_at->m_len;
311 if (m_at->m_next == NULL) {
312 m_at->m_next = copy_initack;
313 break;
314 }
315 }
316
317 for (m_at = copy_initack; m_at; m_at = m_at->m_next) {
318 cookie_sz += m_at->m_len;
319 if (m_at->m_next == NULL) {
320 break;
321 }
322 }
323 MGET(sig, MB_DONTWAIT, MT_DATA);
324 if (sig == NULL) {
325 /* no space */
326 sctp_m_freem(mret);
327 sctp_m_freem(copy_init);
328 sctp_m_freem(copy_initack);
329 return (NULL);
330 }
331 sig->m_len = 0;
332 m_at->m_next = sig;
333 sig_offset = 0;
334 signature = (uint8_t *)(mtod(sig, caddr_t) + sig_offset);
335 /* Time to sign the cookie */
336 sctp_hash_digest_m((char *)inp->sctp_ep.secret_key[
337 (int)(inp->sctp_ep.current_secret_number)],
338 SCTP_SECRET_SIZE, mret, sizeof(struct sctp_paramhdr),
339 (uint8_t *)signature);
340 sig->m_len += SCTP_SIGNATURE_SIZE;
341 cookie_sz += SCTP_SIGNATURE_SIZE;
342
343 ph->param_length = htons(cookie_sz);
344 return (mret);
345 }
346
347
348 static struct sockaddr_in *
349 sctp_is_v4_ifa_addr_prefered (struct ifaddr *ifa, uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
350 {
351 struct sockaddr_in *sin;
352 /*
353 * Here we determine if its a prefered address. A
354 * prefered address means it is the same scope or
355 * higher scope then the destination.
356 * L = loopback, P = private, G = global
357 * -----------------------------------------
358 * src | dest | result
359 *-----------------------------------------
360 * L | L | yes
361 *-----------------------------------------
362 * P | L | yes
363 *-----------------------------------------
364 * G | L | yes
365 *-----------------------------------------
366 * L | P | no
367 *-----------------------------------------
368 * P | P | yes
369 *-----------------------------------------
370 * G | P | no
371 *-----------------------------------------
372 * L | G | no
373 *-----------------------------------------
374 * P | G | no
375 *-----------------------------------------
376 * G | G | yes
377 *-----------------------------------------
378 */
379
380 if (ifa->ifa_addr->sa_family != AF_INET) {
381 /* forget non-v4 */
382 return (NULL);
383 }
384 /* Ok the address may be ok */
385 sin = (struct sockaddr_in *)ifa->ifa_addr;
386 if (sin->sin_addr.s_addr == 0) {
387 return (NULL);
388 }
389 *sin_local = *sin_loop = 0;
390 if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
391 (IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) {
392 *sin_loop = 1;
393 *sin_local = 1;
394 }
395 if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
396 *sin_local = 1;
397 }
398 if (!loopscope && *sin_loop) {
399 /* Its a loopback address and we don't have loop scope */
400 return (NULL);
401 }
402 if (!ipv4_scope && *sin_local) {
403 /* Its a private address, and we don't have private address scope */
404 return (NULL);
405 }
406 if (((ipv4_scope == 0) && (loopscope == 0)) && (*sin_local)) {
407 /* its a global src and a private dest */
408 return (NULL);
409 }
410 /* its a prefered address */
411 return (sin);
412 }
413
414 static struct sockaddr_in *
415 sctp_is_v4_ifa_addr_acceptable (struct ifaddr *ifa, uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
416 {
417 struct sockaddr_in *sin;
418 /*
419 * Here we determine if its a acceptable address. A
420 * acceptable address means it is the same scope or
421 * higher scope but we can allow for NAT which means
422 * its ok to have a global dest and a private src.
423 *
424 * L = loopback, P = private, G = global
425 * -----------------------------------------
426 * src | dest | result
427 *-----------------------------------------
428 * L | L | yes
429 *-----------------------------------------
430 * P | L | yes
431 *-----------------------------------------
432 * G | L | yes
433 *-----------------------------------------
434 * L | P | no
435 *-----------------------------------------
436 * P | P | yes
437 *-----------------------------------------
438 * G | P | yes - probably this won't work.
439 *-----------------------------------------
440 * L | G | no
441 *-----------------------------------------
442 * P | G | yes
443 *-----------------------------------------
444 * G | G | yes
445 *-----------------------------------------
446 */
447
448 if (ifa->ifa_addr->sa_family != AF_INET) {
449 /* forget non-v4 */
450 return (NULL);
451 }
452 /* Ok the address may be ok */
453 sin = (struct sockaddr_in *)ifa->ifa_addr;
454 if (sin->sin_addr.s_addr == 0) {
455 return (NULL);
456 }
457 *sin_local = *sin_loop = 0;
458 if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
459 (IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) {
460 *sin_loop = 1;
461 *sin_local = 1;
462 }
463 if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
464 *sin_local = 1;
465 }
466 if (!loopscope && *sin_loop) {
467 /* Its a loopback address and we don't have loop scope */
468 return (NULL);
469 }
470 /* its an acceptable address */
471 return (sin);
472 }
473
474 /*
475 * This treats the address list on the ep as a restricted list
476 * (negative list). If a the passed address is listed, then
477 * the address is NOT allowed on the association.
478 */
479 int
480 sctp_is_addr_restricted(struct sctp_tcb *stcb, struct sockaddr *addr)
481 {
482 struct sctp_laddr *laddr;
483 #ifdef SCTP_DEBUG
484 int cnt=0;
485 #endif
486 if (stcb == NULL) {
487 /* There are no restrictions, no TCB :-) */
488 return (0);
489 }
490 #ifdef SCTP_DEBUG
491 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
492 cnt++;
493 }
494 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
495 kprintf("There are %d addresses on the restricted list\n", cnt);
496 }
497 cnt = 0;
498 #endif
499 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
500 if (laddr->ifa == NULL) {
501 #ifdef SCTP_DEBUG
502 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
503 kprintf("Help I have fallen and I can't get up!\n");
504 }
505 #endif
506 continue;
507 }
508 #ifdef SCTP_DEBUG
509 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
510 cnt++;
511 kprintf("Restricted address[%d]:", cnt);
512 sctp_print_address(laddr->ifa->ifa_addr);
513 }
514 #endif
515 if (sctp_cmpaddr(addr, laddr->ifa->ifa_addr) == 1) {
516 /* Yes it is on the list */
517 return (1);
518 }
519 }
520 return (0);
521 }
522
523 static int
524 sctp_is_addr_in_ep(struct sctp_inpcb *inp, struct ifaddr *ifa)
525 {
526 struct sctp_laddr *laddr;
527
528 if (ifa == NULL)
529 return (0);
530 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
531 if (laddr->ifa == NULL) {
532 #ifdef SCTP_DEBUG
533 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
534 kprintf("Help I have fallen and I can't get up!\n");
535 }
536 #endif
537 continue;
538 }
539 if (laddr->ifa->ifa_addr == NULL)
540 continue;
541 if (laddr->ifa == ifa)
542 /* same pointer */
543 return (1);
544 if (laddr->ifa->ifa_addr->sa_family != ifa->ifa_addr->sa_family) {
545 /* skip non compatible address comparison */
546 continue;
547 }
548 if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
549 /* Yes it is restricted */
550 return (1);
551 }
552 }
553 return (0);
554 }
555
556
557
558 static struct in_addr
559 sctp_choose_v4_boundspecific_inp(struct sctp_inpcb *inp,
560 struct rtentry *rt,
561 uint8_t ipv4_scope,
562 uint8_t loopscope)
563 {
564 struct in_addr ans;
565 struct sctp_laddr *laddr;
566 struct sockaddr_in *sin;
567 struct ifnet *ifn;
568 uint8_t sin_loop, sin_local;
569
570 /* first question, is the ifn we will emit on
571 * in our list, if so, we want that one.
572 */
573 ifn = rt->rt_ifp;
574 if (ifn) {
575 struct ifaddr_container *ifac;
576
577 /* is a prefered one on the interface we route out? */
578 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
579 struct ifaddr *ifa = ifac->ifa;
580
581 sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
582 if (sin == NULL)
583 continue;
584 if (sctp_is_addr_in_ep(inp, ifa)) {
585 return (sin->sin_addr);
586 }
587 }
588 /* is an acceptable one on the interface we route out? */
589 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
590 struct ifaddr *ifa = ifac->ifa;
591
592 sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
593 if (sin == NULL)
594 continue;
595 if (sctp_is_addr_in_ep(inp, ifa)) {
596 return (sin->sin_addr);
597 }
598 }
599 }
600 /* ok, what about a prefered address in the inp */
601 for (laddr = LIST_FIRST(&inp->sctp_addr_list);
602 laddr && (laddr != inp->next_addr_touse);
603 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
604 if (laddr->ifa == NULL) {
605 /* address has been removed */
606 continue;
607 }
608 sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
609 if (sin == NULL)
610 continue;
611 return (sin->sin_addr);
612
613 }
614 /* ok, what about an acceptable address in the inp */
615 for (laddr = LIST_FIRST(&inp->sctp_addr_list);
616 laddr && (laddr != inp->next_addr_touse);
617 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
618 if (laddr->ifa == NULL) {
619 /* address has been removed */
620 continue;
621 }
622 sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
623 if (sin == NULL)
624 continue;
625 return (sin->sin_addr);
626
627 }
628
629 /* no address bound can be a source for the destination we are in trouble */
630 #ifdef SCTP_DEBUG
631 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
632 kprintf("Src address selection for EP, no acceptable src address found for address\n");
633 }
634 #endif
635 memset(&ans, 0, sizeof(ans));
636 return (ans);
637 }
638
639
640
641 static struct in_addr
642 sctp_choose_v4_boundspecific_stcb(struct sctp_inpcb *inp,
643 struct sctp_tcb *stcb,
644 struct sctp_nets *net,
645 struct rtentry *rt,
646 uint8_t ipv4_scope,
647 uint8_t loopscope,
648 int non_asoc_addr_ok)
649 {
650 /*
651 * Here we have two cases, bound all asconf
652 * allowed. bound all asconf not allowed.
653 *
654 */
655 struct sctp_laddr *laddr, *starting_point;
656 struct in_addr ans;
657 struct ifnet *ifn;
658 uint8_t sin_loop, sin_local, start_at_beginning=0;
659 struct sockaddr_in *sin;
660
661 /* first question, is the ifn we will emit on
662 * in our list, if so, we want that one.
663 */
664 ifn = rt->rt_ifp;
665
666 if (inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) {
667 /*
668 * Here we use the list of addresses on the endpoint. Then
669 * the addresses listed on the "restricted" list is just that,
670 * address that have not been added and can't be used (unless
671 * the non_asoc_addr_ok is set).
672 */
673 #ifdef SCTP_DEBUG
674 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
675 kprintf("Have a STCB - asconf allowed, not bound all have a netgative list\n");
676 }
677 #endif
678 /* first question, is the ifn we will emit on
679 * in our list, if so, we want that one.
680 */
681 if (ifn) {
682 struct ifaddr_container *ifac;
683
684 /* first try for an prefered address on the ep */
685 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
686 struct ifaddr *ifa = ifac->ifa;
687
688 if (sctp_is_addr_in_ep(inp, ifa)) {
689 sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
690 if (sin == NULL)
691 continue;
692 if ((non_asoc_addr_ok == 0) &&
693 (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
694 /* on the no-no list */
695 continue;
696 }
697 return (sin->sin_addr);
698 }
699 }
700 /* next try for an acceptable address on the ep */
701 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
702 struct ifaddr *ifa = ifac->ifa;
703
704 if (sctp_is_addr_in_ep(inp, ifa)) {
705 sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
706 if (sin == NULL)
707 continue;
708 if ((non_asoc_addr_ok == 0) &&
709 (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
710 /* on the no-no list */
711 continue;
712 }
713 return (sin->sin_addr);
714 }
715 }
716
717 }
718 /* if we can't find one like that then we must
719 * look at all addresses bound to pick one at
720 * first prefereable then secondly acceptable.
721 */
722 starting_point = stcb->asoc.last_used_address;
723 sctpv4_from_the_top:
724 if (stcb->asoc.last_used_address == NULL) {
725 start_at_beginning=1;
726 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
727 }
728 /* search beginning with the last used address */
729 for (laddr = stcb->asoc.last_used_address; laddr;
730 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
731 if (laddr->ifa == NULL) {
732 /* address has been removed */
733 continue;
734 }
735 sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
736 if (sin == NULL)
737 continue;
738 if ((non_asoc_addr_ok == 0) &&
739 (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
740 /* on the no-no list */
741 continue;
742 }
743 return (sin->sin_addr);
744
745 }
746 if (start_at_beginning == 0) {
747 stcb->asoc.last_used_address = NULL;
748 goto sctpv4_from_the_top;
749 }
750 /* now try for any higher scope than the destination */
751 stcb->asoc.last_used_address = starting_point;
752 start_at_beginning = 0;
753 sctpv4_from_the_top2:
754 if (stcb->asoc.last_used_address == NULL) {
755 start_at_beginning=1;
756 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
757 }
758 /* search beginning with the last used address */
759 for (laddr = stcb->asoc.last_used_address; laddr;
760 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
761 if (laddr->ifa == NULL) {
762 /* address has been removed */
763 continue;
764 }
765 sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
766 if (sin == NULL)
767 continue;
768 if ((non_asoc_addr_ok == 0) &&
769 (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
770 /* on the no-no list */
771 continue;
772 }
773 return (sin->sin_addr);
774 }
775 if (start_at_beginning == 0) {
776 stcb->asoc.last_used_address = NULL;
777 goto sctpv4_from_the_top2;
778 }
779 } else {
780 /*
781 * Here we have an address list on the association, thats the
782 * only valid source addresses that we can use.
783 */
784 #ifdef SCTP_DEBUG
785 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
786 kprintf("Have a STCB - no asconf allowed, not bound all have a positive list\n");
787 }
788 #endif
789 /* First look at all addresses for one that is on
790 * the interface we route out
791 */
792 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
793 sctp_nxt_addr) {
794 if (laddr->ifa == NULL) {
795 /* address has been removed */
796 continue;
797 }
798 sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
799 if (sin == NULL)
800 continue;
801 /* first question, is laddr->ifa an address associated with the emit interface */
802 if (ifn) {
803 struct ifaddr_container *ifac;
804
805 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
806 struct ifaddr *ifa = ifac->ifa;
807
808 if (laddr->ifa == ifa) {
809 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
810 return (sin->sin_addr);
811 }
812 if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
813 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
814 return (sin->sin_addr);
815 }
816 }
817 }
818 }
819 /* what about an acceptable one on the interface? */
820 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
821 sctp_nxt_addr) {
822 if (laddr->ifa == NULL) {
823 /* address has been removed */
824 continue;
825 }
826 sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
827 if (sin == NULL)
828 continue;
829 /* first question, is laddr->ifa an address associated with the emit interface */
830 if (ifn) {
831 struct ifaddr_container *ifac;
832
833 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
834 struct ifaddr *ifa = ifac->ifa;
835
836 if (laddr->ifa == ifa) {
837 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
838 return (sin->sin_addr);
839 }
840 if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
841 sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
842 return (sin->sin_addr);
843 }
844 }
845 }
846 }
847 /* ok, next one that is preferable in general */
848 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
849 sctp_nxt_addr) {
850 if (laddr->ifa == NULL) {
851 /* address has been removed */
852 continue;
853 }
854 sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
855 if (sin == NULL)
856 continue;
857 return (sin->sin_addr);
858 }
859
860 /* last, what about one that is acceptable */
861 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
862 sctp_nxt_addr) {
863 if (laddr->ifa == NULL) {
864 /* address has been removed */
865 continue;
866 }
867 sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
868 if (sin == NULL)
869 continue;
870 return (sin->sin_addr);
871 }
872 }
873 memset(&ans, 0, sizeof(ans));
874 return (ans);
875 }
876
877 static struct sockaddr_in *
878 sctp_select_v4_nth_prefered_addr_from_ifn_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok,
879 uint8_t loopscope, uint8_t ipv4_scope, int cur_addr_num)
880 {
881 struct ifaddr_container *ifac;
882 struct sockaddr_in *sin;
883 uint8_t sin_loop, sin_local;
884 int num_eligible_addr = 0;
885
886 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
887 struct ifaddr *ifa = ifac->ifa;
888
889 sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
890 if (sin == NULL)
891 continue;
892 if (stcb) {
893 if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
894 /* It is restricted for some reason.. probably
895 * not yet added.
896 */
897 continue;
898 }
899 }
900 if (cur_addr_num == num_eligible_addr) {
901 return (sin);
902 }
903 }
904 return (NULL);
905 }
906
907
908 static int
909 sctp_count_v4_num_prefered_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok,
910 uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
911 {
912 struct ifaddr_container *ifac;
913 struct sockaddr_in *sin;
914 int num_eligible_addr = 0;
915
916 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
917 struct ifaddr *ifa = ifac->ifa;
918
919 sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, sin_loop, sin_local);
920 if (sin == NULL)
921 continue;
922 if (stcb) {
923 if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
924 /* It is restricted for some reason.. probably
925 * not yet added.
926 */
927 continue;
928 }
929 }
930 num_eligible_addr++;
931 }
932 return (num_eligible_addr);
933
934 }
935
936 static struct in_addr
937 sctp_choose_v4_boundall(struct sctp_inpcb *inp,
938 struct sctp_tcb *stcb,
939 struct sctp_nets *net,
940 struct rtentry *rt,
941 uint8_t ipv4_scope,
942 uint8_t loopscope,
943 int non_asoc_addr_ok)
944 {
945 int cur_addr_num=0, num_prefered=0;
946 uint8_t sin_loop, sin_local;
947 struct ifnet *ifn;
948 struct sockaddr_in *sin;
949 struct in_addr ans;
950 struct ifaddr_container *ifac;
951 /*
952 * For v4 we can use (in boundall) any address in the association. If
953 * non_asoc_addr_ok is set we can use any address (at least in theory).
954 * So we look for prefered addresses first. If we find one, we use it.
955 * Otherwise we next try to get an address on the interface, which we
956 * should be able to do (unless non_asoc_addr_ok is false and we are
957 * routed out that way). In these cases where we can't use the address
958 * of the interface we go through all the ifn's looking for an address
959 * we can use and fill that in. Punting means we send back address
960 * 0, which will probably cause problems actually since then IP will
961 * fill in the address of the route ifn, which means we probably already
962 * rejected it.. i.e. here comes an abort :-<.
963 */
964 ifn = rt->rt_ifp;
965 if (net) {
966 cur_addr_num = net->indx_of_eligible_next_to_use;
967 }
968 if (ifn == NULL) {
969 goto bound_all_v4_plan_c;
970 }
971 num_prefered = sctp_count_v4_num_prefered_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, ipv4_scope, &sin_loop, &sin_local);
972 #ifdef SCTP_DEBUG
973 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
974 kprintf("Found %d preferred source addresses\n", num_prefered);
975 }
976 #endif
977 if (num_prefered == 0) {
978 /* no eligible addresses, we must use some other
979 * interface address if we can find one.
980 */
981 goto bound_all_v4_plan_b;
982 }
983 /* Ok we have num_eligible_addr set with how many we can use,
984 * this may vary from call to call due to addresses being deprecated etc..
985 */
986 if (cur_addr_num >= num_prefered) {
987 cur_addr_num = 0;
988 }
989 /* select the nth address from the list (where cur_addr_num is the nth) and
990 * 0 is the first one, 1 is the second one etc...
991 */
992 #ifdef SCTP_DEBUG
993 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
994 kprintf("cur_addr_num:%d\n", cur_addr_num);
995 }
996 #endif
997 sin = sctp_select_v4_nth_prefered_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
998 ipv4_scope, cur_addr_num);
999
1000 /* if sin is NULL something changed??, plan_a now */
1001 if (sin) {
1002 return (sin->sin_addr);
1003 }
1004
1005 /*
1006 * plan_b: Look at the interface that we emit on
1007 * and see if we can find an acceptable address.
1008 */
1009 bound_all_v4_plan_b:
1010 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1011 struct ifaddr *ifa = ifac->ifa;
1012
1013 sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
1014 if (sin == NULL)
1015 continue;
1016 if (stcb) {
1017 if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
1018 /* It is restricted for some reason.. probably
1019 * not yet added.
1020 */
1021 continue;
1022 }
1023 }
1024 return (sin->sin_addr);
1025 }
1026 /*
1027 * plan_c: Look at all interfaces and find a prefered
1028 * address. If we reache here we are in trouble I think.
1029 */
1030 bound_all_v4_plan_c:
1031 for (ifn = TAILQ_FIRST(&ifnet);
1032 ifn && (ifn != inp->next_ifn_touse);
1033 ifn=TAILQ_NEXT(ifn, if_list)) {
1034 if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
1035 /* wrong base scope */
1036 continue;
1037 }
1038 if (ifn == rt->rt_ifp)
1039 /* already looked at this guy */
1040 continue;
1041 num_prefered = sctp_count_v4_num_prefered_boundall (ifn, stcb, non_asoc_addr_ok,
1042 loopscope, ipv4_scope, &sin_loop, &sin_local);
1043 #ifdef SCTP_DEBUG
1044 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1045 kprintf("Found ifn:%x %d preferred source addresses\n", (u_int)ifn, num_prefered);
1046 }
1047 #endif
1048 if (num_prefered == 0) {
1049 /*
1050 * None on this interface.
1051 */
1052 continue;
1053 }
1054 /* Ok we have num_eligible_addr set with how many we can use,
1055 * this may vary from call to call due to addresses being deprecated etc..
1056 */
1057 if (cur_addr_num >= num_prefered) {
1058 cur_addr_num = 0;
1059 }
1060 sin = sctp_select_v4_nth_prefered_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1061 ipv4_scope, cur_addr_num);
1062 if (sin == NULL)
1063 continue;
1064 return (sin->sin_addr);
1065
1066 }
1067
1068 /*
1069 * plan_d: We are in deep trouble. No prefered address on
1070 * any interface. And the emit interface does not
1071 * even have an acceptable address. Take anything
1072 * we can get! If this does not work we are
1073 * probably going to emit a packet that will
1074 * illicit an ABORT, falling through.
1075 */
1076
1077 for (ifn = TAILQ_FIRST(&ifnet);
1078 ifn && (ifn != inp->next_ifn_touse);
1079 ifn=TAILQ_NEXT(ifn, if_list)) {
1080 if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
1081 /* wrong base scope */
1082 continue;
1083 }
1084 if (ifn == rt->rt_ifp)
1085 /* already looked at this guy */
1086 continue;
1087
1088 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1089 struct ifaddr *ifa = ifac->ifa;
1090
1091 sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
1092 if (sin == NULL)
1093 continue;
1094 if (stcb) {
1095 if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
1096 /* It is restricted for some reason.. probably
1097 * not yet added.
1098 */
1099 continue;
1100 }
1101 }
1102 return (sin->sin_addr);
1103 }
1104 }
1105 /*
1106 * Ok we can find NO address to source from that is
1107 * not on our negative list. It is either the special
1108 * ASCONF case where we are sourceing from a intf that
1109 * has been ifconfig'd to a different address (i.e.
1110 * it holds a ADD/DEL/SET-PRIM and the proper lookup
1111 * address. OR we are hosed, and this baby is going
1112 * to abort the association.
1113 */
1114 if (non_asoc_addr_ok) {
1115 return (((struct sockaddr_in *)(rt->rt_ifa->ifa_addr))->sin_addr);
1116 } else {
1117 memset(&ans, 0, sizeof(ans));
1118 return (ans);
1119 }
1120 }
1121
1122
1123
1124 /* tcb may be NULL */
1125 struct in_addr
1126 sctp_ipv4_source_address_selection(struct sctp_inpcb *inp,
1127 struct sctp_tcb *stcb, struct route *ro, struct sctp_nets *net,
1128 int non_asoc_addr_ok)
1129 {
1130 struct in_addr ans;
1131 struct sockaddr_in *to = (struct sockaddr_in *)&ro->ro_dst;
1132 uint8_t ipv4_scope, loopscope;
1133 /*
1134 * Rules:
1135 * - Find the route if needed, cache if I can.
1136 * - Look at interface address in route, Is it
1137 * in the bound list. If so we have the best source.
1138 * - If not we must rotate amongst the addresses.
1139 *
1140 * Cavets and issues
1141 *
1142 * Do we need to pay attention to scope. We can have
1143 * a private address or a global address we are sourcing
1144 * or sending to. So if we draw it out
1145 * source * dest * result
1146 * ------------------------------------------
1147 * a Private * Global * NAT?
1148 * ------------------------------------------
1149 * b Private * Private * No problem
1150 * ------------------------------------------
1151 * c Global * Private * Huh, How will this work?
1152 * ------------------------------------------
1153 * d Global * Global * No Problem
1154 * ------------------------------------------
1155 *
1156 * And then we add to that what happens if there are multiple
1157 * addresses assigned to an interface. Remember the ifa on a
1158 * ifn is a linked list of addresses. So one interface can
1159 * have more than one IPv4 address. What happens if we
1160 * have both a private and a global address? Do we then
1161 * use context of destination to sort out which one is
1162 * best? And what about NAT's sending P->G may get you
1163 * a NAT translation, or should you select the G thats
1164 * on the interface in preference.
1165 *
1166 * Decisions:
1167 *
1168 * - count the number of addresses on the interface.
1169 * - if its one, no problem except case <c>. For <a>
1170 * we will assume a NAT out there.
1171 * - if there are more than one, then we need to worry
1172 * about scope P or G. We should prefer G -> G and
1173 * P -> P if possible. Then as a secondary fall back
1174 * to mixed types G->P being a last ditch one.
1175 * - The above all works for bound all, but bound
1176 * specific we need to use the same concept but instead
1177 * only consider the bound addresses. If the bound set
1178 * is NOT assigned to the interface then we must use
1179 * rotation amongst them.
1180 *
1181 * Notes: For v4, we can always punt and let ip_output
1182 * decide by sending back a source of 0.0.0.0
1183 */
1184
1185 if (ro->ro_rt == NULL) {
1186 /*
1187 * Need a route to cache.
1188 *
1189 */
1190 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
1191 rtalloc_ign(ro, 0UL);
1192 #else
1193 rtalloc(ro);
1194 #endif
1195 }
1196 if (ro->ro_rt == NULL) {
1197 /* No route to host .. punt */
1198 memset(&ans, 0, sizeof(ans));
1199 return (ans);
1200 }
1201 /* Setup our scopes */
1202 if (stcb) {
1203 ipv4_scope = stcb->asoc.ipv4_local_scope;
1204 loopscope = stcb->asoc.loopback_scope;
1205 } else {
1206 /* Scope based on outbound address */
1207 if ((IN4_ISPRIVATE_ADDRESS(&to->sin_addr))) {
1208 ipv4_scope = 1;
1209 loopscope = 0;
1210 } else if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
1211 ipv4_scope = 1;
1212 loopscope = 1;
1213 } else {
1214 ipv4_scope = 0;
1215 loopscope = 0;
1216 }
1217 }
1218 #ifdef SCTP_DEBUG
1219 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1220 kprintf("Scope setup loop:%d ipv4_scope:%d\n",
1221 loopscope, ipv4_scope);
1222 }
1223 #endif
1224 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
1225 /*
1226 * When bound to all if the address list is set
1227 * it is a negative list. Addresses being added
1228 * by asconf.
1229 */
1230 return (sctp_choose_v4_boundall(inp, stcb, net, ro->ro_rt,
1231 ipv4_scope, loopscope, non_asoc_addr_ok));
1232 }
1233 /*
1234 * Three possiblities here:
1235 *
1236 * a) stcb is NULL, which means we operate only from
1237 * the list of addresses (ifa's) bound to the assoc and
1238 * we care not about the list.
1239 * b) stcb is NOT-NULL, which means we have an assoc structure and
1240 * auto-asconf is on. This means that the list of addresses is
1241 * a NOT list. We use the list from the inp, but any listed address
1242 * in our list is NOT yet added. However if the non_asoc_addr_ok is
1243 * set we CAN use an address NOT available (i.e. being added). Its
1244 * a negative list.
1245 * c) stcb is NOT-NULL, which means we have an assoc structure and
1246 * auto-asconf is off. This means that the list of addresses is
1247 * the ONLY addresses I can use.. its positive.
1248 *
1249 * Note we collapse b & c into the same function just like in
1250 * the v6 address selection.
1251 */
1252 if (stcb) {
1253 return (sctp_choose_v4_boundspecific_stcb(inp, stcb, net,
1254 ro->ro_rt, ipv4_scope, loopscope, non_asoc_addr_ok));
1255 } else {
1256 return (sctp_choose_v4_boundspecific_inp(inp, ro->ro_rt,
1257 ipv4_scope, loopscope));
1258 }
1259 /* this should not be reached */
1260 memset(&ans, 0, sizeof(ans));
1261 return (ans);
1262 }
1263
1264
1265
1266 static struct sockaddr_in6 *
1267 sctp_is_v6_ifa_addr_acceptable (struct ifaddr *ifa, int loopscope, int loc_scope, int *sin_loop, int *sin_local)
1268 {
1269 struct in6_ifaddr *ifa6;
1270 struct sockaddr_in6 *sin6;
1271
1272 if (ifa->ifa_addr->sa_family != AF_INET6) {
1273 /* forget non-v6 */
1274 return (NULL);
1275 }
1276 ifa6 = (struct in6_ifaddr *)ifa;
1277 /* ok to use deprecated addresses? */
1278 if (!ip6_use_deprecated) {
1279 if (IFA6_IS_DEPRECATED(ifa6)) {
1280 /* can't use this type */
1281 return (NULL);
1282 }
1283 }
1284 /* are we ok, with the current state of this address? */
1285 if (ifa6->ia6_flags &
1286 (IN6_IFF_DETACHED | IN6_IFF_NOTREADY | IN6_IFF_ANYCAST)) {
1287 /* Can't use these types */
1288 return (NULL);
1289 }
1290 /* Ok the address may be ok */
1291 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
1292 *sin_local = *sin_loop = 0;
1293 if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
1294 (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr))) {
1295 *sin_loop = 1;
1296 }
1297 if (!loopscope && *sin_loop) {
1298 /* Its a loopback address and we don't have loop scope */
1299 return (NULL);
1300 }
1301 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1302 /* we skip unspecifed addresses */
1303 return (NULL);
1304 }
1305
1306 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1307 *sin_local = 1;
1308 }
1309 if (!loc_scope && *sin_local) {
1310 /* Its a link local address, and we don't have link local scope */
1311 return (NULL);
1312 }
1313 return (sin6);
1314 }
1315
1316
1317 static struct sockaddr_in6 *
1318 sctp_choose_v6_boundspecific_stcb(struct sctp_inpcb *inp,
1319 struct sctp_tcb *stcb,
1320 struct sctp_nets *net,
1321 struct rtentry *rt,
1322 uint8_t loc_scope,
1323 uint8_t loopscope,
1324 int non_asoc_addr_ok)
1325 {
1326 /*
1327 * Each endpoint has a list of local addresses associated
1328 * with it. The address list is either a "negative list" i.e.
1329 * those addresses that are NOT allowed to be used as a source OR
1330 * a "postive list" i.e. those addresses that CAN be used.
1331 *
1332 * Its a negative list if asconf is allowed. What we do
1333 * in this case is use the ep address list BUT we have
1334 * to cross check it against the negative list.
1335 *
1336 * In the case where NO asconf is allowed, we have just
1337 * a straight association level list that we must use to
1338 * find a source address.
1339 */
1340 struct sctp_laddr *laddr, *starting_point;
1341 struct sockaddr_in6 *sin6;
1342 int sin_loop, sin_local;
1343 int start_at_beginning=0;
1344 struct ifnet *ifn;
1345
1346 ifn = rt->rt_ifp;
1347 if (inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) {
1348 #ifdef SCTP_DEBUG
1349 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1350 kprintf("Have a STCB - asconf allowed, not bound all have a netgative list\n");
1351 }
1352 #endif
1353 /* first question, is the ifn we will emit on
1354 * in our list, if so, we want that one.
1355 */
1356 if (ifn) {
1357 struct ifaddr_container *ifac;
1358
1359 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1360 struct ifaddr *ifa = ifac->ifa;
1361
1362 if (sctp_is_addr_in_ep(inp, ifa)) {
1363 sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1364 if (sin6 == NULL)
1365 continue;
1366 if ((non_asoc_addr_ok == 0) &&
1367 (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1368 /* on the no-no list */
1369 continue;
1370 }
1371 return (sin6);
1372 }
1373 }
1374 }
1375 starting_point = stcb->asoc.last_used_address;
1376 /* First try for matching scope */
1377 sctp_from_the_top:
1378 if (stcb->asoc.last_used_address == NULL) {
1379 start_at_beginning=1;
1380 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
1381 }
1382 /* search beginning with the last used address */
1383 for (laddr = stcb->asoc.last_used_address; laddr;
1384 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1385 if (laddr->ifa == NULL) {
1386 /* address has been removed */
1387 continue;
1388 }
1389 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1390 if (sin6 == NULL)
1391 continue;
1392 if ((non_asoc_addr_ok == 0) && (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1393 /* on the no-no list */
1394 continue;
1395 }
1396 /* is it of matching scope ? */
1397 if ((loopscope == 0) &&
1398 (loc_scope == 0) &&
1399 (sin_loop == 0) &&
1400 (sin_local == 0)) {
1401 /* all of global scope we are ok with it */
1402 return (sin6);
1403 }
1404 if (loopscope && sin_loop)
1405 /* both on the loopback, thats ok */
1406 return (sin6);
1407 if (loc_scope && sin_local)
1408 /* both local scope */
1409 return (sin6);
1410
1411 }
1412 if (start_at_beginning == 0) {
1413 stcb->asoc.last_used_address = NULL;
1414 goto sctp_from_the_top;
1415 }
1416 /* now try for any higher scope than the destination */
1417 stcb->asoc.last_used_address = starting_point;
1418 start_at_beginning = 0;
1419 sctp_from_the_top2:
1420 if (stcb->asoc.last_used_address == NULL) {
1421 start_at_beginning=1;
1422 stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
1423 }
1424 /* search beginning with the last used address */
1425 for (laddr = stcb->asoc.last_used_address; laddr;
1426 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1427 if (laddr->ifa == NULL) {
1428 /* address has been removed */
1429 continue;
1430 }
1431 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1432 if (sin6 == NULL)
1433 continue;
1434 if ((non_asoc_addr_ok == 0) && (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
1435 /* on the no-no list */
1436 continue;
1437 }
1438 return (sin6);
1439 }
1440 if (start_at_beginning == 0) {
1441 stcb->asoc.last_used_address = NULL;
1442 goto sctp_from_the_top2;
1443 }
1444 } else {
1445 #ifdef SCTP_DEBUG
1446 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1447 kprintf("Have a STCB - no asconf allowed, not bound all have a positive list\n");
1448 }
1449 #endif
1450 /* First try for interface output match */
1451 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1452 sctp_nxt_addr) {
1453 if (laddr->ifa == NULL) {
1454 /* address has been removed */
1455 continue;
1456 }
1457 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1458 if (sin6 == NULL)
1459 continue;
1460 /* first question, is laddr->ifa an address associated with the emit interface */
1461 if (ifn) {
1462 struct ifaddr_container *ifac;
1463
1464 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1465 struct ifaddr *ifa = ifac->ifa;
1466
1467 if (laddr->ifa == ifa) {
1468 sin6 = (struct sockaddr_in6 *)laddr->ifa->ifa_addr;
1469 return (sin6);
1470 }
1471 if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
1472 sin6 = (struct sockaddr_in6 *)laddr->ifa->ifa_addr;
1473 return (sin6);
1474 }
1475 }
1476 }
1477 }
1478 /* Next try for matching scope */
1479 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1480 sctp_nxt_addr) {
1481 if (laddr->ifa == NULL) {
1482 /* address has been removed */
1483 continue;
1484 }
1485 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1486 if (sin6 == NULL)
1487 continue;
1488
1489 if ((loopscope == 0) &&
1490 (loc_scope == 0) &&
1491 (sin_loop == 0) &&
1492 (sin_local == 0)) {
1493 /* all of global scope we are ok with it */
1494 return (sin6);
1495 }
1496 if (loopscope && sin_loop)
1497 /* both on the loopback, thats ok */
1498 return (sin6);
1499 if (loc_scope && sin_local)
1500 /* both local scope */
1501 return (sin6);
1502 }
1503 /* ok, now try for a higher scope in the source address */
1504 /* First try for matching scope */
1505 LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
1506 sctp_nxt_addr) {
1507 if (laddr->ifa == NULL) {
1508 /* address has been removed */
1509 continue;
1510 }
1511 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1512 if (sin6 == NULL)
1513 continue;
1514 return (sin6);
1515 }
1516 }
1517 return (NULL);
1518 }
1519
1520 static struct sockaddr_in6 *
1521 sctp_choose_v6_boundspecific_inp(struct sctp_inpcb *inp,
1522 struct rtentry *rt,
1523 uint8_t loc_scope,
1524 uint8_t loopscope)
1525 {
1526 /*
1527 * Here we are bound specific and have only
1528 * an inp. We must find an address that is bound
1529 * that we can give out as a src address. We
1530 * prefer two addresses of same scope if we can
1531 * find them that way.
1532 */
1533 struct sctp_laddr *laddr;
1534 struct sockaddr_in6 *sin6;
1535 struct ifnet *ifn;
1536 int sin_loop, sin_local;
1537
1538 /* first question, is the ifn we will emit on
1539 * in our list, if so, we want that one.
1540 */
1541
1542 ifn = rt->rt_ifp;
1543 if (ifn) {
1544 struct ifaddr_container *ifac;
1545
1546 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1547 struct ifaddr *ifa = ifac->ifa;
1548
1549 sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1550 if (sin6 == NULL)
1551 continue;
1552 if (sctp_is_addr_in_ep(inp, ifa)) {
1553 return (sin6);
1554 }
1555 }
1556 }
1557 for (laddr = LIST_FIRST(&inp->sctp_addr_list);
1558 laddr && (laddr != inp->next_addr_touse);
1559 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1560 if (laddr->ifa == NULL) {
1561 /* address has been removed */
1562 continue;
1563 }
1564 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1565 if (sin6 == NULL)
1566 continue;
1567
1568 if ((loopscope == 0) &&
1569 (loc_scope == 0) &&
1570 (sin_loop == 0) &&
1571 (sin_local == 0)) {
1572 /* all of global scope we are ok with it */
1573 return (sin6);
1574 }
1575 if (loopscope && sin_loop)
1576 /* both on the loopback, thats ok */
1577 return (sin6);
1578 if (loc_scope && sin_local)
1579 /* both local scope */
1580 return (sin6);
1581
1582 }
1583 /* if we reach here, we could not find two addresses
1584 * of the same scope to give out. Lets look for any higher level
1585 * scope for a source address.
1586 */
1587 for (laddr = LIST_FIRST(&inp->sctp_addr_list);
1588 laddr && (laddr != inp->next_addr_touse);
1589 laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
1590 if (laddr->ifa == NULL) {
1591 /* address has been removed */
1592 continue;
1593 }
1594 sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1595 if (sin6 == NULL)
1596 continue;
1597 return (sin6);
1598 }
1599 /* no address bound can be a source for the destination */
1600 #ifdef SCTP_DEBUG
1601 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1602 kprintf("Src address selection for EP, no acceptable src address found for address\n");
1603 }
1604 #endif
1605 return (NULL);
1606 }
1607
1608
1609 static struct sockaddr_in6 *
1610 sctp_select_v6_nth_addr_from_ifn_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok, uint8_t loopscope,
1611 uint8_t loc_scope, int cur_addr_num, int match_scope)
1612 {
1613 struct ifaddr_container *ifac;
1614 struct sockaddr_in6 *sin6;
1615 int sin_loop, sin_local;
1616 int num_eligible_addr = 0;
1617
1618 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1619 struct ifaddr *ifa = ifac->ifa;
1620
1621 sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1622 if (sin6 == NULL)
1623 continue;
1624 if (stcb) {
1625 if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6)) {
1626 /* It is restricted for some reason.. probably
1627 * not yet added.
1628 */
1629 continue;
1630 }
1631 }
1632 if (match_scope) {
1633 /* Here we are asked to match scope if possible */
1634 if (loopscope && sin_loop)
1635 /* src and destination are loopback scope */
1636 return (sin6);
1637 if (loc_scope && sin_local)
1638 /* src and destination are local scope */
1639 return (sin6);
1640 if ((loopscope == 0) &&
1641 (loc_scope == 0) &&
1642 (sin_loop == 0) &&
1643 (sin_local == 0)) {
1644 /* src and destination are global scope */
1645 return (sin6);
1646 }
1647 continue;
1648 }
1649 if (num_eligible_addr == cur_addr_num) {
1650 /* this is it */
1651 return (sin6);
1652 }
1653 num_eligible_addr++;
1654 }
1655 return (NULL);
1656 }
1657
1658
1659 static int
1660 sctp_count_v6_num_eligible_boundall (struct ifnet *ifn, struct sctp_tcb *stcb,
1661 int non_asoc_addr_ok, uint8_t loopscope, uint8_t loc_scope)
1662 {
1663 struct ifaddr_container *ifac;
1664 struct sockaddr_in6 *sin6;
1665 int num_eligible_addr = 0;
1666 int sin_loop, sin_local;
1667
1668 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
1669 struct ifaddr *ifa = ifac->ifa;
1670
1671 sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
1672 if (sin6 == NULL)
1673 continue;
1674 if (stcb) {
1675 if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6)) {
1676 /* It is restricted for some reason.. probably
1677 * not yet added.
1678 */
1679 continue;
1680 }
1681 }
1682 num_eligible_addr++;
1683 }
1684 return (num_eligible_addr);
1685 }
1686
1687
1688 static struct sockaddr_in6 *
1689 sctp_choose_v6_boundall(struct sctp_inpcb *inp,
1690 struct sctp_tcb *stcb,
1691 struct sctp_nets *net,
1692 struct rtentry *rt,
1693 uint8_t loc_scope,
1694 uint8_t loopscope,
1695 int non_asoc_addr_ok)
1696 {
1697 /* Ok, we are bound all SO any address
1698 * is ok to use as long as it is NOT in the negative
1699 * list.
1700 */
1701 int num_eligible_addr;
1702 int cur_addr_num=0;
1703 int started_at_beginning=0;
1704 int match_scope_prefered;
1705 /* first question is, how many eligible addresses are
1706 * there for the destination ifn that we are using that
1707 * are within the proper scope?
1708 */
1709 struct ifnet *ifn;
1710 struct sockaddr_in6 *sin6;
1711
1712 ifn = rt->rt_ifp;
1713 if (net) {
1714 cur_addr_num = net->indx_of_eligible_next_to_use;
1715 }
1716 if (cur_addr_num == 0) {
1717 match_scope_prefered = 1;
1718 } else {
1719 match_scope_prefered = 0;
1720 }
1721 num_eligible_addr = sctp_count_v6_num_eligible_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope);
1722 #ifdef SCTP_DEBUG
1723 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1724 kprintf("Found %d eligible source addresses\n", num_eligible_addr);
1725 }
1726 #endif
1727 if (num_eligible_addr == 0) {
1728 /* no eligible addresses, we must use some other
1729 * interface address if we can find one.
1730 */
1731 goto bound_all_v6_plan_b;
1732 }
1733 /* Ok we have num_eligible_addr set with how many we can use,
1734 * this may vary from call to call due to addresses being deprecated etc..
1735 */
1736 if (cur_addr_num >= num_eligible_addr) {
1737 cur_addr_num = 0;
1738 }
1739 /* select the nth address from the list (where cur_addr_num is the nth) and
1740 * 0 is the first one, 1 is the second one etc...
1741 */
1742 #ifdef SCTP_DEBUG
1743 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1744 kprintf("cur_addr_num:%d match_scope_prefered:%d select it\n",
1745 cur_addr_num, match_scope_prefered);
1746 }
1747 #endif
1748 sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1749 loc_scope, cur_addr_num, match_scope_prefered);
1750 if (match_scope_prefered && (sin6 == NULL)) {
1751 /* retry without the preference for matching scope */
1752 #ifdef SCTP_DEBUG
1753 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1754 kprintf("retry with no match_scope_prefered\n");
1755 }
1756 #endif
1757 sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
1758 loc_scope, cur_addr_num, 0);
1759 }
1760 if (sin6) {
1761 #ifdef SCTP_DEBUG
1762 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1763 kprintf("Selected address %d ifn:%x for the route\n", cur_addr_num, (u_int)ifn);
1764 }
1765 #endif
1766 if (net) {
1767 /* store so we get the next one */
1768 if (cur_addr_num < 255)
1769 net->indx_of_eligible_next_to_use = cur_addr_num + 1;
1770 else
1771 net->indx_of_eligible_next_to_use = 0;
1772 }
1773 return (sin6);
1774 }
1775 num_eligible_addr = 0;
1776 bound_all_v6_plan_b:
1777 /* ok, if we reach here we either fell through
1778 * due to something changing during an interupt (unlikely)
1779 * or we have NO eligible source addresses for the ifn
1780 * of the route (most likely). We must look at all the other
1781 * interfaces EXCEPT rt->rt_ifp and do the same game.
1782 */
1783 #ifdef SCTP_DEBUG
1784 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1785 kprintf("bound-all Plan B\n");
1786 }
1787 #endif
1788 if (inp->next_ifn_touse == NULL) {
1789 started_at_beginning=1;
1790 inp->next_ifn_touse = TAILQ_FIRST(&ifnet);
1791 #ifdef SCTP_DEBUG
1792 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1793 kprintf("Start at first IFN:%x\n", (u_int)inp->next_ifn_touse);
1794 }
1795 #endif
1796 } else {
1797 inp->next_ifn_touse = TAILQ_NEXT(inp->next_ifn_touse, if_list);
1798 #ifdef SCTP_DEBUG
1799 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1800 kprintf("Resume at IFN:%x\n", (u_int)inp->next_ifn_touse);
1801 }
1802 #endif
1803 if (inp->next_ifn_touse == NULL) {
1804 #ifdef SCTP_DEBUG
1805 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1806 kprintf("IFN Resets\n");
1807 }
1808 #endif
1809 started_at_beginning=1;
1810 inp->next_ifn_touse = TAILQ_FIRST(&ifnet);
1811 }
1812 }
1813 for (ifn = inp->next_ifn_touse; ifn;
1814 ifn = TAILQ_NEXT(ifn, if_list)) {
1815 if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
1816 /* wrong base scope */
1817 continue;
1818 }
1819 if (loc_scope && (ifn->if_index != loc_scope)) {
1820 /* by definition the scope (from to->sin6_scopeid)
1821 * must match that of the interface. If not then
1822 * we could pick a wrong scope for the address.
1823 * Ususally we don't hit plan-b since the route
1824 * handles this. However we can hit plan-b when
1825 * we send to local-host so the route is the
1826 * loopback interface, but the destination is a
1827 * link local.
1828 */
1829 continue;
1830 }
1831 if (ifn == rt->rt_ifp) {
1832 /* already looked at this guy */
1833 continue;
1834 }
1835 /* Address rotation will only work when we are not
1836 * rotating sourced interfaces and are using the interface
1837 * of the route. We would need to have a per interface index
1838 * in order to do proper rotation.
1839 */
1840 num_eligible_addr = sctp_count_v6_num_eligible_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope);
1841 #ifdef SCTP_DEBUG
1842 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1843 kprintf("IFN:%x has %d eligible\n", (u_int)ifn, num_eligible_addr);
1844 }
1845 #endif
1846 if (num_eligible_addr == 0) {
1847 /* none we can use */
1848 continue;
1849 }
1850 /* Ok we have num_eligible_addr set with how many we can use,
1851 * this may vary from call to call due to addresses being deprecated etc..
1852 */
1853 inp->next_ifn_touse = ifn;
1854
1855 /* select the first one we can find with perference for matching scope.
1856 */
1857 sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope, 0, 1);
1858 if (sin6 == NULL) {
1859 /* can't find one with matching scope how about a source with higher
1860 * scope
1861 */
1862 sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope, 0, 0);
1863 if (sin6 == NULL)
1864 /* Hmm, can't find one in the interface now */
1865 continue;
1866 }
1867 #ifdef SCTP_DEBUG
1868 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1869 kprintf("Selected the %d'th address of ifn:%x\n",
1870 cur_addr_num,
1871 (u_int)ifn);
1872 }
1873 #endif
1874 return (sin6);
1875 }
1876 if (started_at_beginning == 0) {
1877 /* we have not been through all of them yet, force
1878 * us to go through them all.
1879 */
1880 #ifdef SCTP_DEBUG
1881 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1882 kprintf("Force a recycle\n");
1883 }
1884 #endif
1885 inp->next_ifn_touse = NULL;
1886 goto bound_all_v6_plan_b;
1887 }
1888 return (NULL);
1889
1890 }
1891
1892 /* stcb and net may be NULL */
1893 struct in6_addr
1894 sctp_ipv6_source_address_selection(struct sctp_inpcb *inp,
1895 struct sctp_tcb *stcb, struct route *ro, struct sctp_nets *net,
1896 int non_asoc_addr_ok)
1897 {
1898 struct in6_addr ans;
1899 struct sockaddr_in6 *rt_addr;
1900 uint8_t loc_scope, loopscope;
1901 struct sockaddr_in6 *to = (struct sockaddr_in6 *)&ro->ro_dst;
1902
1903 /*
1904 * This routine is tricky standard v6 src address
1905 * selection cannot take into account what we have
1906 * bound etc, so we can't use it.
1907 *
1908 * Instead here is what we must do:
1909 * 1) Make sure we have a route, if we
1910 * don't have a route we can never reach the peer.
1911 * 2) Once we have a route, determine the scope of the
1912 * route. Link local, loopback or global.
1913 * 3) Next we divide into three types. Either we
1914 * are bound all.. which means we want to use
1915 * one of the addresses of the interface we are
1916 * going out. <or>
1917 * 4a) We have not stcb, which means we are using the
1918 * specific addresses bound on an inp, in this
1919 * case we are similar to the stcb case (4b below)
1920 * accept the list is always a positive list.<or>
1921 * 4b) We are bound specific with a stcb, which means we have a
1922 * list of bound addresses and we must see if the
1923 * ifn of the route is actually one of the bound addresses.
1924 * If not, then we must rotate addresses amongst properly
1925 * scoped bound addresses, if so we use the address
1926 * of the interface.
1927 * 5) Always, no matter which path we take through the above
1928 * we must be sure the source address we use is allowed to
1929 * be used. I.e. IN6_IFF_DETACHED, IN6_IFF_NOTREADY, and IN6_IFF_ANYCAST
1930 * addresses cannot be used.
1931 * 6) Addresses that are deprecated MAY be used
1932 * if (!ip6_use_deprecated) {
1933 * if (IFA6_IS_DEPRECATED(ifa6)) {
1934 * skip the address
1935 * }
1936 * }
1937 */
1938
1939 /*** 1> determine route, if not already done */
1940 if (ro->ro_rt == NULL) {
1941 /*
1942 * Need a route to cache.
1943 */
1944 #ifndef SCOPEDROUTING
1945 int scope_save;
1946 scope_save = to->sin6_scope_id;
1947 to->sin6_scope_id = 0;
1948 #endif
1949
1950 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
1951 rtalloc_ign(ro, 0UL);
1952 #else
1953 rtalloc(ro);
1954 #endif
1955 #ifndef SCOPEDROUTING
1956 to->sin6_scope_id = scope_save;
1957 #endif
1958 }
1959 if (ro->ro_rt == NULL) {
1960 /*
1961 * no route to host. this packet is going no-where.
1962 * We probably should make sure we arrange to send back
1963 * an error.
1964 */
1965 #ifdef SCTP_DEBUG
1966 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1967 kprintf("No route to host, this packet cannot be sent!\n");
1968 }
1969 #endif
1970 memset(&ans, 0, sizeof(ans));
1971 return (ans);
1972 }
1973
1974 /*** 2a> determine scope for outbound address/route */
1975 loc_scope = loopscope = 0;
1976 /*
1977 * We base our scope on the outbound packet scope and route,
1978 * NOT the TCB (if there is one). This way in local scope we will only
1979 * use a local scope src address when we send to a local address.
1980 */
1981
1982 if (IN6_IS_ADDR_LOOPBACK(&to->sin6_addr)) {
1983 /* If the route goes to the loopback address OR
1984 * the address is a loopback address, we are loopback
1985 * scope.
1986 */
1987 #ifdef SCTP_DEBUG
1988 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
1989 kprintf("Loopback scope is set\n");
1990 }
1991 #endif
1992 loc_scope = 0;
1993 loopscope = 1;
1994 if (net != NULL) {
1995 /* mark it as local */
1996 net->addr_is_local = 1;
1997 }
1998
1999 } else if (IN6_IS_ADDR_LINKLOCAL(&to->sin6_addr)) {
2000 #ifdef SCTP_DEBUG
2001 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2002 kprintf("Link local scope is set, id:%d\n", to->sin6_scope_id);
2003 }
2004 #endif
2005 if (to->sin6_scope_id)
2006 loc_scope = to->sin6_scope_id;
2007 else {
2008 loc_scope = 1;
2009 }
2010 loopscope = 0;
2011 } else {
2012 #ifdef SCTP_DEBUG
2013 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2014 kprintf("Global scope is set\n");
2015 }
2016 #endif
2017 }
2018
2019 /* now, depending on which way we are bound we call the appropriate
2020 * routine to do steps 3-6
2021 */
2022 #ifdef SCTP_DEBUG
2023 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2024 kprintf("Destination address:");
2025 sctp_print_address((struct sockaddr *)to);
2026 }
2027 #endif
2028
2029 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
2030 #ifdef SCTP_DEBUG
2031 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2032 kprintf("Calling bound-all src addr selection for v6\n");
2033 }
2034 #endif
2035 rt_addr = sctp_choose_v6_boundall(inp, stcb, net, ro->ro_rt, loc_scope, loopscope, non_asoc_addr_ok);
2036 } else {
2037 #ifdef SCTP_DEBUG
2038 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2039 kprintf("Calling bound-specific src addr selection for v6\n");
2040 }
2041 #endif
2042 if (stcb)
2043 rt_addr = sctp_choose_v6_boundspecific_stcb(inp, stcb, net, ro->ro_rt, loc_scope, loopscope, non_asoc_addr_ok);
2044 else
2045 /* we can't have a non-asoc address since we have no association */
2046 rt_addr = sctp_choose_v6_boundspecific_inp(inp, ro->ro_rt, loc_scope, loopscope);
2047 }
2048 if (rt_addr == NULL) {
2049 /* no suitable address? */
2050 struct in6_addr in6;
2051 #ifdef SCTP_DEBUG
2052 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2053 kprintf("V6 packet will reach dead-end no suitable src address\n");
2054 }
2055 #endif
2056 memset(&in6, 0, sizeof(in6));
2057 return (in6);
2058 }
2059 #ifdef SCTP_DEBUG
2060 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2061 kprintf("Source address selected is:");
2062 sctp_print_address((struct sockaddr *)rt_addr);
2063 }
2064 #endif
2065 return (rt_addr->sin6_addr);
2066 }
2067
2068 static uint8_t
2069 sctp_get_ect(struct sctp_tcb *stcb,
2070 struct sctp_tmit_chunk *chk)
2071 {
2072 uint8_t this_random;
2073
2074 /* Huh? */
2075 if (sctp_ecn == 0)
2076 return (0);
2077
2078 if (sctp_ecn_nonce == 0)
2079 /* no nonce, always return ECT0 */
2080 return (SCTP_ECT0_BIT);
2081
2082 if (stcb->asoc.peer_supports_ecn_nonce == 0) {
2083 /* Peer does NOT support it, so we send a ECT0 only */
2084 return (SCTP_ECT0_BIT);
2085 }
2086
2087 if (chk == NULL)
2088 return (SCTP_ECT0_BIT);
2089
2090 if (((stcb->asoc.hb_random_idx == 3) &&
2091 (stcb->asoc.hb_ect_randombit > 7)) ||
2092 (stcb->asoc.hb_random_idx > 3)) {
2093 uint32_t rndval;
2094 rndval = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
2095 memcpy(stcb->asoc.hb_random_values, &rndval,
2096 sizeof(stcb->asoc.hb_random_values));
2097 this_random = stcb->asoc.hb_random_values[0];
2098 stcb->asoc.hb_random_idx = 0;
2099 stcb->asoc.hb_ect_randombit = 0;
2100 } else {
2101 if (stcb->asoc.hb_ect_randombit > 7) {
2102 stcb->asoc.hb_ect_randombit = 0;
2103 stcb->asoc.hb_random_idx++;
2104 }
2105 this_random = stcb->asoc.hb_random_values[stcb->asoc.hb_random_idx];
2106 }
2107 if ((this_random >> stcb->asoc.hb_ect_randombit) & 0x01) {
2108 if (chk != NULL)
2109 /* ECN Nonce stuff */
2110 chk->rec.data.ect_nonce = SCTP_ECT1_BIT;
2111 stcb->asoc.hb_ect_randombit++;
2112 return (SCTP_ECT1_BIT);
2113 } else {
2114 stcb->asoc.hb_ect_randombit++;
2115 return (SCTP_ECT0_BIT);
2116 }
2117 }
2118
2119 extern int sctp_no_csum_on_loopback;
2120
2121 static int
2122 sctp_lowlevel_chunk_output(struct sctp_inpcb *inp,
2123 struct sctp_tcb *stcb, /* may be NULL */
2124 struct sctp_nets *net,
2125 struct sockaddr *to,
2126 struct mbuf *m,
2127 int nofragment_flag,
2128 int ecn_ok,
2129 struct sctp_tmit_chunk *chk,
2130 int out_of_asoc_ok)
2131 /* nofragment_flag to tell if IP_DF should be set (IPv4 only) */
2132 {
2133 /*
2134 * Given a mbuf chain (via m_next) that holds a packet header
2135 * WITH a SCTPHDR but no IP header, endpoint inp and sa structure.
2136 * - calculate SCTP checksum and fill in
2137 * - prepend a IP address header
2138 * - if boundall use INADDR_ANY
2139 * - if boundspecific do source address selection
2140 * - set fragmentation option for ipV4
2141 * - On return from IP output, check/adjust mtu size
2142 * - of output interface and smallest_mtu size as well.
2143 */
2144 struct sctphdr *sctphdr;
2145 int o_flgs;
2146 uint32_t csum;
2147 int ret;
2148 unsigned int have_mtu;
2149 struct route *ro;
2150
2151 if ((net) && (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)) {
2152 sctp_m_freem(m);
2153 return (EFAULT);
2154 }
2155 if ((m->m_flags & M_PKTHDR) == 0) {
2156 #ifdef SCTP_DEBUG
2157 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2158 kprintf("Software error: sctp_lowlevel_chunk_output() called with non pkthdr!\n");
2159 }
2160 #endif
2161 sctp_m_freem(m);
2162 return (EFAULT);
2163 }
2164 /* Calculate the csum and fill in the length of the packet */
2165 sctphdr = mtod(m, struct sctphdr *);
2166 have_mtu = 0;
2167 if (sctp_no_csum_on_loopback &&
2168 (stcb) &&
2169 (stcb->asoc.loopback_scope)) {
2170 sctphdr->checksum = 0;
2171 m->m_pkthdr.len = sctp_calculate_len(m);
2172 } else {
2173 sctphdr->checksum = 0;
2174 csum = sctp_calculate_sum(m, &m->m_pkthdr.len, 0);
2175 sctphdr->checksum = csum;
2176 }
2177 if (to->sa_family == AF_INET) {
2178 struct ip *ip;
2179 struct route iproute;
2180 M_PREPEND(m, sizeof(struct ip), MB_DONTWAIT);
2181 if (m == NULL) {
2182 /* failed to prepend data, give up */
2183 return (ENOMEM);
2184 }
2185 ip = mtod(m, struct ip *);
2186 ip->ip_v = IPVERSION;
2187 ip->ip_hl = (sizeof(struct ip) >> 2);
2188 if (nofragment_flag) {
2189 #if defined(WITH_CONVERT_IP_OFF) || defined(__FreeBSD__) || defined(__DragonFly__)
2190 #if defined( __OpenBSD__) || defined(__NetBSD__)
2191 /* OpenBSD has WITH_CONVERT_IP_OFF defined?? */
2192 ip->ip_off = htons(IP_DF);
2193 #else
2194 ip->ip_off = IP_DF;
2195 #endif
2196 #else
2197 ip->ip_off = htons(IP_DF);
2198 #endif
2199 } else
2200 ip->ip_off = 0;
2201
2202 /* FreeBSD and Apple have RANDOM_IP_ID switch */
2203 #if defined(RANDOM_IP_ID) || defined(__NetBSD__) || defined(__OpenBSD__)
2204 ip->ip_id = htons(ip_randomid());
2205 #else
2206 ip->ip_id = htons(ip_id++);
2207 #endif
2208
2209 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
2210 ip->ip_ttl = inp->ip_inp.inp.inp_ip_ttl;
2211 #else
2212 ip->ip_ttl = inp->inp_ip_ttl;
2213 #endif
2214 #if defined(__OpenBSD__) || defined(__NetBSD__)
2215 ip->ip_len = htons(m->m_pkthdr.len);
2216 #else
2217 ip->ip_len = m->m_pkthdr.len;
2218 #endif
2219 if (stcb) {
2220 if ((stcb->asoc.ecn_allowed) && ecn_ok) {
2221 /* Enable ECN */
2222 #if defined(__FreeBSD__) || defined (__APPLE__) || defined(__DragonFly__)
2223 ip->ip_tos = (u_char)((inp->ip_inp.inp.inp_ip_tos & 0x000000fc) |
2224 sctp_get_ect(stcb, chk));
2225 #elif defined(__NetBSD__)
2226 ip->ip_tos = (u_char)((inp->ip_inp.inp.inp_ip.ip_tos & 0x000000fc) |
2227 sctp_get_ect(stcb, chk));
2228 #else
2229 ip->ip_tos = (u_char)((inp->inp_ip_tos & 0x000000fc) |
2230 sctp_get_ect(stcb, chk));
2231 #endif
2232 } else {
2233 /* No ECN */
2234 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
2235 ip->ip_tos = inp->ip_inp.inp.inp_ip_tos;
2236 #elif defined(__NetBSD__)
2237 ip->ip_tos = inp->ip_inp.inp.inp_ip.ip_tos;
2238 #else
2239 ip->ip_tos = inp->inp_ip_tos;
2240 #endif
2241 }
2242 } else {
2243 /* no association at all */
2244 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
2245 ip->ip_tos = inp->ip_inp.inp.inp_ip_tos;
2246 #else
2247 ip->ip_tos = inp->inp_ip_tos;
2248 #endif
2249 }
2250 ip->ip_p = IPPROTO_SCTP;
2251 ip->ip_sum = 0;
2252 if (net == NULL) {
2253 ro = &iproute;
2254 memset(&iproute, 0, sizeof(iproute));
2255 memcpy(&ro->ro_dst, to, to->sa_len);
2256 } else {
2257 ro = (struct route *)&net->ro;
2258 }
2259 /* Now the address selection part */
2260 ip->ip_dst.s_addr = ((struct sockaddr_in *)to)->sin_addr.s_addr;
2261
2262 /* call the routine to select the src address */
2263 if (net) {
2264 if (net->src_addr_selected == 0) {
2265 /* Cache the source address */
2266 ((struct sockaddr_in *)&net->ro._s_addr)->sin_addr = sctp_ipv4_source_address_selection(inp,
2267 stcb,
2268 ro, net, out_of_asoc_ok);
2269 if (ro->ro_rt)
2270 net->src_addr_selected = 1;
2271 }
2272 ip->ip_src = ((struct sockaddr_in *)&net->ro._s_addr)->sin_addr;
2273 } else {
2274 ip->ip_src = sctp_ipv4_source_address_selection(inp,
2275 stcb, ro, net, out_of_asoc_ok);
2276 }
2277 /*
2278 * If source address selection fails and we find no route then
2279 * the ip_ouput should fail as well with a NO_ROUTE_TO_HOST
2280 * type error. We probably should catch that somewhere and
2281 * abort the association right away (assuming this is an INIT
2282 * being sent).
2283 */
2284 if ((ro->ro_rt == NULL)) {
2285 /*
2286 * src addr selection failed to find a route (or valid
2287 * source addr), so we can't get there from here!
2288 */
2289 #ifdef SCTP_DEBUG
2290 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2291 kprintf("low_level_output: dropped v4 packet- no valid source addr\n");
2292 kprintf("Destination was %x\n", (u_int)(ntohl(ip->ip_dst.s_addr)));
2293 }
2294 #endif /* SCTP_DEBUG */
2295 if (net) {
2296 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb)
2297 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN,
2298 stcb,
2299 SCTP_FAILED_THRESHOLD,
2300 (void *)net);
2301 net->dest_state &= ~SCTP_ADDR_REACHABLE;
2302 net->dest_state |= SCTP_ADDR_NOT_REACHABLE;
2303 if (stcb) {
2304 if (net == stcb->asoc.primary_destination) {
2305 /* need a new primary */
2306 struct sctp_nets *alt;
2307 alt = sctp_find_alternate_net(stcb, net);
2308 if (alt != net) {
2309 if (sctp_set_primary_addr(stcb,
2310 NULL,
2311 alt) == 0) {
2312 net->dest_state |= SCTP_ADDR_WAS_PRIMARY;
2313 net->src_addr_selected = 0;
2314 }
2315 }
2316 }
2317 }
2318 }
2319 sctp_m_freem(m);
2320 return (EHOSTUNREACH);
2321 } else {
2322 have_mtu = ro->ro_rt->rt_ifp->if_mtu;
2323 }
2324
2325 o_flgs = (IP_RAWOUTPUT | (inp->sctp_socket->so_options & (SO_DONTROUTE | SO_BROADCAST)));
2326 #ifdef SCTP_DEBUG
2327 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2328 kprintf("Calling ipv4 output routine from low level src addr:%x\n",
2329 (u_int)(ntohl(ip->ip_src.s_addr)));
2330 kprintf("Destination is %x\n", (u_int)(ntohl(ip->ip_dst.s_addr)));
2331 kprintf("RTP route is %p through\n", ro->ro_rt);
2332 }
2333 #endif
2334 if ((have_mtu) && (net) && (have_mtu > net->mtu)) {
2335 ro->ro_rt->rt_ifp->if_mtu = net->mtu;
2336 }
2337 ret = ip_output(m, inp->ip_inp.inp.inp_options,
2338 ro, o_flgs, inp->ip_inp.inp.inp_moptions
2339 #if defined(__OpenBSD__) || (defined(__FreeBSD__) && __FreeBSD_version >= 480000) \
2340 || defined(__DragonFly__)
2341 , NULL
2342 #endif
2343 #if defined(__NetBSD__)
2344 ,(struct socket *)inp->sctp_socket
2345 #endif
2346
2347 );
2348 if ((ro->ro_rt) && (have_mtu) && (net) && (have_mtu > net->mtu)) {
2349 ro->ro_rt->rt_ifp->if_mtu = have_mtu;
2350 }
2351 sctp_pegs[SCTP_DATAGRAMS_SENT]++;
2352 #ifdef SCTP_DEBUG
2353 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2354 kprintf("Ip output returns %d\n", ret);
2355 }
2356 #endif
2357 if (net == NULL) {
2358 /* free tempy routes */
2359 if (ro->ro_rt)
2360 RTFREE(ro->ro_rt);
2361 } else {
2362 /* PMTU check versus smallest asoc MTU goes here */
2363 if (ro->ro_rt != NULL) {
2364 if (ro->ro_rt->rt_rmx.rmx_mtu &&
2365 (stcb->asoc.smallest_mtu > ro->ro_rt->rt_rmx.rmx_mtu)) {
2366 sctp_mtu_size_reset(inp, &stcb->asoc,
2367 ro->ro_rt->rt_rmx.rmx_mtu);
2368 }
2369 } else {
2370 /* route was freed */
2371 net->src_addr_selected = 0;
2372 }
2373 }
2374 return (ret);
2375 }
2376 #ifdef INET6
2377 else if (to->sa_family == AF_INET6) {
2378 struct ip6_hdr *ip6h;
2379 #ifdef NEW_STRUCT_ROUTE
2380 struct route ip6route;
2381 #else
2382 struct route_in6 ip6route;
2383 #endif
2384 struct ifnet *ifp;
2385 u_char flowTop;
2386 uint16_t flowBottom;
2387 u_char tosBottom, tosTop;
2388 struct sockaddr_in6 *sin6, tmp, *lsa6, lsa6_tmp;
2389 struct sockaddr_in6 lsa6_storage;
2390 int prev_scope=0;
2391 int error;
2392 u_short prev_port=0;
2393
2394 M_PREPEND(m, sizeof(struct ip6_hdr), MB_DONTWAIT);
2395 if (m == NULL) {
2396 /* failed to prepend data, give up */
2397 return (ENOMEM);
2398 }
2399 ip6h = mtod(m, struct ip6_hdr *);
2400
2401 /*
2402 * We assume here that inp_flow is in host byte order within
2403 * the TCB!
2404 */
2405 flowBottom = ((struct in6pcb *)inp)->in6p_flowinfo & 0x0000ffff;
2406 flowTop = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x000f0000) >> 16);
2407
2408 tosTop = (((((struct in6pcb *)inp)->in6p_flowinfo & 0xf0) >> 4) | IPV6_VERSION);
2409
2410 /* protect *sin6 from overwrite */
2411 sin6 = (struct sockaddr_in6 *)to;
2412 tmp = *sin6;
2413 sin6 = &tmp;
2414
2415 /* KAME hack: embed scopeid */
2416 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) || defined(__DragonFly__)
2417 if (in6_embedscope(&sin6->sin6_addr, sin6, NULL, NULL) != 0)
2418 #else
2419 if (in6_embedscope(&sin6->sin6_addr, sin6) != 0)
2420 #endif
2421 return (EINVAL);
2422 if (net == NULL) {
2423 memset(&ip6route, 0, sizeof(ip6route));
2424 ro = (struct route *)&ip6route;
2425 memcpy(&ro->ro_dst, sin6, sin6->sin6_len);
2426 } else {
2427 ro = (struct route *)&net->ro;
2428 }
2429 if (stcb != NULL) {
2430 if ((stcb->asoc.ecn_allowed) && ecn_ok) {
2431 /* Enable ECN */
2432 tosBottom = (((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) | sctp_get_ect(stcb, chk)) << 4);
2433 } else {
2434 /* No ECN */
2435 tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4);
2436 }
2437 } else {
2438 /* we could get no asoc if it is a O-O-T-B packet */
2439 tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4);
2440 }
2441 ip6h->ip6_flow = htonl(((tosTop << 24) | ((tosBottom|flowTop) << 16) | flowBottom));
2442 ip6h->ip6_nxt = IPPROTO_SCTP;
2443 ip6h->ip6_plen = m->m_pkthdr.len;
2444 ip6h->ip6_dst = sin6->sin6_addr;
2445
2446 /*
2447 * Add SRC address selection here:
2448 * we can only reuse to a limited degree the kame src-addr-sel,
2449 * since we can try their selection but it may not be bound.
2450 */
2451 bzero(&lsa6_tmp, sizeof(lsa6_tmp));
2452 lsa6_tmp.sin6_family = AF_INET6;
2453 lsa6_tmp.sin6_len = sizeof(lsa6_tmp);
2454 lsa6 = &lsa6_tmp;
2455 if (net) {
2456 if (net->src_addr_selected == 0) {
2457 /* Cache the source address */
2458 ((struct sockaddr_in6 *)&net->ro._s_addr)->sin6_addr = sctp_ipv6_source_address_selection(inp,
2459 stcb, ro, net, out_of_asoc_ok);
2460
2461 if (ro->ro_rt)
2462 net->src_addr_selected = 1;
2463 }
2464 lsa6->sin6_addr = ((struct sockaddr_in6 *)&net->ro._s_addr)->sin6_addr;
2465 } else {
2466 lsa6->sin6_addr = sctp_ipv6_source_address_selection(
2467 inp, stcb, ro, net, out_of_asoc_ok);
2468 }
2469 lsa6->sin6_port = inp->sctp_lport;
2470
2471 if ((ro->ro_rt == NULL)) {
2472 /*
2473 * src addr selection failed to find a route (or valid
2474 * source addr), so we can't get there from here!
2475 */
2476 #ifdef SCTP_DEBUG
2477 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2478 kprintf("low_level_output: dropped v6 pkt- no valid source addr\n");
2479 }
2480 #endif
2481 sctp_m_freem(m);
2482 if (net) {
2483 if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb)
2484 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN,
2485 stcb,
2486 SCTP_FAILED_THRESHOLD,
2487 (void *)net);
2488 net->dest_state &= ~SCTP_ADDR_REACHABLE;
2489 net->dest_state |= SCTP_ADDR_NOT_REACHABLE;
2490 if (stcb) {
2491 if (net == stcb->asoc.primary_destination) {
2492 /* need a new primary */
2493 struct sctp_nets *alt;
2494 alt = sctp_find_alternate_net(stcb, net);
2495 if (alt != net) {
2496 if (sctp_set_primary_addr(stcb,
2497 NULL,
2498 alt) == 0) {
2499 net->dest_state |= SCTP_ADDR_WAS_PRIMARY;
2500 net->src_addr_selected = 0;
2501 }
2502 }
2503 }
2504 }
2505 }
2506 return (EHOSTUNREACH);
2507 }
2508
2509 #ifndef SCOPEDROUTING
2510 /*
2511 * XXX: sa6 may not have a valid sin6_scope_id in
2512 * the non-SCOPEDROUTING case.
2513 */
2514 bzero(&lsa6_storage, sizeof(lsa6_storage));
2515 lsa6_storage.sin6_family = AF_INET6;
2516 lsa6_storage.sin6_len = sizeof(lsa6_storage);
2517 if ((error = in6_recoverscope(&lsa6_storage, &lsa6->sin6_addr,
2518 NULL)) != 0) {
2519 sctp_m_freem(m);
2520 return (error);
2521 }
2522 /* XXX */
2523 lsa6_storage.sin6_addr = lsa6->sin6_addr;
2524 lsa6_storage.sin6_port = inp->sctp_lport;
2525 lsa6 = &lsa6_storage;
2526 #endif /* SCOPEDROUTING */
2527 ip6h->ip6_src = lsa6->sin6_addr;
2528
2529 /*
2530 * We set the hop limit now since there is a good chance that
2531 * our ro pointer is now filled
2532 */
2533 ip6h->ip6_hlim = in6_selecthlim((struct in6pcb *)&inp->ip_inp.inp,
2534 (ro ?
2535 (ro->ro_rt ? (ro->ro_rt->rt_ifp) : (NULL)) :
2536 (NULL)));
2537 o_flgs = 0;
2538 ifp = ro->ro_rt->rt_ifp;
2539 #ifdef SCTP_DEBUG
2540 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2541 /* Copy to be sure something bad is not happening */
2542 sin6->sin6_addr = ip6h->ip6_dst;
2543 lsa6->sin6_addr = ip6h->ip6_src;
2544
2545 kprintf("Calling ipv6 output routine from low level\n");
2546 kprintf("src: ");
2547 sctp_print_address((struct sockaddr *)lsa6);
2548 kprintf("dst: ");
2549 sctp_print_address((struct sockaddr *)sin6);
2550 }
2551 #endif /* SCTP_DEBUG */
2552 if (net) {
2553 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
2554 /* preserve the port and scope for link local send */
2555 prev_scope = sin6->sin6_scope_id;
2556 prev_port = sin6->sin6_port;
2557 }
2558 ret = ip6_output(m, ((struct in6pcb *)inp)->in6p_outputopts,
2559 #ifdef NEW_STRUCT_ROUTE
2560 ro,
2561 #else
2562 (struct route_in6 *)ro,
2563 #endif
2564 o_flgs,
2565 ((struct in6pcb *)inp)->in6p_moptions,
2566 #if defined(__NetBSD__)
2567 (struct socket *)inp->sctp_socket,
2568 #endif
2569 &ifp
2570 #if (defined(__FreeBSD__) && __FreeBSD_version >= 480000) || defined(__DragonFly__)
2571 , NULL
2572 #endif
2573 );
2574 if (net) {
2575 /* for link local this must be done */
2576 sin6->sin6_scope_id = prev_scope;
2577 sin6->sin6_port = prev_port;
2578 }
2579 #ifdef SCTP_DEBUG
2580 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
2581 kprintf("return from send is %d\n", ret);
2582 }
2583 #endif /* SCTP_DEBUG_OUTPUT */
2584 sctp_pegs[SCTP_DATAGRAMS_SENT]++;
2585 if (net == NULL) {
2586 /* Now if we had a temp route free it */
2587 if (ro->ro_rt) {
2588 RTFREE(ro->ro_rt);
2589 }
2590 } else {
2591 /* PMTU check versus smallest asoc MTU goes here */
2592 if (ro->ro_rt == NULL) {
2593 /* Route was freed */
2594 net->src_addr_selected = 0;
2595 }
2596 if (ro->ro_rt != NULL) {
2597 if (ro->ro_rt->rt_rmx.rmx_mtu &&
2598 (stcb->asoc.smallest_mtu > ro->ro_rt->rt_rmx.rmx_mtu)) {
2599 sctp_mtu_size_reset(inp,
2600 &stcb->asoc,
2601 ro->ro_rt->rt_rmx.rmx_mtu);
2602 }
2603 } else if (ifp) {
2604 #if (defined(SCTP_BASE_FREEBSD) && __FreeBSD_version < 500000) || defined(__APPLE__)
2605 #define ND_IFINFO(ifp) (&nd_ifinfo[ifp->if_index])
2606 #endif /* SCTP_BASE_FREEBSD */
2607 if (ND_IFINFO(ifp)->linkmtu &&
2608 (stcb->asoc.smallest_mtu > ND_IFINFO(ifp)->linkmtu)) {
2609 sctp_mtu_size_reset(inp,
2610 &stcb->asoc,
2611 ND_IFINFO(ifp)->linkmtu);
2612 }
2613 }
2614 }
2615 return (ret);
2616 }
2617 #endif
2618 else {
2619 #ifdef SCTP_DEBUG
2620 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
2621 kprintf("Unknown protocol (TSNH) type %d\n", ((struct sockaddr *)to)->sa_family);
2622 }
2623 #endif
2624 sctp_m_freem(m);
2625 return (EFAULT);
2626 }
2627 }
2628
2629 static int
2630 sctp_is_address_in_scope(struct ifaddr *ifa,
2631 int ipv4_addr_legal,
2632 int ipv6_addr_legal,
2633 int loopback_scope,
2634 int ipv4_local_scope,
2635 int local_scope,
2636 int site_scope)
2637 {
2638 if ((loopback_scope == 0) &&
2639 (ifa->ifa_ifp) &&
2640 (ifa->ifa_ifp->if_type == IFT_LOOP)) {
2641 /* skip loopback if not in scope *
2642 */
2643 return (0);
2644 }
2645 if ((ifa->ifa_addr->sa_family == AF_INET) && ipv4_addr_legal) {
2646 struct sockaddr_in *sin;
2647 sin = (struct sockaddr_in *)ifa->ifa_addr;
2648 if (sin->sin_addr.s_addr == 0) {
2649 /* not in scope , unspecified */
2650 return (0);
2651 }
2652 if ((ipv4_local_scope == 0) &&
2653 (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
2654 /* private address not in scope */
2655 return (0);
2656 }
2657 } else if ((ifa->ifa_addr->sa_family == AF_INET6) && ipv6_addr_legal) {
2658 struct sockaddr_in6 *sin6;
2659 struct in6_ifaddr *ifa6;
2660
2661 ifa6 = (struct in6_ifaddr *)ifa;
2662 /* ok to use deprecated addresses? */
2663 if (!ip6_use_deprecated) {
2664 if (ifa6->ia6_flags &
2665 IN6_IFF_DEPRECATED) {
2666 return (0);
2667 }
2668 }
2669 if (ifa6->ia6_flags &
2670 (IN6_IFF_DETACHED |
2671 IN6_IFF_ANYCAST |
2672 IN6_IFF_NOTREADY)) {
2673 return (0);
2674 }
2675 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
2676 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2677 /* skip unspecifed addresses */
2678 return (0);
2679 }
2680 if (/*(local_scope == 0) && */
2681 (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
2682 return (0);
2683 }
2684 if ((site_scope == 0) &&
2685 (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
2686 return (0);
2687 }
2688 } else {
2689 return (0);
2690 }
2691 return (1);
2692 }
2693
2694
2695 void
2696 sctp_send_initiate(struct sctp_inpcb *inp, struct sctp_tcb *stcb)
2697 {
2698 struct mbuf *m, *m_at, *m_last;
2699 struct sctp_nets *net;
2700 struct sctp_init_msg *initm;
2701 struct sctp_supported_addr_param *sup_addr;
2702 struct sctp_ecn_supported_param *ecn;
2703 struct sctp_prsctp_supported_param *prsctp;
2704 struct sctp_ecn_nonce_supported_param *ecn_nonce;
2705 struct sctp_supported_chunk_types_param *pr_supported;
2706 int cnt_inits_to=0;
2707 int padval, ret;
2708
2709 /* INIT's always go to the primary (and usually ONLY address) */
2710 m_last = NULL;
2711 net = stcb->asoc.primary_destination;
2712 if (net == NULL) {
2713 net = TAILQ_FIRST(&stcb->asoc.nets);
2714 if (net == NULL) {
2715 /* TSNH */
2716 return;
2717 }
2718 /* we confirm any address we send an INIT to */
2719 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2720 sctp_set_primary_addr(stcb, NULL, net);
2721 } else {
2722 /* we confirm any address we send an INIT to */
2723 net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2724 }
2725 #ifdef SCTP_DEBUG
2726 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
2727 kprintf("Sending INIT to ");
2728 sctp_print_address ((struct sockaddr *)&net->ro._l_addr);
2729 }
2730 #endif
2731 if (((struct sockaddr *)&(net->ro._l_addr))->sa_family == AF_INET6) {
2732 /* special hook, if we are sending to link local
2733 * it will not show up in our private address count.
2734 */
2735 struct sockaddr_in6 *sin6l;
2736 sin6l = &net->ro._l_addr.sin6;
2737 if (IN6_IS_ADDR_LINKLOCAL(&sin6l->sin6_addr))
2738 cnt_inits_to = 1;
2739 }
2740 if (callout_pending(&net->rxt_timer.timer)) {
2741 /* This case should not happen */
2742 return;
2743 }
2744 /* start the INIT timer */
2745 if (sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net)) {
2746 /* we are hosed since I can't start the INIT timer? */
2747 return;
2748 }
2749 MGETHDR(m, MB_DONTWAIT, MT_HEADER);
2750 if (m == NULL) {
2751 /* No memory, INIT timer will re-attempt. */
2752 return;
2753 }
2754 /* make it into a M_EXT */
2755 MCLGET(m, MB_DONTWAIT);
2756 if ((m->m_flags & M_EXT) != M_EXT) {
2757 /* Failed to get cluster buffer */
2758 sctp_m_freem(m);
2759 return;
2760 }
2761 m->m_data += SCTP_MIN_OVERHEAD;
2762 m->m_len = sizeof(struct sctp_init_msg);
2763 /* Now lets put the SCTP header in place */
2764 initm = mtod(m, struct sctp_init_msg *);
2765 initm->sh.src_port = inp->sctp_lport;
2766 initm->sh.dest_port = stcb->rport;
2767 initm->sh.v_tag = 0;
2768 initm->sh.checksum = 0; /* calculate later */
2769 /* now the chunk header */
2770 initm->msg.ch.chunk_type = SCTP_INITIATION;
2771 initm->msg.ch.chunk_flags = 0;
2772 /* fill in later from mbuf we build */
2773 initm->msg.ch.chunk_length = 0;
2774 /* place in my tag */
2775 initm->msg.init.initiate_tag = htonl(stcb->asoc.my_vtag);
2776 /* set up some of the credits. */
2777 initm->msg.init.a_rwnd = htonl(max(inp->sctp_socket->so_rcv.ssb_hiwat,
2778 SCTP_MINIMAL_RWND));
2779
2780 initm->msg.init.num_outbound_streams = htons(stcb->asoc.pre_open_streams);
2781 initm->msg.init.num_inbound_streams = htons(stcb->asoc.max_inbound_streams);
2782 initm->msg.init.initial_tsn = htonl(stcb->asoc.init_seq_number);
2783 /* now the address restriction */
2784 sup_addr = (struct sctp_supported_addr_param *)((caddr_t)initm +
2785 sizeof(*initm));
2786 sup_addr->ph.param_type = htons(SCTP_SUPPORTED_ADDRTYPE);
2787 /* we support 2 types IPv6/IPv4 */
2788 sup_addr->ph.param_length = htons(sizeof(*sup_addr) +
2789 sizeof(uint16_t));
2790 sup_addr->addr_type[0] = htons(SCTP_IPV4_ADDRESS);
2791 sup_addr->addr_type[1] = htons(SCTP_IPV6_ADDRESS);
2792 m->m_len += sizeof(*sup_addr) + sizeof(uint16_t);
2793
2794 /* if (inp->sctp_flags & SCTP_PCB_FLAGS_ADAPTIONEVNT) {*/
2795 if (inp->sctp_ep.adaption_layer_indicator) {
2796 struct sctp_adaption_layer_indication *ali;
2797 ali = (struct sctp_adaption_layer_indication *)(
2798 (caddr_t)sup_addr + sizeof(*sup_addr) + sizeof(uint16_t));
2799 ali->ph.param_type = htons(SCTP_ULP_ADAPTION);
2800 ali->ph.param_length = htons(sizeof(*ali));
2801 ali->indication = ntohl(inp->sctp_ep.adaption_layer_indicator);
2802 m->m_len += sizeof(*ali);
2803 ecn = (struct sctp_ecn_supported_param *)((caddr_t)ali +
2804 sizeof(*ali));
2805 } else {
2806 ecn = (struct sctp_ecn_supported_param *)((caddr_t)sup_addr +
2807 sizeof(*sup_addr) + sizeof(uint16_t));
2808 }
2809
2810 /* now any cookie time extensions */
2811 if (stcb->asoc.cookie_preserve_req) {
2812 struct sctp_cookie_perserve_param *cookie_preserve;
2813 cookie_preserve = (struct sctp_cookie_perserve_param *)(ecn);
2814 cookie_preserve->ph.param_type = htons(SCTP_COOKIE_PRESERVE);
2815 cookie_preserve->ph.param_length = htons(
2816 sizeof(*cookie_preserve));
2817 cookie_preserve->time = htonl(stcb->asoc.cookie_preserve_req);
2818 m->m_len += sizeof(*cookie_preserve);
2819 ecn = (struct sctp_ecn_supported_param *)(
2820 (caddr_t)cookie_preserve + sizeof(*cookie_preserve));
2821 stcb->asoc.cookie_preserve_req = 0;
2822 }
2823
2824 /* ECN parameter */
2825 if (sctp_ecn == 1) {
2826 ecn->ph.param_type = htons(SCTP_ECN_CAPABLE);
2827 ecn->ph.param_length = htons(sizeof(*ecn));
2828 m->m_len += sizeof(*ecn);
2829 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn +
2830 sizeof(*ecn));
2831 } else {
2832 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn);
2833 }
2834 /* And now tell the peer we do pr-sctp */
2835 prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED);
2836 prsctp->ph.param_length = htons(sizeof(*prsctp));
2837 m->m_len += sizeof(*prsctp);
2838
2839
2840 /* And now tell the peer we do all the extensions */
2841 pr_supported = (struct sctp_supported_chunk_types_param *)((caddr_t)prsctp +
2842 sizeof(*prsctp));
2843
2844 pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT);
2845 pr_supported->ph.param_length = htons(sizeof(*pr_supported) + SCTP_EXT_COUNT);
2846 pr_supported->chunk_types[0] = SCTP_ASCONF;
2847 pr_supported->chunk_types[1] = SCTP_ASCONF_ACK;
2848 pr_supported->chunk_types[2] = SCTP_FORWARD_CUM_TSN;
2849 pr_supported->chunk_types[3] = SCTP_PACKET_DROPPED;
2850 pr_supported->chunk_types[4] = SCTP_STREAM_RESET;
2851 pr_supported->chunk_types[5] = 0; /* pad */
2852 pr_supported->chunk_types[6] = 0; /* pad */
2853 pr_supported->chunk_types[7] = 0; /* pad */
2854
2855 m->m_len += (sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
2856 /* ECN nonce: And now tell the peer we support ECN nonce */
2857
2858 if (sctp_ecn_nonce) {
2859 ecn_nonce = (struct sctp_ecn_nonce_supported_param *)((caddr_t)pr_supported +
2860 sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
2861 ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED);
2862 ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce));
2863 m->m_len += sizeof(*ecn_nonce);
2864 }
2865
2866 m_at = m;
2867 /* now the addresses */
2868 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
2869 struct ifnet *ifn;
2870 int cnt;
2871
2872 cnt = cnt_inits_to;
2873 TAILQ_FOREACH(ifn, &ifnet, if_list) {
2874 struct ifaddr_container *ifac;
2875
2876 if ((stcb->asoc.loopback_scope == 0) &&
2877 (ifn->if_type == IFT_LOOP)) {
2878 /*
2879 * Skip loopback devices if loopback_scope
2880 * not set
2881 */
2882 continue;
2883 }
2884 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
2885 struct ifaddr *ifa = ifac->ifa;
2886
2887 if (sctp_is_address_in_scope(ifa,
2888 stcb->asoc.ipv4_addr_legal,
2889 stcb->asoc.ipv6_addr_legal,
2890 stcb->asoc.loopback_scope,
2891 stcb->asoc.ipv4_local_scope,
2892 stcb->asoc.local_scope,
2893 stcb->asoc.site_scope) == 0) {
2894 continue;
2895 }
2896 cnt++;
2897 }
2898 }
2899 if (cnt > 1) {
2900 TAILQ_FOREACH(ifn, &ifnet, if_list) {
2901 struct ifaddr_container *ifac;
2902
2903 if ((stcb->asoc.loopback_scope == 0) &&
2904 (ifn->if_type == IFT_LOOP)) {
2905 /*
2906 * Skip loopback devices if loopback_scope
2907 * not set
2908 */
2909 continue;
2910 }
2911 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
2912 struct ifaddr *ifa = ifac->ifa;
2913
2914 if (sctp_is_address_in_scope(ifa,
2915 stcb->asoc.ipv4_addr_legal,
2916 stcb->asoc.ipv6_addr_legal,
2917 stcb->asoc.loopback_scope,
2918 stcb->asoc.ipv4_local_scope,
2919 stcb->asoc.local_scope,
2920 stcb->asoc.site_scope) == 0) {
2921 continue;
2922 }
2923 m_at = sctp_add_addr_to_mbuf(m_at, ifa);
2924 }
2925 }
2926 }
2927 } else {
2928 struct sctp_laddr *laddr;
2929 int cnt;
2930 cnt = cnt_inits_to;
2931 /* First, how many ? */
2932 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
2933 if (laddr->ifa == NULL) {
2934 continue;
2935 }
2936 if (laddr->ifa->ifa_addr == NULL)
2937 continue;
2938 if (sctp_is_address_in_scope(laddr->ifa,
2939 stcb->asoc.ipv4_addr_legal,
2940 stcb->asoc.ipv6_addr_legal,
2941 stcb->asoc.loopback_scope,
2942 stcb->asoc.ipv4_local_scope,
2943 stcb->asoc.local_scope,
2944 stcb->asoc.site_scope) == 0) {
2945 continue;
2946 }
2947 cnt++;
2948 }
2949 /* To get through a NAT we only list addresses if
2950 * we have more than one. That way if you just
2951 * bind a single address we let the source of the init
2952 * dictate our address.
2953 */
2954 if (cnt > 1) {
2955 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
2956 if (laddr->ifa == NULL) {
2957 continue;
2958 }
2959 if (laddr->ifa->ifa_addr == NULL) {
2960 continue;
2961 }
2962
2963 if (sctp_is_address_in_scope(laddr->ifa,
2964 stcb->asoc.ipv4_addr_legal,
2965 stcb->asoc.ipv6_addr_legal,
2966 stcb->asoc.loopback_scope,
2967 stcb->asoc.ipv4_local_scope,
2968 stcb->asoc.local_scope,
2969 stcb->asoc.site_scope) == 0) {
2970 continue;
2971 }
2972 m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa);
2973 }
2974 }
2975 }
2976 /* calulate the size and update pkt header and chunk header */
2977 m->m_pkthdr.len = 0;
2978 for (m_at = m; m_at; m_at = m_at->m_next) {
2979 if (m_at->m_next == NULL)
2980 m_last = m_at;
2981 m->m_pkthdr.len += m_at->m_len;
2982 }
2983 initm->msg.ch.chunk_length = htons((m->m_pkthdr.len -
2984 sizeof(struct sctphdr)));
2985 /* We pass 0 here to NOT set IP_DF if its IPv4, we
2986 * ignore the return here since the timer will drive
2987 * a retranmission.
2988 */
2989
2990 /* I don't expect this to execute but we will be safe here */
2991 padval = m->m_pkthdr.len % 4;
2992 if ((padval) && (m_last)) {
2993 /* The compiler worries that m_last may not be
2994 * set even though I think it is impossible :->
2995 * however we add m_last here just in case.
2996 */
2997 int ret;
2998 ret = sctp_add_pad_tombuf(m_last, (4-padval));
2999 if (ret) {
3000 /* Houston we have a problem, no space */
3001 sctp_m_freem(m);
3002 return;
3003 }
3004 m->m_pkthdr.len += padval;
3005 }
3006 #ifdef SCTP_DEBUG
3007 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3008 kprintf("Calling lowlevel output stcb:%x net:%x\n",
3009 (u_int)stcb, (u_int)net);
3010 }
3011 #endif
3012 ret = sctp_lowlevel_chunk_output(inp, stcb, net,
3013 (struct sockaddr *)&net->ro._l_addr, m, 0, 0, NULL, 0);
3014 #ifdef SCTP_DEBUG
3015 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3016 kprintf("Low level output returns %d\n", ret);
3017 }
3018 #endif
3019 sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net);
3020 SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
3021 }
3022
3023 struct mbuf *
3024 sctp_arethere_unrecognized_parameters(struct mbuf *in_initpkt,
3025 int param_offset, int *abort_processing, struct sctp_chunkhdr *cp)
3026 {
3027 /* Given a mbuf containing an INIT or INIT-ACK
3028 * with the param_offset being equal to the
3029 * beginning of the params i.e. (iphlen + sizeof(struct sctp_init_msg)
3030 * parse through the parameters to the end of the mbuf verifying
3031 * that all parameters are known.
3032 *
3033 * For unknown parameters build and return a mbuf with
3034 * UNRECOGNIZED_PARAMETER errors. If the flags indicate
3035 * to stop processing this chunk stop, and set *abort_processing
3036 * to 1.
3037 *
3038 * By having param_offset be pre-set to where parameters begin
3039 * it is hoped that this routine may be reused in the future
3040 * by new features.
3041 */
3042 struct sctp_paramhdr *phdr, params;
3043
3044 struct mbuf *mat, *op_err;
3045 char tempbuf[2048];
3046 int at, limit, pad_needed;
3047 uint16_t ptype, plen;
3048 int err_at;
3049
3050 *abort_processing = 0;
3051 mat = in_initpkt;
3052 err_at = 0;
3053 limit = ntohs(cp->chunk_length) - sizeof(struct sctp_init_chunk);
3054 #ifdef SCTP_DEBUG
3055 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3056 kprintf("Limit is %d bytes\n", limit);
3057 }
3058 #endif
3059 at = param_offset;
3060 op_err = NULL;
3061
3062 phdr = sctp_get_next_param(mat, at, &params, sizeof(params));
3063 while ((phdr != NULL) && ((size_t)limit >= sizeof(struct sctp_paramhdr))) {
3064 ptype = ntohs(phdr->param_type);
3065 plen = ntohs(phdr->param_length);
3066 limit -= SCTP_SIZE32(plen);
3067 if (plen < sizeof(struct sctp_paramhdr)) {
3068 #ifdef SCTP_DEBUG
3069 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3070 kprintf("sctp_output.c:Impossible length in parameter < %d\n", plen);
3071 }
3072 #endif
3073 *abort_processing = 1;
3074 break;
3075 }
3076 /* All parameters for all chunks that we
3077 * know/understand are listed here. We process
3078 * them other places and make appropriate
3079 * stop actions per the upper bits. However
3080 * this is the generic routine processor's can
3081 * call to get back an operr.. to either incorporate (init-ack)
3082 * or send.
3083 */
3084 if ((ptype == SCTP_HEARTBEAT_INFO) ||
3085 (ptype == SCTP_IPV4_ADDRESS) ||
3086 (ptype == SCTP_IPV6_ADDRESS) ||
3087 (ptype == SCTP_STATE_COOKIE) ||
3088 (ptype == SCTP_UNRECOG_PARAM) ||
3089 (ptype == SCTP_COOKIE_PRESERVE) ||
3090 (ptype == SCTP_SUPPORTED_ADDRTYPE) ||
3091 (ptype == SCTP_PRSCTP_SUPPORTED) ||
3092 (ptype == SCTP_ADD_IP_ADDRESS) ||
3093 (ptype == SCTP_DEL_IP_ADDRESS) ||
3094 (ptype == SCTP_ECN_CAPABLE) ||
3095 (ptype == SCTP_ULP_ADAPTION) ||
3096 (ptype == SCTP_ERROR_CAUSE_IND) ||
3097 (ptype == SCTP_SET_PRIM_ADDR) ||
3098 (ptype == SCTP_SUCCESS_REPORT) ||
3099 (ptype == SCTP_ULP_ADAPTION) ||
3100 (ptype == SCTP_SUPPORTED_CHUNK_EXT) ||
3101 (ptype == SCTP_ECN_NONCE_SUPPORTED)
3102 ) {
3103 /* no skip it */
3104 at += SCTP_SIZE32(plen);
3105 } else if (ptype == SCTP_HOSTNAME_ADDRESS) {
3106 /* We can NOT handle HOST NAME addresses!! */
3107 #ifdef SCTP_DEBUG
3108 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3109 kprintf("Can't handle hostname addresses.. abort processing\n");
3110 }
3111 #endif
3112 *abort_processing = 1;
3113 if (op_err == NULL) {
3114 /* Ok need to try to get a mbuf */
3115 MGETHDR(op_err, MB_DONTWAIT, MT_DATA);
3116 if (op_err) {
3117 op_err->m_len = 0;
3118 op_err->m_pkthdr.len = 0;
3119 /* pre-reserve space for ip and sctp header and chunk hdr*/
3120 op_err->m_data += sizeof(struct ip6_hdr);
3121 op_err->m_data += sizeof(struct sctphdr);
3122 op_err->m_data += sizeof(struct sctp_chunkhdr);
3123 }
3124 }
3125 if (op_err) {
3126 /* If we have space */
3127 struct sctp_paramhdr s;
3128 if (err_at % 4) {
3129 u_int32_t cpthis=0;
3130 pad_needed = 4 - (err_at % 4);
3131 m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis);
3132 err_at += pad_needed;
3133 }
3134 s.param_type = htons(SCTP_CAUSE_UNRESOLV_ADDR);
3135 s.param_length = htons(sizeof(s) + plen);
3136 m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s);
3137 err_at += sizeof(s);
3138 phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen);
3139 if (phdr == NULL) {
3140 sctp_m_freem(op_err);
3141 /* we are out of memory but we
3142 * still need to have a look at what to
3143 * do (the system is in trouble though).
3144 */
3145 return (NULL);
3146 }
3147 m_copyback(op_err, err_at, plen, (caddr_t)phdr);
3148 err_at += plen;
3149 }
3150 return (op_err);
3151 } else {
3152 /* we do not recognize the parameter
3153 * figure out what we do.
3154 */
3155 #ifdef SCTP_DEBUG
3156 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3157 kprintf("Got parameter type %x - unknown\n",
3158 (u_int)ptype);
3159 }
3160 #endif
3161 if ((ptype & 0x4000) == 0x4000) {
3162 /* Report bit is set?? */
3163 #ifdef SCTP_DEBUG
3164 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3165 kprintf("Report bit is set\n");
3166 }
3167 #endif
3168 if (op_err == NULL) {
3169 /* Ok need to try to get an mbuf */
3170 MGETHDR(op_err, MB_DONTWAIT, MT_DATA);
3171 if (op_err) {
3172 op_err->m_len = 0;
3173 op_err->m_pkthdr.len = 0;
3174 op_err->m_data += sizeof(struct ip6_hdr);
3175 op_err->m_data += sizeof(struct sctphdr);
3176 op_err->m_data += sizeof(struct sctp_chunkhdr);
3177 }
3178 }
3179 if (op_err) {
3180 /* If we have space */
3181 struct sctp_paramhdr s;
3182 if (err_at % 4) {
3183 u_int32_t cpthis=0;
3184 pad_needed = 4 - (err_at % 4);
3185 m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis);
3186 err_at += pad_needed;
3187 }
3188 s.param_type = htons(SCTP_UNRECOG_PARAM);
3189 s.param_length = htons(sizeof(s) + plen);
3190 m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s);
3191 err_at += sizeof(s);
3192 if (plen > sizeof(tempbuf)) {
3193 plen = sizeof(tempbuf);
3194 }
3195 phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen);
3196 if (phdr == NULL) {
3197 sctp_m_freem(op_err);
3198 /* we are out of memory but we
3199 * still need to have a look at what to
3200 * do (the system is in trouble though).
3201 */
3202 goto more_processing;
3203 }
3204 m_copyback(op_err, err_at, plen, (caddr_t)phdr);
3205 err_at += plen;
3206 }
3207 }
3208 more_processing:
3209 if ((ptype & 0x8000) == 0x0000) {
3210 #ifdef SCTP_DEBUG
3211 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
3212 kprintf("Abort bit is now setting1\n");
3213 }
3214 #endif
3215 return (op_err);
3216 } else {
3217 /* skip this chunk and continue processing */
3218 at += SCTP_SIZE32(plen);
3219 }
3220
3221 }
3222 phdr = sctp_get_next_param(mat, at, &params, sizeof(params));
3223 }
3224 return (op_err);
3225 }
3226
3227 static int
3228 sctp_are_there_new_addresses(struct sctp_association *asoc,
3229 struct mbuf *in_initpkt, int iphlen, int offset)
3230 {
3231 /*
3232 * Given a INIT packet, look through the packet to verify that
3233 * there are NO new addresses. As we go through the parameters
3234 * add reports of any un-understood parameters that require an
3235 * error. Also we must return (1) to drop the packet if we see
3236 * a un-understood parameter that tells us to drop the chunk.
3237 */
3238 struct sockaddr_in sin4, *sa4;
3239 struct sockaddr_in6 sin6, *sa6;
3240 struct sockaddr *sa_touse;
3241 struct sockaddr *sa;
3242 struct sctp_paramhdr *phdr, params;
3243 struct ip *iph;
3244 struct mbuf *mat;
3245 uint16_t ptype, plen;
3246 int err_at;
3247 uint8_t fnd;
3248 struct sctp_nets *net;
3249
3250 memset(&sin4, 0, sizeof(sin4));
3251 memset(&sin6, 0, sizeof(sin6));
3252 sin4.sin_family = AF_INET;
3253 sin4.sin_len = sizeof(sin4);
3254 sin6.sin6_family = AF_INET6;
3255 sin6.sin6_len = sizeof(sin6);
3256
3257 sa_touse = NULL;
3258 /* First what about the src address of the pkt ? */
3259 iph = mtod(in_initpkt, struct ip *);
3260 if (iph->ip_v == IPVERSION) {
3261 /* source addr is IPv4 */
3262 sin4.sin_addr = iph->ip_src;
3263 sa_touse = (struct sockaddr *)&sin4;
3264 } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
3265 /* source addr is IPv6 */
3266 struct ip6_hdr *ip6h;
3267 ip6h = mtod(in_initpkt, struct ip6_hdr *);
3268 sin6.sin6_addr = ip6h->ip6_src;
3269 sa_touse = (struct sockaddr *)&sin6;
3270 } else {
3271 return (1);
3272 }
3273
3274 fnd = 0;
3275 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3276 sa = (struct sockaddr *)&net->ro._l_addr;
3277 if (sa->sa_family == sa_touse->sa_family) {
3278 if (sa->sa_family == AF_INET) {
3279 sa4 = (struct sockaddr_in *)sa;
3280 if (sa4->sin_addr.s_addr ==
3281 sin4.sin_addr.s_addr) {
3282 fnd = 1;
3283 break;
3284 }
3285 } else if (sa->sa_family == AF_INET6) {
3286 sa6 = (struct sockaddr_in6 *)sa;
3287 if (SCTP6_ARE_ADDR_EQUAL(&sa6->sin6_addr,
3288 &sin6.sin6_addr)) {
3289 fnd = 1;
3290 break;
3291 }
3292 }
3293 }
3294 }
3295 if (fnd == 0) {
3296 /* New address added! no need to look futher. */
3297 return (1);
3298 }
3299 /* Ok so far lets munge through the rest of the packet */
3300 mat = in_initpkt;
3301 err_at = 0;
3302 sa_touse = NULL;
3303 offset += sizeof(struct sctp_init_chunk);
3304 phdr = sctp_get_next_param(mat, offset, &params, sizeof(params));
3305 while (phdr) {
3306 ptype = ntohs(phdr->param_type);
3307 plen = ntohs(phdr->param_length);
3308 if (ptype == SCTP_IPV4_ADDRESS) {
3309 struct sctp_ipv4addr_param *p4, p4_buf;
3310
3311 phdr = sctp_get_next_param(mat, offset,
3312 (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf));
3313 if (plen != sizeof(struct sctp_ipv4addr_param) ||
3314 phdr == NULL) {
3315 return (1);
3316 }
3317 p4 = (struct sctp_ipv4addr_param *)phdr;
3318 sin4.sin_addr.s_addr = p4->addr;
3319 sa_touse = (struct sockaddr *)&sin4;
3320 } else if (ptype == SCTP_IPV6_ADDRESS) {
3321 struct sctp_ipv6addr_param *p6, p6_buf;
3322
3323 phdr = sctp_get_next_param(mat, offset,
3324 (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf));
3325 if (plen != sizeof(struct sctp_ipv6addr_param) ||
3326 phdr == NULL) {
3327 return (1);
3328 }
3329 p6 = (struct sctp_ipv6addr_param *)phdr;
3330 memcpy((caddr_t)&sin6.sin6_addr, p6->addr,
3331 sizeof(p6->addr));
3332 sa_touse = (struct sockaddr *)&sin4;
3333 }
3334
3335 if (sa_touse) {
3336 /* ok, sa_touse points to one to check */
3337 fnd = 0;
3338 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3339 sa = (struct sockaddr *)&net->ro._l_addr;
3340 if (sa->sa_family != sa_touse->sa_family) {
3341 continue;
3342 }
3343 if (sa->sa_family == AF_INET) {
3344 sa4 = (struct sockaddr_in *)sa;
3345 if (sa4->sin_addr.s_addr ==
3346 sin4.sin_addr.s_addr) {
3347 fnd = 1;
3348 break;
3349 }
3350 } else if (sa->sa_family == AF_INET6) {
3351 sa6 = (struct sockaddr_in6 *)sa;
3352 if (SCTP6_ARE_ADDR_EQUAL(
3353 &sa6->sin6_addr, &sin6.sin6_addr)) {
3354 fnd = 1;
3355 break;
3356 }
3357 }
3358 }
3359 if (!fnd) {
3360 /* New addr added! no need to look further */
3361 return (1);
3362 }
3363 }
3364 offset += SCTP_SIZE32(plen);
3365 phdr = sctp_get_next_param(mat, offset, &params, sizeof(params));
3366 }
3367 return (0);
3368 }
3369
3370 /*
3371 * Given a MBUF chain that was sent into us containing an
3372 * INIT. Build a INIT-ACK with COOKIE and send back.
3373 * We assume that the in_initpkt has done a pullup to
3374 * include IPv6/4header, SCTP header and initial part of
3375 * INIT message (i.e. the struct sctp_init_msg).
3376 */
3377 void
3378 sctp_send_initiate_ack(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3379 struct mbuf *init_pkt, int iphlen, int offset, struct sctphdr *sh,
3380 struct sctp_init_chunk *init_chk)
3381 {
3382 struct sctp_association *asoc;
3383 struct mbuf *m, *m_at, *m_tmp, *m_cookie, *op_err, *m_last;
3384 struct sctp_init_msg *initackm_out;
3385 struct sctp_ecn_supported_param *ecn;
3386 struct sctp_prsctp_supported_param *prsctp;
3387 struct sctp_ecn_nonce_supported_param *ecn_nonce;
3388 struct sctp_supported_chunk_types_param *pr_supported;
3389 struct sockaddr_storage store;
3390 struct sockaddr_in *sin;
3391 struct sockaddr_in6 *sin6;
3392 struct route *ro;
3393 struct ip *iph;
3394 struct ip6_hdr *ip6;
3395 struct sockaddr *to;
3396 struct sctp_state_cookie stc;
3397 struct sctp_nets *net=NULL;
3398 int cnt_inits_to=0;
3399 uint16_t his_limit, i_want;
3400 int abort_flag, padval, sz_of;
3401
3402 if (stcb) {
3403 asoc = &stcb->asoc;
3404 } else {
3405 asoc = NULL;
3406 }
3407 m_last = NULL;
3408 if ((asoc != NULL) &&
3409 (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
3410 (sctp_are_there_new_addresses(asoc, init_pkt, iphlen, offset))) {
3411 /* new addresses, out of here in non-cookie-wait states */
3412 /*
3413 * Send a ABORT, we don't add the new address error clause though
3414 * we even set the T bit and copy in the 0 tag.. this looks no
3415 * different than if no listner was present.
3416 */
3417 sctp_send_abort(init_pkt, iphlen, sh, 0, NULL);
3418 return;
3419 }
3420 abort_flag = 0;
3421 op_err = sctp_arethere_unrecognized_parameters(init_pkt,
3422 (offset+sizeof(struct sctp_init_chunk)),
3423 &abort_flag, (struct sctp_chunkhdr *)init_chk);
3424 if (abort_flag) {
3425 sctp_send_abort(init_pkt, iphlen, sh, init_chk->init.initiate_tag, op_err);
3426 return;
3427 }
3428 MGETHDR(m, MB_DONTWAIT, MT_HEADER);
3429 if (m == NULL) {
3430 /* No memory, INIT timer will re-attempt. */
3431 if (op_err)
3432 sctp_m_freem(op_err);
3433 return;
3434 }
3435 MCLGET(m, MB_DONTWAIT);
3436 if ((m->m_flags & M_EXT) != M_EXT) {
3437 /* Failed to get cluster buffer */
3438 if (op_err)
3439 sctp_m_freem(op_err);
3440 sctp_m_freem(m);
3441 return;
3442 }
3443 m->m_data += SCTP_MIN_OVERHEAD;
3444 m->m_pkthdr.rcvif = 0;
3445 m->m_len = sizeof(struct sctp_init_msg);
3446
3447 /* the time I built cookie */
3448 SCTP_GETTIME_TIMEVAL(&stc.time_entered);
3449
3450 /* populate any tie tags */
3451 if (asoc != NULL) {
3452 /* unlock before tag selections */
3453 SCTP_TCB_UNLOCK(stcb);
3454 if (asoc->my_vtag_nonce == 0)
3455 asoc->my_vtag_nonce = sctp_select_a_tag(inp);
3456 stc.tie_tag_my_vtag = asoc->my_vtag_nonce;
3457
3458 if (asoc->peer_vtag_nonce == 0)
3459 asoc->peer_vtag_nonce = sctp_select_a_tag(inp);
3460 stc.tie_tag_peer_vtag = asoc->peer_vtag_nonce;
3461
3462 stc.cookie_life = asoc->cookie_life;
3463 net = asoc->primary_destination;
3464 /* now we must relock */
3465 SCTP_INP_RLOCK(inp);
3466 /* we may be in trouble here if the inp got freed
3467 * most likely this set of tests will protect
3468 * us but there is a chance not.
3469 */
3470 if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
3471 if (op_err)
3472 sctp_m_freem(op_err);
3473 sctp_m_freem(m);
3474 sctp_send_abort(init_pkt, iphlen, sh, 0, NULL);
3475 return;
3476 }
3477 SCTP_TCB_LOCK(stcb);
3478 SCTP_INP_RUNLOCK(stcb->sctp_ep);
3479 } else {
3480 stc.tie_tag_my_vtag = 0;
3481 stc.tie_tag_peer_vtag = 0;
3482 /* life I will award this cookie */
3483 stc.cookie_life = inp->sctp_ep.def_cookie_life;
3484 }
3485
3486 /* copy in the ports for later check */
3487 stc.myport = sh->dest_port;
3488 stc.peerport = sh->src_port;
3489
3490 /*
3491 * If we wanted to honor cookie life extentions, we would add
3492 * to stc.cookie_life. For now we should NOT honor any extension
3493 */
3494 stc.site_scope = stc.local_scope = stc.loopback_scope = 0;
3495 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
3496 struct inpcb *in_inp;
3497 /* Its a V6 socket */
3498 in_inp = (struct inpcb *)inp;
3499 stc.ipv6_addr_legal = 1;
3500 /* Now look at the binding flag to see if V4 will be legal */
3501 if (
3502 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
3503 (in_inp->inp_flags & IN6P_IPV6_V6ONLY)
3504 #elif defined(__OpenBSD__)
3505 (0) /* For openbsd we do dual bind only */
3506 #else
3507 (((struct in6pcb *)in_inp)->in6p_flags & IN6P_IPV6_V6ONLY)
3508 #endif
3509 == 0) {
3510 stc.ipv4_addr_legal = 1;
3511 } else {
3512 /* V4 addresses are NOT legal on the association */
3513 stc.ipv4_addr_legal = 0;
3514 }
3515 } else {
3516 /* Its a V4 socket, no - V6 */
3517 stc.ipv4_addr_legal = 1;
3518 stc.ipv6_addr_legal = 0;
3519 }
3520
3521 #ifdef SCTP_DONT_DO_PRIVADDR_SCOPE
3522 stc.ipv4_scope = 1;
3523 #else
3524 stc.ipv4_scope = 0;
3525 #endif
3526 /* now for scope setup */
3527 memset((caddr_t)&store, 0, sizeof(store));
3528 sin = (struct sockaddr_in *)&store;
3529 sin6 = (struct sockaddr_in6 *)&store;
3530 if (net == NULL) {
3531 to = (struct sockaddr *)&store;
3532 iph = mtod(init_pkt, struct ip *);
3533 if (iph->ip_v == IPVERSION) {
3534 struct in_addr addr;
3535 struct route iproute;
3536
3537 sin->sin_family = AF_INET;
3538 sin->sin_len = sizeof(struct sockaddr_in);
3539 sin->sin_port = sh->src_port;
3540 sin->sin_addr = iph->ip_src;
3541 /* lookup address */
3542 stc.address[0] = sin->sin_addr.s_addr;
3543 stc.address[1] = 0;
3544 stc.address[2] = 0;
3545 stc.address[3] = 0;
3546 stc.addr_type = SCTP_IPV4_ADDRESS;
3547 /* local from address */
3548 memset(&iproute, 0, sizeof(iproute));
3549 ro = &iproute;
3550 memcpy(&ro->ro_dst, sin, sizeof(*sin));
3551 addr = sctp_ipv4_source_address_selection(inp, NULL,
3552 ro, NULL, 0);
3553 if (ro->ro_rt) {
3554 RTFREE(ro->ro_rt);
3555 }
3556 stc.laddress[0] = addr.s_addr;
3557 stc.laddress[1] = 0;
3558 stc.laddress[2] = 0;
3559 stc.laddress[3] = 0;
3560 stc.laddr_type = SCTP_IPV4_ADDRESS;
3561 /* scope_id is only for v6 */
3562 stc.scope_id = 0;
3563 #ifndef SCTP_DONT_DO_PRIVADDR_SCOPE
3564 if (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
3565 stc.ipv4_scope = 1;
3566 }
3567 #else
3568 stc.ipv4_scope = 1;
3569 #endif /* SCTP_DONT_DO_PRIVADDR_SCOPE */
3570 /* Must use the address in this case */
3571 if (sctp_is_address_on_local_host((struct sockaddr *)sin)) {
3572 stc.loopback_scope = 1;
3573 stc.ipv4_scope = 1;
3574 stc.site_scope = 1;
3575 stc.local_scope = 1;
3576 }
3577 } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
3578 struct in6_addr addr;
3579 #ifdef NEW_STRUCT_ROUTE
3580 struct route iproute6;
3581 #else
3582 struct route_in6 iproute6;
3583 #endif
3584 ip6 = mtod(init_pkt, struct ip6_hdr *);
3585 sin6->sin6_family = AF_INET6;
3586 sin6->sin6_len = sizeof(struct sockaddr_in6);
3587 sin6->sin6_port = sh->src_port;
3588 sin6->sin6_addr = ip6->ip6_src;
3589 /* lookup address */
3590 memcpy(&stc.address, &sin6->sin6_addr,
3591 sizeof(struct in6_addr));
3592 sin6->sin6_scope_id = 0;
3593 stc.addr_type = SCTP_IPV6_ADDRESS;
3594 stc.scope_id = 0;
3595 if (sctp_is_address_on_local_host((struct sockaddr *)sin6)) {
3596 stc.loopback_scope = 1;
3597 stc.local_scope = 1;
3598 stc.site_scope = 1;
3599 stc.ipv4_scope = 1;
3600 } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
3601 /*
3602 * If the new destination is a LINK_LOCAL
3603 * we must have common both site and local
3604 * scope. Don't set local scope though since
3605 * we must depend on the source to be added
3606 * implicitly. We cannot assure just because
3607 * we share one link that all links are common.
3608 */
3609 stc.local_scope = 0;
3610 stc.site_scope = 1;
3611 stc.ipv4_scope = 1;
3612 /* we start counting for the private
3613 * address stuff at 1. since the link
3614 * local we source from won't show
3615 * up in our scoped cou8nt.
3616 */
3617 cnt_inits_to=1;
3618 /* pull out the scope_id from incoming pkt */
3619 in6_recoverscope(sin6, &ip6->ip6_src,
3620 init_pkt->m_pkthdr.rcvif);
3621 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) || defined(__DragonFly__)
3622 in6_embedscope(&sin6->sin6_addr, sin6, NULL,
3623 NULL);
3624 #else
3625 in6_embedscope(&sin6->sin6_addr, sin6);
3626 #endif
3627 stc.scope_id = sin6->sin6_scope_id;
3628 } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
3629 /*
3630 * If the new destination is SITE_LOCAL
3631 * then we must have site scope in common.
3632 */
3633 stc.site_scope = 1;
3634 }
3635 /* local from address */
3636 memset(&iproute6, 0, sizeof(iproute6));
3637 ro = (struct route *)&iproute6;
3638 memcpy(&ro->ro_dst, sin6, sizeof(*sin6));
3639 addr = sctp_ipv6_source_address_selection(inp, NULL,
3640 ro, NULL, 0);
3641 if (ro->ro_rt) {
3642 RTFREE(ro->ro_rt);
3643 }
3644 memcpy(&stc.laddress, &addr, sizeof(struct in6_addr));
3645 stc.laddr_type = SCTP_IPV6_ADDRESS;
3646 }
3647 } else {
3648 /* set the scope per the existing tcb */
3649 struct sctp_nets *lnet;
3650
3651 stc.loopback_scope = asoc->loopback_scope;
3652 stc.ipv4_scope = asoc->ipv4_local_scope;
3653 stc.site_scope = asoc->site_scope;
3654 stc.local_scope = asoc->local_scope;
3655 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) {
3656 if (lnet->ro._l_addr.sin6.sin6_family == AF_INET6) {
3657 if (IN6_IS_ADDR_LINKLOCAL(&lnet->ro._l_addr.sin6.sin6_addr)) {
3658 /* if we have a LL address, start counting
3659 * at 1.
3660 */
3661 cnt_inits_to = 1;
3662 }
3663 }
3664 }
3665
3666 /* use the net pointer */
3667 to = (struct sockaddr *)&net->ro._l_addr;
3668 if (to->sa_family == AF_INET) {
3669 sin = (struct sockaddr_in *)to;
3670 stc.address[0] = sin->sin_addr.s_addr;
3671 stc.address[1] = 0;
3672 stc.address[2] = 0;
3673 stc.address[3] = 0;
3674 stc.addr_type = SCTP_IPV4_ADDRESS;
3675 if (net->src_addr_selected == 0) {
3676 /* strange case here, the INIT
3677 * should have did the selection.
3678 */
3679 net->ro._s_addr.sin.sin_addr =
3680 sctp_ipv4_source_address_selection(inp,
3681 stcb, (struct route *)&net->ro, net, 0);
3682 net->src_addr_selected = 1;
3683
3684 }
3685
3686 stc.laddress[0] = net->ro._s_addr.sin.sin_addr.s_addr;
3687 stc.laddress[1] = 0;
3688 stc.laddress[2] = 0;
3689 stc.laddress[3] = 0;
3690 stc.laddr_type = SCTP_IPV4_ADDRESS;
3691 } else if (to->sa_family == AF_INET6) {
3692 sin6 = (struct sockaddr_in6 *)to;
3693 memcpy(&stc.address, &sin6->sin6_addr,
3694 sizeof(struct in6_addr));
3695 stc.addr_type = SCTP_IPV6_ADDRESS;
3696 if (net->src_addr_selected == 0) {
3697 /* strange case here, the INIT
3698 * should have did the selection.
3699 */
3700 net->ro._s_addr.sin6.sin6_addr =
3701 sctp_ipv6_source_address_selection(inp,
3702 stcb, (struct route *)&net->ro, net, 0);
3703 net->src_addr_selected = 1;
3704 }
3705 memcpy(&stc.laddress, &net->ro._l_addr.sin6.sin6_addr,
3706 sizeof(struct in6_addr));
3707 stc.laddr_type = SCTP_IPV6_ADDRESS;
3708 }
3709 }
3710 /* Now lets put the SCTP header in place */
3711 initackm_out = mtod(m, struct sctp_init_msg *);
3712 initackm_out->sh.src_port = inp->sctp_lport;
3713 initackm_out->sh.dest_port = sh->src_port;
3714 initackm_out->sh.v_tag = init_chk->init.initiate_tag;
3715 /* Save it off for quick ref */
3716 stc.peers_vtag = init_chk->init.initiate_tag;
3717 initackm_out->sh.checksum = 0; /* calculate later */
3718 /* who are we */
3719 strncpy(stc.identification, SCTP_VERSION_STRING,
3720 min(strlen(SCTP_VERSION_STRING), sizeof(stc.identification)));
3721 /* now the chunk header */
3722 initackm_out->msg.ch.chunk_type = SCTP_INITIATION_ACK;
3723 initackm_out->msg.ch.chunk_flags = 0;
3724 /* fill in later from mbuf we build */
3725 initackm_out->msg.ch.chunk_length = 0;
3726 /* place in my tag */
3727 if ((asoc != NULL) &&
3728 ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
3729 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED))) {
3730 /* re-use the v-tags and init-seq here */
3731 initackm_out->msg.init.initiate_tag = htonl(asoc->my_vtag);
3732 initackm_out->msg.init.initial_tsn = htonl(asoc->init_seq_number);
3733 } else {
3734 initackm_out->msg.init.initiate_tag = htonl(sctp_select_a_tag(inp));
3735 /* get a TSN to use too */
3736 initackm_out->msg.init.initial_tsn = htonl(sctp_select_initial_TSN(&inp->sctp_ep));
3737 }
3738 /* save away my tag to */
3739 stc.my_vtag = initackm_out->msg.init.initiate_tag;
3740
3741 /* set up some of the credits. */
3742 initackm_out->msg.init.a_rwnd = htonl(max(inp->sctp_socket->so_rcv.ssb_hiwat, SCTP_MINIMAL_RWND));
3743 /* set what I want */
3744 his_limit = ntohs(init_chk->init.num_inbound_streams);
3745 /* choose what I want */
3746 if (asoc != NULL) {
3747 if (asoc->streamoutcnt > inp->sctp_ep.pre_open_stream_count) {
3748 i_want = asoc->streamoutcnt;
3749 } else {
3750 i_want = inp->sctp_ep.pre_open_stream_count;
3751 }
3752 } else {
3753 i_want = inp->sctp_ep.pre_open_stream_count;
3754 }
3755 if (his_limit < i_want) {
3756 /* I Want more :< */
3757 initackm_out->msg.init.num_outbound_streams = init_chk->init.num_inbound_streams;
3758 } else {
3759 /* I can have what I want :> */
3760 initackm_out->msg.init.num_outbound_streams = htons(i_want);
3761 }
3762 /* tell him his limt. */
3763 initackm_out->msg.init.num_inbound_streams =
3764 htons(inp->sctp_ep.max_open_streams_intome);
3765 /* setup the ECN pointer */
3766
3767 /* if (inp->sctp_flags & SCTP_PCB_FLAGS_ADAPTIONEVNT) {*/
3768 if (inp->sctp_ep.adaption_layer_indicator) {
3769 struct sctp_adaption_layer_indication *ali;
3770 ali = (struct sctp_adaption_layer_indication *)(
3771 (caddr_t)initackm_out + sizeof(*initackm_out));
3772 ali->ph.param_type = htons(SCTP_ULP_ADAPTION);
3773 ali->ph.param_length = htons(sizeof(*ali));
3774 ali->indication = ntohl(inp->sctp_ep.adaption_layer_indicator);
3775 m->m_len += sizeof(*ali);
3776 ecn = (struct sctp_ecn_supported_param *)((caddr_t)ali +
3777 sizeof(*ali));
3778 } else {
3779 ecn = (struct sctp_ecn_supported_param*)(
3780 (caddr_t)initackm_out + sizeof(*initackm_out));
3781 }
3782
3783 /* ECN parameter */
3784 if (sctp_ecn == 1) {
3785 ecn->ph.param_type = htons(SCTP_ECN_CAPABLE);
3786 ecn->ph.param_length = htons(sizeof(*ecn));
3787 m->m_len += sizeof(*ecn);
3788
3789 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn +
3790 sizeof(*ecn));
3791 } else {
3792 prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn);
3793 }
3794 /* And now tell the peer we do pr-sctp */
3795 prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED);
3796 prsctp->ph.param_length = htons(sizeof(*prsctp));
3797 m->m_len += sizeof(*prsctp);
3798
3799
3800 /* And now tell the peer we do all the extensions */
3801 pr_supported = (struct sctp_supported_chunk_types_param *)((caddr_t)prsctp +
3802 sizeof(*prsctp));
3803
3804 pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT);
3805 pr_supported->ph.param_length = htons(sizeof(*pr_supported) + SCTP_EXT_COUNT);
3806 pr_supported->chunk_types[0] = SCTP_ASCONF;
3807 pr_supported->chunk_types[1] = SCTP_ASCONF_ACK;
3808 pr_supported->chunk_types[2] = SCTP_FORWARD_CUM_TSN;
3809 pr_supported->chunk_types[3] = SCTP_PACKET_DROPPED;
3810 pr_supported->chunk_types[4] = SCTP_STREAM_RESET;
3811 pr_supported->chunk_types[5] = 0; /* pad */
3812 pr_supported->chunk_types[6] = 0; /* pad */
3813 pr_supported->chunk_types[7] = 0; /* pad */
3814
3815 m->m_len += (sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
3816 if (sctp_ecn_nonce) {
3817 /* ECN nonce: And now tell the peer we support ECN nonce */
3818 ecn_nonce = (struct sctp_ecn_nonce_supported_param *)((caddr_t)pr_supported +
3819 sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
3820 ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED);
3821 ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce));
3822 m->m_len += sizeof(*ecn_nonce);
3823 }
3824
3825 m_at = m;
3826 /* now the addresses */
3827 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3828 struct ifnet *ifn;
3829 int cnt = cnt_inits_to;
3830
3831 TAILQ_FOREACH(ifn, &ifnet, if_list) {
3832 struct ifaddr_container *ifac;
3833
3834 if ((stc.loopback_scope == 0) &&
3835 (ifn->if_type == IFT_LOOP)) {
3836 /*
3837 * Skip loopback devices if loopback_scope
3838 * not set
3839 */
3840 continue;
3841 }
3842 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
3843 struct ifaddr *ifa = ifac->ifa;
3844
3845 if (sctp_is_address_in_scope(ifa,
3846 stc.ipv4_addr_legal, stc.ipv6_addr_legal,
3847 stc.loopback_scope, stc.ipv4_scope,
3848 stc.local_scope, stc.site_scope) == 0) {
3849 continue;
3850 }
3851 cnt++;
3852 }
3853 }
3854 if (cnt > 1) {
3855 TAILQ_FOREACH(ifn, &ifnet, if_list) {
3856 struct ifaddr_container *ifac;
3857
3858 if ((stc.loopback_scope == 0) &&
3859 (ifn->if_type == IFT_LOOP)) {
3860 /*
3861 * Skip loopback devices if
3862 * loopback_scope not set
3863 */
3864 continue;
3865 }
3866 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
3867 struct ifaddr *ifa = ifac->ifa;
3868
3869 if (sctp_is_address_in_scope(ifa,
3870 stc.ipv4_addr_legal,
3871 stc.ipv6_addr_legal,
3872 stc.loopback_scope, stc.ipv4_scope,
3873 stc.local_scope, stc.site_scope) == 0) {
3874 continue;
3875 }
3876 m_at = sctp_add_addr_to_mbuf(m_at, ifa);
3877 }
3878 }
3879 }
3880 } else {
3881 struct sctp_laddr *laddr;
3882 int cnt;
3883 cnt = cnt_inits_to;
3884 /* First, how many ? */
3885 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
3886 if (laddr->ifa == NULL) {
3887 continue;
3888 }
3889 if (laddr->ifa->ifa_addr == NULL)
3890 continue;
3891 if (sctp_is_address_in_scope(laddr->ifa,
3892 stc.ipv4_addr_legal, stc.ipv6_addr_legal,
3893 stc.loopback_scope, stc.ipv4_scope,
3894 stc.local_scope, stc.site_scope) == 0) {
3895 continue;
3896 }
3897 cnt++;
3898 }
3899 /* If we bind a single address only we won't list
3900 * any. This way you can get through a NAT
3901 */
3902 if (cnt > 1) {
3903 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
3904 if (laddr->ifa == NULL) {
3905 #ifdef SCTP_DEBUG
3906 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
3907 kprintf("Help I have fallen and I can't get up!\n");
3908 }
3909 #endif
3910 continue;
3911 }
3912 if (laddr->ifa->ifa_addr == NULL)
3913 continue;
3914 if (sctp_is_address_in_scope(laddr->ifa,
3915 stc.ipv4_addr_legal, stc.ipv6_addr_legal,
3916 stc.loopback_scope, stc.ipv4_scope,
3917 stc.local_scope, stc.site_scope) == 0) {
3918 continue;
3919 }
3920 m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa);
3921 }
3922 }
3923 }
3924
3925 /* tack on the operational error if present */
3926 if (op_err) {
3927 if (op_err->m_pkthdr.len % 4) {
3928 /* must add a pad to the param */
3929 u_int32_t cpthis=0;
3930 int padlen;
3931 padlen = 4 - (op_err->m_pkthdr.len % 4);
3932 m_copyback(op_err, op_err->m_pkthdr.len, padlen, (caddr_t)&cpthis);
3933 }
3934 while (m_at->m_next != NULL) {
3935 m_at = m_at->m_next;
3936 }
3937 m_at->m_next = op_err;
3938 while (m_at->m_next != NULL) {
3939 m_at = m_at->m_next;
3940 }
3941 }
3942 /* Get total size of init packet */
3943 sz_of = SCTP_SIZE32(ntohs(init_chk->ch.chunk_length));
3944 /* pre-calulate the size and update pkt header and chunk header */
3945 m->m_pkthdr.len = 0;
3946 for (m_tmp = m; m_tmp; m_tmp = m_tmp->m_next) {
3947 m->m_pkthdr.len += m_tmp->m_len;
3948 if (m_tmp->m_next == NULL) {
3949 /* m_tmp should now point to last one */
3950 break;
3951 }
3952 }
3953 /*
3954 * Figure now the size of the cookie. We know the size of the
3955 * INIT-ACK. The Cookie is going to be the size of INIT, INIT-ACK,
3956 * COOKIE-STRUCTURE and SIGNATURE.
3957 */
3958
3959 /*
3960 * take our earlier INIT calc and add in the sz we just calculated
3961 * minus the size of the sctphdr (its not included in chunk size
3962 */
3963
3964 /* add once for the INIT-ACK */
3965 sz_of += (m->m_pkthdr.len - sizeof(struct sctphdr));
3966
3967 /* add a second time for the INIT-ACK in the cookie */
3968 sz_of += (m->m_pkthdr.len - sizeof(struct sctphdr));
3969
3970 /* Now add the cookie header and cookie message struct */
3971 sz_of += sizeof(struct sctp_state_cookie_param);
3972 /* ...and add the size of our signature */
3973 sz_of += SCTP_SIGNATURE_SIZE;
3974 initackm_out->msg.ch.chunk_length = htons(sz_of);
3975
3976 /* Now we must build a cookie */
3977 m_cookie = sctp_add_cookie(inp, init_pkt, offset, m,
3978 sizeof(struct sctphdr), &stc);
3979 if (m_cookie == NULL) {
3980 /* memory problem */
3981 sctp_m_freem(m);
3982 return;
3983 }
3984 /* Now append the cookie to the end and update the space/size */
3985 m_tmp->m_next = m_cookie;
3986
3987 /*
3988 * We pass 0 here to NOT set IP_DF if its IPv4, we ignore the
3989 * return here since the timer will drive a retranmission.
3990 */
3991 padval = m->m_pkthdr.len % 4;
3992 if ((padval) && (m_last)) {
3993 /* see my previous comments on m_last */
3994 int ret;
3995 ret = sctp_add_pad_tombuf(m_last, (4-padval));
3996 if (ret) {
3997 /* Houston we have a problem, no space */
3998 sctp_m_freem(m);
3999 return;
4000 }
4001 m->m_pkthdr.len += padval;
4002 }
4003 sctp_lowlevel_chunk_output(inp, NULL, NULL, to, m, 0, 0, NULL, 0);
4004 }
4005
4006
4007 static void
4008 sctp_insert_on_wheel(struct sctp_association *asoc,
4009 struct sctp_stream_out *strq)
4010 {
4011 struct sctp_stream_out *stre, *strn;
4012 stre = TAILQ_FIRST(&asoc->out_wheel);
4013 if (stre == NULL) {
4014 /* only one on wheel */
4015 TAILQ_INSERT_HEAD(&asoc->out_wheel, strq, next_spoke);
4016 return;
4017 }
4018 for (; stre; stre = strn) {
4019 strn = TAILQ_NEXT(stre, next_spoke);
4020 if (stre->stream_no > strq->stream_no) {
4021 TAILQ_INSERT_BEFORE(stre, strq, next_spoke);
4022 return;
4023 } else if (stre->stream_no == strq->stream_no) {
4024 /* huh, should not happen */
4025 return;
4026 } else if (strn == NULL) {
4027 /* next one is null */
4028 TAILQ_INSERT_AFTER(&asoc->out_wheel, stre, strq,
4029 next_spoke);
4030 }
4031 }
4032 }
4033
4034 static void
4035 sctp_remove_from_wheel(struct sctp_association *asoc,
4036 struct sctp_stream_out *strq)
4037 {
4038 /* take off and then setup so we know it is not on the wheel */
4039 TAILQ_REMOVE(&asoc->out_wheel, strq, next_spoke);
4040 strq->next_spoke.tqe_next = NULL;
4041 strq->next_spoke.tqe_prev = NULL;
4042 }
4043
4044
4045 static void
4046 sctp_prune_prsctp(struct sctp_tcb *stcb,
4047 struct sctp_association *asoc,
4048 struct sctp_sndrcvinfo *srcv,
4049 int dataout
4050 )
4051 {
4052 int freed_spc=0;
4053 struct sctp_tmit_chunk *chk, *nchk;
4054 if ((asoc->peer_supports_prsctp) && (asoc->sent_queue_cnt_removeable > 0)) {
4055 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
4056 /*
4057 * Look for chunks marked with the PR_SCTP
4058 * flag AND the buffer space flag. If the one
4059 * being sent is equal or greater priority then
4060 * purge the old one and free some space.
4061 */
4062 if ((chk->flags & (SCTP_PR_SCTP_ENABLED |
4063 SCTP_PR_SCTP_BUFFER)) ==
4064 (SCTP_PR_SCTP_ENABLED|SCTP_PR_SCTP_BUFFER)) {
4065 /*
4066 * This one is PR-SCTP AND buffer space
4067 * limited type
4068 */
4069 if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) {
4070 /* Lower numbers equates to
4071 * higher priority so if the
4072 * one we are looking at has a
4073 * larger or equal priority we
4074 * want to drop the data and
4075 * NOT retransmit it.
4076 */
4077 if (chk->data) {
4078 /* We release the
4079 * book_size if the
4080 * mbuf is here
4081 */
4082 int ret_spc;
4083 int cause;
4084 if (chk->sent > SCTP_DATAGRAM_UNSENT)
4085 cause = SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_SENT;
4086 else
4087 cause = SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_UNSENT;
4088 ret_spc = sctp_release_pr_sctp_chunk(stcb, chk,
4089 cause,
4090 &asoc->sent_queue);
4091 freed_spc += ret_spc;
4092 if (freed_spc >= dataout) {
4093 return;
4094 }
4095 } /* if chunk was present */
4096 } /* if of sufficent priority */
4097 } /* if chunk has enabled */
4098 } /* tailqforeach */
4099
4100 chk = TAILQ_FIRST(&asoc->send_queue);
4101 while (chk) {
4102 nchk = TAILQ_NEXT(chk, sctp_next);
4103 /* Here we must move to the sent queue and mark */
4104 if ((chk->flags & (SCTP_PR_SCTP_ENABLED |
4105 SCTP_PR_SCTP_BUFFER)) ==
4106 (SCTP_PR_SCTP_ENABLED|SCTP_PR_SCTP_BUFFER)) {
4107 if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) {
4108 if (chk->data) {
4109 /* We release the
4110 * book_size if the
4111 * mbuf is here
4112 */
4113 int ret_spc;
4114 ret_spc = sctp_release_pr_sctp_chunk(stcb, chk,
4115 SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_UNSENT,
4116 &asoc->send_queue);
4117
4118 freed_spc += ret_spc;
4119 if (freed_spc >= dataout) {
4120 return;
4121 }
4122 } /* end if chk->data */
4123 } /* end if right class */
4124 } /* end if chk pr-sctp */
4125 chk = nchk;
4126 } /* end while (chk) */
4127 } /* if enabled in asoc */
4128 }
4129
4130 static void
4131 sctp_prepare_chunk(struct sctp_tmit_chunk *template,
4132 struct sctp_tcb *stcb,
4133 struct sctp_sndrcvinfo *srcv,
4134 struct sctp_stream_out *strq,
4135 struct sctp_nets *net)
4136 {
4137 bzero(template, sizeof(struct sctp_tmit_chunk));
4138 template->sent = SCTP_DATAGRAM_UNSENT;
4139 if ((stcb->asoc.peer_supports_prsctp) &&
4140 (srcv->sinfo_flags & (MSG_PR_SCTP_TTL|MSG_PR_SCTP_BUF)) &&
4141 (srcv->sinfo_timetolive > 0)
4142 ) {
4143 /* If:
4144 * Peer supports PR-SCTP
4145 * The flags is set against this send for PR-SCTP
4146 * And timetolive is a postive value, zero is reserved
4147 * to mean a reliable send for both buffer/time
4148 * related one.
4149 */
4150 if (srcv->sinfo_flags & MSG_PR_SCTP_BUF) {
4151 /*
4152 * Time to live is a priority stored in tv_sec
4153 * when doing the buffer drop thing.
4154 */
4155 template->rec.data.timetodrop.tv_sec = srcv->sinfo_timetolive;
4156 } else {
4157 struct timeval tv;
4158
4159 SCTP_GETTIME_TIMEVAL(&template->rec.data.timetodrop);
4160 tv.tv_sec = srcv->sinfo_timetolive / 1000;
4161 tv.tv_usec = (srcv->sinfo_timetolive * 1000) % 1000000;
4162 #ifndef __FreeBSD__
4163 timeradd(&template->rec.data.timetodrop, &tv,
4164 &template->rec.data.timetodrop);
4165 #else
4166 timevaladd(&template->rec.data.timetodrop, &tv);
4167 #endif
4168 }
4169 }
4170 if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
4171 template->rec.data.stream_seq = strq->next_sequence_sent;
4172 } else {
4173 template->rec.data.stream_seq = 0;
4174 }
4175 template->rec.data.TSN_seq = 0; /* not yet assigned */
4176
4177 template->rec.data.stream_number = srcv->sinfo_stream;
4178 template->rec.data.payloadtype = srcv->sinfo_ppid;
4179 template->rec.data.context = srcv->sinfo_context;
4180 template->rec.data.doing_fast_retransmit = 0;
4181 template->rec.data.ect_nonce = 0; /* ECN Nonce */
4182
4183 if (srcv->sinfo_flags & MSG_ADDR_OVER) {
4184 template->whoTo = net;
4185 } else {
4186 if (stcb->asoc.primary_destination)
4187 template->whoTo = stcb->asoc.primary_destination;
4188 else {
4189 /* TSNH */
4190 template->whoTo = net;
4191 }
4192 }
4193 /* the actual chunk flags */
4194 if (srcv->sinfo_flags & MSG_UNORDERED) {
4195 template->rec.data.rcv_flags = SCTP_DATA_UNORDERED;
4196 } else {
4197 template->rec.data.rcv_flags = 0;
4198 }
4199 /* no flags yet, FRAGMENT_OK goes here */
4200 template->flags = 0;
4201 /* PR sctp flags */
4202 if (stcb->asoc.peer_supports_prsctp) {
4203 if (srcv->sinfo_timetolive > 0) {
4204 /*
4205 * We only set the flag if timetolive (or
4206 * priority) was set to a positive number.
4207 * Zero is reserved specifically to be
4208 * EXCLUDED and sent reliable.
4209 */
4210 if (srcv->sinfo_flags & MSG_PR_SCTP_TTL) {
4211 template->flags |= SCTP_PR_SCTP_ENABLED;
4212 }
4213 if (srcv->sinfo_flags & MSG_PR_SCTP_BUF) {
4214 template->flags |= SCTP_PR_SCTP_BUFFER;
4215 }
4216 }
4217 }
4218 template->asoc = &stcb->asoc;
4219 }
4220
4221
4222 int
4223 sctp_get_frag_point(struct sctp_tcb *stcb,
4224 struct sctp_association *asoc)
4225 {
4226 int siz, ovh;
4227
4228 /* For endpoints that have both 6 and 4 addresses
4229 * we must reserver room for the 6 ip header, for
4230 * those that are only dealing with V4 we use
4231 * a larger frag point.
4232 */
4233 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
4234 ovh = SCTP_MED_OVERHEAD;
4235 } else {
4236 ovh = SCTP_MED_V4_OVERHEAD;
4237 }
4238
4239 if (stcb->sctp_ep->sctp_frag_point > asoc->smallest_mtu)
4240 siz = asoc->smallest_mtu - ovh;
4241 else
4242 siz = (stcb->sctp_ep->sctp_frag_point - ovh);
4243 /*
4244 if (siz > (MCLBYTES-sizeof(struct sctp_data_chunk))) { */
4245 /* A data chunk MUST fit in a cluster */
4246 /* siz = (MCLBYTES - sizeof(struct sctp_data_chunk));*/
4247 /* }*/
4248
4249 if (siz % 4) {
4250 /* make it an even word boundary please */
4251 siz -= (siz % 4);
4252 }
4253 return (siz);
4254 }
4255 extern unsigned int sctp_max_chunks_on_queue;
4256
4257 #define SBLOCKWAIT(f) (((f)&MSG_DONTWAIT) ? M_NOWAIT : M_WAITOK)
4258
4259 static int
4260 sctp_msg_append(struct sctp_tcb *stcb,
4261 struct sctp_nets *net,
4262 struct mbuf *m,
4263 struct sctp_sndrcvinfo *srcv,
4264 int flags)
4265 {
4266 struct socket *so;
4267 struct sctp_association *asoc;
4268 struct sctp_stream_out *strq;
4269 struct sctp_tmit_chunk *chk;
4270 struct sctpchunk_listhead tmp;
4271 struct sctp_tmit_chunk template;
4272 struct mbuf *n, *mnext;
4273 struct mbuf *mm;
4274 unsigned int dataout, siz;
4275 int mbcnt = 0;
4276 int mbcnt_e = 0;
4277 int error = 0;
4278
4279 if ((stcb == NULL) || (net == NULL) || (m == NULL) || (srcv == NULL)) {
4280 /* Software fault, you blew it on the call */
4281 #ifdef SCTP_DEBUG
4282 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
4283 kprintf("software error in sctp_msg_append:1\n");
4284 kprintf("stcb:%p net:%p m:%p srcv:%p\n",
4285 stcb, net, m, srcv);
4286 }
4287 #endif
4288 if (m)
4289 sctp_m_freem(m);
4290 return (EFAULT);
4291 }
4292 so = stcb->sctp_socket;
4293 asoc = &stcb->asoc;
4294 if (srcv->sinfo_flags & MSG_ABORT) {
4295 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
4296 (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) {
4297 /* It has to be up before we abort */
4298 /* how big is the user initiated abort? */
4299 if ((m->m_flags & M_PKTHDR) && (m->m_pkthdr.len)) {
4300 dataout = m->m_pkthdr.len;
4301 } else {
4302 /* we must count */
4303 dataout = 0;
4304 for (n = m; n; n = n->m_next) {
4305 dataout += n->m_len;
4306 }
4307 }
4308 M_PREPEND(m, sizeof(struct sctp_paramhdr), MB_DONTWAIT);
4309 if (m) {
4310 struct sctp_paramhdr *ph;
4311 m->m_len = sizeof(struct sctp_paramhdr) + dataout;
4312 ph = mtod(m, struct sctp_paramhdr *);
4313 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT);
4314 ph->param_length = htons(m->m_len);
4315 }
4316 sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_RESPONSE_TO_USER_REQ, m);
4317 m = NULL;
4318 } else {
4319 /* Only free if we don't send an abort */
4320 ;
4321 }
4322 goto out;
4323 }
4324 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
4325 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
4326 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
4327 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
4328 /* got data while shutting down */
4329 error = ECONNRESET;
4330 goto out;
4331 }
4332
4333 if (srcv->sinfo_stream >= asoc->streamoutcnt) {
4334 /* Invalid stream number */
4335 error = EINVAL;
4336 goto out;
4337 }
4338 if (asoc->strmout == NULL) {
4339 /* huh? software error */
4340 #ifdef SCTP_DEBUG
4341 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
4342 kprintf("software error in sctp_msg_append:2\n");
4343 }
4344 #endif
4345 error = EFAULT;
4346 goto out;
4347 }
4348 strq = &asoc->strmout[srcv->sinfo_stream];
4349 /* how big is it ? */
4350 if ((m->m_flags & M_PKTHDR) && (m->m_pkthdr.len)) {
4351 dataout = m->m_pkthdr.len;
4352 } else {
4353 /* we must count */
4354 dataout = 0;
4355 for (n = m; n; n = n->m_next) {
4356 dataout += n->m_len;
4357 }
4358 }
4359 #ifdef SCTP_DEBUG
4360 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
4361 kprintf("Attempt to send out %d bytes\n",
4362 dataout);
4363 }
4364 #endif
4365
4366 /* lock the socket buf */
4367 SOCKBUF_LOCK(&so->so_snd);
4368 error = ssb_lock(&so->so_snd, SBLOCKWAIT(flags));
4369 if (error)
4370 goto out_locked;
4371
4372 if (dataout > so->so_snd.ssb_hiwat) {
4373 /* It will NEVER fit */
4374 error = EMSGSIZE;
4375 goto release;
4376 }
4377 if ((srcv->sinfo_flags & MSG_EOF) &&
4378 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE) &&
4379 (dataout == 0)
4380 ) {
4381 goto zap_by_it_all;
4382 }
4383 if ((so->so_snd.ssb_hiwat <
4384 (dataout + asoc->total_output_queue_size)) ||
4385 (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) ||
4386 (asoc->total_output_mbuf_queue_size >
4387 so->so_snd.ssb_mbmax)
4388 ) {
4389 /* XXX Buffer space hunt for data to skip */
4390 if (asoc->peer_supports_prsctp) {
4391 sctp_prune_prsctp(stcb, asoc, srcv, dataout);
4392 }
4393 while ((so->so_snd.ssb_hiwat <
4394 (dataout + asoc->total_output_queue_size)) ||
4395 (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) ||
4396 (asoc->total_output_mbuf_queue_size >
4397 so->so_snd.ssb_mbmax)) {
4398 struct sctp_inpcb *inp;
4399 /* Now did we free up enough room? */
4400 if (flags & (MSG_FNONBLOCKING|MSG_DONTWAIT)) {
4401 /* Non-blocking io in place */
4402 error = EWOULDBLOCK;
4403 goto release;
4404 }
4405 /*
4406 * We store off a pointer to the endpoint.
4407 * Since on return from this we must check to
4408 * see if an so_error is set. If so we may have
4409 * been reset and our stcb destroyed. Returning
4410 * an error will cause the correct error return
4411 * through and fix this all.
4412 */
4413 inp = stcb->sctp_ep;
4414 /*
4415 * Not sure how else to do this since
4416 * the level we suspended at is not
4417 * known deep down where we are. I will
4418 * drop to spl0() so that others can
4419 * get in.
4420 */
4421
4422 inp->sctp_tcb_at_block = (void *)stcb;
4423 inp->error_on_block = 0;
4424 ssb_unlock(&so->so_snd);
4425 error = ssb_wait(&so->so_snd);
4426 /*
4427 * XXX: This is ugly but I have
4428 * recreated most of what goes on to
4429 * block in the sb. UGHH
4430 * May want to add the bit about being
4431 * no longer connected.. but this then
4432 * further dooms the UDP model NOT to
4433 * allow this.
4434 */
4435 inp->sctp_tcb_at_block = 0;
4436 if (inp->error_on_block)
4437 error = inp->error_on_block;
4438 if (so->so_error)
4439 error = so->so_error;
4440 if (error) {
4441 goto out_locked;
4442 }
4443 error = ssb_lock(&so->so_snd, M_WAITOK);
4444 if (error)
4445 goto out_locked;
4446 /* Otherwise we cycle back and recheck
4447 * the space
4448 */
4449 #if defined(__FreeBSD__) && __FreeBSD_version >= 502115
4450 if (so->so_rcv.sb_state & SBS_CANTSENDMORE) {
4451 #else
4452 if (so->so_state & SS_CANTSENDMORE) {
4453 #endif
4454 error = EPIPE;
4455 goto release;
4456 }
4457 if (so->so_error) {
4458 error = so->so_error;
4459 goto release;
4460 }
4461 }
4462 }
4463 /* If we have a packet header fix it if it was broke */
4464 if (m->m_flags & M_PKTHDR) {
4465 m->m_pkthdr.len = dataout;
4466 }
4467 /* use the smallest one, user set value or
4468 * smallest mtu of the asoc
4469 */
4470 siz = sctp_get_frag_point(stcb, asoc);
4471 SOCKBUF_UNLOCK(&so->so_snd);
4472 if ((dataout) && (dataout <= siz)) {
4473 /* Fast path */
4474 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
4475 if (chk == NULL) {
4476 error = ENOMEM;
4477 SOCKBUF_LOCK(&so->so_snd);
4478 goto release;
4479 }
4480 sctp_prepare_chunk(chk, stcb, srcv, strq, net);
4481 chk->whoTo->ref_count++;
4482 chk->rec.data.rcv_flags |= SCTP_DATA_NOT_FRAG;
4483
4484 /* no flags yet, FRAGMENT_OK goes here */
4485 sctppcbinfo.ipi_count_chunk++;
4486 sctppcbinfo.ipi_gencnt_chunk++;
4487 asoc->chunks_on_out_queue++;
4488 chk->data = m;
4489 m = NULL;
4490 /* Total in the MSIZE */
4491 for (mm = chk->data; mm; mm = mm->m_next) {
4492 mbcnt += MSIZE;
4493 if (mm->m_flags & M_EXT) {
4494 mbcnt += chk->data->m_ext.ext_size;
4495 }
4496 }
4497 /* fix up the send_size if it is not present */
4498 chk->send_size = dataout;
4499 chk->book_size = chk->send_size;
4500 chk->mbcnt = mbcnt;
4501 /* ok, we are commited */
4502 if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
4503 /* bump the ssn if we are unordered. */
4504 strq->next_sequence_sent++;
4505 }
4506 chk->data->m_nextpkt = 0;
4507 asoc->stream_queue_cnt++;
4508 TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
4509 /* now check if this stream is on the wheel */
4510 if ((strq->next_spoke.tqe_next == NULL) &&
4511 (strq->next_spoke.tqe_prev == NULL)) {
4512 /* Insert it on the wheel since it is not
4513 * on it currently
4514 */
4515 sctp_insert_on_wheel(asoc, strq);
4516 }
4517 } else if ((dataout) && (dataout > siz)) {
4518 /* Slow path */
4519 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NO_FRAGMENT) &&
4520 (dataout > siz)) {
4521 error = EMSGSIZE;
4522 SOCKBUF_LOCK(&so->so_snd);
4523 goto release;
4524 }
4525 /* setup the template */
4526 sctp_prepare_chunk(&template, stcb, srcv, strq, net);
4527
4528 n = m;
4529 while (dataout > siz) {
4530 /*
4531 * We can wait since this is called from the user
4532 * send side
4533 */
4534 n->m_nextpkt = m_split(n, siz, MB_WAIT);
4535 if (n->m_nextpkt == NULL) {
4536 error = EFAULT;
4537 SOCKBUF_LOCK(&so->so_snd);
4538 goto release;
4539 }
4540 dataout -= siz;
4541 n = n->m_nextpkt;
4542 }
4543 /*
4544 * ok, now we have a chain on m where m->m_nextpkt points to
4545 * the next chunk and m/m->m_next chain is the piece to send.
4546 * We must go through the chains and thread them on to
4547 * sctp_tmit_chunk chains and place them all on the stream
4548 * queue, breaking the m->m_nextpkt pointers as we go.
4549 */
4550 n = m;
4551 TAILQ_INIT(&tmp);
4552 while (n) {
4553 /*
4554 * first go through and allocate a sctp_tmit chunk
4555 * for each chunk piece
4556 */
4557 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
4558 if (chk == NULL) {
4559 /*
4560 * ok we must spin through and dump anything
4561 * we have allocated and then jump to the
4562 * no_membad
4563 */
4564 chk = TAILQ_FIRST(&tmp);
4565 while (chk) {
4566 TAILQ_REMOVE(&tmp, chk, sctp_next);
4567 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
4568 sctppcbinfo.ipi_count_chunk--;
4569 asoc->chunks_on_out_queue--;
4570 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
4571 panic("Chunk count is negative");
4572 }
4573 sctppcbinfo.ipi_gencnt_chunk++;
4574 chk = TAILQ_FIRST(&tmp);
4575 }
4576 error = ENOMEM;
4577 SOCKBUF_LOCK(&so->so_snd);
4578 goto release;
4579 }
4580 sctppcbinfo.ipi_count_chunk++;
4581 asoc->chunks_on_out_queue++;
4582
4583 sctppcbinfo.ipi_gencnt_chunk++;
4584 *chk = template;
4585 chk->whoTo->ref_count++;
4586 chk->data = n;
4587 /* Total in the MSIZE */
4588 mbcnt_e = 0;
4589 for (mm = chk->data; mm; mm = mm->m_next) {
4590 mbcnt_e += MSIZE;
4591 if (mm->m_flags & M_EXT) {
4592 mbcnt_e += chk->data->m_ext.ext_size;
4593 }
4594 }
4595 /* now fix the chk->send_size */
4596 if (chk->data->m_flags & M_PKTHDR) {
4597 chk->send_size = chk->data->m_pkthdr.len;
4598 } else {
4599 struct mbuf *nn;
4600 chk->send_size = 0;
4601 for (nn = chk->data; nn; nn = nn->m_next) {
4602 chk->send_size += nn->m_len;
4603 }
4604 }
4605 chk->book_size = chk->send_size;
4606 chk->mbcnt = mbcnt_e;
4607 mbcnt += mbcnt_e;
4608 if (chk->flags & SCTP_PR_SCTP_BUFFER) {
4609 asoc->sent_queue_cnt_removeable++;
4610 }
4611 n = n->m_nextpkt;
4612 TAILQ_INSERT_TAIL(&tmp, chk, sctp_next);
4613 }
4614 m = NULL;
4615 /* now that we have enough space for all de-couple the
4616 * chain of mbufs by going through our temp array
4617 * and breaking the pointers.
4618 */
4619 /* ok, we are commited */
4620 if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
4621 /* bump the ssn if we are unordered. */
4622 strq->next_sequence_sent++;
4623 }
4624 /* Mark the first/last flags. This will
4625 * result int a 3 for a single item on the list
4626 */
4627 chk = TAILQ_FIRST(&tmp);
4628 chk->rec.data.rcv_flags |= SCTP_DATA_FIRST_FRAG;
4629 chk = TAILQ_LAST(&tmp, sctpchunk_listhead);
4630 chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
4631 /* now break any chains on the queue and
4632 * move it to the streams actual queue.
4633 */
4634 chk = TAILQ_FIRST(&tmp);
4635 while (chk) {
4636 chk->data->m_nextpkt = 0;
4637 TAILQ_REMOVE(&tmp, chk, sctp_next);
4638 asoc->stream_queue_cnt++;
4639 TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
4640 chk = TAILQ_FIRST(&tmp);
4641 }
4642 /* now check if this stream is on the wheel */
4643 if ((strq->next_spoke.tqe_next == NULL) &&
4644 (strq->next_spoke.tqe_prev == NULL)) {
4645 /* Insert it on the wheel since it is not
4646 * on it currently
4647 */
4648 sctp_insert_on_wheel(asoc, strq);
4649 }
4650 }
4651 SOCKBUF_LOCK(&so->so_snd);
4652 /* has a SHUTDOWN been (also) requested by the user on this asoc? */
4653 zap_by_it_all:
4654
4655 if ((srcv->sinfo_flags & MSG_EOF) &&
4656 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)) {
4657
4658 int some_on_streamwheel = 0;
4659
4660 if (!TAILQ_EMPTY(&asoc->out_wheel)) {
4661 /* Check to see if some data queued */
4662 struct sctp_stream_out *outs;
4663 TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) {
4664 if (!TAILQ_EMPTY(&outs->outqueue)) {
4665 some_on_streamwheel = 1;
4666 break;
4667 }
4668 }
4669 }
4670
4671 if (TAILQ_EMPTY(&asoc->send_queue) &&
4672 TAILQ_EMPTY(&asoc->sent_queue) &&
4673 (some_on_streamwheel == 0)) {
4674 /* there is nothing queued to send, so I'm done... */
4675 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
4676 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
4677 /* only send SHUTDOWN the first time through */
4678 #ifdef SCTP_DEBUG
4679 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
4680 kprintf("%s:%d sends a shutdown\n",
4681 __FILE__,
4682 __LINE__
4683 );
4684 }
4685 #endif
4686 sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
4687 asoc->state = SCTP_STATE_SHUTDOWN_SENT;
4688 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
4689 asoc->primary_destination);
4690 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb,
4691 asoc->primary_destination);
4692 }
4693 } else {
4694 /*
4695 * we still got (or just got) data to send, so set
4696 * SHUTDOWN_PENDING
4697 */
4698 /*
4699 * XXX sockets draft says that MSG_EOF should be sent
4700 * with no data. currently, we will allow user data
4701 * to be sent first and move to SHUTDOWN-PENDING
4702 */
4703 asoc->state |= SCTP_STATE_SHUTDOWN_PENDING;
4704 }
4705 }
4706 #ifdef SCTP_MBCNT_LOGGING
4707 sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE,
4708 asoc->total_output_queue_size,
4709 dataout,
4710 asoc->total_output_mbuf_queue_size,
4711 mbcnt);
4712 #endif
4713 asoc->total_output_queue_size += dataout;
4714 asoc->total_output_mbuf_queue_size += mbcnt;
4715 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
4716 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
4717 so->so_snd.ssb_cc += dataout;
4718 so->so_snd.ssb_mbcnt += mbcnt;
4719 }
4720
4721 #ifdef SCTP_DEBUG
4722 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
4723 kprintf("++total out:%d total_mbuf_out:%d\n",
4724 (int)asoc->total_output_queue_size,
4725 (int)asoc->total_output_mbuf_queue_size);
4726 }
4727 #endif
4728
4729 release:
4730 ssb_unlock(&so->so_snd);
4731 out_locked:
4732 SOCKBUF_UNLOCK(&so->so_snd);
4733 out:
4734 if (m && m->m_nextpkt) {
4735 n = m;
4736 while (n) {
4737 mnext = n->m_nextpkt;
4738 n->m_nextpkt = NULL;
4739 sctp_m_freem(n);
4740 n = mnext;
4741 }
4742 } else if (m)
4743 sctp_m_freem(m);
4744
4745 return (error);
4746 }
4747
4748 static struct mbuf *
4749 sctp_copy_mbufchain(struct mbuf *clonechain,
4750 struct mbuf *outchain)
4751 {
4752 struct mbuf *appendchain;
4753 #if defined(__FreeBSD__) || defined(__NetBSD__)
4754 /* Supposedly m_copypacket is an optimization, use it if we can */
4755 if (clonechain->m_flags & M_PKTHDR) {
4756 appendchain = m_copypacket(clonechain, MB_DONTWAIT);
4757 sctp_pegs[SCTP_CACHED_SRC]++;
4758 } else
4759 appendchain = m_copy(clonechain, 0, M_COPYALL);
4760 #elif defined(__APPLE__)
4761 appendchain = sctp_m_copym(clonechain, 0, M_COPYALL, MB_DONTWAIT);
4762 #else
4763 appendchain = m_copy(clonechain, 0, M_COPYALL);
4764 #endif
4765
4766 if (appendchain == NULL) {
4767 /* error */
4768 if (outchain)
4769 sctp_m_freem(outchain);
4770 return (NULL);
4771 }
4772 if (outchain) {
4773 /* tack on to the end */
4774 struct mbuf *m;
4775 m = outchain;
4776 while (m) {
4777 if (m->m_next == NULL) {
4778 m->m_next = appendchain;
4779 break;
4780 }
4781 m = m->m_next;
4782 }
4783 if (outchain->m_flags & M_PKTHDR) {
4784 int append_tot;
4785 struct mbuf *t;
4786 t = appendchain;
4787 append_tot = 0;
4788 while (t) {
4789 append_tot += t->m_len;
4790 t = t->m_next;
4791 }
4792 outchain->m_pkthdr.len += append_tot;
4793 }
4794 return (outchain);
4795 } else {
4796 return (appendchain);
4797 }
4798 }
4799
4800 static void
4801 sctp_sendall_iterator(struct sctp_inpcb *inp, struct sctp_tcb *stcb, void *ptr, u_int32_t val)
4802 {
4803 struct sctp_copy_all *ca;
4804 struct mbuf *m;
4805 int ret;
4806
4807 ca = (struct sctp_copy_all *)ptr;
4808 if (ca->m == NULL) {
4809 return;
4810 }
4811 if (ca->inp != inp) {
4812 /* TSNH */
4813 return;
4814 }
4815 m = sctp_copy_mbufchain(ca->m, NULL);
4816 if (m == NULL) {
4817 /* can't copy so we are done */
4818 ca->cnt_failed++;
4819 return;
4820 }
4821 ret = sctp_msg_append(stcb, stcb->asoc.primary_destination, m,
4822 &ca->sndrcv, MSG_FNONBLOCKING);
4823 if (ret) {
4824 ca->cnt_failed++;
4825 } else {
4826 ca->cnt_sent++;
4827 }
4828 }
4829
4830 static void
4831 sctp_sendall_completes(void *ptr, u_int32_t val)
4832 {
4833 struct sctp_copy_all *ca;
4834 ca = (struct sctp_copy_all *)ptr;
4835 /* Do a notify here?
4836 * Kacheong suggests that the notify
4837 * be done at the send time.. so you would
4838 * push up a notification if any send failed.
4839 * Don't know if this is feasable since the
4840 * only failures we have is "memory" related and
4841 * if you cannot get an mbuf to send the data
4842 * you surely can't get an mbuf to send up
4843 * to notify the user you can't send the data :->
4844 */
4845
4846 /* now free everything */
4847 m_freem(ca->m);
4848 FREE(ca, M_PCB);
4849 }
4850
4851
4852 #define MC_ALIGN(m, len) do { \
4853 (m)->m_data += (MCLBYTES - (len)) & ~(sizeof(long) - 1); \
4854 } while (0)
4855
4856
4857
4858 static struct mbuf *
4859 sctp_copy_out_all(struct uio *uio, int len)
4860 {
4861 struct mbuf *ret, *at;
4862 int left, willcpy, cancpy, error;
4863
4864 MGETHDR(ret, MB_WAIT, MT_HEADER);
4865 if (ret == NULL) {
4866 /* TSNH */
4867 return (NULL);
4868 }
4869 left = len;
4870 ret->m_len = 0;
4871 ret->m_pkthdr.len = len;
4872 MCLGET(ret, MB_WAIT);
4873 if (ret == NULL) {
4874 return (NULL);
4875 }
4876 if ((ret->m_flags & M_EXT) == 0) {
4877 m_freem (ret);
4878 return (NULL);
4879 }
4880 cancpy = M_TRAILINGSPACE(ret);
4881 willcpy = min(cancpy, left);
4882 at = ret;
4883 while (left > 0) {
4884 /* Align data to the end */
4885 MC_ALIGN(at, willcpy);
4886 error = uiomove(mtod(at, caddr_t), willcpy, uio);
4887 if (error) {
4888 err_out_now:
4889 m_freem(ret);
4890 return (NULL);
4891 }
4892 at->m_len = willcpy;
4893 at->m_nextpkt = at->m_next = 0;
4894 left -= willcpy;
4895 if (left > 0) {
4896 MGET(at->m_next, MB_WAIT, MT_DATA);
4897 if (at->m_next == NULL) {
4898 goto err_out_now;
4899 }
4900 at = at->m_next;
4901 at->m_len = 0;
4902 MCLGET(at, MB_WAIT);
4903 if (at == NULL) {
4904 goto err_out_now;
4905 }
4906 if ((at->m_flags & M_EXT) == 0) {
4907 goto err_out_now;
4908 }
4909 cancpy = M_TRAILINGSPACE(at);
4910 willcpy = min(cancpy, left);
4911 }
4912 }
4913 return (ret);
4914 }
4915
4916 static int
4917 sctp_sendall (struct sctp_inpcb *inp, struct uio *uio, struct mbuf *m, struct sctp_sndrcvinfo *srcv)
4918 {
4919 int ret;
4920 struct sctp_copy_all *ca;
4921 MALLOC(ca, struct sctp_copy_all *,
4922 sizeof(struct sctp_copy_all), M_PCB, MB_WAIT);
4923 if (ca == NULL) {
4924 m_freem(m);
4925 return (ENOMEM);
4926 }
4927 memset (ca, 0, sizeof(struct sctp_copy_all));
4928
4929 ca->inp = inp;
4930 ca->sndrcv = *srcv;
4931 /* take off the sendall flag, it would
4932 * be bad if we failed to do this :-0
4933 */
4934 ca->sndrcv.sinfo_flags &= ~MSG_SENDALL;
4935
4936 /* get length and mbuf chain */
4937 if (uio) {
4938 ca->sndlen = uio->uio_resid;
4939 ca->m = sctp_copy_out_all(uio, ca->sndlen);
4940 if (ca->m == NULL) {
4941 FREE(ca, M_PCB);
4942 return (ENOMEM);
4943 }
4944 } else {
4945 if ((m->m_flags & M_PKTHDR) == 0) {
4946 struct mbuf *mat;
4947 mat = m;
4948 ca->sndlen = 0;
4949 while(m) {
4950 ca->sndlen += m->m_len;
4951 m = m->m_next;
4952 }
4953 } else {
4954 ca->sndlen = m->m_pkthdr.len;
4955 }
4956 ca->m = m;
4957 }
4958
4959 ret = sctp_initiate_iterator(sctp_sendall_iterator, SCTP_PCB_ANY_FLAGS, SCTP_ASOC_ANY_STATE,
4960 (void *)ca, 0, sctp_sendall_completes, inp);
4961 if (ret) {
4962 #ifdef SCTP_DEBUG
4963 kprintf("Failed to initate iterator to takeover associations\n");
4964 #endif
4965 FREE(ca, M_PCB);
4966 return (EFAULT);
4967
4968 }
4969 return (0);
4970 }
4971
4972
4973 void
4974 sctp_toss_old_cookies(struct sctp_association *asoc)
4975 {
4976 struct sctp_tmit_chunk *chk, *nchk;
4977 chk = TAILQ_FIRST(&asoc->control_send_queue);
4978 while (chk) {
4979 nchk = TAILQ_NEXT(chk, sctp_next);
4980 if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) {
4981 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
4982 if (chk->data) {
4983 sctp_m_freem(chk->data);
4984 chk->data = NULL;
4985 }
4986 asoc->ctrl_queue_cnt--;
4987 if (chk->whoTo)
4988 sctp_free_remote_addr(chk->whoTo);
4989 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
4990 sctppcbinfo.ipi_count_chunk--;
4991 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
4992 panic("Chunk count is negative");
4993 }
4994 sctppcbinfo.ipi_gencnt_chunk++;
4995 }
4996 chk = nchk;
4997 }
4998 }
4999
5000 void
5001 sctp_toss_old_asconf(struct sctp_tcb *stcb)
5002 {
5003 struct sctp_association *asoc;
5004 struct sctp_tmit_chunk *chk, *chk_tmp;
5005
5006 asoc = &stcb->asoc;
5007 for (chk = TAILQ_FIRST(&asoc->control_send_queue); chk != NULL;
5008 chk = chk_tmp) {
5009 /* get next chk */
5010 chk_tmp = TAILQ_NEXT(chk, sctp_next);
5011 /* find SCTP_ASCONF chunk in queue (only one ever in queue) */
5012 if (chk->rec.chunk_id == SCTP_ASCONF) {
5013 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
5014 if (chk->data) {
5015 sctp_m_freem(chk->data);
5016 chk->data = NULL;
5017 }
5018 asoc->ctrl_queue_cnt--;
5019 if (chk->whoTo)
5020 sctp_free_remote_addr(chk->whoTo);
5021 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
5022 sctppcbinfo.ipi_count_chunk--;
5023 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
5024 panic("Chunk count is negative");
5025 }
5026 sctppcbinfo.ipi_gencnt_chunk++;
5027 }
5028 }
5029 }
5030
5031
5032 static void
5033 sctp_clean_up_datalist(struct sctp_tcb *stcb,
5034 struct sctp_association *asoc,
5035 struct sctp_tmit_chunk **data_list,
5036 int bundle_at,
5037 struct sctp_nets *net)
5038 {
5039 int i;
5040 for (i = 0; i < bundle_at; i++) {
5041 /* off of the send queue */
5042 if (i) {
5043 /* Any chunk NOT 0 you zap the time
5044 * chunk 0 gets zapped or set based on
5045 * if a RTO measurment is needed.
5046 */
5047 data_list[i]->do_rtt = 0;
5048 }
5049 /* record time */
5050 data_list[i]->sent_rcv_time = net->last_sent_time;
5051 TAILQ_REMOVE(&asoc->send_queue,
5052 data_list[i],
5053 sctp_next);
5054 /* on to the sent queue */
5055 TAILQ_INSERT_TAIL(&asoc->sent_queue,
5056 data_list[i],
5057 sctp_next);
5058 /* This does not lower until the cum-ack passes it */
5059 asoc->sent_queue_cnt++;
5060 asoc->send_queue_cnt--;
5061 if ((asoc->peers_rwnd <= 0) &&
5062 (asoc->total_flight == 0) &&
5063 (bundle_at == 1)) {
5064 /* Mark the chunk as being a window probe */
5065 #ifdef SCTP_DEBUG
5066 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
5067 kprintf("WINDOW PROBE SET\n");
5068 }
5069 #endif
5070 sctp_pegs[SCTP_WINDOW_PROBES]++;
5071 data_list[i]->rec.data.state_flags |= SCTP_WINDOW_PROBE;
5072 } else {
5073 data_list[i]->rec.data.state_flags &= ~SCTP_WINDOW_PROBE;
5074 }
5075 #ifdef SCTP_AUDITING_ENABLED
5076 sctp_audit_log(0xC2, 3);
5077 #endif
5078 data_list[i]->sent = SCTP_DATAGRAM_SENT;
5079 data_list[i]->snd_count = 1;
5080 net->flight_size += data_list[i]->book_size;
5081 asoc->total_flight += data_list[i]->book_size;
5082 asoc->total_flight_count++;
5083 #ifdef SCTP_LOG_RWND
5084 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND,
5085 asoc->peers_rwnd , data_list[i]->send_size, sctp_peer_chunk_oh);
5086 #endif
5087 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd,
5088 (u_int32_t)(data_list[i]->send_size + sctp_peer_chunk_oh));
5089 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
5090 /* SWS sender side engages */
5091 asoc->peers_rwnd = 0;
5092 }
5093 }
5094 }
5095
5096 static void
5097 sctp_clean_up_ctl(struct sctp_association *asoc)
5098 {
5099 struct sctp_tmit_chunk *chk, *nchk;
5100 for (chk = TAILQ_FIRST(&asoc->control_send_queue);
5101 chk; chk = nchk) {
5102 nchk = TAILQ_NEXT(chk, sctp_next);
5103 if ((chk->rec.chunk_id == SCTP_SELECTIVE_ACK) ||
5104 (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST) ||
5105 (chk->rec.chunk_id == SCTP_HEARTBEAT_ACK) ||
5106 (chk->rec.chunk_id == SCTP_SHUTDOWN) ||
5107 (chk->rec.chunk_id == SCTP_SHUTDOWN_ACK) ||
5108 (chk->rec.chunk_id == SCTP_OPERATION_ERROR) ||
5109 (chk->rec.chunk_id == SCTP_PACKET_DROPPED) ||
5110 (chk->rec.chunk_id == SCTP_COOKIE_ACK) ||
5111 (chk->rec.chunk_id == SCTP_ECN_CWR) ||
5112 (chk->rec.chunk_id == SCTP_ASCONF_ACK)) {
5113 /* Stray chunks must be cleaned up */
5114 clean_up_anyway:
5115 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
5116 if (chk->data) {
5117 sctp_m_freem(chk->data);
5118 chk->data = NULL;
5119 }
5120 asoc->ctrl_queue_cnt--;
5121 sctp_free_remote_addr(chk->whoTo);
5122 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
5123 sctppcbinfo.ipi_count_chunk--;
5124 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
5125 panic("Chunk count is negative");
5126 }
5127 sctppcbinfo.ipi_gencnt_chunk++;
5128 } else if (chk->rec.chunk_id == SCTP_STREAM_RESET) {
5129 struct sctp_stream_reset_req *strreq;
5130 /* special handling, we must look into the param */
5131 strreq = mtod(chk->data, struct sctp_stream_reset_req *);
5132 if (strreq->sr_req.ph.param_type == ntohs(SCTP_STR_RESET_RESPONSE)) {
5133 goto clean_up_anyway;
5134 }
5135 }
5136 }
5137 }
5138
5139 static int
5140 sctp_move_to_outqueue(struct sctp_tcb *stcb,
5141 struct sctp_stream_out *strq)
5142 {
5143 /* Move from the stream to the send_queue keeping track of the total */
5144 struct sctp_association *asoc;
5145 int tot_moved = 0;
5146 int failed = 0;
5147 int padval;
5148 struct sctp_tmit_chunk *chk, *nchk;
5149 struct sctp_data_chunk *dchkh;
5150 struct sctpchunk_listhead tmp;
5151 struct mbuf *orig;
5152
5153 asoc = &stcb->asoc;
5154 TAILQ_INIT(&tmp);
5155 chk = TAILQ_FIRST(&strq->outqueue);
5156 while (chk) {
5157 nchk = TAILQ_NEXT(chk, sctp_next);
5158 /* now put in the chunk header */
5159 orig = chk->data;
5160 M_PREPEND(chk->data, sizeof(struct sctp_data_chunk), MB_DONTWAIT);
5161 if (chk->data == NULL) {
5162 /* HELP */
5163 failed++;
5164 break;
5165 }
5166 if (orig != chk->data) {
5167 /* A new mbuf was added, account for it */
5168 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5169 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
5170 stcb->sctp_socket->so_snd.ssb_mbcnt += MSIZE;
5171 }
5172 #ifdef SCTP_MBCNT_LOGGING
5173 sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE,
5174 asoc->total_output_queue_size,
5175 0,
5176 asoc->total_output_mbuf_queue_size,
5177 MSIZE);
5178 #endif
5179 stcb->asoc.total_output_mbuf_queue_size += MSIZE;
5180 chk->mbcnt += MSIZE;
5181 }
5182 chk->send_size += sizeof(struct sctp_data_chunk);
5183 /* This should NOT have to do anything, but
5184 * I would rather be cautious
5185 */
5186 if (!failed && ((size_t)chk->data->m_len < sizeof(struct sctp_data_chunk))) {
5187 m_pullup(chk->data, sizeof(struct sctp_data_chunk));
5188 if (chk->data == NULL) {
5189 failed++;
5190 break;
5191 }
5192 }
5193 dchkh = mtod(chk->data, struct sctp_data_chunk *);
5194 dchkh->ch.chunk_length = htons(chk->send_size);
5195 /* Chunks must be padded to even word boundary */
5196 padval = chk->send_size % 4;
5197 if (padval) {
5198 /* For fragmented messages this should not
5199 * run except possibly on the last chunk
5200 */
5201 if (sctp_pad_lastmbuf(chk->data, (4 - padval))) {
5202 /* we are in big big trouble no mbufs :< */
5203 failed++;
5204 break;
5205 }
5206 chk->send_size += (4 - padval);
5207 }
5208 /* pull from stream queue */
5209 TAILQ_REMOVE(&strq->outqueue, chk, sctp_next);
5210 asoc->stream_queue_cnt--;
5211 TAILQ_INSERT_TAIL(&tmp, chk, sctp_next);
5212 /* add it in to the size of moved chunks */
5213 if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
5214 /* we pull only one message */
5215 break;
5216 }
5217 chk = nchk;
5218 }
5219 if (failed) {
5220 /* Gak, we just lost the user message */
5221 chk = TAILQ_FIRST(&tmp);
5222 while (chk) {
5223 nchk = TAILQ_NEXT(chk, sctp_next);
5224 TAILQ_REMOVE(&tmp, chk, sctp_next);
5225
5226 sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb,
5227 (SCTP_NOTIFY_DATAGRAM_UNSENT|SCTP_INTERNAL_ERROR),
5228 chk);
5229
5230 if (chk->data) {
5231 sctp_m_freem(chk->data);
5232 chk->data = NULL;
5233 }
5234 if (chk->whoTo) {
5235 sctp_free_remote_addr(chk->whoTo);
5236 chk->whoTo = NULL;
5237 }
5238 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
5239 sctppcbinfo.ipi_count_chunk--;
5240 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
5241 panic("Chunk count is negative");
5242 }
5243 sctppcbinfo.ipi_gencnt_chunk++;
5244 chk = nchk;
5245 }
5246 return (0);
5247 }
5248 /* now pull them off of temp wheel */
5249 chk = TAILQ_FIRST(&tmp);
5250 while (chk) {
5251 nchk = TAILQ_NEXT(chk, sctp_next);
5252 /* insert on send_queue */
5253 TAILQ_REMOVE(&tmp, chk, sctp_next);
5254 TAILQ_INSERT_TAIL(&asoc->send_queue, chk, sctp_next);
5255 asoc->send_queue_cnt++;
5256 /* assign TSN */
5257 chk->rec.data.TSN_seq = asoc->sending_seq++;
5258
5259 dchkh = mtod(chk->data, struct sctp_data_chunk *);
5260 /* Put the rest of the things in place now. Size
5261 * was done earlier in previous loop prior to
5262 * padding.
5263 */
5264 dchkh->ch.chunk_type = SCTP_DATA;
5265 dchkh->ch.chunk_flags = chk->rec.data.rcv_flags;
5266 dchkh->dp.tsn = htonl(chk->rec.data.TSN_seq);
5267 dchkh->dp.stream_id = htons(strq->stream_no);
5268 dchkh->dp.stream_sequence = htons(chk->rec.data.stream_seq);
5269 dchkh->dp.protocol_id = chk->rec.data.payloadtype;
5270 /* total count moved */
5271 tot_moved += chk->send_size;
5272 chk = nchk;
5273 }
5274 return (tot_moved);
5275 }
5276
5277 static void
5278 sctp_fill_outqueue(struct sctp_tcb *stcb,
5279 struct sctp_nets *net)
5280 {
5281 struct sctp_association *asoc;
5282 struct sctp_tmit_chunk *chk;
5283 struct sctp_stream_out *strq, *strqn;
5284 int mtu_fromwheel, goal_mtu;
5285 unsigned int moved, seenend, cnt_mvd=0;
5286
5287 asoc = &stcb->asoc;
5288 /* Attempt to move at least 1 MTU's worth
5289 * onto the wheel for each destination address
5290 */
5291 goal_mtu = net->cwnd - net->flight_size;
5292 if ((unsigned int)goal_mtu < net->mtu) {
5293 goal_mtu = net->mtu;
5294 }
5295 if (sctp_pegs[SCTP_MOVED_MTU] < (unsigned int)goal_mtu) {
5296 sctp_pegs[SCTP_MOVED_MTU] = goal_mtu;
5297 }
5298 seenend = moved = mtu_fromwheel = 0;
5299 if (asoc->last_out_stream == NULL) {
5300 strq = asoc->last_out_stream = TAILQ_FIRST(&asoc->out_wheel);
5301 if (asoc->last_out_stream == NULL) {
5302 /* huh nothing on the wheel, TSNH */
5303 return;
5304 }
5305 goto done_it;
5306 }
5307 strq = TAILQ_NEXT(asoc->last_out_stream, next_spoke);
5308 done_it:
5309 if (strq == NULL) {
5310 asoc->last_out_stream = TAILQ_FIRST(&asoc->out_wheel);
5311 }
5312 while (mtu_fromwheel < goal_mtu) {
5313 if (strq == NULL) {
5314 if (seenend == 0) {
5315 seenend = 1;
5316 strq = TAILQ_FIRST(&asoc->out_wheel);
5317 } else if ((moved == 0) && (seenend)) {
5318 /* none left on the wheel */
5319 sctp_pegs[SCTP_MOVED_NLEF]++;
5320 return;
5321 } else if (moved) {
5322 /*
5323 * clear the flags and rotate back through
5324 * again
5325 */
5326 moved = 0;
5327 seenend = 0;
5328 strq = TAILQ_FIRST(&asoc->out_wheel);
5329 }
5330 if (strq == NULL)
5331 break;
5332 continue;
5333 }
5334 strqn = TAILQ_NEXT(strq, next_spoke);
5335 if ((chk = TAILQ_FIRST(&strq->outqueue)) == NULL) {
5336 /* none left on this queue, prune a spoke? */
5337 sctp_remove_from_wheel(asoc, strq);
5338 if (strq == asoc->last_out_stream) {
5339 /* the last one we used went off the wheel */
5340 asoc->last_out_stream = NULL;
5341 }
5342 strq = strqn;
5343 continue;
5344 }
5345 if (chk->whoTo != net) {
5346 /* Skip this stream, first one on stream
5347 * does not head to our current destination.
5348 */
5349 strq = strqn;
5350 continue;
5351 }
5352 mtu_fromwheel += sctp_move_to_outqueue(stcb, strq);
5353 cnt_mvd++;
5354 moved++;
5355 asoc->last_out_stream = strq;
5356 strq = strqn;
5357 }
5358 sctp_pegs[SCTP_MOVED_MAX]++;
5359 #ifdef SCTP_DEBUG
5360 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5361 kprintf("Ok we moved %d chunks to send queue\n",
5362 moved);
5363 }
5364 #endif
5365 if (sctp_pegs[SCTP_MOVED_QMAX] < cnt_mvd) {
5366 sctp_pegs[SCTP_MOVED_QMAX] = cnt_mvd;
5367 }
5368 }
5369
5370 void
5371 sctp_fix_ecn_echo(struct sctp_association *asoc)
5372 {
5373 struct sctp_tmit_chunk *chk;
5374 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
5375 if (chk->rec.chunk_id == SCTP_ECN_ECHO) {
5376 chk->sent = SCTP_DATAGRAM_UNSENT;
5377 }
5378 }
5379 }
5380
5381 static void
5382 sctp_move_to_an_alt(struct sctp_tcb *stcb,
5383 struct sctp_association *asoc,
5384 struct sctp_nets *net)
5385 {
5386 struct sctp_tmit_chunk *chk;
5387 struct sctp_nets *a_net;
5388 a_net = sctp_find_alternate_net(stcb, net);
5389 if ((a_net != net) &&
5390 ((a_net->dest_state & SCTP_ADDR_REACHABLE) == SCTP_ADDR_REACHABLE)) {
5391 /*
5392 * We only proceed if a valid alternate is found that is
5393 * not this one and is reachable. Here we must move all
5394 * chunks queued in the send queue off of the destination
5395 * address to our alternate.
5396 */
5397 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
5398 if (chk->whoTo == net) {
5399 /* Move the chunk to our alternate */
5400 sctp_free_remote_addr(chk->whoTo);
5401 chk->whoTo = a_net;
5402 a_net->ref_count++;
5403 }
5404 }
5405 }
5406 }
5407
5408 static int sctp_from_user_send=0;
5409
5410 static int
5411 sctp_med_chunk_output(struct sctp_inpcb *inp,
5412 struct sctp_tcb *stcb,
5413 struct sctp_association *asoc,
5414 int *num_out,
5415 int *reason_code,
5416 int control_only, int *cwnd_full, int from_where,
5417 struct timeval *now, int *now_filled)
5418 {
5419 /*
5420 * Ok this is the generic chunk service queue.
5421 * we must do the following:
5422 * - Service the stream queue that is next, moving any message
5423 * (note I must get a complete message i.e. FIRST/MIDDLE and
5424 * LAST to the out queue in one pass) and assigning TSN's
5425 * - Check to see if the cwnd/rwnd allows any output, if so we
5426 * go ahead and fomulate and send the low level chunks. Making
5427 * sure to combine any control in the control chunk queue also.
5428 */
5429 struct sctp_nets *net;
5430 struct mbuf *outchain;
5431 struct sctp_tmit_chunk *chk, *nchk;
5432 struct sctphdr *shdr;
5433 /* temp arrays for unlinking */
5434 struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING];
5435 int no_fragmentflg, error;
5436 int one_chunk, hbflag;
5437 int asconf, cookie, no_out_cnt;
5438 int bundle_at, ctl_cnt, no_data_chunks, cwnd_full_ind;
5439 unsigned int mtu, r_mtu, omtu;
5440 *num_out = 0;
5441 cwnd_full_ind = 0;
5442 ctl_cnt = no_out_cnt = asconf = cookie = 0;
5443 /*
5444 * First lets prime the pump. For each destination, if there
5445 * is room in the flight size, attempt to pull an MTU's worth
5446 * out of the stream queues into the general send_queue
5447 */
5448 #ifdef SCTP_AUDITING_ENABLED
5449 sctp_audit_log(0xC2, 2);
5450 #endif
5451 #ifdef SCTP_DEBUG
5452 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5453 kprintf("***********************\n");
5454 }
5455 #endif
5456 hbflag = 0;
5457 if (control_only)
5458 no_data_chunks = 1;
5459 else
5460 no_data_chunks = 0;
5461
5462 /* Nothing to possible to send? */
5463 if (TAILQ_EMPTY(&asoc->control_send_queue) &&
5464 TAILQ_EMPTY(&asoc->send_queue) &&
5465 TAILQ_EMPTY(&asoc->out_wheel)) {
5466 #ifdef SCTP_DEBUG
5467 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5468 kprintf("All wheels empty\n");
5469 }
5470 #endif
5471 return (0);
5472 }
5473 if (asoc->peers_rwnd <= 0) {
5474 /* No room in peers rwnd */
5475 *cwnd_full = 1;
5476 *reason_code = 1;
5477 if (asoc->total_flight > 0) {
5478 /* we are allowed one chunk in flight */
5479 no_data_chunks = 1;
5480 sctp_pegs[SCTP_RWND_BLOCKED]++;
5481 }
5482 }
5483 #ifdef SCTP_DEBUG
5484 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5485 kprintf("Ok we have done the fillup no_data_chunk=%d tf=%d prw:%d\n",
5486 (int)no_data_chunks,
5487 (int)asoc->total_flight, (int)asoc->peers_rwnd);
5488 }
5489 #endif
5490 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5491 #ifdef SCTP_DEBUG
5492 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5493 kprintf("net:%p fs:%d cwnd:%d\n",
5494 net, net->flight_size, net->cwnd);
5495 }
5496 #endif
5497 if (net->flight_size >= net->cwnd) {
5498 /* skip this network, no room */
5499 cwnd_full_ind++;
5500 #ifdef SCTP_DEBUG
5501 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5502 kprintf("Ok skip fillup->fs:%d > cwnd:%d\n",
5503 net->flight_size,
5504 net->cwnd);
5505 }
5506 #endif
5507 sctp_pegs[SCTP_CWND_NOFILL]++;
5508 continue;
5509 }
5510 /*
5511 * spin through the stream queues moving one message and
5512 * assign TSN's as appropriate.
5513 */
5514 sctp_fill_outqueue(stcb, net);
5515 }
5516 *cwnd_full = cwnd_full_ind;
5517 /* now service each destination and send out what we can for it */
5518 #ifdef SCTP_DEBUG
5519 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5520 int chk_cnt = 0;
5521 TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
5522 chk_cnt++;
5523 }
5524 kprintf("We have %d chunks on the send_queue\n", chk_cnt);
5525 chk_cnt = 0;
5526 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
5527 chk_cnt++;
5528 }
5529 kprintf("We have %d chunks on the sent_queue\n", chk_cnt);
5530 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
5531 chk_cnt++;
5532 }
5533 kprintf("We have %d chunks on the control_queue\n", chk_cnt);
5534 }
5535 #endif
5536 /* If we have data to send, and DSACK is running, stop it
5537 * and build a SACK to dump on to bundle with output. This
5538 * actually MAY make it so the bundling does not occur if
5539 * the SACK is big but I think this is ok because basic SACK
5540 * space is pre-reserved in our fragmentation size choice.
5541 */
5542 if ((TAILQ_FIRST(&asoc->send_queue) != NULL) &&
5543 (no_data_chunks == 0)) {
5544 /* We will be sending something */
5545 if (callout_pending(&stcb->asoc.dack_timer.timer)) {
5546 /* Yep a callout is pending */
5547 sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
5548 stcb->sctp_ep,
5549 stcb, NULL);
5550 sctp_send_sack(stcb);
5551 }
5552 }
5553 /* Nothing to send? */
5554 if ((TAILQ_FIRST(&asoc->control_send_queue) == NULL) &&
5555 (TAILQ_FIRST(&asoc->send_queue) == NULL)) {
5556 return (0);
5557 }
5558 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5559 /* how much can we send? */
5560 if (net->ref_count < 2) {
5561 /* Ref-count of 1 so we cannot have data or control
5562 * queued to this address. Skip it.
5563 */
5564 continue;
5565 }
5566 ctl_cnt = bundle_at = 0;
5567 outchain = NULL;
5568 no_fragmentflg = 1;
5569 one_chunk = 0;
5570
5571 if ((net->ro.ro_rt) && (net->ro.ro_rt->rt_ifp)) {
5572 /* if we have a route and an ifp
5573 * check to see if we have room to
5574 * send to this guy
5575 */
5576 struct ifnet *ifp;
5577 ifp = net->ro.ro_rt->rt_ifp;
5578 if ((ifp->if_snd.ifq_len + 2) >= ifp->if_snd.ifq_maxlen) {
5579 sctp_pegs[SCTP_IFP_QUEUE_FULL]++;
5580 #ifdef SCTP_LOG_MAXBURST
5581 sctp_log_maxburst(net, ifp->if_snd.ifq_len, ifp->if_snd.ifq_maxlen, SCTP_MAX_IFP_APPLIED);
5582 #endif
5583 continue;
5584 }
5585 }
5586 if (((struct sockaddr *)&net->ro._l_addr)->sa_family == AF_INET) {
5587 mtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr));
5588 } else {
5589 mtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr));
5590 }
5591 if (mtu > asoc->peers_rwnd) {
5592 if (asoc->total_flight > 0) {
5593 /* We have a packet in flight somewhere */
5594 r_mtu = asoc->peers_rwnd;
5595 } else {
5596 /* We are always allowed to send one MTU out */
5597 one_chunk = 1;
5598 r_mtu = mtu;
5599 }
5600 } else {
5601 r_mtu = mtu;
5602 }
5603 #ifdef SCTP_DEBUG
5604 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5605 kprintf("Ok r_mtu is %d mtu is %d for this net:%p one_chunk:%d\n",
5606 r_mtu, mtu, net, one_chunk);
5607 }
5608 #endif
5609 /************************/
5610 /* Control transmission */
5611 /************************/
5612 /* Now first lets go through the control queue */
5613 for (chk = TAILQ_FIRST(&asoc->control_send_queue);
5614 chk; chk = nchk) {
5615 nchk = TAILQ_NEXT(chk, sctp_next);
5616 if (chk->whoTo != net) {
5617 /*
5618 * No, not sent to the network we are
5619 * looking at
5620 */
5621 continue;
5622 }
5623 if (chk->data == NULL) {
5624 continue;
5625 }
5626 if ((chk->data->m_flags & M_PKTHDR) == 0) {
5627 /*
5628 * NOTE: the chk queue MUST have the PKTHDR
5629 * flag set on it with a total in the
5630 * m_pkthdr.len field!! else the chunk will
5631 * ALWAYS be skipped
5632 */
5633 continue;
5634 }
5635 if (chk->sent != SCTP_DATAGRAM_UNSENT) {
5636 /*
5637 * It must be unsent. Cookies and ASCONF's
5638 * hang around but there timers will force
5639 * when marked for resend.
5640 */
5641 continue;
5642 }
5643 /* Here we do NOT factor the r_mtu */
5644 if ((chk->data->m_pkthdr.len < (int)mtu) ||
5645 (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) {
5646 /*
5647 * We probably should glom the mbuf chain from
5648 * the chk->data for control but the problem
5649 * is it becomes yet one more level of
5650 * tracking to do if for some reason output
5651 * fails. Then I have got to reconstruct the
5652 * merged control chain.. el yucko.. for now
5653 * we take the easy way and do the copy
5654 */
5655 outchain = sctp_copy_mbufchain(chk->data,
5656 outchain);
5657 if (outchain == NULL) {
5658 return (ENOMEM);
5659 }
5660 /* update our MTU size */
5661 mtu -= chk->data->m_pkthdr.len;
5662 if (mtu < 0) {
5663 mtu = 0;
5664 }
5665 /* Do clear IP_DF ? */
5666 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
5667 no_fragmentflg = 0;
5668 }
5669 /* Mark things to be removed, if needed */
5670 if ((chk->rec.chunk_id == SCTP_SELECTIVE_ACK) ||
5671 (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST) ||
5672 (chk->rec.chunk_id == SCTP_HEARTBEAT_ACK) ||
5673 (chk->rec.chunk_id == SCTP_SHUTDOWN) ||
5674 (chk->rec.chunk_id == SCTP_SHUTDOWN_ACK) ||
5675 (chk->rec.chunk_id == SCTP_OPERATION_ERROR) ||
5676 (chk->rec.chunk_id == SCTP_COOKIE_ACK) ||
5677 (chk->rec.chunk_id == SCTP_ECN_CWR) ||
5678 (chk->rec.chunk_id == SCTP_PACKET_DROPPED) ||
5679 (chk->rec.chunk_id == SCTP_ASCONF_ACK)) {
5680
5681 if (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST)
5682 hbflag = 1;
5683 /* remove these chunks at the end */
5684 if (chk->rec.chunk_id == SCTP_SELECTIVE_ACK) {
5685 /* turn off the timer */
5686 if (callout_pending(&stcb->asoc.dack_timer.timer)) {
5687 sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
5688 inp, stcb, net);
5689 }
5690 }
5691 ctl_cnt++;
5692 } else {
5693 /*
5694 * Other chunks, since they have
5695 * timers running (i.e. COOKIE or
5696 * ASCONF) we just "trust" that it
5697 * gets sent or retransmitted.
5698 */
5699 ctl_cnt++;
5700 if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) {
5701 cookie = 1;
5702 no_out_cnt = 1;
5703 } else if (chk->rec.chunk_id == SCTP_ASCONF) {
5704 /*
5705 * set hb flag since we can use
5706 * these for RTO
5707 */
5708 hbflag = 1;
5709 asconf = 1;
5710 }
5711 chk->sent = SCTP_DATAGRAM_SENT;
5712 chk->snd_count++;
5713 }
5714 if (mtu == 0) {
5715 /*
5716 * Ok we are out of room but we can
5717 * output without effecting the flight
5718 * size since this little guy is a
5719 * control only packet.
5720 */
5721 if (asconf) {
5722 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net);
5723 asconf = 0;
5724 }
5725 if (cookie) {
5726 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net);
5727 cookie = 0;
5728 }
5729 if (outchain->m_len == 0) {
5730 /*
5731 * Special case for when you
5732 * get a 0 len mbuf at the
5733 * head due to the lack of a
5734 * MHDR at the beginning.
5735 */
5736 outchain->m_len = sizeof(struct sctphdr);
5737 } else {
5738 M_PREPEND(outchain, sizeof(struct sctphdr), MB_DONTWAIT);
5739 if (outchain == NULL) {
5740 /* no memory */
5741 error = ENOBUFS;
5742 goto error_out_again;
5743 }
5744 }
5745 shdr = mtod(outchain, struct sctphdr *);
5746 shdr->src_port = inp->sctp_lport;
5747 shdr->dest_port = stcb->rport;
5748 shdr->v_tag = htonl(stcb->asoc.peer_vtag);
5749 shdr->checksum = 0;
5750
5751 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
5752 (struct sockaddr *)&net->ro._l_addr,
5753 outchain,
5754 no_fragmentflg, 0, NULL, asconf))) {
5755 if (error == ENOBUFS) {
5756 asoc->ifp_had_enobuf = 1;
5757 }
5758 sctp_pegs[SCTP_DATA_OUT_ERR]++;
5759 if (from_where == 0) {
5760 sctp_pegs[SCTP_ERROUT_FRM_USR]++;
5761 }
5762 error_out_again:
5763 #ifdef SCTP_DEBUG
5764 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
5765 kprintf("Gak got ctrl error %d\n", error);
5766 }
5767 #endif
5768 /* error, could not output */
5769 if (hbflag) {
5770 #ifdef SCTP_DEBUG
5771 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5772 kprintf("Update HB anyway\n");
5773 }
5774 #endif
5775 if (*now_filled == 0) {
5776 SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
5777 *now_filled = 1;
5778 *now = net->last_sent_time;
5779 } else {
5780 net->last_sent_time = *now;
5781 }
5782 hbflag = 0;
5783 }
5784 if (error == EHOSTUNREACH) {
5785 /*
5786 * Destination went
5787 * unreachable during
5788 * this send
5789 */
5790 #ifdef SCTP_DEBUG
5791 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5792 kprintf("Moving data to an alterante\n");
5793 }
5794 #endif
5795 sctp_move_to_an_alt(stcb, asoc, net);
5796 }
5797 sctp_clean_up_ctl (asoc);
5798 return (error);
5799 } else
5800 asoc->ifp_had_enobuf = 0;
5801 /* Only HB or ASCONF advances time */
5802 if (hbflag) {
5803 if (*now_filled == 0) {
5804 SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
5805 *now_filled = 1;
5806 *now = net->last_sent_time;
5807 } else {
5808 net->last_sent_time = *now;
5809 }
5810 hbflag = 0;
5811 }
5812 /*
5813 * increase the number we sent, if a
5814 * cookie is sent we don't tell them
5815 * any was sent out.
5816 */
5817 if (!no_out_cnt)
5818 *num_out += ctl_cnt;
5819 /* recalc a clean slate and setup */
5820 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
5821 mtu = (net->mtu - SCTP_MIN_OVERHEAD);
5822 } else {
5823 mtu = (net->mtu - SCTP_MIN_V4_OVERHEAD);
5824 }
5825 no_fragmentflg = 1;
5826 }
5827 }
5828 }
5829 /*********************/
5830 /* Data transmission */
5831 /*********************/
5832 /* now lets add any data within the MTU constraints */
5833 if (((struct sockaddr *)&net->ro._l_addr)->sa_family == AF_INET) {
5834 omtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr));
5835 } else {
5836 omtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr));
5837 }
5838
5839 #ifdef SCTP_DEBUG
5840 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5841 kprintf("Now to data transmission\n");
5842 }
5843 #endif
5844
5845 if (((asoc->state & SCTP_STATE_OPEN) == SCTP_STATE_OPEN) ||
5846 (cookie)) {
5847 for (chk = TAILQ_FIRST(&asoc->send_queue); chk; chk = nchk) {
5848 if (no_data_chunks) {
5849 /* let only control go out */
5850 #ifdef SCTP_DEBUG
5851 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5852 kprintf("Either nothing to send or we are full\n");
5853 }
5854 #endif
5855 break;
5856 }
5857 if (net->flight_size >= net->cwnd) {
5858 /* skip this net, no room for data */
5859 #ifdef SCTP_DEBUG
5860 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5861 kprintf("fs:%d > cwnd:%d\n",
5862 net->flight_size, net->cwnd);
5863 }
5864 #endif
5865 sctp_pegs[SCTP_CWND_BLOCKED]++;
5866 *reason_code = 2;
5867 break;
5868 }
5869 nchk = TAILQ_NEXT(chk, sctp_next);
5870 if (chk->whoTo != net) {
5871 /* No, not sent to this net */
5872 #ifdef SCTP_DEBUG
5873 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5874 kprintf("chk->whoTo:%p not %p\n",
5875 chk->whoTo, net);
5876
5877 }
5878 #endif
5879 continue;
5880 }
5881 #ifdef SCTP_DEBUG
5882 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5883 kprintf("Can we pick up a chunk?\n");
5884 }
5885 #endif
5886 if ((chk->send_size > omtu) && ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) == 0)) {
5887 /* strange, we have a chunk that is to bit
5888 * for its destination and yet no fragment ok flag.
5889 * Something went wrong when the PMTU changed...we did
5890 * not mark this chunk for some reason?? I will
5891 * fix it here by letting IP fragment it for now and
5892 * printing a warning. This really should not happen ...
5893 */
5894 /*#ifdef SCTP_DEBUG*/
5895 kprintf("Warning chunk of %d bytes > mtu:%d and yet PMTU disc missed\n",
5896 chk->send_size, mtu);
5897 /*#endif*/
5898 chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
5899 }
5900
5901 if (((chk->send_size <= mtu) && (chk->send_size <= r_mtu)) ||
5902 ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) && (chk->send_size <= asoc->peers_rwnd))) {
5903 /* ok we will add this one */
5904 #ifdef SCTP_DEBUG
5905 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5906 kprintf("Picking up the chunk\n");
5907 }
5908 #endif
5909 outchain = sctp_copy_mbufchain(chk->data, outchain);
5910 if (outchain == NULL) {
5911 #ifdef SCTP_DEBUG
5912 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5913 kprintf("Gakk no memory\n");
5914 }
5915 #endif
5916 if (!callout_pending(&net->rxt_timer.timer)) {
5917 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
5918 }
5919 return (ENOMEM);
5920 }
5921 /* upate our MTU size */
5922 /* Do clear IP_DF ? */
5923 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
5924 no_fragmentflg = 0;
5925 }
5926 mtu -= chk->send_size;
5927 r_mtu -= chk->send_size;
5928 data_list[bundle_at++] = chk;
5929 if (bundle_at >= SCTP_MAX_DATA_BUNDLING) {
5930 mtu = 0;
5931 break;
5932 }
5933 if (mtu <= 0) {
5934 mtu = 0;
5935 break;
5936 }
5937 if ((r_mtu <= 0) || one_chunk) {
5938 r_mtu = 0;
5939 break;
5940 }
5941 } else {
5942 /*
5943 * Must be sent in order of the TSN's
5944 * (on a network)
5945 */
5946 #ifdef SCTP_DEBUG
5947 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5948 kprintf("ok no more chk:%d > mtu:%d || < r_mtu:%d\n",
5949 chk->send_size, mtu, r_mtu);
5950 }
5951 #endif
5952
5953 break;
5954 }
5955 }/* for () */
5956 } /* if asoc.state OPEN */
5957 /* Is there something to send for this destination? */
5958 #ifdef SCTP_DEBUG
5959 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5960 kprintf("ok now is chain assembled? %p\n",
5961 outchain);
5962 }
5963 #endif
5964
5965 if (outchain) {
5966 /* We may need to start a control timer or two */
5967 if (asconf) {
5968 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net);
5969 asconf = 0;
5970 }
5971 if (cookie) {
5972 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net);
5973 cookie = 0;
5974 }
5975 /* must start a send timer if data is being sent */
5976 if (bundle_at && (!callout_pending(&net->rxt_timer.timer))) {
5977 /* no timer running on this destination
5978 * restart it.
5979 */
5980 #ifdef SCTP_DEBUG
5981 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
5982 kprintf("ok lets start a send timer .. we will transmit %p\n",
5983 outchain);
5984 }
5985 #endif
5986 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
5987 }
5988 /* Now send it, if there is anything to send :> */
5989 if ((outchain->m_flags & M_PKTHDR) == 0) {
5990 struct mbuf *t;
5991
5992 MGETHDR(t, MB_DONTWAIT, MT_HEADER);
5993 if (t == NULL) {
5994 sctp_m_freem(outchain);
5995 return (ENOMEM);
5996 }
5997 t->m_next = outchain;
5998 t->m_pkthdr.len = 0;
5999 t->m_pkthdr.rcvif = 0;
6000 t->m_len = 0;
6001
6002 outchain = t;
6003 while (t) {
6004 outchain->m_pkthdr.len += t->m_len;
6005 t = t->m_next;
6006 }
6007 }
6008 if (outchain->m_len == 0) {
6009 /* Special case for when you get a 0 len
6010 * mbuf at the head due to the lack
6011 * of a MHDR at the beginning.
6012 */
6013 MH_ALIGN(outchain, sizeof(struct sctphdr));
6014 outchain->m_len = sizeof(struct sctphdr);
6015 } else {
6016 M_PREPEND(outchain, sizeof(struct sctphdr), MB_DONTWAIT);
6017 if (outchain == NULL) {
6018 /* out of mbufs */
6019 error = ENOBUFS;
6020 goto errored_send;
6021 }
6022 }
6023 shdr = mtod(outchain, struct sctphdr *);
6024 shdr->src_port = inp->sctp_lport;
6025 shdr->dest_port = stcb->rport;
6026 shdr->v_tag = htonl(stcb->asoc.peer_vtag);
6027 shdr->checksum = 0;
6028 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
6029 (struct sockaddr *)&net->ro._l_addr,
6030 outchain,
6031 no_fragmentflg, bundle_at, data_list[0], asconf))) {
6032 /* error, we could not output */
6033 if (error == ENOBUFS) {
6034 asoc->ifp_had_enobuf = 1;
6035 }
6036 sctp_pegs[SCTP_DATA_OUT_ERR]++;
6037 if (from_where == 0) {
6038 sctp_pegs[SCTP_ERROUT_FRM_USR]++;
6039 }
6040
6041 errored_send:
6042 #ifdef SCTP_DEBUG
6043 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
6044 kprintf("Gak send error %d\n", error);
6045 }
6046 #endif
6047 if (hbflag) {
6048 #ifdef SCTP_DEBUG
6049 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
6050 kprintf("Update HB time anyway\n");
6051 }
6052 #endif
6053 if (*now_filled == 0) {
6054 SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
6055 *now_filled = 1;
6056 *now = net->last_sent_time;
6057 } else {
6058 net->last_sent_time = *now;
6059 }
6060 hbflag = 0;
6061 }
6062 if (error == EHOSTUNREACH) {
6063 /*
6064 * Destination went unreachable during
6065 * this send
6066 */
6067 #ifdef SCTP_DEBUG
6068 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
6069 kprintf("Calling the movement routine\n");
6070 }
6071 #endif
6072 sctp_move_to_an_alt(stcb, asoc, net);
6073 }
6074 sctp_clean_up_ctl (asoc);
6075 return (error);
6076 } else {
6077 asoc->ifp_had_enobuf = 0;
6078 }
6079 if (bundle_at || hbflag) {
6080 /* For data/asconf and hb set time */
6081 if (*now_filled == 0) {
6082 SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
6083 *now_filled = 1;
6084 *now = net->last_sent_time;
6085 } else {
6086 net->last_sent_time = *now;
6087 }
6088 }
6089
6090 if (!no_out_cnt) {
6091 *num_out += (ctl_cnt + bundle_at);
6092 }
6093 if (bundle_at) {
6094 if (!net->rto_pending) {
6095 /* setup for a RTO measurement */
6096 net->rto_pending = 1;
6097 data_list[0]->do_rtt = 1;
6098 } else {
6099 data_list[0]->do_rtt = 0;
6100 }
6101 sctp_pegs[SCTP_PEG_TSNS_SENT] += bundle_at;
6102 sctp_clean_up_datalist(stcb, asoc, data_list, bundle_at, net);
6103 }
6104 if (one_chunk) {
6105 break;
6106 }
6107 }
6108 }
6109 /* At the end there should be no NON timed
6110 * chunks hanging on this queue.
6111 */
6112 if ((*num_out == 0) && (*reason_code == 0)) {
6113 *reason_code = 3;
6114 }
6115 sctp_clean_up_ctl (asoc);
6116 return (0);
6117 }
6118
6119 void
6120 sctp_queue_op_err(struct sctp_tcb *stcb, struct mbuf *op_err)
6121 {
6122 /* Prepend a OPERATIONAL_ERROR chunk header
6123 * and put on the end of the control chunk queue.
6124 */
6125 /* Sender had better have gotten a MGETHDR or else
6126 * the control chunk will be forever skipped
6127 */
6128 struct sctp_chunkhdr *hdr;
6129 struct sctp_tmit_chunk *chk;
6130 struct mbuf *mat;
6131
6132 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6133 if (chk == NULL) {
6134 /* no memory */
6135 sctp_m_freem(op_err);
6136 return;
6137 }
6138 sctppcbinfo.ipi_count_chunk++;
6139 sctppcbinfo.ipi_gencnt_chunk++;
6140 M_PREPEND(op_err, sizeof(struct sctp_chunkhdr), MB_DONTWAIT);
6141 if (op_err == NULL) {
6142 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
6143 sctppcbinfo.ipi_count_chunk--;
6144 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
6145 panic("Chunk count is negative");
6146 }
6147 sctppcbinfo.ipi_gencnt_chunk++;
6148 return;
6149 }
6150 chk->send_size = 0;
6151 mat = op_err;
6152 while (mat != NULL) {
6153 chk->send_size += mat->m_len;
6154 mat = mat->m_next;
6155 }
6156 chk->rec.chunk_id = SCTP_OPERATION_ERROR;
6157 chk->sent = SCTP_DATAGRAM_UNSENT;
6158 chk->snd_count = 0;
6159 chk->flags = 0;
6160 chk->asoc = &stcb->asoc;
6161 chk->data = op_err;
6162 chk->whoTo = chk->asoc->primary_destination;
6163 chk->whoTo->ref_count++;
6164 hdr = mtod(op_err, struct sctp_chunkhdr *);
6165 hdr->chunk_type = SCTP_OPERATION_ERROR;
6166 hdr->chunk_flags = 0;
6167 hdr->chunk_length = htons(chk->send_size);
6168 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue,
6169 chk,
6170 sctp_next);
6171 chk->asoc->ctrl_queue_cnt++;
6172 }
6173
6174 int
6175 sctp_send_cookie_echo(struct mbuf *m,
6176 int offset,
6177 struct sctp_tcb *stcb,
6178 struct sctp_nets *net)
6179 {
6180 /*
6181 * pull out the cookie and put it at the front of the control
6182 * chunk queue.
6183 */
6184 int at;
6185 struct mbuf *cookie, *mat;
6186 struct sctp_paramhdr parm, *phdr;
6187 struct sctp_chunkhdr *hdr;
6188 struct sctp_tmit_chunk *chk;
6189 uint16_t ptype, plen;
6190 /* First find the cookie in the param area */
6191 cookie = NULL;
6192 at = offset + sizeof(struct sctp_init_chunk);
6193
6194 do {
6195 phdr = sctp_get_next_param(m, at, &parm, sizeof(parm));
6196 if (phdr == NULL) {
6197 return (-3);
6198 }
6199 ptype = ntohs(phdr->param_type);
6200 plen = ntohs(phdr->param_length);
6201 if (ptype == SCTP_STATE_COOKIE) {
6202 int pad;
6203 /* found the cookie */
6204 if ((pad = (plen % 4))) {
6205 plen += 4 - pad;
6206 }
6207 cookie = sctp_m_copym(m, at, plen, MB_DONTWAIT);
6208 if (cookie == NULL) {
6209 /* No memory */
6210 return (-2);
6211 }
6212 break;
6213 }
6214 at += SCTP_SIZE32(plen);
6215 } while (phdr);
6216 if (cookie == NULL) {
6217 /* Did not find the cookie */
6218 return (-3);
6219 }
6220 /* ok, we got the cookie lets change it into a cookie echo chunk */
6221
6222 /* first the change from param to cookie */
6223 hdr = mtod(cookie, struct sctp_chunkhdr *);
6224 hdr->chunk_type = SCTP_COOKIE_ECHO;
6225 hdr->chunk_flags = 0;
6226 /* now we MUST have a PKTHDR on it */
6227 if ((cookie->m_flags & M_PKTHDR) != M_PKTHDR) {
6228 /* we hope this happens rarely */
6229 MGETHDR(mat, MB_DONTWAIT, MT_HEADER);
6230 if (mat == NULL) {
6231 sctp_m_freem(cookie);
6232 return (-4);
6233 }
6234 mat->m_len = 0;
6235 mat->m_pkthdr.rcvif = 0;
6236 mat->m_next = cookie;
6237 cookie = mat;
6238 }
6239 cookie->m_pkthdr.len = plen;
6240 /* get the chunk stuff now and place it in the FRONT of the queue */
6241 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6242 if (chk == NULL) {
6243 /* no memory */
6244 sctp_m_freem(cookie);
6245 return (-5);
6246 }
6247 sctppcbinfo.ipi_count_chunk++;
6248 sctppcbinfo.ipi_gencnt_chunk++;
6249 chk->send_size = cookie->m_pkthdr.len;
6250 chk->rec.chunk_id = SCTP_COOKIE_ECHO;
6251 chk->sent = SCTP_DATAGRAM_UNSENT;
6252 chk->snd_count = 0;
6253 chk->flags = 0;
6254 chk->asoc = &stcb->asoc;
6255 chk->data = cookie;
6256 chk->whoTo = chk->asoc->primary_destination;
6257 chk->whoTo->ref_count++;
6258 TAILQ_INSERT_HEAD(&chk->asoc->control_send_queue, chk, sctp_next);
6259 chk->asoc->ctrl_queue_cnt++;
6260 return (0);
6261 }
6262
6263 void
6264 sctp_send_heartbeat_ack(struct sctp_tcb *stcb,
6265 struct mbuf *m,
6266 int offset,
6267 int chk_length,
6268 struct sctp_nets *net)
6269 {
6270 /* take a HB request and make it into a
6271 * HB ack and send it.
6272 */
6273 struct mbuf *outchain;
6274 struct sctp_chunkhdr *chdr;
6275 struct sctp_tmit_chunk *chk;
6276
6277
6278 if (net == NULL)
6279 /* must have a net pointer */
6280 return;
6281
6282 outchain = sctp_m_copym(m, offset, chk_length, MB_DONTWAIT);
6283 if (outchain == NULL) {
6284 /* gak out of memory */
6285 return;
6286 }
6287 chdr = mtod(outchain, struct sctp_chunkhdr *);
6288 chdr->chunk_type = SCTP_HEARTBEAT_ACK;
6289 chdr->chunk_flags = 0;
6290 if ((outchain->m_flags & M_PKTHDR) != M_PKTHDR) {
6291 /* should not happen but we are cautious. */
6292 struct mbuf *tmp;
6293 MGETHDR(tmp, MB_DONTWAIT, MT_HEADER);
6294 if (tmp == NULL) {
6295 return;
6296 }
6297 tmp->m_len = 0;
6298 tmp->m_pkthdr.rcvif = 0;
6299 tmp->m_next = outchain;
6300 outchain = tmp;
6301 }
6302 outchain->m_pkthdr.len = chk_length;
6303 if (chk_length % 4) {
6304 /* need pad */
6305 u_int32_t cpthis=0;
6306 int padlen;
6307 padlen = 4 - (outchain->m_pkthdr.len % 4);
6308 m_copyback(outchain, outchain->m_pkthdr.len, padlen, (caddr_t)&cpthis);
6309 }
6310 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6311 if (chk == NULL) {
6312 /* no memory */
6313 sctp_m_freem(outchain);
6314 return ;
6315 }
6316 sctppcbinfo.ipi_count_chunk++;
6317 sctppcbinfo.ipi_gencnt_chunk++;
6318
6319 chk->send_size = chk_length;
6320 chk->rec.chunk_id = SCTP_HEARTBEAT_ACK;
6321 chk->sent = SCTP_DATAGRAM_UNSENT;
6322 chk->snd_count = 0;
6323 chk->flags = 0;
6324 chk->asoc = &stcb->asoc;
6325 chk->data = outchain;
6326 chk->whoTo = net;
6327 chk->whoTo->ref_count++;
6328 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6329 chk->asoc->ctrl_queue_cnt++;
6330 }
6331
6332 int
6333 sctp_send_cookie_ack(struct sctp_tcb *stcb) {
6334 /* formulate and queue a cookie-ack back to sender */
6335 struct mbuf *cookie_ack;
6336 struct sctp_chunkhdr *hdr;
6337 struct sctp_tmit_chunk *chk;
6338
6339 cookie_ack = NULL;
6340 MGETHDR(cookie_ack, MB_DONTWAIT, MT_HEADER);
6341 if (cookie_ack == NULL) {
6342 /* no mbuf's */
6343 return (-1);
6344 }
6345 cookie_ack->m_data += SCTP_MIN_OVERHEAD;
6346 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6347 if (chk == NULL) {
6348 /* no memory */
6349 sctp_m_freem(cookie_ack);
6350 return (-1);
6351 }
6352 sctppcbinfo.ipi_count_chunk++;
6353 sctppcbinfo.ipi_gencnt_chunk++;
6354
6355 chk->send_size = sizeof(struct sctp_chunkhdr);
6356 chk->rec.chunk_id = SCTP_COOKIE_ACK;
6357 chk->sent = SCTP_DATAGRAM_UNSENT;
6358 chk->snd_count = 0;
6359 chk->flags = 0;
6360 chk->asoc = &stcb->asoc;
6361 chk->data = cookie_ack;
6362 if (chk->asoc->last_control_chunk_from != NULL) {
6363 chk->whoTo = chk->asoc->last_control_chunk_from;
6364 } else {
6365 chk->whoTo = chk->asoc->primary_destination;
6366 }
6367 chk->whoTo->ref_count++;
6368 hdr = mtod(cookie_ack, struct sctp_chunkhdr *);
6369 hdr->chunk_type = SCTP_COOKIE_ACK;
6370 hdr->chunk_flags = 0;
6371 hdr->chunk_length = htons(chk->send_size);
6372 cookie_ack->m_pkthdr.len = cookie_ack->m_len = chk->send_size;
6373 cookie_ack->m_pkthdr.rcvif = 0;
6374 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6375 chk->asoc->ctrl_queue_cnt++;
6376 return (0);
6377 }
6378
6379
6380 int
6381 sctp_send_shutdown_ack(struct sctp_tcb *stcb, struct sctp_nets *net)
6382 {
6383 /* formulate and queue a SHUTDOWN-ACK back to the sender */
6384 struct mbuf *m_shutdown_ack;
6385 struct sctp_shutdown_ack_chunk *ack_cp;
6386 struct sctp_tmit_chunk *chk;
6387
6388 m_shutdown_ack = NULL;
6389 MGETHDR(m_shutdown_ack, MB_DONTWAIT, MT_HEADER);
6390 if (m_shutdown_ack == NULL) {
6391 /* no mbuf's */
6392 return (-1);
6393 }
6394 m_shutdown_ack->m_data += SCTP_MIN_OVERHEAD;
6395 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6396 if (chk == NULL) {
6397 /* no memory */
6398 sctp_m_freem(m_shutdown_ack);
6399 return (-1);
6400 }
6401 sctppcbinfo.ipi_count_chunk++;
6402 sctppcbinfo.ipi_gencnt_chunk++;
6403
6404 chk->send_size = sizeof(struct sctp_chunkhdr);
6405 chk->rec.chunk_id = SCTP_SHUTDOWN_ACK;
6406 chk->sent = SCTP_DATAGRAM_UNSENT;
6407 chk->snd_count = 0;
6408 chk->flags = 0;
6409 chk->asoc = &stcb->asoc;
6410 chk->data = m_shutdown_ack;
6411 chk->whoTo = net;
6412 net->ref_count++;
6413
6414 ack_cp = mtod(m_shutdown_ack, struct sctp_shutdown_ack_chunk *);
6415 ack_cp->ch.chunk_type = SCTP_SHUTDOWN_ACK;
6416 ack_cp->ch.chunk_flags = 0;
6417 ack_cp->ch.chunk_length = htons(chk->send_size);
6418 m_shutdown_ack->m_pkthdr.len = m_shutdown_ack->m_len = chk->send_size;
6419 m_shutdown_ack->m_pkthdr.rcvif = 0;
6420 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6421 chk->asoc->ctrl_queue_cnt++;
6422 return (0);
6423 }
6424
6425 int
6426 sctp_send_shutdown(struct sctp_tcb *stcb, struct sctp_nets *net)
6427 {
6428 /* formulate and queue a SHUTDOWN to the sender */
6429 struct mbuf *m_shutdown;
6430 struct sctp_shutdown_chunk *shutdown_cp;
6431 struct sctp_tmit_chunk *chk;
6432
6433 m_shutdown = NULL;
6434 MGETHDR(m_shutdown, MB_DONTWAIT, MT_HEADER);
6435 if (m_shutdown == NULL) {
6436 /* no mbuf's */
6437 return (-1);
6438 }
6439 m_shutdown->m_data += SCTP_MIN_OVERHEAD;
6440 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6441 if (chk == NULL) {
6442 /* no memory */
6443 sctp_m_freem(m_shutdown);
6444 return (-1);
6445 }
6446 sctppcbinfo.ipi_count_chunk++;
6447 sctppcbinfo.ipi_gencnt_chunk++;
6448
6449 chk->send_size = sizeof(struct sctp_shutdown_chunk);
6450 chk->rec.chunk_id = SCTP_SHUTDOWN;
6451 chk->sent = SCTP_DATAGRAM_UNSENT;
6452 chk->snd_count = 0;
6453 chk->flags = 0;
6454 chk->asoc = &stcb->asoc;
6455 chk->data = m_shutdown;
6456 chk->whoTo = net;
6457 net->ref_count++;
6458
6459 shutdown_cp = mtod(m_shutdown, struct sctp_shutdown_chunk *);
6460 shutdown_cp->ch.chunk_type = SCTP_SHUTDOWN;
6461 shutdown_cp->ch.chunk_flags = 0;
6462 shutdown_cp->ch.chunk_length = htons(chk->send_size);
6463 shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn);
6464 m_shutdown->m_pkthdr.len = m_shutdown->m_len = chk->send_size;
6465 m_shutdown->m_pkthdr.rcvif = 0;
6466 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6467 chk->asoc->ctrl_queue_cnt++;
6468
6469 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
6470 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
6471 stcb->sctp_ep->sctp_socket->so_snd.ssb_cc = 0;
6472 soisdisconnecting(stcb->sctp_ep->sctp_socket);
6473 }
6474 return (0);
6475 }
6476
6477 int
6478 sctp_send_asconf(struct sctp_tcb *stcb, struct sctp_nets *net)
6479 {
6480 /*
6481 * formulate and queue an ASCONF to the peer
6482 * ASCONF parameters should be queued on the assoc queue
6483 */
6484 struct sctp_tmit_chunk *chk;
6485 struct mbuf *m_asconf;
6486 struct sctp_asconf_chunk *acp;
6487
6488
6489 /* compose an ASCONF chunk, maximum length is PMTU */
6490 m_asconf = sctp_compose_asconf(stcb);
6491 if (m_asconf == NULL) {
6492 return (-1);
6493 }
6494 acp = mtod(m_asconf, struct sctp_asconf_chunk *);
6495 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6496 if (chk == NULL) {
6497 /* no memory */
6498 sctp_m_freem(m_asconf);
6499 return (-1);
6500 }
6501 sctppcbinfo.ipi_count_chunk++;
6502 sctppcbinfo.ipi_gencnt_chunk++;
6503
6504 chk->data = m_asconf;
6505 chk->send_size = m_asconf->m_pkthdr.len;
6506 chk->rec.chunk_id = SCTP_ASCONF;
6507 chk->sent = SCTP_DATAGRAM_UNSENT;
6508 chk->snd_count = 0;
6509 chk->flags = 0;
6510 chk->asoc = &stcb->asoc;
6511 chk->whoTo = chk->asoc->primary_destination;
6512 chk->whoTo->ref_count++;
6513 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6514 chk->asoc->ctrl_queue_cnt++;
6515 return (0);
6516 }
6517
6518 int
6519 sctp_send_asconf_ack(struct sctp_tcb *stcb, uint32_t retrans)
6520 {
6521 /*
6522 * formulate and queue a asconf-ack back to sender
6523 * the asconf-ack must be stored in the tcb
6524 */
6525 struct sctp_tmit_chunk *chk;
6526 struct mbuf *m_ack;
6527
6528 /* is there a asconf-ack mbuf chain to send? */
6529 if (stcb->asoc.last_asconf_ack_sent == NULL) {
6530 return (-1);
6531 }
6532
6533 /* copy the asconf_ack */
6534 #if defined(__FreeBSD__) || defined(__NetBSD__)
6535 /* Supposedly the m_copypacket is a optimzation,
6536 * use it if we can.
6537 */
6538 if (stcb->asoc.last_asconf_ack_sent->m_flags & M_PKTHDR) {
6539 m_ack = m_copypacket(stcb->asoc.last_asconf_ack_sent, MB_DONTWAIT);
6540 sctp_pegs[SCTP_CACHED_SRC]++;
6541 } else
6542 m_ack = m_copy(stcb->asoc.last_asconf_ack_sent, 0, M_COPYALL);
6543 #else
6544 m_ack = m_copy(stcb->asoc.last_asconf_ack_sent, 0, M_COPYALL);
6545 #endif
6546 if (m_ack == NULL) {
6547 /* couldn't copy it */
6548
6549 return (-1);
6550 }
6551 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
6552 if (chk == NULL) {
6553 /* no memory */
6554 if (m_ack)
6555 sctp_m_freem(m_ack);
6556 return (-1);
6557 }
6558 sctppcbinfo.ipi_count_chunk++;
6559 sctppcbinfo.ipi_gencnt_chunk++;
6560
6561 /* figure out where it goes to */
6562 if (retrans) {
6563 /* we're doing a retransmission */
6564 if (stcb->asoc.used_alt_asconfack > 2) {
6565 /* tried alternate nets already, go back */
6566 chk->whoTo = NULL;
6567 } else {
6568 /* need to try and alternate net */
6569 chk->whoTo = sctp_find_alternate_net(stcb, stcb->asoc.last_control_chunk_from);
6570 stcb->asoc.used_alt_asconfack++;
6571 }
6572 if (chk->whoTo == NULL) {
6573 /* no alternate */
6574 if (stcb->asoc.last_control_chunk_from == NULL)
6575 chk->whoTo = stcb->asoc.primary_destination;
6576 else
6577 chk->whoTo = stcb->asoc.last_control_chunk_from;
6578 stcb->asoc.used_alt_asconfack = 0;
6579 }
6580 } else {
6581 /* normal case */
6582 if (stcb->asoc.last_control_chunk_from == NULL)
6583 chk->whoTo = stcb->asoc.primary_destination;
6584 else
6585 chk->whoTo = stcb->asoc.last_control_chunk_from;
6586 stcb->asoc.used_alt_asconfack = 0;
6587 }
6588 chk->data = m_ack;
6589 chk->send_size = m_ack->m_pkthdr.len;
6590 chk->rec.chunk_id = SCTP_ASCONF_ACK;
6591 chk->sent = SCTP_DATAGRAM_UNSENT;
6592 chk->snd_count = 0;
6593 chk->flags = 0;
6594 chk->asoc = &stcb->asoc;
6595 chk->whoTo->ref_count++;
6596 TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
6597 chk->asoc->ctrl_queue_cnt++;
6598 return (0);
6599 }
6600
6601
6602 static int
6603 sctp_chunk_retransmission(struct sctp_inpcb *inp,
6604 struct sctp_tcb *stcb,
6605 struct sctp_association *asoc,
6606 int *cnt_out, struct timeval *now, int *now_filled)
6607 {
6608 /*
6609 * send out one MTU of retransmission.
6610 * If fast_retransmit is happening we ignore the cwnd.
6611 * Otherwise we obey the cwnd and rwnd.
6612 * For a Cookie or Asconf in the control chunk queue we retransmit
6613 * them by themselves.
6614 *
6615 * For data chunks we will pick out the lowest TSN's in the
6616 * sent_queue marked for resend and bundle them all together
6617 * (up to a MTU of destination). The address to send to should
6618 * have been selected/changed where the retransmission was
6619 * marked (i.e. in FR or t3-timeout routines).
6620 */
6621 struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING];
6622 struct sctp_tmit_chunk *chk, *fwd;
6623 struct mbuf *m;
6624 struct sctphdr *shdr;
6625 int asconf;
6626 struct sctp_nets *net;
6627 int no_fragmentflg, bundle_at, cnt_thru;
6628 unsigned int mtu;
6629 int error, i, one_chunk, fwd_tsn, ctl_cnt, tmr_started;
6630
6631 tmr_started = ctl_cnt = bundle_at = error = 0;
6632 no_fragmentflg = 1;
6633 asconf = 0;
6634 fwd_tsn = 0;
6635 *cnt_out = 0;
6636 fwd = NULL;
6637 m = NULL;
6638 #ifdef SCTP_AUDITING_ENABLED
6639 sctp_audit_log(0xC3, 1);
6640 #endif
6641 if (TAILQ_EMPTY(&asoc->sent_queue)) {
6642 #ifdef SCTP_DEBUG
6643 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6644 kprintf("SCTP hits empty queue with cnt set to %d?\n",
6645 asoc->sent_queue_retran_cnt);
6646 }
6647 #endif
6648 asoc->sent_queue_cnt = 0;
6649 asoc->sent_queue_cnt_removeable = 0;
6650 }
6651 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
6652 if (chk->sent != SCTP_DATAGRAM_RESEND) {
6653 /* we only worry about things marked for resend */
6654 continue;
6655 }
6656 if ((chk->rec.chunk_id == SCTP_COOKIE_ECHO) ||
6657 (chk->rec.chunk_id == SCTP_ASCONF) ||
6658 (chk->rec.chunk_id == SCTP_STREAM_RESET) ||
6659 (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN)) {
6660 if (chk->rec.chunk_id == SCTP_STREAM_RESET) {
6661 /* For stream reset we only retran the request
6662 * not the response.
6663 */
6664 struct sctp_stream_reset_req *strreq;
6665 strreq = mtod(chk->data, struct sctp_stream_reset_req *);
6666 if (strreq->sr_req.ph.param_type != ntohs(SCTP_STR_RESET_REQUEST)) {
6667 continue;
6668 }
6669 }
6670 ctl_cnt++;
6671 if (chk->rec.chunk_id == SCTP_ASCONF) {
6672 no_fragmentflg = 1;
6673 asconf = 1;
6674 }
6675 if (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN) {
6676 fwd_tsn = 1;
6677 fwd = chk;
6678 }
6679 m = sctp_copy_mbufchain(chk->data, m);
6680 break;
6681 }
6682 }
6683 one_chunk = 0;
6684 cnt_thru = 0;
6685 /* do we have control chunks to retransmit? */
6686 if (m != NULL) {
6687 /* Start a timer no matter if we suceed or fail */
6688 if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) {
6689 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, chk->whoTo);
6690 } else if (chk->rec.chunk_id == SCTP_ASCONF)
6691 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, chk->whoTo);
6692
6693 if (m->m_len == 0) {
6694 /* Special case for when you get a 0 len
6695 * mbuf at the head due to the lack
6696 * of a MHDR at the beginning.
6697 */
6698 m->m_len = sizeof(struct sctphdr);
6699 } else {
6700 M_PREPEND(m, sizeof(struct sctphdr), MB_DONTWAIT);
6701 if (m == NULL) {
6702 return (ENOBUFS);
6703 }
6704 }
6705 shdr = mtod(m, struct sctphdr *);
6706 shdr->src_port = inp->sctp_lport;
6707 shdr->dest_port = stcb->rport;
6708 shdr->v_tag = htonl(stcb->asoc.peer_vtag);
6709 shdr->checksum = 0;
6710 chk->snd_count++; /* update our count */
6711
6712 if ((error = sctp_lowlevel_chunk_output(inp, stcb, chk->whoTo,
6713 (struct sockaddr *)&chk->whoTo->ro._l_addr, m,
6714 no_fragmentflg, 0, NULL, asconf))) {
6715 sctp_pegs[SCTP_DATA_OUT_ERR]++;
6716 return (error);
6717 }
6718 /*
6719 *We don't want to mark the net->sent time here since this
6720 * we use this for HB and retrans cannot measure RTT
6721 */
6722 /* SCTP_GETTIME_TIMEVAL(&chk->whoTo->last_sent_time);*/
6723 *cnt_out += 1;
6724 chk->sent = SCTP_DATAGRAM_SENT;
6725 asoc->sent_queue_retran_cnt--;
6726 if (asoc->sent_queue_retran_cnt < 0) {
6727 asoc->sent_queue_retran_cnt = 0;
6728 }
6729 if (fwd_tsn == 0) {
6730 return (0);
6731 } else {
6732 /* Clean up the fwd-tsn list */
6733 sctp_clean_up_ctl (asoc);
6734 return (0);
6735 }
6736 }
6737 /* Ok, it is just data retransmission we need to do or
6738 * that and a fwd-tsn with it all.
6739 */
6740 if (TAILQ_EMPTY(&asoc->sent_queue)) {
6741 return (-1);
6742 }
6743 #ifdef SCTP_DEBUG
6744 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6745 kprintf("Normal chunk retransmission cnt:%d\n",
6746 asoc->sent_queue_retran_cnt);
6747 }
6748 #endif
6749 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) ||
6750 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT)) {
6751 /* not yet open, resend the cookie and that is it */
6752 return (1);
6753 }
6754
6755
6756 #ifdef SCTP_AUDITING_ENABLED
6757 sctp_auditing(20, inp, stcb, NULL);
6758 #endif
6759 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
6760 if (chk->sent != SCTP_DATAGRAM_RESEND) {
6761 /* No, not sent to this net or not ready for rtx */
6762 continue;
6763
6764 }
6765 /* pick up the net */
6766 net = chk->whoTo;
6767 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
6768 mtu = (net->mtu - SCTP_MIN_OVERHEAD);
6769 } else {
6770 mtu = net->mtu- SCTP_MIN_V4_OVERHEAD;
6771 }
6772
6773 if ((asoc->peers_rwnd < mtu) && (asoc->total_flight > 0)) {
6774 /* No room in peers rwnd */
6775 uint32_t tsn;
6776 tsn = asoc->last_acked_seq + 1;
6777 if (tsn == chk->rec.data.TSN_seq) {
6778 /* we make a special exception for this case.
6779 * The peer has no rwnd but is missing the
6780 * lowest chunk.. which is probably what is
6781 * holding up the rwnd.
6782 */
6783 goto one_chunk_around;
6784 }
6785 #ifdef SCTP_DEBUG
6786 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
6787 kprintf("blocked-peers_rwnd:%d tf:%d\n",
6788 (int)asoc->peers_rwnd,
6789 (int)asoc->total_flight);
6790 }
6791 #endif
6792 sctp_pegs[SCTP_RWND_BLOCKED]++;
6793 return (1);
6794 }
6795 one_chunk_around:
6796 if (asoc->peers_rwnd < mtu) {
6797 one_chunk = 1;
6798 }
6799 #ifdef SCTP_AUDITING_ENABLED
6800 sctp_audit_log(0xC3, 2);
6801 #endif
6802 bundle_at = 0;
6803 m = NULL;
6804 net->fast_retran_ip = 0;
6805 if (chk->rec.data.doing_fast_retransmit == 0) {
6806 /* if no FR in progress skip destination that
6807 * have flight_size > cwnd.
6808 */
6809 if (net->flight_size >= net->cwnd) {
6810 sctp_pegs[SCTP_CWND_BLOCKED]++;
6811 continue;
6812 }
6813 } else {
6814 /* Mark the destination net to have FR recovery
6815 * limits put on it.
6816 */
6817 net->fast_retran_ip = 1;
6818 }
6819
6820 if ((chk->send_size <= mtu) || (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) {
6821 /* ok we will add this one */
6822 m = sctp_copy_mbufchain(chk->data, m);
6823 if (m == NULL) {
6824 return (ENOMEM);
6825 }
6826 /* upate our MTU size */
6827 /* Do clear IP_DF ? */
6828 if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
6829 no_fragmentflg = 0;
6830 }
6831 mtu -= chk->send_size;
6832 data_list[bundle_at++] = chk;
6833 if (one_chunk && (asoc->total_flight <= 0)) {
6834 sctp_pegs[SCTP_WINDOW_PROBES]++;
6835 chk->rec.data.state_flags |= SCTP_WINDOW_PROBE;
6836 }
6837 }
6838 if (one_chunk == 0) {
6839 /* now are there anymore forward from chk to pick up?*/
6840 fwd = TAILQ_NEXT(chk, sctp_next);
6841 while (fwd) {
6842 if (fwd->sent != SCTP_DATAGRAM_RESEND) {
6843 /* Nope, not for retran */
6844 fwd = TAILQ_NEXT(fwd, sctp_next);
6845 continue;
6846 }
6847 if (fwd->whoTo != net) {
6848 /* Nope, not the net in question */
6849 fwd = TAILQ_NEXT(fwd, sctp_next);
6850 continue;
6851 }
6852 if (fwd->send_size <= mtu) {
6853 m = sctp_copy_mbufchain(fwd->data, m);
6854 if (m == NULL) {
6855 return (ENOMEM);
6856 }
6857 /* upate our MTU size */
6858 /* Do clear IP_DF ? */
6859 if (fwd->flags & CHUNK_FLAGS_FRAGMENT_OK) {
6860 no_fragmentflg = 0;
6861 }
6862 mtu -= fwd->send_size;
6863 data_list[bundle_at++] = fwd;
6864 if (bundle_at >= SCTP_MAX_DATA_BUNDLING) {
6865 break;
6866 }
6867 fwd = TAILQ_NEXT(fwd, sctp_next);
6868 } else {
6869 /* can't fit so we are done */
6870 break;
6871 }
6872 }
6873 }
6874 /* Is there something to send for this destination? */
6875 if (m) {
6876 /* No matter if we fail/or suceed we should
6877 * start a timer. A failure is like a lost
6878 * IP packet :-)
6879 */
6880 if (!callout_pending(&net->rxt_timer.timer)) {
6881 /* no timer running on this destination
6882 * restart it.
6883 */
6884 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
6885 tmr_started = 1;
6886 }
6887 if (m->m_len == 0) {
6888 /* Special case for when you get a 0 len
6889 * mbuf at the head due to the lack
6890 * of a MHDR at the beginning.
6891 */
6892 m->m_len = sizeof(struct sctphdr);
6893 } else {
6894 M_PREPEND(m, sizeof(struct sctphdr), MB_DONTWAIT);
6895 if (m == NULL) {
6896 return (ENOBUFS);
6897 }
6898 }
6899 shdr = mtod(m, struct sctphdr *);
6900 shdr->src_port = inp->sctp_lport;
6901 shdr->dest_port = stcb->rport;
6902 shdr->v_tag = htonl(stcb->asoc.peer_vtag);
6903 shdr->checksum = 0;
6904
6905 /* Now lets send it, if there is anything to send :> */
6906 if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
6907 (struct sockaddr *)&net->ro._l_addr,
6908 m,
6909 no_fragmentflg, 0, NULL, asconf))) {
6910 /* error, we could not output */
6911 sctp_pegs[SCTP_DATA_OUT_ERR]++;
6912 return (error);
6913 }
6914 /* For HB's */
6915 /*
6916 * We don't want to mark the net->sent time here since
6917 * this we use this for HB and retrans cannot measure
6918 * RTT
6919 */
6920 /* SCTP_GETTIME_TIMEVAL(&net->last_sent_time);*/
6921
6922 /* For auto-close */
6923 cnt_thru++;
6924 if (*now_filled == 0) {
6925 SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent);
6926 *now = asoc->time_last_sent;
6927 *now_filled = 1;
6928 } else {
6929 asoc->time_last_sent = *now;
6930 }
6931 *cnt_out += bundle_at;
6932 #ifdef SCTP_AUDITING_ENABLED
6933 sctp_audit_log(0xC4, bundle_at);
6934 #endif
6935 for (i = 0; i < bundle_at; i++) {
6936 sctp_pegs[SCTP_RETRANTSN_SENT]++;
6937 data_list[i]->sent = SCTP_DATAGRAM_SENT;
6938 data_list[i]->snd_count++;
6939 asoc->sent_queue_retran_cnt--;
6940 /* record the time */
6941 data_list[i]->sent_rcv_time = asoc->time_last_sent;
6942 if (asoc->sent_queue_retran_cnt < 0) {
6943 asoc->sent_queue_retran_cnt = 0;
6944 }
6945 net->flight_size += data_list[i]->book_size;
6946 asoc->total_flight += data_list[i]->book_size;
6947 asoc->total_flight_count++;
6948
6949 #ifdef SCTP_LOG_RWND
6950 sctp_log_rwnd(SCTP_DECREASE_PEER_RWND,
6951 asoc->peers_rwnd , data_list[i]->send_size, sctp_peer_chunk_oh);
6952 #endif
6953 asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd,
6954 (u_int32_t)(data_list[i]->send_size + sctp_peer_chunk_oh));
6955 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
6956 /* SWS sender side engages */
6957 asoc->peers_rwnd = 0;
6958 }
6959
6960 if ((i == 0) &&
6961 (data_list[i]->rec.data.doing_fast_retransmit)) {
6962 sctp_pegs[SCTP_FAST_RETRAN]++;
6963 if ((data_list[i] == TAILQ_FIRST(&asoc->sent_queue)) &&
6964 (tmr_started == 0)) {
6965 /*
6966 * ok we just fast-retrans'd
6967 * the lowest TSN, i.e the
6968 * first on the list. In this
6969 * case we want to give some
6970 * more time to get a SACK
6971 * back without a t3-expiring.
6972 */
6973 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
6974 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
6975 }
6976 }
6977 }
6978 #ifdef SCTP_AUDITING_ENABLED
6979 sctp_auditing(21, inp, stcb, NULL);
6980 #endif
6981 } else {
6982 /* None will fit */
6983 return (1);
6984 }
6985 if (asoc->sent_queue_retran_cnt <= 0) {
6986 /* all done we have no more to retran */
6987 asoc->sent_queue_retran_cnt = 0;
6988 break;
6989 }
6990 if (one_chunk) {
6991 /* No more room in rwnd */
6992 return (1);
6993 }
6994 /* stop the for loop here. we sent out a packet */
6995 break;
6996 }
6997 return (0);
6998 }
6999
7000
7001 static int
7002 sctp_timer_validation(struct sctp_inpcb *inp,
7003 struct sctp_tcb *stcb,
7004 struct sctp_association *asoc,
7005 int ret)
7006 {
7007 struct sctp_nets *net;
7008 /* Validate that a timer is running somewhere */
7009 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
7010 if (callout_pending(&net->rxt_timer.timer)) {
7011 /* Here is a timer */
7012 return (ret);
7013 }
7014 }
7015 /* Gak, we did not have a timer somewhere */
7016 #ifdef SCTP_DEBUG
7017 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7018 kprintf("Deadlock avoided starting timer on a dest at retran\n");
7019 }
7020 #endif
7021 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->primary_destination);
7022 return (ret);
7023 }
7024
7025 int
7026 sctp_chunk_output(struct sctp_inpcb *inp,
7027 struct sctp_tcb *stcb,
7028 int from_where)
7029 {
7030 /* Ok this is the generic chunk service queue.
7031 * we must do the following:
7032 * - See if there are retransmits pending, if so we
7033 * must do these first and return.
7034 * - Service the stream queue that is next,
7035 * moving any message (note I must get a complete
7036 * message i.e. FIRST/MIDDLE and LAST to the out
7037 * queue in one pass) and assigning TSN's
7038 * - Check to see if the cwnd/rwnd allows any output, if
7039 * so we go ahead and fomulate and send the low level
7040 * chunks. Making sure to combine any control in the
7041 * control chunk queue also.
7042 */
7043 struct sctp_association *asoc;
7044 struct sctp_nets *net;
7045 int error, num_out, tot_out, ret, reason_code, burst_cnt, burst_limit;
7046 struct timeval now;
7047 int now_filled=0;
7048 int cwnd_full=0;
7049 asoc = &stcb->asoc;
7050 tot_out = 0;
7051 num_out = 0;
7052 reason_code = 0;
7053 sctp_pegs[SCTP_CALLS_TO_CO]++;
7054 #ifdef SCTP_DEBUG
7055 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7056 kprintf("in co - retran count:%d\n", asoc->sent_queue_retran_cnt);
7057 }
7058 #endif
7059 while (asoc->sent_queue_retran_cnt) {
7060 /* Ok, it is retransmission time only, we send out only ONE
7061 * packet with a single call off to the retran code.
7062 */
7063 ret = sctp_chunk_retransmission(inp, stcb, asoc, &num_out, &now, &now_filled);
7064 if (ret > 0) {
7065 /* Can't send anymore */
7066 #ifdef SCTP_DEBUG
7067 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7068 kprintf("retransmission ret:%d -- full\n", ret);
7069 }
7070 #endif
7071 /*
7072 * now lets push out control by calling med-level
7073 * output once. this assures that we WILL send HB's
7074 * if queued too.
7075 */
7076 sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1,
7077 &cwnd_full, from_where,
7078 &now, &now_filled);
7079 #ifdef SCTP_DEBUG
7080 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7081 kprintf("Control send outputs:%d@full\n", num_out);
7082 }
7083 #endif
7084 #ifdef SCTP_AUDITING_ENABLED
7085 sctp_auditing(8, inp, stcb, NULL);
7086 #endif
7087 return (sctp_timer_validation(inp, stcb, asoc, ret));
7088 }
7089 if (ret < 0) {
7090 /*
7091 * The count was off.. retran is not happening so do
7092 * the normal retransmission.
7093 */
7094 #ifdef SCTP_DEBUG
7095 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7096 kprintf("Done with retrans, none left fill up window\n");
7097 }
7098 #endif
7099 #ifdef SCTP_AUDITING_ENABLED
7100 sctp_auditing(9, inp, stcb, NULL);
7101 #endif
7102 break;
7103 }
7104 if (from_where == 1) {
7105 /* Only one transmission allowed out of a timeout */
7106 #ifdef SCTP_DEBUG
7107 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7108 kprintf("Only one packet allowed out\n");
7109 }
7110 #endif
7111 #ifdef SCTP_AUDITING_ENABLED
7112 sctp_auditing(10, inp, stcb, NULL);
7113 #endif
7114 /* Push out any control */
7115 sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, &cwnd_full, from_where,
7116 &now, &now_filled);
7117 return (ret);
7118 }
7119 if ((num_out == 0) && (ret == 0)) {
7120 /* No more retrans to send */
7121 break;
7122 }
7123 }
7124 #ifdef SCTP_AUDITING_ENABLED
7125 sctp_auditing(12, inp, stcb, NULL);
7126 #endif
7127 /* Check for bad destinations, if they exist move chunks around. */
7128 burst_limit = asoc->max_burst;
7129 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
7130 if ((net->dest_state & SCTP_ADDR_NOT_REACHABLE) ==
7131 SCTP_ADDR_NOT_REACHABLE) {
7132 /*
7133 * if possible move things off of this address
7134 * we still may send below due to the dormant state
7135 * but we try to find an alternate address to send
7136 * to and if we have one we move all queued data on
7137 * the out wheel to this alternate address.
7138 */
7139 sctp_move_to_an_alt(stcb, asoc, net);
7140 } else {
7141 /*
7142 if ((asoc->sat_network) || (net->addr_is_local)) {
7143 burst_limit = asoc->max_burst * SCTP_SAT_NETWORK_BURST_INCR;
7144 }
7145 */
7146 #ifdef SCTP_DEBUG
7147 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7148 kprintf("examined net:%p burst limit:%d\n", net, asoc->max_burst);
7149 }
7150 #endif
7151
7152 #ifdef SCTP_USE_ALLMAN_BURST
7153 if ((net->flight_size+(burst_limit*net->mtu)) < net->cwnd) {
7154 if (net->ssthresh < net->cwnd)
7155 net->ssthresh = net->cwnd;
7156 net->cwnd = (net->flight_size+(burst_limit*net->mtu));
7157 #ifdef SCTP_LOG_MAXBURST
7158 sctp_log_maxburst(net, 0, burst_limit, SCTP_MAX_BURST_APPLIED);
7159 #endif
7160 sctp_pegs[SCTP_MAX_BURST_APL]++;
7161 }
7162 net->fast_retran_ip = 0;
7163 #endif
7164 }
7165
7166 }
7167 /* Fill up what we can to the destination */
7168 burst_cnt = 0;
7169 cwnd_full = 0;
7170 do {
7171 #ifdef SCTP_DEBUG
7172 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7173 kprintf("Burst count:%d - call m-c-o\n", burst_cnt);
7174 }
7175 #endif
7176 error = sctp_med_chunk_output(inp, stcb, asoc, &num_out,
7177 &reason_code, 0, &cwnd_full, from_where,
7178 &now, &now_filled);
7179 if (error) {
7180 #ifdef SCTP_DEBUG
7181 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7182 kprintf("Error %d was returned from med-c-op\n", error);
7183 }
7184 #endif
7185 #ifdef SCTP_LOG_MAXBURST
7186 sctp_log_maxburst(asoc->primary_destination, error , burst_cnt, SCTP_MAX_BURST_ERROR_STOP);
7187 #endif
7188 break;
7189 }
7190 #ifdef SCTP_DEBUG
7191 if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
7192 kprintf("m-c-o put out %d\n", num_out);
7193 }
7194 #endif
7195 tot_out += num_out;
7196 burst_cnt++;
7197 } while (num_out
7198 #ifndef SCTP_USE_ALLMAN_BURST
7199 && (burst_cnt < burst_limit)
7200 #endif
7201 );
7202 #ifndef SCTP_USE_ALLMAN_BURST
7203 if (burst_cnt >= burst_limit) {
7204 sctp_pegs[SCTP_MAX_BURST_APL]++;
7205 asoc->burst_limit_applied = 1;
7206 #ifdef SCTP_LOG_MAXBURST
7207 sctp_log_maxburst(asoc->primary_destination, 0 , burst_cnt, SCTP_MAX_BURST_APPLIED);
7208 #endif
7209 } else {
7210 asoc->burst_limit_applied = 0;
7211 }
7212 #endif
7213
7214 #ifdef SCTP_DEBUG
7215 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7216 kprintf("Ok, we have put out %d chunks\n", tot_out);
7217 }
7218 #endif
7219 if (tot_out == 0) {
7220 sctp_pegs[SCTP_CO_NODATASNT]++;
7221 if (asoc->stream_queue_cnt > 0) {
7222 sctp_pegs[SCTP_SOS_NOSNT]++;
7223 } else {
7224 sctp_pegs[SCTP_NOS_NOSNT]++;
7225 }
7226 if (asoc->send_queue_cnt > 0) {
7227 sctp_pegs[SCTP_SOSE_NOSNT]++;
7228 } else {
7229 sctp_pegs[SCTP_NOSE_NOSNT]++;
7230 }
7231 }
7232 /* Now we need to clean up the control chunk chain if
7233 * a ECNE is on it. It must be marked as UNSENT again
7234 * so next call will continue to send it until
7235 * such time that we get a CWR, to remove it.
7236 */
7237 sctp_fix_ecn_echo(asoc);
7238 return (error);
7239 }
7240
7241
7242 int
7243 sctp_output(struct sctp_inpcb *inp, struct mbuf *m, struct sockaddr *addr,
7244 struct mbuf *control, struct thread *p, int flags)
7245 {
7246 struct inpcb *ip_inp;
7247 struct sctp_inpcb *t_inp;
7248 struct sctp_tcb *stcb;
7249 struct sctp_nets *net;
7250 struct sctp_association *asoc;
7251 int create_lock_applied = 0;
7252 int queue_only, error = 0;
7253 struct sctp_sndrcvinfo srcv;
7254 int un_sent = 0;
7255 int use_rcvinfo = 0;
7256 t_inp = inp;
7257 /* struct route ro;*/
7258
7259 crit_enter();
7260 queue_only = 0;
7261 ip_inp = (struct inpcb *)inp;
7262 stcb = NULL;
7263 asoc = NULL;
7264 net = NULL;
7265
7266 #ifdef SCTP_DEBUG
7267 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7268 kprintf("USR Send BEGINS\n");
7269 }
7270 #endif
7271
7272 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
7273 (inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING)) {
7274 /* The listner can NOT send */
7275 if (control) {
7276 sctppcbinfo.mbuf_track--;
7277 sctp_m_freem(control);
7278 control = NULL;
7279 }
7280 sctp_m_freem(m);
7281 crit_exit();
7282 return (EFAULT);
7283 }
7284 /* Can't allow a V6 address on a non-v6 socket */
7285 if (addr) {
7286 SCTP_ASOC_CREATE_LOCK(inp);
7287 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
7288 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
7289 /* Should I really unlock ? */
7290 SCTP_ASOC_CREATE_UNLOCK(inp);
7291 if (control) {
7292 sctppcbinfo.mbuf_track--;
7293 sctp_m_freem(control);
7294 control = NULL;
7295 }
7296 sctp_m_freem(m);
7297 crit_exit();
7298 return (EFAULT);
7299 }
7300 create_lock_applied = 1;
7301 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) &&
7302 (addr->sa_family == AF_INET6)) {
7303 SCTP_ASOC_CREATE_UNLOCK(inp);
7304 if (control) {
7305 sctppcbinfo.mbuf_track--;
7306 sctp_m_freem(control);
7307 control = NULL;
7308 }
7309 sctp_m_freem(m);
7310 crit_exit();
7311 return (EINVAL);
7312 }
7313 }
7314 if (control) {
7315 sctppcbinfo.mbuf_track++;
7316 if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&srcv, control,
7317 sizeof(srcv))) {
7318 if (srcv.sinfo_flags & MSG_SENDALL) {
7319 /* its a sendall */
7320 sctppcbinfo.mbuf_track--;
7321 sctp_m_freem(control);
7322 crit_exit();
7323 if (create_lock_applied) {
7324 SCTP_ASOC_CREATE_UNLOCK(inp);
7325 create_lock_applied = 0;
7326 }
7327 return (sctp_sendall(inp, NULL, m, &srcv));
7328 }
7329 if (srcv.sinfo_assoc_id) {
7330 if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
7331 SCTP_INP_RLOCK(inp);
7332 stcb = LIST_FIRST(&inp->sctp_asoc_list);
7333 if (stcb)
7334 SCTP_TCB_LOCK(stcb);
7335 SCTP_INP_RUNLOCK(inp);
7336
7337 if (stcb == NULL) {
7338 if (create_lock_applied) {
7339 SCTP_ASOC_CREATE_UNLOCK(inp);
7340 create_lock_applied = 0;
7341 }
7342 sctppcbinfo.mbuf_track--;
7343 sctp_m_freem(control);
7344 sctp_m_freem(m);
7345 crit_exit();
7346 return (ENOTCONN);
7347 }
7348 net = stcb->asoc.primary_destination;
7349 } else {
7350 stcb = sctp_findassociation_ep_asocid(inp, srcv.sinfo_assoc_id);
7351 }
7352 /*
7353 * Question: Should I error here if the
7354
7355 * assoc_id is no longer valid?
7356 * i.e. I can't find it?
7357 */
7358 if ((stcb) &&
7359 (addr != NULL)) {
7360 /* Must locate the net structure */
7361 if (addr)
7362 net = sctp_findnet(stcb, addr);
7363 }
7364 if (net == NULL)
7365 net = stcb->asoc.primary_destination;
7366 }
7367 use_rcvinfo = 1;
7368 }
7369 }
7370 if (stcb == NULL) {
7371 if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
7372 SCTP_INP_RLOCK(inp);
7373 stcb = LIST_FIRST(&inp->sctp_asoc_list);
7374 if (stcb)
7375 SCTP_TCB_LOCK(stcb);
7376 SCTP_INP_RUNLOCK(inp);
7377 if (stcb == NULL) {
7378 crit_exit();
7379 if (create_lock_applied) {
7380 SCTP_ASOC_CREATE_UNLOCK(inp);
7381 create_lock_applied = 0;
7382 }
7383 if (control) {
7384 sctppcbinfo.mbuf_track--;
7385 sctp_m_freem(control);
7386 control = NULL;
7387 }
7388 sctp_m_freem(m);
7389 return (ENOTCONN);
7390 }
7391 if (addr == NULL) {
7392 net = stcb->asoc.primary_destination;
7393 } else {
7394 net = sctp_findnet(stcb, addr);
7395 if (net == NULL) {
7396 net = stcb->asoc.primary_destination;
7397 }
7398 }
7399 } else {
7400 if (addr != NULL) {
7401 SCTP_INP_WLOCK(inp);
7402 SCTP_INP_INCR_REF(inp);
7403 SCTP_INP_WUNLOCK(inp);
7404 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL);
7405 if (stcb == NULL) {
7406 SCTP_INP_WLOCK(inp);
7407 SCTP_INP_DECR_REF(inp);
7408 SCTP_INP_WUNLOCK(inp);
7409 }
7410 }
7411 }
7412 }
7413 if ((stcb == NULL) &&
7414 (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)) {
7415 if (control) {
7416 sctppcbinfo.mbuf_track--;
7417 sctp_m_freem(control);
7418 control = NULL;
7419 }
7420 if (create_lock_applied) {
7421 SCTP_ASOC_CREATE_UNLOCK(inp);
7422 create_lock_applied = 0;
7423 }
7424 sctp_m_freem(m);
7425 crit_exit();
7426 return (ENOTCONN);
7427 } else if ((stcb == NULL) &&
7428 (addr == NULL)) {
7429 if (control) {
7430 sctppcbinfo.mbuf_track--;
7431 sctp_m_freem(control);
7432 control = NULL;
7433 }
7434 if (create_lock_applied) {
7435 SCTP_ASOC_CREATE_UNLOCK(inp);
7436 create_lock_applied = 0;
7437 }
7438 sctp_m_freem(m);
7439 crit_exit();
7440 return (ENOENT);
7441 } else if (stcb == NULL) {
7442 /* UDP mode, we must go ahead and start the INIT process */
7443 if ((use_rcvinfo) && (srcv.sinfo_flags & MSG_ABORT)) {
7444 /* Strange user to do this */
7445 if (control) {
7446 sctppcbinfo.mbuf_track--;
7447 sctp_m_freem(control);
7448 control = NULL;
7449 }
7450 if (create_lock_applied) {
7451 SCTP_ASOC_CREATE_UNLOCK(inp);
7452 create_lock_applied = 0;
7453 }
7454 sctp_m_freem(m);
7455 crit_exit();
7456 return (ENOENT);
7457 }
7458 stcb = sctp_aloc_assoc(inp, addr, 1, &error, 0);
7459 if (stcb == NULL) {
7460 if (control) {
7461 sctppcbinfo.mbuf_track--;
7462 sctp_m_freem(control);
7463 control = NULL;
7464 }
7465 if (create_lock_applied) {
7466 SCTP_ASOC_CREATE_UNLOCK(inp);
7467 create_lock_applied = 0;
7468 }
7469 sctp_m_freem(m);
7470 crit_exit();
7471 return (error);
7472 }
7473 if (create_lock_applied) {
7474 SCTP_ASOC_CREATE_UNLOCK(inp);
7475 create_lock_applied = 0;
7476 } else {
7477 kprintf("Huh-1, create lock should have been applied!\n");
7478 }
7479 queue_only = 1;
7480 asoc = &stcb->asoc;
7481 asoc->state = SCTP_STATE_COOKIE_WAIT;
7482 SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
7483 if (control) {
7484 /* see if a init structure exists in cmsg headers */
7485 struct sctp_initmsg initm;
7486 int i;
7487 if (sctp_find_cmsg(SCTP_INIT, (void *)&initm, control,
7488 sizeof(initm))) {
7489 /* we have an INIT override of the default */
7490 if (initm.sinit_max_attempts)
7491 asoc->max_init_times = initm.sinit_max_attempts;
7492 if (initm.sinit_num_ostreams)
7493 asoc->pre_open_streams = initm.sinit_num_ostreams;
7494 if (initm.sinit_max_instreams)
7495 asoc->max_inbound_streams = initm.sinit_max_instreams;
7496 if (initm.sinit_max_init_timeo)
7497 asoc->initial_init_rto_max = initm.sinit_max_init_timeo;
7498 }
7499 if (asoc->streamoutcnt < asoc->pre_open_streams) {
7500 /* Default is NOT correct */
7501 #ifdef SCTP_DEBUG
7502 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7503 kprintf("Ok, defout:%d pre_open:%d\n",
7504 asoc->streamoutcnt, asoc->pre_open_streams);
7505 }
7506 #endif
7507 FREE(asoc->strmout, M_PCB);
7508 asoc->strmout = NULL;
7509 asoc->streamoutcnt = asoc->pre_open_streams;
7510 MALLOC(asoc->strmout, struct sctp_stream_out *,
7511 asoc->streamoutcnt *
7512 sizeof(struct sctp_stream_out), M_PCB,
7513 MB_WAIT);
7514 for (i = 0; i < asoc->streamoutcnt; i++) {
7515 /*
7516 * inbound side must be set to 0xffff,
7517 * also NOTE when we get the INIT-ACK
7518 * back (for INIT sender) we MUST
7519 * reduce the count (streamoutcnt) but
7520 * first check if we sent to any of the
7521 * upper streams that were dropped (if
7522 * some were). Those that were dropped
7523 * must be notified to the upper layer
7524 * as failed to send.
7525 */
7526 asoc->strmout[i].next_sequence_sent = 0x0;
7527 TAILQ_INIT(&asoc->strmout[i].outqueue);
7528 asoc->strmout[i].stream_no = i;
7529 asoc->strmout[i].next_spoke.tqe_next = 0;
7530 asoc->strmout[i].next_spoke.tqe_prev = 0;
7531 }
7532 }
7533 }
7534 sctp_send_initiate(inp, stcb);
7535 /*
7536 * we may want to dig in after this call and adjust the MTU
7537 * value. It defaulted to 1500 (constant) but the ro structure
7538 * may now have an update and thus we may need to change it
7539 * BEFORE we append the message.
7540 */
7541 net = stcb->asoc.primary_destination;
7542 } else {
7543 if (create_lock_applied) {
7544 SCTP_ASOC_CREATE_UNLOCK(inp);
7545 create_lock_applied = 0;
7546 }
7547 asoc = &stcb->asoc;
7548 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
7549 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
7550 queue_only = 1;
7551 }
7552 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
7553 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
7554 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
7555 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
7556 if (control) {
7557 sctppcbinfo.mbuf_track--;
7558 sctp_m_freem(control);
7559 control = NULL;
7560 }
7561 if ((use_rcvinfo) &&
7562 (srcv.sinfo_flags & MSG_ABORT)) {
7563 sctp_msg_append(stcb, net, m, &srcv, flags);
7564 error = 0;
7565 } else {
7566 if (m)
7567 sctp_m_freem(m);
7568 error = ECONNRESET;
7569 }
7570 crit_exit();
7571 SCTP_TCB_UNLOCK(stcb);
7572 return (error);
7573 }
7574 }
7575 if (create_lock_applied) {
7576 /* we should never hit here with the create lock applied
7577 *
7578 */
7579 SCTP_ASOC_CREATE_UNLOCK(inp);
7580 create_lock_applied = 0;
7581 }
7582
7583
7584 if (use_rcvinfo == 0) {
7585 srcv = stcb->asoc.def_send;
7586 }
7587 #ifdef SCTP_DEBUG
7588 else {
7589 if (sctp_debug_on & SCTP_DEBUG_OUTPUT5) {
7590 kprintf("stream:%d\n", srcv.sinfo_stream);
7591 kprintf("flags:%x\n", (u_int)srcv.sinfo_flags);
7592 kprintf("ppid:%d\n", srcv.sinfo_ppid);
7593 kprintf("context:%d\n", srcv.sinfo_context);
7594 }
7595 }
7596 #endif
7597 if (control) {
7598 sctppcbinfo.mbuf_track--;
7599 sctp_m_freem(control);
7600 control = NULL;
7601 }
7602 if (net && ((srcv.sinfo_flags & MSG_ADDR_OVER))) {
7603 /* we take the override or the unconfirmed */
7604 ;
7605 } else {
7606 net = stcb->asoc.primary_destination;
7607 }
7608 if ((error = sctp_msg_append(stcb, net, m, &srcv, flags))) {
7609 SCTP_TCB_UNLOCK(stcb);
7610 crit_exit();
7611 return (error);
7612 }
7613 if (net->flight_size > net->cwnd) {
7614 sctp_pegs[SCTP_SENDTO_FULL_CWND]++;
7615 queue_only = 1;
7616 } else if (asoc->ifp_had_enobuf) {
7617 sctp_pegs[SCTP_QUEONLY_BURSTLMT]++;
7618 queue_only = 1;
7619 } else {
7620 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
7621 ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * sizeof(struct sctp_data_chunk)) +
7622 SCTP_MED_OVERHEAD);
7623
7624 if (((inp->sctp_flags & SCTP_PCB_FLAGS_NODELAY) == 0) &&
7625 (stcb->asoc.total_flight > 0) &&
7626 (un_sent < (int)stcb->asoc.smallest_mtu)
7627 ) {
7628
7629 /* Ok, Nagle is set on and we have
7630 * data outstanding. Don't send anything
7631 * and let the SACK drive out the data.
7632 */
7633 sctp_pegs[SCTP_NAGLE_NOQ]++;
7634 queue_only = 1;
7635 } else {
7636 sctp_pegs[SCTP_NAGLE_OFF]++;
7637 }
7638 }
7639 if ((queue_only == 0) && stcb->asoc.peers_rwnd) {
7640 /* we can attempt to send too.*/
7641 #ifdef SCTP_DEBUG
7642 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7643 kprintf("USR Send calls sctp_chunk_output\n");
7644 }
7645 #endif
7646 #ifdef SCTP_AUDITING_ENABLED
7647 sctp_audit_log(0xC0, 1);
7648 sctp_auditing(6, inp, stcb, net);
7649 #endif
7650 sctp_pegs[SCTP_OUTPUT_FRM_SND]++;
7651 sctp_chunk_output(inp, stcb, 0);
7652 #ifdef SCTP_AUDITING_ENABLED
7653 sctp_audit_log(0xC0, 2);
7654 sctp_auditing(7, inp, stcb, net);
7655 #endif
7656
7657 }
7658 #ifdef SCTP_DEBUG
7659 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
7660 kprintf("USR Send complete qo:%d prw:%d\n", queue_only, stcb->asoc.peers_rwnd);
7661 }
7662 #endif
7663 SCTP_TCB_UNLOCK(stcb);
7664 crit_exit();
7665 return (0);
7666 }
7667
7668 void
7669 send_forward_tsn(struct sctp_tcb *stcb,
7670 struct sctp_association *asoc)
7671 {
7672 struct sctp_tmit_chunk *chk;
7673 struct sctp_forward_tsn_chunk *fwdtsn;
7674
7675 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
7676 if (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN) {
7677 /* mark it to unsent */
7678 chk->sent = SCTP_DATAGRAM_UNSENT;
7679 chk->snd_count = 0;
7680 /* Do we correct its output location? */
7681 if (chk->whoTo != asoc->primary_destination) {
7682 sctp_free_remote_addr(chk->whoTo);
7683 chk->whoTo = asoc->primary_destination;
7684 chk->whoTo->ref_count++;
7685 }
7686 goto sctp_fill_in_rest;
7687 }
7688 }
7689 /* Ok if we reach here we must build one */
7690 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
7691 if (chk == NULL) {
7692 return;
7693 }
7694 sctppcbinfo.ipi_count_chunk++;
7695 sctppcbinfo.ipi_gencnt_chunk++;
7696 chk->rec.chunk_id = SCTP_FORWARD_CUM_TSN;
7697 chk->asoc = asoc;
7698 MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
7699 if (chk->data == NULL) {
7700 chk->whoTo->ref_count--;
7701 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
7702 sctppcbinfo.ipi_count_chunk--;
7703 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
7704 panic("Chunk count is negative");
7705 }
7706 sctppcbinfo.ipi_gencnt_chunk++;
7707 return;
7708 }
7709 chk->data->m_data += SCTP_MIN_OVERHEAD;
7710 chk->sent = SCTP_DATAGRAM_UNSENT;
7711 chk->snd_count = 0;
7712 chk->whoTo = asoc->primary_destination;
7713 chk->whoTo->ref_count++;
7714 TAILQ_INSERT_TAIL(&asoc->control_send_queue, chk, sctp_next);
7715 asoc->ctrl_queue_cnt++;
7716 sctp_fill_in_rest:
7717 /* Here we go through and fill out the part that
7718 * deals with stream/seq of the ones we skip.
7719 */
7720 chk->data->m_pkthdr.len = chk->data->m_len = 0;
7721 {
7722 struct sctp_tmit_chunk *at, *tp1, *last;
7723 struct sctp_strseq *strseq;
7724 unsigned int cnt_of_space, i, ovh;
7725 unsigned int space_needed;
7726 unsigned int cnt_of_skipped = 0;
7727 TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) {
7728 if (at->sent != SCTP_FORWARD_TSN_SKIP) {
7729 /* no more to look at */
7730 break;
7731 }
7732 if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) {
7733 /* We don't report these */
7734 continue;
7735 }
7736 cnt_of_skipped++;
7737 }
7738 space_needed = (sizeof(struct sctp_forward_tsn_chunk) +
7739 (cnt_of_skipped * sizeof(struct sctp_strseq)));
7740 if ((M_TRAILINGSPACE(chk->data) < (int)space_needed) &&
7741 ((chk->data->m_flags & M_EXT) == 0)) {
7742 /* Need a M_EXT, get one and move
7743 * fwdtsn to data area.
7744 */
7745 MCLGET(chk->data, MB_DONTWAIT);
7746 }
7747 cnt_of_space = M_TRAILINGSPACE(chk->data);
7748
7749 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
7750 ovh = SCTP_MIN_OVERHEAD;
7751 } else {
7752 ovh = SCTP_MIN_V4_OVERHEAD;
7753 }
7754 if (cnt_of_space > (asoc->smallest_mtu-ovh)) {
7755 /* trim to a mtu size */
7756 cnt_of_space = asoc->smallest_mtu - ovh;
7757 }
7758 if (cnt_of_space < space_needed) {
7759 /* ok we must trim down the chunk by lowering
7760 * the advance peer ack point.
7761 */
7762 cnt_of_skipped = (cnt_of_space-
7763 ((sizeof(struct sctp_forward_tsn_chunk))/
7764 sizeof(struct sctp_strseq)));
7765 /* Go through and find the TSN that
7766 * will be the one we report.
7767 */
7768 at = TAILQ_FIRST(&asoc->sent_queue);
7769 for (i = 0; i < cnt_of_skipped; i++) {
7770 tp1 = TAILQ_NEXT(at, sctp_next);
7771 at = tp1;
7772 }
7773 last = at;
7774 /* last now points to last one I can report, update peer ack point */
7775 asoc->advanced_peer_ack_point = last->rec.data.TSN_seq;
7776 space_needed -= (cnt_of_skipped * sizeof(struct sctp_strseq));
7777 }
7778 chk->send_size = space_needed;
7779 /* Setup the chunk */
7780 fwdtsn = mtod(chk->data, struct sctp_forward_tsn_chunk *);
7781 fwdtsn->ch.chunk_length = htons(chk->send_size);
7782 fwdtsn->ch.chunk_flags = 0;
7783 fwdtsn->ch.chunk_type = SCTP_FORWARD_CUM_TSN;
7784 fwdtsn->new_cumulative_tsn = htonl(asoc->advanced_peer_ack_point);
7785 chk->send_size = (sizeof(struct sctp_forward_tsn_chunk) +
7786 (cnt_of_skipped * sizeof(struct sctp_strseq)));
7787 chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
7788 fwdtsn++;
7789 /* Move pointer to after the fwdtsn and transfer to
7790 * the strseq pointer.
7791 */
7792 strseq = (struct sctp_strseq *)fwdtsn;
7793 /*
7794 * Now populate the strseq list. This is done blindly
7795 * without pulling out duplicate stream info. This is
7796 * inefficent but won't harm the process since the peer
7797 * will look at these in sequence and will thus release
7798 * anything. It could mean we exceed the PMTU and chop
7799 * off some that we could have included.. but this is
7800 * unlikely (aka 1432/4 would mean 300+ stream seq's would
7801 * have to be reported in one FWD-TSN. With a bit of work
7802 * we can later FIX this to optimize and pull out duplcates..
7803 * but it does add more overhead. So for now... not!
7804 */
7805 at = TAILQ_FIRST(&asoc->sent_queue);
7806 for (i = 0; i < cnt_of_skipped; i++) {
7807 tp1 = TAILQ_NEXT(at, sctp_next);
7808 if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) {
7809 /* We don't report these */
7810 i--;
7811 at = tp1;
7812 continue;
7813 }
7814 strseq->stream = ntohs(at->rec.data.stream_number);
7815 strseq->sequence = ntohs(at->rec.data.stream_seq);
7816 strseq++;
7817 at = tp1;
7818 }
7819 }
7820 return;
7821
7822 }
7823
7824 void
7825 sctp_send_sack(struct sctp_tcb *stcb)
7826 {
7827 /*
7828 * Queue up a SACK in the control queue. We must first check to
7829 * see if a SACK is somehow on the control queue. If so, we will
7830 * take and and remove the old one.
7831 */
7832 struct sctp_association *asoc;
7833 struct sctp_tmit_chunk *chk, *a_chk;
7834 struct sctp_sack_chunk *sack;
7835 struct sctp_gap_ack_block *gap_descriptor;
7836 uint32_t *dup;
7837 int start;
7838 unsigned int i, maxi, seeing_ones, m_size;
7839 unsigned int num_gap_blocks, space;
7840
7841 start = maxi = 0;
7842 seeing_ones = 1;
7843 a_chk = NULL;
7844 asoc = &stcb->asoc;
7845 if (asoc->last_data_chunk_from == NULL) {
7846 /* Hmm we never received anything */
7847 return;
7848 }
7849 sctp_set_rwnd(stcb, asoc);
7850 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
7851 if (chk->rec.chunk_id == SCTP_SELECTIVE_ACK) {
7852 /* Hmm, found a sack already on queue, remove it */
7853 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
7854 asoc->ctrl_queue_cnt++;
7855 a_chk = chk;
7856 if (a_chk->data)
7857 sctp_m_freem(a_chk->data);
7858 a_chk->data = NULL;
7859 sctp_free_remote_addr(a_chk->whoTo);
7860 a_chk->whoTo = NULL;
7861 break;
7862 }
7863 }
7864 if (a_chk == NULL) {
7865 a_chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
7866 if (a_chk == NULL) {
7867 /* No memory so we drop the idea, and set a timer */
7868 sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
7869 stcb->sctp_ep, stcb, NULL);
7870 sctp_timer_start(SCTP_TIMER_TYPE_RECV,
7871 stcb->sctp_ep, stcb, NULL);
7872 return;
7873 }
7874 sctppcbinfo.ipi_count_chunk++;
7875 sctppcbinfo.ipi_gencnt_chunk++;
7876 a_chk->rec.chunk_id = SCTP_SELECTIVE_ACK;
7877 }
7878 a_chk->asoc = asoc;
7879 a_chk->snd_count = 0;
7880 a_chk->send_size = 0; /* fill in later */
7881 a_chk->sent = SCTP_DATAGRAM_UNSENT;
7882 m_size = (asoc->mapping_array_size << 3);
7883
7884 if ((asoc->numduptsns) ||
7885 (asoc->last_data_chunk_from->dest_state & SCTP_ADDR_NOT_REACHABLE)
7886 ) {
7887 /* Ok, we have some duplicates or the destination for the
7888 * sack is unreachable, lets see if we can select an alternate
7889 * than asoc->last_data_chunk_from
7890 */
7891 if ((!(asoc->last_data_chunk_from->dest_state &
7892 SCTP_ADDR_NOT_REACHABLE)) &&
7893 (asoc->used_alt_onsack > 2)) {
7894 /* We used an alt last time, don't this time */
7895 a_chk->whoTo = NULL;
7896 } else {
7897 asoc->used_alt_onsack++;
7898 a_chk->whoTo = sctp_find_alternate_net(stcb, asoc->last_data_chunk_from);
7899 }
7900 if (a_chk->whoTo == NULL) {
7901 /* Nope, no alternate */
7902 a_chk->whoTo = asoc->last_data_chunk_from;
7903 asoc->used_alt_onsack = 0;
7904 }
7905 } else {
7906 /* No duplicates so we use the last
7907 * place we received data from.
7908 */
7909 #ifdef SCTP_DEBUG
7910 if (asoc->last_data_chunk_from == NULL) {
7911 kprintf("Huh, last_data_chunk_from is null when we want to sack??\n");
7912 }
7913 #endif
7914 asoc->used_alt_onsack = 0;
7915 a_chk->whoTo = asoc->last_data_chunk_from;
7916 }
7917 if (a_chk->whoTo)
7918 a_chk->whoTo->ref_count++;
7919
7920 /* Ok now lets formulate a MBUF with our sack */
7921 MGETHDR(a_chk->data, MB_DONTWAIT, MT_DATA);
7922 if ((a_chk->data == NULL) ||
7923 (a_chk->whoTo == NULL)) {
7924 /* rats, no mbuf memory */
7925 if (a_chk->data) {
7926 /* was a problem with the destination */
7927 sctp_m_freem(a_chk->data);
7928 a_chk->data = NULL;
7929 }
7930 a_chk->whoTo->ref_count--;
7931 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, a_chk);
7932 sctppcbinfo.ipi_count_chunk--;
7933 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
7934 panic("Chunk count is negative");
7935 }
7936 sctppcbinfo.ipi_gencnt_chunk++;
7937 sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
7938 stcb->sctp_ep, stcb, NULL);
7939 sctp_timer_start(SCTP_TIMER_TYPE_RECV,
7940 stcb->sctp_ep, stcb, NULL);
7941 return;
7942 }
7943 /* First count the number of gap ack blocks we need */
7944 if (asoc->highest_tsn_inside_map == asoc->cumulative_tsn) {
7945 /* We know if there are none above the cum-ack we
7946 * have everything with NO gaps
7947 */
7948 num_gap_blocks = 0;
7949 } else {
7950 /* Ok we must count how many gaps we
7951 * have.
7952 */
7953 num_gap_blocks = 0;
7954 if (asoc->highest_tsn_inside_map >= asoc->mapping_array_base_tsn) {
7955 maxi = (asoc->highest_tsn_inside_map - asoc->mapping_array_base_tsn);
7956 } else {
7957 maxi = (asoc->highest_tsn_inside_map + (MAX_TSN - asoc->mapping_array_base_tsn) + 1);
7958 }
7959 if (maxi > m_size) {
7960 /* impossible but who knows, someone is playing with us :> */
7961 #ifdef SCTP_DEBUG
7962 kprintf("GAK maxi:%d > m_size:%d came out higher than allowed htsn:%u base:%u cumack:%u\n",
7963 maxi,
7964 m_size,
7965 asoc->highest_tsn_inside_map,
7966 asoc->mapping_array_base_tsn,
7967 asoc->cumulative_tsn
7968 );
7969 #endif
7970 num_gap_blocks = 0;
7971 goto no_gaps_now;
7972 }
7973 if (asoc->cumulative_tsn >= asoc->mapping_array_base_tsn) {
7974 start = (asoc->cumulative_tsn - asoc->mapping_array_base_tsn);
7975 } else {
7976 /* Set it so we start at 0 */
7977 start = -1;
7978 }
7979 /* Ok move start up one to look at the NEXT past the cum-ack */
7980 start++;
7981 for (i = start; i <= maxi; i++) {
7982 if (seeing_ones) {
7983 /* while seeing ones I must
7984 * transition back to 0 before
7985 * finding the next gap and
7986 * counting the segment.
7987 */
7988 if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i) == 0) {
7989 seeing_ones = 0;
7990 }
7991 } else {
7992 if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i)) {
7993 seeing_ones = 1;
7994 num_gap_blocks++;
7995 }
7996 }
7997 }
7998 no_gaps_now:
7999 if (num_gap_blocks == 0) {
8000 /*
8001 * Traveled all of the bits and NO one,
8002 * must have reneged
8003 */
8004 if (compare_with_wrap(asoc->cumulative_tsn, asoc->highest_tsn_inside_map, MAX_TSN)) {
8005 asoc->highest_tsn_inside_map = asoc->cumulative_tsn;
8006 #ifdef SCTP_MAP_LOGGING
8007 sctp_log_map(0, 4, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
8008 #endif
8009 }
8010 }
8011 }
8012
8013 /* Now calculate the space needed */
8014 space = (sizeof(struct sctp_sack_chunk) +
8015 (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
8016 (asoc->numduptsns * sizeof(int32_t))
8017 );
8018 if (space > (asoc->smallest_mtu-SCTP_MAX_OVERHEAD)) {
8019 /* Reduce the size of the sack to fit */
8020 int calc, fit;
8021 calc = (asoc->smallest_mtu - SCTP_MAX_OVERHEAD);
8022 calc -= sizeof(struct sctp_gap_ack_block);
8023 fit = calc/sizeof(struct sctp_gap_ack_block);
8024 if (fit > (int)num_gap_blocks) {
8025 /* discard some dups */
8026 asoc->numduptsns = (fit - num_gap_blocks);
8027 } else {
8028 /* discard all dups and some gaps */
8029 num_gap_blocks = fit;
8030 asoc->numduptsns = 0;
8031 }
8032 /* recalc space */
8033 space = (sizeof(struct sctp_sack_chunk) +
8034 (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
8035 (asoc->numduptsns * sizeof(int32_t))
8036 );
8037
8038 }
8039
8040 if ((space+SCTP_MIN_OVERHEAD) > MHLEN) {
8041 /* We need a cluster */
8042 MCLGET(a_chk->data, MB_DONTWAIT);
8043 if ((a_chk->data->m_flags & M_EXT) != M_EXT) {
8044 /* can't get a cluster
8045 * give up and try later.
8046 */
8047 if (a_chk->data)
8048 sctp_m_freem(a_chk->data);
8049 a_chk->data = NULL;
8050 a_chk->whoTo->ref_count--;
8051 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, a_chk);
8052 sctppcbinfo.ipi_count_chunk--;
8053 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8054 panic("Chunk count is negative");
8055 }
8056 sctppcbinfo.ipi_gencnt_chunk++;
8057 sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
8058 stcb->sctp_ep, stcb, NULL);
8059 sctp_timer_start(SCTP_TIMER_TYPE_RECV,
8060 stcb->sctp_ep, stcb, NULL);
8061 return;
8062 }
8063 }
8064
8065 /* ok, lets go through and fill it in */
8066 a_chk->data->m_data += SCTP_MIN_OVERHEAD;
8067 sack = mtod(a_chk->data, struct sctp_sack_chunk *);
8068 sack->ch.chunk_type = SCTP_SELECTIVE_ACK;
8069 sack->ch.chunk_flags = asoc->receiver_nonce_sum & SCTP_SACK_NONCE_SUM;
8070 sack->sack.cum_tsn_ack = htonl(asoc->cumulative_tsn);
8071 sack->sack.a_rwnd = htonl(asoc->my_rwnd);
8072 asoc->my_last_reported_rwnd = asoc->my_rwnd;
8073 sack->sack.num_gap_ack_blks = htons(num_gap_blocks);
8074 sack->sack.num_dup_tsns = htons(asoc->numduptsns);
8075
8076 a_chk->send_size = (sizeof(struct sctp_sack_chunk) +
8077 (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
8078 (asoc->numduptsns * sizeof(int32_t)));
8079 a_chk->data->m_pkthdr.len = a_chk->data->m_len = a_chk->send_size;
8080 sack->ch.chunk_length = htons(a_chk->send_size);
8081
8082 gap_descriptor = (struct sctp_gap_ack_block *)((caddr_t)sack + sizeof(struct sctp_sack_chunk));
8083 seeing_ones = 0;
8084 for (i = start; i <= maxi; i++) {
8085 if (num_gap_blocks == 0) {
8086 break;
8087 }
8088 if (seeing_ones) {
8089 /* while seeing Ones I must
8090 * transition back to 0 before
8091 * finding the next gap
8092 */
8093 if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i) == 0) {
8094 gap_descriptor->end = htons(((uint16_t)(i-start)));
8095 gap_descriptor++;
8096 seeing_ones = 0;
8097 num_gap_blocks--;
8098 }
8099 } else {
8100 if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i)) {
8101 gap_descriptor->start = htons(((uint16_t)(i+1-start)));
8102 /* advance struct to next pointer */
8103 seeing_ones = 1;
8104 }
8105 }
8106 }
8107 if (num_gap_blocks) {
8108 /* special case where the array is all 1's
8109 * to the end of the array.
8110 */
8111 gap_descriptor->end = htons(((uint16_t)((i-start))));
8112 gap_descriptor++;
8113 }
8114 /* now we must add any dups we are going to report. */
8115 if (asoc->numduptsns) {
8116 dup = (uint32_t *)gap_descriptor;
8117 for (i = 0; i < asoc->numduptsns; i++) {
8118 *dup = htonl(asoc->dup_tsns[i]);
8119 dup++;
8120 }
8121 asoc->numduptsns = 0;
8122 }
8123 /* now that the chunk is prepared queue it to the control
8124 * chunk queue.
8125 */
8126 TAILQ_INSERT_TAIL(&asoc->control_send_queue, a_chk, sctp_next);
8127 asoc->ctrl_queue_cnt++;
8128 sctp_pegs[SCTP_PEG_SACKS_SENT]++;
8129 return;
8130 }
8131
8132 void
8133 sctp_send_abort_tcb(struct sctp_tcb *stcb, struct mbuf *operr)
8134 {
8135 struct mbuf *m_abort;
8136 struct sctp_abort_msg *abort_m;
8137 int sz;
8138 abort_m = NULL;
8139 MGETHDR(m_abort, MB_DONTWAIT, MT_HEADER);
8140 if (m_abort == NULL) {
8141 /* no mbuf's */
8142 return;
8143 }
8144 m_abort->m_data += SCTP_MIN_OVERHEAD;
8145 abort_m = mtod(m_abort, struct sctp_abort_msg *);
8146 m_abort->m_len = sizeof(struct sctp_abort_msg);
8147 m_abort->m_next = operr;
8148 sz = 0;
8149 if (operr) {
8150 struct mbuf *n;
8151 n = operr;
8152 while (n) {
8153 sz += n->m_len;
8154 n = n->m_next;
8155 }
8156 }
8157 abort_m->msg.ch.chunk_type = SCTP_ABORT_ASSOCIATION;
8158 abort_m->msg.ch.chunk_flags = 0;
8159 abort_m->msg.ch.chunk_length = htons(sizeof(struct sctp_abort_chunk) +
8160 sz);
8161 abort_m->sh.src_port = stcb->sctp_ep->sctp_lport;
8162 abort_m->sh.dest_port = stcb->rport;
8163 abort_m->sh.v_tag = htonl(stcb->asoc.peer_vtag);
8164 abort_m->sh.checksum = 0;
8165 m_abort->m_pkthdr.len = m_abort->m_len + sz;
8166 m_abort->m_pkthdr.rcvif = 0;
8167 sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb,
8168 stcb->asoc.primary_destination,
8169 (struct sockaddr *)&stcb->asoc.primary_destination->ro._l_addr,
8170 m_abort, 1, 0, NULL, 0);
8171 }
8172
8173 int
8174 sctp_send_shutdown_complete(struct sctp_tcb *stcb,
8175 struct sctp_nets *net)
8176
8177 {
8178 /* formulate and SEND a SHUTDOWN-COMPLETE */
8179 struct mbuf *m_shutdown_comp;
8180 struct sctp_shutdown_complete_msg *comp_cp;
8181
8182 m_shutdown_comp = NULL;
8183 MGETHDR(m_shutdown_comp, MB_DONTWAIT, MT_HEADER);
8184 if (m_shutdown_comp == NULL) {
8185 /* no mbuf's */
8186 return (-1);
8187 }
8188 m_shutdown_comp->m_data += sizeof(struct ip6_hdr);
8189 comp_cp = mtod(m_shutdown_comp, struct sctp_shutdown_complete_msg *);
8190 comp_cp->shut_cmp.ch.chunk_type = SCTP_SHUTDOWN_COMPLETE;
8191 comp_cp->shut_cmp.ch.chunk_flags = 0;
8192 comp_cp->shut_cmp.ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk));
8193 comp_cp->sh.src_port = stcb->sctp_ep->sctp_lport;
8194 comp_cp->sh.dest_port = stcb->rport;
8195 comp_cp->sh.v_tag = htonl(stcb->asoc.peer_vtag);
8196 comp_cp->sh.checksum = 0;
8197
8198 m_shutdown_comp->m_pkthdr.len = m_shutdown_comp->m_len = sizeof(struct sctp_shutdown_complete_msg);
8199 m_shutdown_comp->m_pkthdr.rcvif = 0;
8200 sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net,
8201 (struct sockaddr *)&net->ro._l_addr, m_shutdown_comp,
8202 1, 0, NULL, 0);
8203 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
8204 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
8205 stcb->sctp_ep->sctp_flags &= ~SCTP_PCB_FLAGS_CONNECTED;
8206 stcb->sctp_ep->sctp_socket->so_snd.ssb_cc = 0;
8207 soisdisconnected(stcb->sctp_ep->sctp_socket);
8208 }
8209 return (0);
8210 }
8211
8212 int
8213 sctp_send_shutdown_complete2(struct mbuf *m, int iphlen, struct sctphdr *sh)
8214 {
8215 /* formulate and SEND a SHUTDOWN-COMPLETE */
8216 struct mbuf *mout;
8217 struct ip *iph, *iph_out;
8218 struct ip6_hdr *ip6, *ip6_out;
8219 int offset_out;
8220 struct sctp_shutdown_complete_msg *comp_cp;
8221
8222 MGETHDR(mout, MB_DONTWAIT, MT_HEADER);
8223 if (mout == NULL) {
8224 /* no mbuf's */
8225 return (-1);
8226 }
8227 iph = mtod(m, struct ip *);
8228 iph_out = NULL;
8229 ip6_out = NULL;
8230 offset_out = 0;
8231 if (iph->ip_v == IPVERSION) {
8232 mout->m_len = sizeof(struct ip) +
8233 sizeof(struct sctp_shutdown_complete_msg);
8234 mout->m_next = NULL;
8235 iph_out = mtod(mout, struct ip *);
8236
8237 /* Fill in the IP header for the ABORT */
8238 iph_out->ip_v = IPVERSION;
8239 iph_out->ip_hl = (sizeof(struct ip)/4);
8240 iph_out->ip_tos = (u_char)0;
8241 iph_out->ip_id = 0;
8242 iph_out->ip_off = 0;
8243 iph_out->ip_ttl = MAXTTL;
8244 iph_out->ip_p = IPPROTO_SCTP;
8245 iph_out->ip_src.s_addr = iph->ip_dst.s_addr;
8246 iph_out->ip_dst.s_addr = iph->ip_src.s_addr;
8247
8248 /* let IP layer calculate this */
8249 iph_out->ip_sum = 0;
8250 offset_out += sizeof(*iph_out);
8251 comp_cp = (struct sctp_shutdown_complete_msg *)(
8252 (caddr_t)iph_out + offset_out);
8253 } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
8254 ip6 = (struct ip6_hdr *)iph;
8255 mout->m_len = sizeof(struct ip6_hdr) +
8256 sizeof(struct sctp_shutdown_complete_msg);
8257 mout->m_next = NULL;
8258 ip6_out = mtod(mout, struct ip6_hdr *);
8259
8260 /* Fill in the IPv6 header for the ABORT */
8261 ip6_out->ip6_flow = ip6->ip6_flow;
8262 ip6_out->ip6_hlim = ip6_defhlim;
8263 ip6_out->ip6_nxt = IPPROTO_SCTP;
8264 ip6_out->ip6_src = ip6->ip6_dst;
8265 ip6_out->ip6_dst = ip6->ip6_src;
8266 ip6_out->ip6_plen = mout->m_len;
8267 offset_out += sizeof(*ip6_out);
8268 comp_cp = (struct sctp_shutdown_complete_msg *)(
8269 (caddr_t)ip6_out + offset_out);
8270 } else {
8271 /* Currently not supported. */
8272 return (-1);
8273 }
8274
8275 /* Now copy in and fill in the ABORT tags etc. */
8276 comp_cp->sh.src_port = sh->dest_port;
8277 comp_cp->sh.dest_port = sh->src_port;
8278 comp_cp->sh.checksum = 0;
8279 comp_cp->sh.v_tag = sh->v_tag;
8280 comp_cp->shut_cmp.ch.chunk_flags = SCTP_HAD_NO_TCB;
8281 comp_cp->shut_cmp.ch.chunk_type = SCTP_SHUTDOWN_COMPLETE;
8282 comp_cp->shut_cmp.ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk));
8283
8284 mout->m_pkthdr.len = mout->m_len;
8285 /* add checksum */
8286 if ((sctp_no_csum_on_loopback) &&
8287 (m->m_pkthdr.rcvif) &&
8288 (m->m_pkthdr.rcvif->if_type == IFT_LOOP)) {
8289 comp_cp->sh.checksum = 0;
8290 } else {
8291 comp_cp->sh.checksum = sctp_calculate_sum(mout, NULL, offset_out);
8292 }
8293
8294 /* zap the rcvif, it should be null */
8295 mout->m_pkthdr.rcvif = 0;
8296 /* zap the stack pointer to the route */
8297 if (iph_out != NULL) {
8298 struct route ro;
8299
8300 bzero(&ro, sizeof ro);
8301 #ifdef SCTP_DEBUG
8302 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
8303 kprintf("sctp_shutdown_complete2 calling ip_output:\n");
8304 sctp_print_address_pkt(iph_out, &comp_cp->sh);
8305 }
8306 #endif
8307 /* set IPv4 length */
8308 #if defined(__FreeBSD__)
8309 iph_out->ip_len = mout->m_pkthdr.len;
8310 #else
8311 iph_out->ip_len = htons(mout->m_pkthdr.len);
8312 #endif
8313 /* out it goes */
8314 ip_output(mout, 0, &ro, IP_RAWOUTPUT, NULL
8315 #if defined(__OpenBSD__) || (defined(__FreeBSD__) && __FreeBSD_version >= 480000) \
8316 || defined(__NetBSD__) || defined(__DragonFly__)
8317 , NULL
8318 #endif
8319 );
8320 /* Free the route if we got one back */
8321 if (ro.ro_rt)
8322 RTFREE(ro.ro_rt);
8323 } else if (ip6_out != NULL) {
8324 #ifdef NEW_STRUCT_ROUTE
8325 struct route ro;
8326 #else
8327 struct route_in6 ro;
8328 #endif
8329
8330 bzero(&ro, sizeof(ro));
8331 #ifdef SCTP_DEBUG
8332 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
8333 kprintf("sctp_shutdown_complete2 calling ip6_output:\n");
8334 sctp_print_address_pkt((struct ip *)ip6_out,
8335 &comp_cp->sh);
8336 }
8337 #endif
8338 ip6_output(mout, NULL, &ro, 0, NULL, NULL
8339 #if defined(__NetBSD__)
8340 , NULL
8341 #endif
8342 #if (defined(__FreeBSD__) && __FreeBSD_version >= 480000) || defined(__DragonFly__)
8343 , NULL
8344 #endif
8345 );
8346 /* Free the route if we got one back */
8347 if (ro.ro_rt)
8348 RTFREE(ro.ro_rt);
8349 }
8350 sctp_pegs[SCTP_DATAGRAMS_SENT]++;
8351 return (0);
8352 }
8353
8354 static struct sctp_nets *
8355 sctp_select_hb_destination(struct sctp_tcb *stcb, struct timeval *now)
8356 {
8357 struct sctp_nets *net, *hnet;
8358 int ms_goneby, highest_ms, state_overide=0;
8359
8360 SCTP_GETTIME_TIMEVAL(now);
8361 highest_ms = 0;
8362 hnet = NULL;
8363 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
8364 if (
8365 ((net->dest_state & SCTP_ADDR_NOHB) && ((net->dest_state & SCTP_ADDR_UNCONFIRMED) == 0)) ||
8366 (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)
8367 ) {
8368 /* Skip this guy from consideration if HB is off AND its confirmed*/
8369 #ifdef SCTP_DEBUG
8370 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8371 kprintf("Skipping net:%p state:%d nohb/out-of-scope\n",
8372 net, net->dest_state);
8373 }
8374 #endif
8375 continue;
8376 }
8377 if (sctp_destination_is_reachable(stcb, (struct sockaddr *)&net->ro._l_addr) == 0) {
8378 /* skip this dest net from consideration */
8379 #ifdef SCTP_DEBUG
8380 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8381 kprintf("Skipping net:%p reachable NOT\n",
8382 net);
8383 }
8384 #endif
8385 continue;
8386 }
8387 if (net->last_sent_time.tv_sec) {
8388 /* Sent to so we subtract */
8389 ms_goneby = (now->tv_sec - net->last_sent_time.tv_sec) * 1000;
8390 } else
8391 /* Never been sent to */
8392 ms_goneby = 0x7fffffff;
8393 #ifdef SCTP_DEBUG
8394 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8395 kprintf("net:%p ms_goneby:%d\n",
8396 net, ms_goneby);
8397 }
8398 #endif
8399 /* When the address state is unconfirmed but still considered reachable, we
8400 * HB at a higher rate. Once it goes confirmed OR reaches the "unreachable"
8401 * state, thenw we cut it back to HB at a more normal pace.
8402 */
8403 if ((net->dest_state & (SCTP_ADDR_UNCONFIRMED|SCTP_ADDR_NOT_REACHABLE)) == SCTP_ADDR_UNCONFIRMED) {
8404 state_overide = 1;
8405 } else {
8406 state_overide = 0;
8407 }
8408
8409 if ((((unsigned int)ms_goneby >= net->RTO) || (state_overide)) &&
8410 (ms_goneby > highest_ms)) {
8411 highest_ms = ms_goneby;
8412 hnet = net;
8413 #ifdef SCTP_DEBUG
8414 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8415 kprintf("net:%p is the new high\n",
8416 net);
8417 }
8418 #endif
8419 }
8420 }
8421 if (hnet &&
8422 ((hnet->dest_state & (SCTP_ADDR_UNCONFIRMED|SCTP_ADDR_NOT_REACHABLE)) == SCTP_ADDR_UNCONFIRMED)) {
8423 state_overide = 1;
8424 } else {
8425 state_overide = 0;
8426 }
8427
8428 if (highest_ms && (((unsigned int)highest_ms >= hnet->RTO) || state_overide)) {
8429 /* Found the one with longest delay bounds
8430 * OR it is unconfirmed and still not marked
8431 * unreachable.
8432 */
8433 #ifdef SCTP_DEBUG
8434 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8435 kprintf("net:%p is the hb winner -",
8436 hnet);
8437 if (hnet)
8438 sctp_print_address((struct sockaddr *)&hnet->ro._l_addr);
8439 else
8440 kprintf(" none\n");
8441 }
8442 #endif
8443 /* update the timer now */
8444 hnet->last_sent_time = *now;
8445 return (hnet);
8446 }
8447 /* Nothing to HB */
8448 return (NULL);
8449 }
8450
8451 int
8452 sctp_send_hb(struct sctp_tcb *stcb, int user_req, struct sctp_nets *u_net)
8453 {
8454 struct sctp_tmit_chunk *chk;
8455 struct sctp_nets *net;
8456 struct sctp_heartbeat_chunk *hb;
8457 struct timeval now;
8458 struct sockaddr_in *sin;
8459 struct sockaddr_in6 *sin6;
8460
8461 if (user_req == 0) {
8462 net = sctp_select_hb_destination(stcb, &now);
8463 if (net == NULL) {
8464 /* All our busy none to send to, just
8465 * start the timer again.
8466 */
8467 if (stcb->asoc.state == 0) {
8468 return (0);
8469 }
8470 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT,
8471 stcb->sctp_ep,
8472 stcb,
8473 net);
8474 return (0);
8475 }
8476 #ifndef SCTP_USE_ALLMAN_BURST
8477 else {
8478 /* found one idle.. decay cwnd on this one
8479 * by 1/2 if none outstanding.
8480 */
8481
8482 if (net->flight_size == 0) {
8483 net->cwnd /= 2;
8484 if (net->addr_is_local) {
8485 if (net->cwnd < (net->mtu *4)) {
8486 net->cwnd = net->mtu * 4;
8487 }
8488 } else {
8489 if (net->cwnd < (net->mtu * 2)) {
8490 net->cwnd = net->mtu * 2;
8491 }
8492 }
8493
8494 }
8495
8496 }
8497 #endif
8498 } else {
8499 net = u_net;
8500 if (net == NULL) {
8501 return (0);
8502 }
8503 SCTP_GETTIME_TIMEVAL(&now);
8504 }
8505 sin = (struct sockaddr_in *)&net->ro._l_addr;
8506 if (sin->sin_family != AF_INET) {
8507 if (sin->sin_family != AF_INET6) {
8508 /* huh */
8509 return (0);
8510 }
8511 }
8512 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8513 if (chk == NULL) {
8514 #ifdef SCTP_DEBUG
8515 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8516 kprintf("Gak, can't get a chunk for hb\n");
8517 }
8518 #endif
8519 return (0);
8520 }
8521 sctppcbinfo.ipi_gencnt_chunk++;
8522 sctppcbinfo.ipi_count_chunk++;
8523 chk->rec.chunk_id = SCTP_HEARTBEAT_REQUEST;
8524 chk->asoc = &stcb->asoc;
8525 chk->send_size = sizeof(struct sctp_heartbeat_chunk);
8526 MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
8527 if (chk->data == NULL) {
8528 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8529 sctppcbinfo.ipi_count_chunk--;
8530 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8531 panic("Chunk count is negative");
8532 }
8533 sctppcbinfo.ipi_gencnt_chunk++;
8534 return (0);
8535 }
8536 chk->data->m_data += SCTP_MIN_OVERHEAD;
8537 chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8538 chk->sent = SCTP_DATAGRAM_UNSENT;
8539 chk->snd_count = 0;
8540 chk->whoTo = net;
8541 chk->whoTo->ref_count++;
8542 /* Now we have a mbuf that we can fill in with the details */
8543 hb = mtod(chk->data, struct sctp_heartbeat_chunk *);
8544
8545 /* fill out chunk header */
8546 hb->ch.chunk_type = SCTP_HEARTBEAT_REQUEST;
8547 hb->ch.chunk_flags = 0;
8548 hb->ch.chunk_length = htons(chk->send_size);
8549 /* Fill out hb parameter */
8550 hb->heartbeat.hb_info.ph.param_type = htons(SCTP_HEARTBEAT_INFO);
8551 hb->heartbeat.hb_info.ph.param_length = htons(sizeof(struct sctp_heartbeat_info_param));
8552 hb->heartbeat.hb_info.time_value_1 = now.tv_sec;
8553 hb->heartbeat.hb_info.time_value_2 = now.tv_usec;
8554 /* Did our user request this one, put it in */
8555 hb->heartbeat.hb_info.user_req = user_req;
8556 hb->heartbeat.hb_info.addr_family = sin->sin_family;
8557 hb->heartbeat.hb_info.addr_len = sin->sin_len;
8558 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) {
8559 /* we only take from the entropy pool if the address is
8560 * not confirmed.
8561 */
8562 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
8563 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
8564 } else {
8565 net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = 0;
8566 net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = 0;
8567 }
8568 if (sin->sin_family == AF_INET) {
8569 memcpy(hb->heartbeat.hb_info.address, &sin->sin_addr, sizeof(sin->sin_addr));
8570 } else if (sin->sin_family == AF_INET6) {
8571 /* We leave the scope the way it is in our lookup table. */
8572 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
8573 memcpy(hb->heartbeat.hb_info.address, &sin6->sin6_addr, sizeof(sin6->sin6_addr));
8574 } else {
8575 /* huh compiler bug */
8576 #ifdef SCTP_DEBUG
8577 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
8578 kprintf("Compiler bug bleeds a mbuf and a chunk\n");
8579 }
8580 #endif
8581 return (0);
8582 }
8583 /* ok we have a destination that needs a beat */
8584 /* lets do the theshold management Qiaobing style */
8585 if (user_req == 0) {
8586 if (sctp_threshold_management(stcb->sctp_ep, stcb, net,
8587 stcb->asoc.max_send_times)) {
8588 /* we have lost the association, in a way this
8589 * is quite bad since we really are one less time
8590 * since we really did not send yet. This is the
8591 * down side to the Q's style as defined in the RFC
8592 * and not my alternate style defined in the RFC.
8593 */
8594 if (chk->data != NULL) {
8595 sctp_m_freem(chk->data);
8596 chk->data = NULL;
8597 }
8598 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8599 sctppcbinfo.ipi_count_chunk--;
8600 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8601 panic("Chunk count is negative");
8602 }
8603 sctppcbinfo.ipi_gencnt_chunk++;
8604 return (-1);
8605 }
8606 }
8607 net->hb_responded = 0;
8608 #ifdef SCTP_DEBUG
8609 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
8610 kprintf("Inserting chunk for HB\n");
8611 }
8612 #endif
8613 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8614 stcb->asoc.ctrl_queue_cnt++;
8615 sctp_pegs[SCTP_HB_SENT]++;
8616 /*
8617 * Call directly med level routine to put out the chunk. It will
8618 * always tumble out control chunks aka HB but it may even tumble
8619 * out data too.
8620 */
8621 if (user_req == 0) {
8622 /* Ok now lets start the HB timer if it is NOT a user req */
8623 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
8624 stcb, net);
8625 }
8626 return (1);
8627 }
8628
8629 void
8630 sctp_send_ecn_echo(struct sctp_tcb *stcb, struct sctp_nets *net,
8631 uint32_t high_tsn)
8632 {
8633 struct sctp_association *asoc;
8634 struct sctp_ecne_chunk *ecne;
8635 struct sctp_tmit_chunk *chk;
8636 asoc = &stcb->asoc;
8637 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
8638 if (chk->rec.chunk_id == SCTP_ECN_ECHO) {
8639 /* found a previous ECN_ECHO update it if needed */
8640 ecne = mtod(chk->data, struct sctp_ecne_chunk *);
8641 ecne->tsn = htonl(high_tsn);
8642 return;
8643 }
8644 }
8645 /* nope could not find one to update so we must build one */
8646 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8647 if (chk == NULL) {
8648 return;
8649 }
8650 sctp_pegs[SCTP_ECNE_SENT]++;
8651 sctppcbinfo.ipi_count_chunk++;
8652 sctppcbinfo.ipi_gencnt_chunk++;
8653 chk->rec.chunk_id = SCTP_ECN_ECHO;
8654 chk->asoc = &stcb->asoc;
8655 chk->send_size = sizeof(struct sctp_ecne_chunk);
8656 MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
8657 if (chk->data == NULL) {
8658 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8659 sctppcbinfo.ipi_count_chunk--;
8660 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8661 panic("Chunk count is negative");
8662 }
8663 sctppcbinfo.ipi_gencnt_chunk++;
8664 return;
8665 }
8666 chk->data->m_data += SCTP_MIN_OVERHEAD;
8667 chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8668 chk->sent = SCTP_DATAGRAM_UNSENT;
8669 chk->snd_count = 0;
8670 chk->whoTo = net;
8671 chk->whoTo->ref_count++;
8672 ecne = mtod(chk->data, struct sctp_ecne_chunk *);
8673 ecne->ch.chunk_type = SCTP_ECN_ECHO;
8674 ecne->ch.chunk_flags = 0;
8675 ecne->ch.chunk_length = htons(sizeof(struct sctp_ecne_chunk));
8676 ecne->tsn = htonl(high_tsn);
8677 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8678 asoc->ctrl_queue_cnt++;
8679 }
8680
8681 void
8682 sctp_send_packet_dropped(struct sctp_tcb *stcb, struct sctp_nets *net,
8683 struct mbuf *m, int iphlen, int bad_crc)
8684 {
8685 struct sctp_association *asoc;
8686 struct sctp_pktdrop_chunk *drp;
8687 struct sctp_tmit_chunk *chk;
8688 uint8_t *datap;
8689 int len;
8690 unsigned int small_one;
8691 struct ip *iph;
8692
8693 long spc;
8694 asoc = &stcb->asoc;
8695 if (asoc->peer_supports_pktdrop == 0) {
8696 /* peer must declare support before I
8697 * send one.
8698 */
8699 return;
8700 }
8701 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8702 if (chk == NULL) {
8703 return;
8704 }
8705 sctppcbinfo.ipi_count_chunk++;
8706 sctppcbinfo.ipi_gencnt_chunk++;
8707
8708 iph = mtod(m, struct ip *);
8709 if (iph == NULL) {
8710 return;
8711 }
8712 if (iph->ip_v == IPVERSION) {
8713 /* IPv4 */
8714 #if defined(__FreeBSD__)
8715 len = chk->send_size = iph->ip_len;
8716 #else
8717 len = chk->send_size = (iph->ip_len - iphlen);
8718 #endif
8719 } else {
8720 struct ip6_hdr *ip6h;
8721 /* IPv6 */
8722 ip6h = mtod(m, struct ip6_hdr *);
8723 len = chk->send_size = htons(ip6h->ip6_plen);
8724 }
8725 if ((len+iphlen) > m->m_pkthdr.len) {
8726 /* huh */
8727 chk->send_size = len = m->m_pkthdr.len - iphlen;
8728 }
8729 chk->asoc = &stcb->asoc;
8730 MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
8731 if (chk->data == NULL) {
8732 jump_out:
8733 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8734 sctppcbinfo.ipi_count_chunk--;
8735 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8736 panic("Chunk count is negative");
8737 }
8738 sctppcbinfo.ipi_gencnt_chunk++;
8739 return;
8740 }
8741 if ((chk->send_size+sizeof(struct sctp_pktdrop_chunk)+SCTP_MIN_OVERHEAD) > MHLEN) {
8742 MCLGET(chk->data, MB_DONTWAIT);
8743 if ((chk->data->m_flags & M_EXT) == 0) {
8744 /* Give up */
8745 sctp_m_freem(chk->data);
8746 chk->data = NULL;
8747 goto jump_out;
8748 }
8749 }
8750 chk->data->m_data += SCTP_MIN_OVERHEAD;
8751 drp = mtod(chk->data, struct sctp_pktdrop_chunk *);
8752 if (drp == NULL) {
8753 sctp_m_freem(chk->data);
8754 chk->data = NULL;
8755 goto jump_out;
8756 }
8757 small_one = asoc->smallest_mtu;
8758 if (small_one > MCLBYTES) {
8759 /* Only one cluster worth of data MAX */
8760 small_one = MCLBYTES;
8761 }
8762 chk->book_size = (chk->send_size + sizeof(struct sctp_pktdrop_chunk) +
8763 sizeof(struct sctphdr) + SCTP_MED_OVERHEAD);
8764 if (chk->book_size > small_one) {
8765 drp->ch.chunk_flags = SCTP_PACKET_TRUNCATED;
8766 drp->trunc_len = htons(chk->send_size);
8767 chk->send_size = small_one - (SCTP_MED_OVERHEAD +
8768 sizeof(struct sctp_pktdrop_chunk) +
8769 sizeof(struct sctphdr));
8770 len = chk->send_size;
8771 } else {
8772 /* no truncation needed */
8773 drp->ch.chunk_flags = 0;
8774 drp->trunc_len = htons(0);
8775 }
8776 if (bad_crc) {
8777 drp->ch.chunk_flags |= SCTP_BADCRC;
8778 }
8779 chk->send_size += sizeof(struct sctp_pktdrop_chunk);
8780 chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8781 chk->sent = SCTP_DATAGRAM_UNSENT;
8782 chk->snd_count = 0;
8783 if (net) {
8784 /* we should hit here */
8785 chk->whoTo = net;
8786 } else {
8787 chk->whoTo = asoc->primary_destination;
8788 }
8789 chk->whoTo->ref_count++;
8790 chk->rec.chunk_id = SCTP_PACKET_DROPPED;
8791 drp->ch.chunk_type = SCTP_PACKET_DROPPED;
8792 drp->ch.chunk_length = htons(chk->send_size);
8793 spc = stcb->sctp_socket->so_rcv.ssb_hiwat;
8794 if (spc < 0) {
8795 spc = 0;
8796 }
8797 drp->bottle_bw = htonl(spc);
8798 drp->current_onq = htonl(asoc->size_on_delivery_queue +
8799 asoc->size_on_reasm_queue +
8800 asoc->size_on_all_streams +
8801 asoc->my_rwnd_control_len +
8802 stcb->sctp_socket->so_rcv.ssb_cc);
8803 drp->reserved = 0;
8804 datap = drp->data;
8805 m_copydata(m, iphlen, len, datap);
8806 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8807 asoc->ctrl_queue_cnt++;
8808 }
8809
8810 void
8811 sctp_send_cwr(struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t high_tsn)
8812 {
8813 struct sctp_association *asoc;
8814 struct sctp_cwr_chunk *cwr;
8815 struct sctp_tmit_chunk *chk;
8816
8817 asoc = &stcb->asoc;
8818 TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
8819 if (chk->rec.chunk_id == SCTP_ECN_CWR) {
8820 /* found a previous ECN_CWR update it if needed */
8821 cwr = mtod(chk->data, struct sctp_cwr_chunk *);
8822 if (compare_with_wrap(high_tsn, ntohl(cwr->tsn),
8823 MAX_TSN)) {
8824 cwr->tsn = htonl(high_tsn);
8825 }
8826 return;
8827 }
8828 }
8829 /* nope could not find one to update so we must build one */
8830 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8831 if (chk == NULL) {
8832 return;
8833 }
8834 sctppcbinfo.ipi_count_chunk++;
8835 sctppcbinfo.ipi_gencnt_chunk++;
8836 chk->rec.chunk_id = SCTP_ECN_CWR;
8837 chk->asoc = &stcb->asoc;
8838 chk->send_size = sizeof(struct sctp_cwr_chunk);
8839 MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
8840 if (chk->data == NULL) {
8841 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8842 sctppcbinfo.ipi_count_chunk--;
8843 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8844 panic("Chunk count is negative");
8845 }
8846 sctppcbinfo.ipi_gencnt_chunk++;
8847 return;
8848 }
8849 chk->data->m_data += SCTP_MIN_OVERHEAD;
8850 chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
8851 chk->sent = SCTP_DATAGRAM_UNSENT;
8852 chk->snd_count = 0;
8853 chk->whoTo = net;
8854 chk->whoTo->ref_count++;
8855 cwr = mtod(chk->data, struct sctp_cwr_chunk *);
8856 cwr->ch.chunk_type = SCTP_ECN_CWR;
8857 cwr->ch.chunk_flags = 0;
8858 cwr->ch.chunk_length = htons(sizeof(struct sctp_cwr_chunk));
8859 cwr->tsn = htonl(high_tsn);
8860 TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
8861 asoc->ctrl_queue_cnt++;
8862 }
8863 static void
8864 sctp_reset_the_streams(struct sctp_tcb *stcb,
8865 struct sctp_stream_reset_request *req, int number_entries, uint16_t *list)
8866 {
8867 int i;
8868
8869 if (req->reset_flags & SCTP_RESET_ALL) {
8870 for (i=0; i<stcb->asoc.streamoutcnt; i++) {
8871 stcb->asoc.strmout[i].next_sequence_sent = 0;
8872 }
8873 } else if (number_entries) {
8874 for (i=0; i<number_entries; i++) {
8875 if (list[i] >= stcb->asoc.streamoutcnt) {
8876 /* no such stream */
8877 continue;
8878 }
8879 stcb->asoc.strmout[(list[i])].next_sequence_sent = 0;
8880 }
8881 }
8882 sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list);
8883 }
8884
8885 void
8886 sctp_send_str_reset_ack(struct sctp_tcb *stcb,
8887 struct sctp_stream_reset_request *req)
8888 {
8889 struct sctp_association *asoc;
8890 struct sctp_stream_reset_resp *strack;
8891 struct sctp_tmit_chunk *chk;
8892 uint32_t seq;
8893 int number_entries, i;
8894 uint8_t two_way=0, not_peer=0;
8895 uint16_t *list=NULL;
8896
8897 asoc = &stcb->asoc;
8898 if (req->reset_flags & SCTP_RESET_ALL)
8899 number_entries = 0;
8900 else
8901 number_entries = (ntohs(req->ph.param_length) - sizeof(struct sctp_stream_reset_request)) / sizeof(uint16_t);
8902
8903 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
8904 if (chk == NULL) {
8905 return;
8906 }
8907 sctppcbinfo.ipi_count_chunk++;
8908 sctppcbinfo.ipi_gencnt_chunk++;
8909 chk->rec.chunk_id = SCTP_STREAM_RESET;
8910 chk->asoc = &stcb->asoc;
8911 chk->send_size = sizeof(struct sctp_stream_reset_resp) + (number_entries * sizeof(uint16_t));
8912 MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
8913 if (chk->data == NULL) {
8914 strresp_jump_out:
8915 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
8916 sctppcbinfo.ipi_count_chunk--;
8917 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
8918 panic("Chunk count is negative");
8919 }
8920 sctppcbinfo.ipi_gencnt_chunk++;
8921 return;
8922 }
8923 chk->data->m_data += SCTP_MIN_OVERHEAD;
8924 chk->data->m_pkthdr.len = chk->data->m_len = SCTP_SIZE32(chk->send_size);
8925 if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
8926 MCLGET(chk->data, MB_DONTWAIT);
8927 if ((chk->data->m_flags & M_EXT) == 0) {
8928 /* Give up */
8929 sctp_m_freem(chk->data);
8930 chk->data = NULL;
8931 goto strresp_jump_out;
8932 }
8933 chk->data->m_data += SCTP_MIN_OVERHEAD;
8934 }
8935 if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
8936 /* can't do it, no room */
8937 /* Give up */
8938 sctp_m_freem(chk->data);
8939 chk->data = NULL;
8940 goto strresp_jump_out;
8941
8942 }
8943 chk->sent = SCTP_DATAGRAM_UNSENT;
8944 chk->snd_count = 0;
8945 chk->whoTo = asoc->primary_destination;
8946 chk->whoTo->ref_count++;
8947 strack = mtod(chk->data, struct sctp_stream_reset_resp *);
8948
8949 strack->ch.chunk_type = SCTP_STREAM_RESET;
8950 strack->ch.chunk_flags = 0;
8951 strack->ch.chunk_length = htons(chk->send_size);
8952
8953 memset(strack->sr_resp.reset_pad, 0, sizeof(strack->sr_resp.reset_pad));
8954
8955 strack->sr_resp.ph.param_type = ntohs(SCTP_STR_RESET_RESPONSE);
8956 strack->sr_resp.ph.param_length = htons((chk->send_size - sizeof(struct sctp_chunkhdr)));
8957
8958
8959
8960 if (chk->send_size % 4) {
8961 /* need a padding for the end */
8962 int pad;
8963 uint8_t *end;
8964 end = (uint8_t *)((caddr_t)strack + chk->send_size);
8965 pad = chk->send_size % 4;
8966 for (i = 0; i < pad; i++) {
8967 end[i] = 0;
8968 }
8969 chk->send_size += pad;
8970 }
8971
8972 /* actual response */
8973 if (req->reset_flags & SCTP_RESET_YOUR) {
8974 strack->sr_resp.reset_flags = SCTP_RESET_PERFORMED;
8975 } else {
8976 strack->sr_resp.reset_flags = 0;
8977 }
8978
8979 /* copied from reset request */
8980 strack->sr_resp.reset_req_seq_resp = req->reset_req_seq;
8981 seq = ntohl(req->reset_req_seq);
8982
8983 list = req->list_of_streams;
8984 /* copy the un-converted network byte order streams */
8985 for (i=0; i<number_entries; i++) {
8986 strack->sr_resp.list_of_streams[i] = list[i];
8987 }
8988 if (asoc->str_reset_seq_in == seq) {
8989 /* is it the next expected? */
8990 asoc->str_reset_seq_in++;
8991 strack->sr_resp.reset_at_tsn = htonl(asoc->sending_seq);
8992 asoc->str_reset_sending_seq = asoc->sending_seq;
8993 if (number_entries) {
8994 int i;
8995 uint16_t temp;
8996 /* convert them to host byte order */
8997 for (i=0 ; i<number_entries; i++) {
8998 temp = ntohs(list[i]);
8999 list[i] = temp;
9000 }
9001 }
9002 if (req->reset_flags & SCTP_RESET_YOUR) {
9003 /* reset my outbound streams */
9004 sctp_reset_the_streams(stcb, req , number_entries, list);
9005 }
9006 if (req->reset_flags & SCTP_RECIPRICAL) {
9007 /* reset peer too */
9008 sctp_send_str_reset_req(stcb, number_entries, list, two_way, not_peer);
9009 }
9010
9011 } else {
9012 /* no its a retran so I must just ack and do nothing */
9013 strack->sr_resp.reset_at_tsn = htonl(asoc->str_reset_sending_seq);
9014 }
9015 strack->sr_resp.cumulative_tsn = htonl(asoc->cumulative_tsn);
9016 TAILQ_INSERT_TAIL(&asoc->control_send_queue,
9017 chk,
9018 sctp_next);
9019 asoc->ctrl_queue_cnt++;
9020 }
9021
9022
9023 void
9024 sctp_send_str_reset_req(struct sctp_tcb *stcb,
9025 int number_entrys, uint16_t *list, uint8_t two_way, uint8_t not_peer)
9026 {
9027 /* Send a stream reset request. The number_entrys may be 0 and list NULL
9028 * if the request is to reset all streams. If two_way is true then we
9029 * not only request a RESET of the received streams but we also
9030 * request the peer to send a reset req to us too.
9031 * Flag combinations in table:
9032 *
9033 * two_way | not_peer | = | Flags
9034 * ------------------------------
9035 * 0 | 0 | = | SCTP_RESET_YOUR (just the peer)
9036 * 1 | 0 | = | SCTP_RESET_YOUR | SCTP_RECIPRICAL (both sides)
9037 * 0 | 1 | = | Not a Valid Request (not anyone)
9038 * 1 | 1 | = | SCTP_RESET_RECIPRICAL (Just local host)
9039 */
9040 struct sctp_association *asoc;
9041 struct sctp_stream_reset_req *strreq;
9042 struct sctp_tmit_chunk *chk;
9043
9044
9045 asoc = &stcb->asoc;
9046 if (asoc->stream_reset_outstanding) {
9047 /* Already one pending, must get ACK back
9048 * to clear the flag.
9049 */
9050 return;
9051 }
9052
9053 if ((two_way == 0) && (not_peer == 1)) {
9054 /* not a valid request */
9055 return;
9056 }
9057
9058 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
9059 if (chk == NULL) {
9060 return;
9061 }
9062 sctppcbinfo.ipi_count_chunk++;
9063 sctppcbinfo.ipi_gencnt_chunk++;
9064 chk->rec.chunk_id = SCTP_STREAM_RESET;
9065 chk->asoc = &stcb->asoc;
9066 chk->send_size = sizeof(struct sctp_stream_reset_req) + (number_entrys * sizeof(uint16_t));
9067 MGETHDR(chk->data, MB_DONTWAIT, MT_DATA);
9068 if (chk->data == NULL) {
9069 strreq_jump_out:
9070 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
9071 sctppcbinfo.ipi_count_chunk--;
9072 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
9073 panic("Chunk count is negative");
9074 }
9075 sctppcbinfo.ipi_gencnt_chunk++;
9076 return;
9077 }
9078 chk->data->m_data += SCTP_MIN_OVERHEAD;
9079 chk->data->m_pkthdr.len = chk->data->m_len = SCTP_SIZE32(chk->send_size);
9080 if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
9081 MCLGET(chk->data, MB_DONTWAIT);
9082 if ((chk->data->m_flags & M_EXT) == 0) {
9083 /* Give up */
9084 sctp_m_freem(chk->data);
9085 chk->data = NULL;
9086 goto strreq_jump_out;
9087 }
9088 chk->data->m_data += SCTP_MIN_OVERHEAD;
9089 }
9090 if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
9091 /* can't do it, no room */
9092 /* Give up */
9093 sctp_m_freem(chk->data);
9094 chk->data = NULL;
9095 goto strreq_jump_out;
9096 }
9097 chk->sent = SCTP_DATAGRAM_UNSENT;
9098 chk->snd_count = 0;
9099 chk->whoTo = asoc->primary_destination;
9100 chk->whoTo->ref_count++;
9101
9102 strreq = mtod(chk->data, struct sctp_stream_reset_req *);
9103 strreq->ch.chunk_type = SCTP_STREAM_RESET;
9104 strreq->ch.chunk_flags = 0;
9105 strreq->ch.chunk_length = htons(chk->send_size);
9106
9107 strreq->sr_req.ph.param_type = ntohs(SCTP_STR_RESET_REQUEST);
9108 strreq->sr_req.ph.param_length = htons((chk->send_size - sizeof(struct sctp_chunkhdr)));
9109
9110 if (chk->send_size % 4) {
9111 /* need a padding for the end */
9112 int pad, i;
9113 uint8_t *end;
9114 end = (uint8_t *)((caddr_t)strreq + chk->send_size);
9115 pad = chk->send_size % 4;
9116 for (i=0; i<pad; i++) {
9117 end[i] = 0;
9118 }
9119 chk->send_size += pad;
9120 }
9121
9122 strreq->sr_req.reset_flags = 0;
9123 if (number_entrys == 0) {
9124 strreq->sr_req.reset_flags |= SCTP_RESET_ALL;
9125 }
9126 if (two_way == 0) {
9127 strreq->sr_req.reset_flags |= SCTP_RESET_YOUR;
9128 } else {
9129 if (not_peer == 0) {
9130 strreq->sr_req.reset_flags |= SCTP_RECIPRICAL | SCTP_RESET_YOUR;
9131 } else {
9132 strreq->sr_req.reset_flags |= SCTP_RECIPRICAL;
9133 }
9134 }
9135 memset(strreq->sr_req.reset_pad, 0, sizeof(strreq->sr_req.reset_pad));
9136 strreq->sr_req.reset_req_seq = htonl(asoc->str_reset_seq_out);
9137 if (number_entrys) {
9138 /* populate the specific entry's */
9139 int i;
9140 for (i=0; i < number_entrys; i++) {
9141 strreq->sr_req.list_of_streams[i] = htons(list[i]);
9142 }
9143 }
9144 TAILQ_INSERT_TAIL(&asoc->control_send_queue,
9145 chk,
9146 sctp_next);
9147 asoc->ctrl_queue_cnt++;
9148 sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo);
9149 asoc->stream_reset_outstanding = 1;
9150 }
9151
9152 void
9153 sctp_send_abort(struct mbuf *m, int iphlen, struct sctphdr *sh, uint32_t vtag,
9154 struct mbuf *err_cause)
9155 {
9156 /*
9157 * Formulate the abort message, and send it back down.
9158 */
9159 struct mbuf *mout;
9160 struct sctp_abort_msg *abm;
9161 struct ip *iph, *iph_out;
9162 struct ip6_hdr *ip6, *ip6_out;
9163 int iphlen_out;
9164
9165 /* don't respond to ABORT with ABORT */
9166 if (sctp_is_there_an_abort_here(m, iphlen, &vtag)) {
9167 if (err_cause)
9168 sctp_m_freem(err_cause);
9169 return;
9170 }
9171 MGETHDR(mout, MB_DONTWAIT, MT_HEADER);
9172 if (mout == NULL) {
9173 if (err_cause)
9174 sctp_m_freem(err_cause);
9175 return;
9176 }
9177 iph = mtod(m, struct ip *);
9178 iph_out = NULL;
9179 ip6_out = NULL;
9180 if (iph->ip_v == IPVERSION) {
9181 iph_out = mtod(mout, struct ip *);
9182 mout->m_len = sizeof(*iph_out) + sizeof(*abm);
9183 mout->m_next = err_cause;
9184
9185 /* Fill in the IP header for the ABORT */
9186 iph_out->ip_v = IPVERSION;
9187 iph_out->ip_hl = (sizeof(struct ip) / 4);
9188 iph_out->ip_tos = (u_char)0;
9189 iph_out->ip_id = 0;
9190 iph_out->ip_off = 0;
9191 iph_out->ip_ttl = MAXTTL;
9192 iph_out->ip_p = IPPROTO_SCTP;
9193 iph_out->ip_src.s_addr = iph->ip_dst.s_addr;
9194 iph_out->ip_dst.s_addr = iph->ip_src.s_addr;
9195 /* let IP layer calculate this */
9196 iph_out->ip_sum = 0;
9197
9198 iphlen_out = sizeof(*iph_out);
9199 abm = (struct sctp_abort_msg *)((caddr_t)iph_out + iphlen_out);
9200 } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
9201 ip6 = (struct ip6_hdr *)iph;
9202 ip6_out = mtod(mout, struct ip6_hdr *);
9203 mout->m_len = sizeof(*ip6_out) + sizeof(*abm);
9204 mout->m_next = err_cause;
9205
9206 /* Fill in the IP6 header for the ABORT */
9207 ip6_out->ip6_flow = ip6->ip6_flow;
9208 ip6_out->ip6_hlim = ip6_defhlim;
9209 ip6_out->ip6_nxt = IPPROTO_SCTP;
9210 ip6_out->ip6_src = ip6->ip6_dst;
9211 ip6_out->ip6_dst = ip6->ip6_src;
9212
9213 iphlen_out = sizeof(*ip6_out);
9214 abm = (struct sctp_abort_msg *)((caddr_t)ip6_out + iphlen_out);
9215 } else {
9216 /* Currently not supported */
9217 return;
9218 }
9219
9220 abm->sh.src_port = sh->dest_port;
9221 abm->sh.dest_port = sh->src_port;
9222 abm->sh.checksum = 0;
9223 if (vtag == 0) {
9224 abm->sh.v_tag = sh->v_tag;
9225 abm->msg.ch.chunk_flags = SCTP_HAD_NO_TCB;
9226 } else {
9227 abm->sh.v_tag = htonl(vtag);
9228 abm->msg.ch.chunk_flags = 0;
9229 }
9230 abm->msg.ch.chunk_type = SCTP_ABORT_ASSOCIATION;
9231
9232 if (err_cause) {
9233 struct mbuf *m_tmp = err_cause;
9234 int err_len = 0;
9235 /* get length of the err_cause chain */
9236 while (m_tmp != NULL) {
9237 err_len += m_tmp->m_len;
9238 m_tmp = m_tmp->m_next;
9239 }
9240 mout->m_pkthdr.len = mout->m_len + err_len;
9241 if (err_len % 4) {
9242 /* need pad at end of chunk */
9243 u_int32_t cpthis=0;
9244 int padlen;
9245 padlen = 4 - (mout->m_pkthdr.len % 4);
9246 m_copyback(mout, mout->m_pkthdr.len, padlen, (caddr_t)&cpthis);
9247 }
9248 abm->msg.ch.chunk_length = htons(sizeof(abm->msg.ch) + err_len);
9249 } else {
9250 mout->m_pkthdr.len = mout->m_len;
9251 abm->msg.ch.chunk_length = htons(sizeof(abm->msg.ch));
9252 }
9253
9254 /* add checksum */
9255 if ((sctp_no_csum_on_loopback) &&
9256 (m->m_pkthdr.rcvif) &&
9257 (m->m_pkthdr.rcvif->if_type == IFT_LOOP)) {
9258 abm->sh.checksum = 0;
9259 } else {
9260 abm->sh.checksum = sctp_calculate_sum(mout, NULL, iphlen_out);
9261 }
9262
9263 /* zap the rcvif, it should be null */
9264 mout->m_pkthdr.rcvif = 0;
9265 if (iph_out != NULL) {
9266 struct route ro;
9267
9268 /* zap the stack pointer to the route */
9269 bzero(&ro, sizeof ro);
9270 #ifdef SCTP_DEBUG
9271 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
9272 kprintf("sctp_send_abort calling ip_output:\n");
9273 sctp_print_address_pkt(iph_out, &abm->sh);
9274 }
9275 #endif
9276 /* set IPv4 length */
9277 #if defined(__FreeBSD__)
9278 iph_out->ip_len = mout->m_pkthdr.len;
9279 #else
9280 iph_out->ip_len = htons(mout->m_pkthdr.len);
9281 #endif
9282 /* out it goes */
9283 ip_output(mout, 0, &ro, IP_RAWOUTPUT, NULL
9284 #if defined(__OpenBSD__) || (defined(__FreeBSD__) && __FreeBSD_version >= 480000) \
9285 || defined(__NetBSD__) || defined(__DragonFly__)
9286 , NULL
9287 #endif
9288 );
9289 /* Free the route if we got one back */
9290 if (ro.ro_rt)
9291 RTFREE(ro.ro_rt);
9292 } else if (ip6_out != NULL) {
9293 #ifdef NEW_STRUCT_ROUTE
9294 struct route ro;
9295 #else
9296 struct route_in6 ro;
9297 #endif
9298
9299 /* zap the stack pointer to the route */
9300 bzero(&ro, sizeof(ro));
9301 #ifdef SCTP_DEBUG
9302 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
9303 kprintf("sctp_send_abort calling ip6_output:\n");
9304 sctp_print_address_pkt((struct ip *)ip6_out, &abm->sh);
9305 }
9306 #endif
9307 ip6_output(mout, NULL, &ro, 0, NULL, NULL
9308 #if defined(__NetBSD__)
9309 , NULL
9310 #endif
9311 #if (defined(__FreeBSD__) && __FreeBSD_version >= 480000) || defined(__DragonFly__)
9312 , NULL
9313 #endif
9314 );
9315 /* Free the route if we got one back */
9316 if (ro.ro_rt)
9317 RTFREE(ro.ro_rt);
9318 }
9319 sctp_pegs[SCTP_DATAGRAMS_SENT]++;
9320 }
9321
9322 void
9323 sctp_send_operr_to(struct mbuf *m, int iphlen,
9324 struct mbuf *scm,
9325 uint32_t vtag)
9326 {
9327 struct sctphdr *ihdr;
9328 int retcode;
9329 struct sctphdr *ohdr;
9330 struct sctp_chunkhdr *ophdr;
9331
9332 struct ip *iph;
9333 #ifdef SCTP_DEBUG
9334 struct sockaddr_in6 lsa6, fsa6;
9335 #endif
9336 uint32_t val;
9337 iph = mtod(m, struct ip *);
9338 ihdr = (struct sctphdr *)((caddr_t)iph + iphlen);
9339 if (!(scm->m_flags & M_PKTHDR)) {
9340 /* must be a pkthdr */
9341 kprintf("Huh, not a packet header in send_operr\n");
9342 m_freem(scm);
9343 return;
9344 }
9345 M_PREPEND(scm, (sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr)), MB_DONTWAIT);
9346 if (scm == NULL) {
9347 /* can't send because we can't add a mbuf */
9348 return;
9349 }
9350 ohdr = mtod(scm, struct sctphdr *);
9351 ohdr->src_port = ihdr->dest_port;
9352 ohdr->dest_port = ihdr->src_port;
9353 ohdr->v_tag = vtag;
9354 ohdr->checksum = 0;
9355 ophdr = (struct sctp_chunkhdr *)(ohdr + 1);
9356 ophdr->chunk_type = SCTP_OPERATION_ERROR;
9357 ophdr->chunk_flags = 0;
9358 ophdr->chunk_length = htons(scm->m_pkthdr.len - sizeof(struct sctphdr));
9359 if (scm->m_pkthdr.len % 4) {
9360 /* need padding */
9361 u_int32_t cpthis=0;
9362 int padlen;
9363 padlen = 4 - (scm->m_pkthdr.len % 4);
9364 m_copyback(scm, scm->m_pkthdr.len, padlen, (caddr_t)&cpthis);
9365 }
9366 if ((sctp_no_csum_on_loopback) &&
9367 (m->m_pkthdr.rcvif) &&
9368 (m->m_pkthdr.rcvif->if_type == IFT_LOOP)) {
9369 val = 0;
9370 } else {
9371 val = sctp_calculate_sum(scm, NULL, 0);
9372 }
9373 ohdr->checksum = val;
9374 if (iph->ip_v == IPVERSION) {
9375 /* V4 */
9376 struct ip *out;
9377 struct route ro;
9378 M_PREPEND(scm, sizeof(struct ip), MB_DONTWAIT);
9379 if (scm == NULL)
9380 return;
9381 bzero(&ro, sizeof ro);
9382 out = mtod(scm, struct ip *);
9383 out->ip_v = iph->ip_v;
9384 out->ip_hl = (sizeof(struct ip)/4);
9385 out->ip_tos = iph->ip_tos;
9386 out->ip_id = iph->ip_id;
9387 out->ip_off = 0;
9388 out->ip_ttl = MAXTTL;
9389 out->ip_p = IPPROTO_SCTP;
9390 out->ip_sum = 0;
9391 out->ip_src = iph->ip_dst;
9392 out->ip_dst = iph->ip_src;
9393 #if defined(__FreeBSD__)
9394 out->ip_len = scm->m_pkthdr.len;
9395 #else
9396 out->ip_len = htons(scm->m_pkthdr.len);
9397 #endif
9398 retcode = ip_output(scm, 0, &ro, IP_RAWOUTPUT, NULL
9399 #if defined(__OpenBSD__) || (defined(__FreeBSD__) && __FreeBSD_version >= 480000) \
9400 || defined(__NetBSD__) || defined(__DragonFly__)
9401 , NULL
9402 #endif
9403 );
9404 sctp_pegs[SCTP_DATAGRAMS_SENT]++;
9405 /* Free the route if we got one back */
9406 if (ro.ro_rt)
9407 RTFREE(ro.ro_rt);
9408 } else {
9409 /* V6 */
9410 #ifdef NEW_STRUCT_ROUTE
9411 struct route ro;
9412 #else
9413 struct route_in6 ro;
9414 #endif
9415 struct ip6_hdr *out6, *in6;
9416
9417 M_PREPEND(scm, sizeof(struct ip6_hdr), MB_DONTWAIT);
9418 if (scm == NULL)
9419 return;
9420 bzero(&ro, sizeof ro);
9421 in6 = mtod(m, struct ip6_hdr *);
9422 out6 = mtod(scm, struct ip6_hdr *);
9423 out6->ip6_flow = in6->ip6_flow;
9424 out6->ip6_hlim = ip6_defhlim;
9425 out6->ip6_nxt = IPPROTO_SCTP;
9426 out6->ip6_src = in6->ip6_dst;
9427 out6->ip6_dst = in6->ip6_src;
9428
9429 #ifdef SCTP_DEBUG
9430 bzero(&lsa6, sizeof(lsa6));
9431 lsa6.sin6_len = sizeof(lsa6);
9432 lsa6.sin6_family = AF_INET6;
9433 lsa6.sin6_addr = out6->ip6_src;
9434 bzero(&fsa6, sizeof(fsa6));
9435 fsa6.sin6_len = sizeof(fsa6);
9436 fsa6.sin6_family = AF_INET6;
9437 fsa6.sin6_addr = out6->ip6_dst;
9438 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
9439 kprintf("sctp_operr_to calling ipv6 output:\n");
9440 kprintf("src: ");
9441 sctp_print_address((struct sockaddr *)&lsa6);
9442 kprintf("dst ");
9443 sctp_print_address((struct sockaddr *)&fsa6);
9444 }
9445 #endif /* SCTP_DEBUG */
9446 ip6_output(scm, NULL, &ro, 0, NULL, NULL
9447 #if defined(__NetBSD__)
9448 , NULL
9449 #endif
9450 #if (defined(__FreeBSD__) && __FreeBSD_version >= 480000) || defined(__DragonFly__)
9451 , NULL
9452 #endif
9453 );
9454 sctp_pegs[SCTP_DATAGRAMS_SENT]++;
9455 /* Free the route if we got one back */
9456 if (ro.ro_rt)
9457 RTFREE(ro.ro_rt);
9458 }
9459 }
9460
9461 static int
9462 sctp_copy_one(struct mbuf *m, struct uio *uio, int cpsz, int resv_upfront, int *mbcnt)
9463 {
9464 int left, cancpy, willcpy, error;
9465 left = cpsz;
9466
9467 if (m == NULL) {
9468 /* TSNH */
9469 *mbcnt = 0;
9470 return (ENOMEM);
9471 }
9472 m->m_len = 0;
9473 if ((left+resv_upfront) > (int)MHLEN) {
9474 MCLGET(m, MB_WAIT);
9475 if (m == NULL) {
9476 *mbcnt = 0;
9477 return (ENOMEM);
9478 }
9479 if ((m->m_flags & M_EXT) == 0) {
9480 *mbcnt = 0;
9481 return (ENOMEM);
9482 }
9483 *mbcnt += m->m_ext.ext_size;
9484 }
9485 *mbcnt += MSIZE;
9486 cancpy = M_TRAILINGSPACE(m);
9487 willcpy = min(cancpy, left);
9488 if ((willcpy + resv_upfront) > cancpy) {
9489 willcpy -= resv_upfront;
9490 }
9491 while (left > 0) {
9492 /* Align data to the end */
9493 if ((m->m_flags & M_EXT) == 0) {
9494 if (m->m_flags & M_PKTHDR) {
9495 MH_ALIGN(m, willcpy);
9496 } else {
9497 M_ALIGN(m, willcpy);
9498 }
9499 } else {
9500 MC_ALIGN(m, willcpy);
9501 }
9502 error = uiomove(mtod(m, caddr_t), willcpy, uio);
9503 if (error) {
9504 return (error);
9505 }
9506 m->m_len = willcpy;
9507 m->m_nextpkt = 0;
9508 left -= willcpy;
9509 if (left > 0) {
9510 MGET(m->m_next, MB_WAIT, MT_DATA);
9511 if (m->m_next == NULL) {
9512 *mbcnt = 0;
9513 return (ENOMEM);
9514 }
9515 m = m->m_next;
9516 m->m_len = 0;
9517 *mbcnt += MSIZE;
9518 if (left > (int)MHLEN) {
9519 MCLGET(m, MB_WAIT);
9520 if (m == NULL) {
9521 *mbcnt = 0;
9522 return (ENOMEM);
9523 }
9524 if ((m->m_flags & M_EXT) == 0) {
9525 *mbcnt = 0;
9526 return (ENOMEM);
9527 }
9528 *mbcnt += m->m_ext.ext_size;
9529 }
9530 cancpy = M_TRAILINGSPACE(m);
9531 willcpy = min(cancpy, left);
9532 }
9533 }
9534 return (0);
9535 }
9536
9537 static int
9538 sctp_copy_it_in(struct sctp_inpcb *inp,
9539 struct sctp_tcb *stcb,
9540 struct sctp_association *asoc,
9541 struct sctp_nets *net,
9542 struct sctp_sndrcvinfo *srcv,
9543 struct uio *uio,
9544 int flags)
9545 {
9546 /* This routine must be very careful in
9547 * its work. Protocol processing is
9548 * up and running so care must be taken to
9549 * spl...() when you need to do something
9550 * that may effect the stcb/asoc. The sb is
9551 * locked however. When data is copied the
9552 * protocol processing should be enabled since
9553 * this is a slower operation...
9554 */
9555 struct socket *so;
9556 int error = 0;
9557 int frag_size, mbcnt = 0, mbcnt_e = 0;
9558 unsigned int sndlen;
9559 unsigned int tot_demand;
9560 int tot_out, dataout;
9561 struct sctp_tmit_chunk *chk;
9562 struct mbuf *mm;
9563 struct sctp_stream_out *strq;
9564 uint32_t my_vtag;
9565 int resv_in_first;
9566
9567 crit_enter();
9568 so = stcb->sctp_socket;
9569 chk = NULL;
9570 mm = NULL;
9571
9572 sndlen = uio->uio_resid;
9573 /* lock the socket buf */
9574 SOCKBUF_LOCK(&so->so_snd);
9575 error = ssb_lock(&so->so_snd, SBLOCKWAIT(flags));
9576 if (error)
9577 goto out_locked;
9578
9579 /* will it ever fit ? */
9580 if (sndlen > so->so_snd.ssb_hiwat) {
9581 /* It will NEVER fit */
9582 error = EMSGSIZE;
9583 crit_exit();
9584 goto release;
9585 }
9586 /* Do I need to block? */
9587 if ((so->so_snd.ssb_hiwat <
9588 (sndlen + asoc->total_output_queue_size)) ||
9589 (asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) ||
9590 (asoc->total_output_mbuf_queue_size >
9591 so->so_snd.ssb_mbmax)
9592 ) {
9593 /* prune any prsctp bufs out */
9594 if (asoc->peer_supports_prsctp) {
9595 sctp_prune_prsctp(stcb, asoc, srcv, sndlen);
9596 }
9597 /*
9598 * We store off a pointer to the endpoint.
9599 * Since on return from this we must check to
9600 * see if an so_error is set. If so we may have
9601 * been reset and our stcb destroyed. Returning
9602 * an error will flow back to the user...
9603 */
9604 while ((so->so_snd.ssb_hiwat <
9605 (sndlen + asoc->total_output_queue_size)) ||
9606 (asoc->chunks_on_out_queue >
9607 sctp_max_chunks_on_queue) ||
9608 (asoc->total_output_mbuf_queue_size >
9609 so->so_snd.ssb_mbmax)
9610 ) {
9611 if (flags & (MSG_FNONBLOCKING|MSG_DONTWAIT)) {
9612 /* Non-blocking io in place */
9613 error = EWOULDBLOCK;
9614 goto release;
9615 }
9616 inp->sctp_tcb_at_block = (void *)stcb;
9617 inp->error_on_block = 0;
9618 #ifdef SCTP_BLK_LOGGING
9619 sctp_log_block(SCTP_BLOCK_LOG_INTO_BLK,
9620 so, asoc);
9621 #endif
9622 ssb_unlock(&so->so_snd);
9623 SCTP_TCB_UNLOCK(stcb);
9624 error = ssb_wait(&so->so_snd);
9625 SCTP_INP_RLOCK(inp);
9626 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
9627 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
9628 /* Should I really unlock ? */
9629 SCTP_INP_RUNLOCK(inp);
9630 error = EFAULT;
9631 goto out_locked;
9632 }
9633 SCTP_TCB_LOCK(stcb);
9634 SCTP_INP_RUNLOCK(inp);
9635
9636 inp->sctp_tcb_at_block = 0;
9637 #ifdef SCTP_BLK_LOGGING
9638 sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK,
9639 so, asoc);
9640 #endif
9641 if (inp->error_on_block) {
9642 /*
9643 * if our asoc was killed, the free code
9644 * (in sctp_pcb.c) will save a error in
9645 * here for us
9646 */
9647 error = inp->error_on_block;
9648 crit_exit();
9649 goto out_locked;
9650 }
9651 if (error) {
9652 crit_exit();
9653 goto out_locked;
9654 }
9655 /* did we encounter a socket error? */
9656 if (so->so_error) {
9657 error = so->so_error;
9658 crit_exit();
9659 goto out_locked;
9660 }
9661 error = ssb_lock(&so->so_snd, M_WAITOK);
9662 if (error) {
9663 /* Can't acquire the lock */
9664 crit_exit();
9665 goto out_locked;
9666 }
9667 #if defined(__FreeBSD__) && __FreeBSD_version >= 502115
9668 if (so->so_rcv.sb_state & SBS_CANTSENDMORE) {
9669 #else
9670 if (so->so_state & SS_CANTSENDMORE) {
9671 #endif
9672 /* The socket is now set not to sendmore.. its gone */
9673 error = EPIPE;
9674 crit_exit();
9675 goto release;
9676 }
9677 if (so->so_error) {
9678 error = so->so_error;
9679 crit_exit();
9680 goto release;
9681 }
9682 if (asoc->peer_supports_prsctp) {
9683 sctp_prune_prsctp(stcb, asoc, srcv, sndlen);
9684 }
9685 }
9686 }
9687 dataout = tot_out = uio->uio_resid;
9688 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
9689 resv_in_first = SCTP_MED_OVERHEAD;
9690 } else {
9691 resv_in_first = SCTP_MED_V4_OVERHEAD;
9692 }
9693
9694 /* Are we aborting? */
9695 if (srcv->sinfo_flags & MSG_ABORT) {
9696 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
9697 (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) {
9698 /* It has to be up before we abort */
9699 /* how big is the user initiated abort? */
9700
9701 /* I wonder about doing a MGET without a splnet set.
9702 * it is done that way in the sosend code so I guess
9703 * it is ok :-0
9704 */
9705 MGETHDR(mm, MB_WAIT, MT_DATA);
9706 if (mm) {
9707 struct sctp_paramhdr *ph;
9708
9709 tot_demand = (tot_out + sizeof(struct sctp_paramhdr));
9710 if (tot_demand > MHLEN) {
9711 if (tot_demand > MCLBYTES) {
9712 /* truncate user data */
9713 tot_demand = MCLBYTES;
9714 tot_out = tot_demand - sizeof(struct sctp_paramhdr);
9715 }
9716 MCLGET(mm, MB_WAIT);
9717 if ((mm->m_flags & M_EXT) == 0) {
9718 /* truncate further */
9719 tot_demand = MHLEN;
9720 tot_out = tot_demand - sizeof(struct sctp_paramhdr);
9721 }
9722 }
9723 /* now move forward the data pointer */
9724 ph = mtod(mm, struct sctp_paramhdr *);
9725 ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT);
9726 ph->param_length = htons((sizeof(struct sctp_paramhdr) + tot_out));
9727 ph++;
9728 mm->m_pkthdr.len = tot_out + sizeof(struct sctp_paramhdr);
9729 mm->m_len = mm->m_pkthdr.len;
9730 error = uiomove((caddr_t)ph, (int)tot_out, uio);
9731 if (error) {
9732 /*
9733 * Here if we can't get his data we
9734 * still abort we just don't get to
9735 * send the users note :-0
9736 */
9737 sctp_m_freem(mm);
9738 mm = NULL;
9739 }
9740 }
9741 ssb_unlock(&so->so_snd);
9742 SOCKBUF_UNLOCK(&so->so_snd);
9743 sctp_abort_an_association(stcb->sctp_ep, stcb,
9744 SCTP_RESPONSE_TO_USER_REQ,
9745 mm);
9746 mm = NULL;
9747 crit_exit();
9748 goto out_notlocked;
9749 }
9750 crit_exit();
9751 goto release;
9752 }
9753
9754 /* Now can we send this? */
9755 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
9756 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
9757 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
9758 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
9759 /* got data while shutting down */
9760 error = ECONNRESET;
9761 crit_exit();
9762 goto release;
9763 }
9764 /* Is the stream no. valid? */
9765 if (srcv->sinfo_stream >= asoc->streamoutcnt) {
9766 /* Invalid stream number */
9767 error = EINVAL;
9768 crit_exit();
9769 goto release;
9770 }
9771 if (asoc->strmout == NULL) {
9772 /* huh? software error */
9773 #ifdef SCTP_DEBUG
9774 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
9775 kprintf("software error in sctp_copy_it_in\n");
9776 }
9777 #endif
9778 error = EFAULT;
9779 crit_exit();
9780 goto release;
9781 }
9782 if ((srcv->sinfo_flags & MSG_EOF) &&
9783 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE) &&
9784 (tot_out == 0)) {
9785 crit_exit();
9786 goto zap_by_it_now;
9787 }
9788 if (tot_out == 0) {
9789 /* not allowed */
9790 error = EMSGSIZE;
9791 crit_exit();
9792 goto release;
9793 }
9794 /* save off the tag */
9795 my_vtag = asoc->my_vtag;
9796 strq = &asoc->strmout[srcv->sinfo_stream];
9797 /* First lets figure out the "chunking" point */
9798 frag_size = sctp_get_frag_point(stcb, asoc);
9799
9800 /* two choices here, it all fits in one chunk or
9801 * we need multiple chunks.
9802 */
9803 crit_exit();
9804 SOCKBUF_UNLOCK(&so->so_snd);
9805 if (tot_out <= frag_size) {
9806 /* no need to setup a template */
9807 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
9808 if (chk == NULL) {
9809 error = ENOMEM;
9810 SOCKBUF_LOCK(&so->so_snd);
9811 goto release;
9812 }
9813 sctppcbinfo.ipi_count_chunk++;
9814 sctppcbinfo.ipi_gencnt_chunk++;
9815 asoc->chunks_on_out_queue++;
9816 MGETHDR(mm, MB_WAIT, MT_DATA);
9817 if (mm == NULL) {
9818 error = ENOMEM;
9819 goto clean_up;
9820 }
9821 error = sctp_copy_one(mm, uio, tot_out, resv_in_first, &mbcnt_e);
9822 if (error)
9823 goto clean_up;
9824 sctp_prepare_chunk(chk, stcb, srcv, strq, net);
9825 chk->mbcnt = mbcnt_e;
9826 mbcnt += mbcnt_e;
9827 mbcnt_e = 0;
9828 mm->m_pkthdr.len = tot_out;
9829 chk->data = mm;
9830 mm = NULL;
9831
9832 /* the actual chunk flags */
9833 chk->rec.data.rcv_flags |= SCTP_DATA_NOT_FRAG;
9834 chk->whoTo->ref_count++;
9835
9836 /* fix up the send_size if it is not present */
9837 chk->send_size = tot_out;
9838 chk->book_size = chk->send_size;
9839 /* ok, we are commited */
9840 if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
9841 /* bump the ssn if we are unordered. */
9842 strq->next_sequence_sent++;
9843 }
9844 if (chk->flags & SCTP_PR_SCTP_BUFFER) {
9845 asoc->sent_queue_cnt_removeable++;
9846 }
9847 crit_enter();
9848 if ((asoc->state == 0) ||
9849 (my_vtag != asoc->my_vtag) ||
9850 (so != inp->sctp_socket) ||
9851 (inp->sctp_socket == 0)) {
9852 /* connection was aborted */
9853 crit_exit();
9854 error = ECONNRESET;
9855 goto clean_up;
9856 }
9857 asoc->stream_queue_cnt++;
9858 TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
9859 /* now check if this stream is on the wheel */
9860 if ((strq->next_spoke.tqe_next == NULL) &&
9861 (strq->next_spoke.tqe_prev == NULL)) {
9862 /* Insert it on the wheel since it is not
9863 * on it currently
9864 */
9865 sctp_insert_on_wheel(asoc, strq);
9866 }
9867 crit_exit();
9868 clean_up:
9869 if (error) {
9870 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
9871 sctppcbinfo.ipi_count_chunk--;
9872 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
9873 panic("Chunk count is negative");
9874 }
9875 SOCKBUF_LOCK(&so->so_snd);
9876 goto release;
9877 }
9878 } else {
9879 /* we need to setup a template */
9880 struct sctp_tmit_chunk template;
9881 struct sctpchunk_listhead tmp;
9882
9883 /* setup the template */
9884 sctp_prepare_chunk(&template, stcb, srcv, strq, net);
9885
9886 /* Prepare the temp list */
9887 TAILQ_INIT(&tmp);
9888
9889 /* Template is complete, now time for the work */
9890 while (tot_out > 0) {
9891 /* Get a chunk */
9892 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
9893 if (chk == NULL) {
9894 /*
9895 * ok we must spin through and dump anything
9896 * we have allocated and then jump to the
9897 * no_membad
9898 */
9899 error = ENOMEM;
9900 }
9901 sctppcbinfo.ipi_count_chunk++;
9902 asoc->chunks_on_out_queue++;
9903
9904 sctppcbinfo.ipi_gencnt_chunk++;
9905 *chk = template;
9906 chk->whoTo->ref_count++;
9907 MGETHDR(chk->data, MB_WAIT, MT_DATA);
9908 if (chk->data == NULL) {
9909 error = ENOMEM;
9910 goto temp_clean_up;
9911 }
9912 tot_demand = min(tot_out, frag_size);
9913 error = sctp_copy_one(chk->data, uio, tot_demand , resv_in_first, &mbcnt_e);
9914 if (error)
9915 goto temp_clean_up;
9916 /* now fix the chk->send_size */
9917 chk->mbcnt = mbcnt_e;
9918 mbcnt += mbcnt_e;
9919 mbcnt_e = 0;
9920 chk->send_size = tot_demand;
9921 chk->data->m_pkthdr.len = tot_demand;
9922 chk->book_size = chk->send_size;
9923 if (chk->flags & SCTP_PR_SCTP_BUFFER) {
9924 asoc->sent_queue_cnt_removeable++;
9925 }
9926 TAILQ_INSERT_TAIL(&tmp, chk, sctp_next);
9927 tot_out -= tot_demand;
9928 }
9929 /* Now the tmp list holds all chunks and data */
9930 if ((srcv->sinfo_flags & MSG_UNORDERED) == 0) {
9931 /* bump the ssn if we are unordered. */
9932 strq->next_sequence_sent++;
9933 }
9934 /* Mark the first/last flags. This will
9935 * result int a 3 for a single item on the list
9936 */
9937 chk = TAILQ_FIRST(&tmp);
9938 chk->rec.data.rcv_flags |= SCTP_DATA_FIRST_FRAG;
9939 chk = TAILQ_LAST(&tmp, sctpchunk_listhead);
9940 chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
9941
9942 /* now move it to the streams actual queue */
9943 /* first stop protocol processing */
9944 crit_enter();
9945 if ((asoc->state == 0) ||
9946 (my_vtag != asoc->my_vtag) ||
9947 (so != inp->sctp_socket) ||
9948 (inp->sctp_socket == 0)) {
9949 /* connection was aborted */
9950 crit_exit();
9951 error = ECONNRESET;
9952 goto temp_clean_up;
9953 }
9954 chk = TAILQ_FIRST(&tmp);
9955 while (chk) {
9956 chk->data->m_nextpkt = 0;
9957 TAILQ_REMOVE(&tmp, chk, sctp_next);
9958 asoc->stream_queue_cnt++;
9959 TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
9960 chk = TAILQ_FIRST(&tmp);
9961 }
9962 /* now check if this stream is on the wheel */
9963 if ((strq->next_spoke.tqe_next == NULL) &&
9964 (strq->next_spoke.tqe_prev == NULL)) {
9965 /* Insert it on the wheel since it is not
9966 * on it currently
9967 */
9968 sctp_insert_on_wheel(asoc, strq);
9969 }
9970 /* Ok now we can allow pping */
9971 crit_exit();
9972 temp_clean_up:
9973 if (error) {
9974 SOCKBUF_LOCK(&so->so_snd);
9975 chk = TAILQ_FIRST(&tmp);
9976 while (chk) {
9977 if (chk->data) {
9978 sctp_m_freem(chk->data);
9979 chk->data = NULL;
9980 }
9981 TAILQ_REMOVE(&tmp, chk, sctp_next);
9982 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
9983 sctppcbinfo.ipi_count_chunk--;
9984 asoc->chunks_on_out_queue--;
9985 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
9986 panic("Chunk count is negative");
9987 }
9988 sctppcbinfo.ipi_gencnt_chunk++;
9989 chk = TAILQ_FIRST(&tmp);
9990 }
9991 goto release;
9992 }
9993 }
9994 zap_by_it_now:
9995 #ifdef SCTP_MBCNT_LOGGING
9996 sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE,
9997 asoc->total_output_queue_size,
9998 dataout,
9999 asoc->total_output_mbuf_queue_size,
10000 mbcnt);
10001 #endif
10002 crit_enter();
10003 SOCKBUF_LOCK(&so->so_snd);
10004 asoc->total_output_queue_size += dataout;
10005 asoc->total_output_mbuf_queue_size += mbcnt;
10006 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
10007 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
10008 so->so_snd.ssb_cc += dataout;
10009 so->so_snd.ssb_mbcnt += mbcnt;
10010 }
10011 if ((srcv->sinfo_flags & MSG_EOF) &&
10012 (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)
10013 ) {
10014 int some_on_streamwheel = 0;
10015 error = 0;
10016 if (!TAILQ_EMPTY(&asoc->out_wheel)) {
10017 /* Check to see if some data queued */
10018 struct sctp_stream_out *outs;
10019 TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) {
10020 if (!TAILQ_EMPTY(&outs->outqueue)) {
10021 some_on_streamwheel = 1;
10022 break;
10023 }
10024 }
10025 }
10026 if (TAILQ_EMPTY(&asoc->send_queue) &&
10027 TAILQ_EMPTY(&asoc->sent_queue) &&
10028 (some_on_streamwheel == 0)) {
10029 /* there is nothing queued to send, so I'm done... */
10030 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
10031 (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
10032 /* only send SHUTDOWN the first time through */
10033 #ifdef SCTP_DEBUG
10034 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
10035 kprintf("%s:%d sends a shutdown\n",
10036 __FILE__,
10037 __LINE__
10038 );
10039 }
10040 #endif
10041 sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
10042 asoc->state = SCTP_STATE_SHUTDOWN_SENT;
10043 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
10044 asoc->primary_destination);
10045 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb,
10046 asoc->primary_destination);
10047 }
10048 } else {
10049 /*
10050 * we still got (or just got) data to send, so set
10051 * SHUTDOWN_PENDING
10052 */
10053 /*
10054 * XXX sockets draft says that MSG_EOF should be sent
10055 * with no data. currently, we will allow user data
10056 * to be sent first and move to SHUTDOWN-PENDING
10057 */
10058 asoc->state |= SCTP_STATE_SHUTDOWN_PENDING;
10059 }
10060 }
10061 crit_exit();
10062 #ifdef SCTP_DEBUG
10063 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
10064 kprintf("++total out:%d total_mbuf_out:%d\n",
10065 (int)asoc->total_output_queue_size,
10066 (int)asoc->total_output_mbuf_queue_size);
10067 }
10068 #endif
10069
10070 release:
10071 ssb_unlock(&so->so_snd);
10072 out_locked:
10073 SOCKBUF_UNLOCK(&so->so_snd);
10074 out_notlocked:
10075 if (mm)
10076 sctp_m_freem(mm);
10077 return (error);
10078 }
10079
10080
10081 int
10082 sctp_sosend(struct socket *so,
10083 #ifdef __NetBSD__
10084 struct mbuf *addr_mbuf,
10085 #else
10086 struct sockaddr *addr,
10087 #endif
10088 struct uio *uio,
10089 struct mbuf *top,
10090 struct mbuf *control,
10091 #if defined(__NetBSD__) || defined(__APPLE__)
10092 int flags
10093 #else
10094 int flags,
10095 #if (defined(__FreeBSD__) && __FreeBSD_version >= 500000) || defined(__DragonFly__)
10096 struct thread *p
10097 #else
10098 struct proc *p
10099 #endif
10100 #endif
10101 )
10102 {
10103 unsigned int sndlen;
10104 int error, use_rcvinfo;
10105 int queue_only = 0, queue_only_for_init=0;
10106 int un_sent = 0;
10107 int now_filled=0;
10108 struct sctp_inpcb *inp;
10109 struct sctp_tcb *stcb=NULL;
10110 struct sctp_sndrcvinfo srcv;
10111 struct timeval now;
10112 struct sctp_nets *net;
10113 struct sctp_association *asoc;
10114 struct sctp_inpcb *t_inp;
10115 int create_lock_applied = 0;
10116 #if defined(__APPLE__)
10117 struct proc *p = current_proc();
10118 #elif defined(__NetBSD__)
10119 struct proc *p = curproc; /* XXX */
10120 struct sockaddr *addr = NULL;
10121 if (addr_mbuf)
10122 addr = mtod(addr_mbuf, struct sockaddr *);
10123 #endif
10124
10125 error = use_rcvinfo = 0;
10126 net = NULL;
10127 stcb = NULL;
10128 asoc = NULL;
10129 t_inp = inp = (struct sctp_inpcb *)so->so_pcb;
10130 if (uio)
10131 sndlen = uio->uio_resid;
10132 else
10133 sndlen = top->m_pkthdr.len;
10134
10135
10136 crit_enter();
10137
10138 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
10139 (inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING)) {
10140 /* The listner can NOT send */
10141 error = EFAULT;
10142 crit_exit();
10143 goto out;
10144 }
10145 if (addr) {
10146 SCTP_ASOC_CREATE_LOCK(inp);
10147 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
10148 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
10149 /* Should I really unlock ? */
10150 error = EFAULT;
10151 crit_exit();
10152 goto out;
10153
10154 }
10155 create_lock_applied = 1;
10156 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) &&
10157 (addr->sa_family == AF_INET6)) {
10158 error = EINVAL;
10159 crit_exit();
10160 goto out;
10161 }
10162 }
10163 /* now we must find the assoc */
10164 if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
10165 SCTP_INP_RLOCK(inp);
10166 stcb = LIST_FIRST(&inp->sctp_asoc_list);
10167 if (stcb == NULL) {
10168 SCTP_INP_RUNLOCK(inp);
10169 error = ENOTCONN;
10170 crit_exit();
10171 goto out;
10172 }
10173 SCTP_TCB_LOCK(stcb);
10174 SCTP_INP_RUNLOCK(inp);
10175 net = stcb->asoc.primary_destination;
10176 }
10177 /* get control */
10178 if (control) {
10179 /* process cmsg snd/rcv info (maybe a assoc-id) */
10180 if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&srcv, control,
10181 sizeof(srcv))) {
10182 /* got one */
10183 if (srcv.sinfo_flags & MSG_SENDALL) {
10184 /* its a sendall */
10185 sctppcbinfo.mbuf_track--;
10186 sctp_m_freem(control);
10187
10188 if (create_lock_applied) {
10189 SCTP_ASOC_CREATE_UNLOCK(inp);
10190 create_lock_applied = 0;
10191 }
10192 return (sctp_sendall(inp, uio, top, &srcv));
10193 }
10194 use_rcvinfo = 1;
10195 }
10196 }
10197 if (stcb == NULL) {
10198 /* Need to do a lookup */
10199 if (use_rcvinfo && srcv.sinfo_assoc_id) {
10200 stcb = sctp_findassociation_ep_asocid(inp, srcv.sinfo_assoc_id);
10201 /*
10202 * Question: Should I error here if the assoc_id is
10203 * no longer valid? i.e. I can't find it?
10204 */
10205 if ((stcb) &&
10206 (addr != NULL)) {
10207 /* Must locate the net structure */
10208 net = sctp_findnet(stcb, addr);
10209 }
10210 }
10211 if (stcb == NULL) {
10212 if (addr != NULL) {
10213 /* Since we did not use findep we must
10214 * increment it, and if we don't find a
10215 * tcb decrement it.
10216 */
10217 SCTP_INP_WLOCK(inp);
10218 SCTP_INP_INCR_REF(inp);
10219 SCTP_INP_WUNLOCK(inp);
10220 stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL);
10221 if (stcb == NULL) {
10222 SCTP_INP_WLOCK(inp);
10223 SCTP_INP_DECR_REF(inp);
10224 SCTP_INP_WUNLOCK(inp);
10225 }
10226 }
10227 }
10228 }
10229 if ((stcb == NULL) &&
10230 (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)) {
10231 error = ENOTCONN;
10232 crit_exit();
10233 goto out;
10234 } else if ((stcb == NULL) && (addr == NULL)) {
10235 error = ENOENT;
10236 crit_exit();
10237 goto out;
10238 } else if (stcb == NULL) {
10239 /* UDP style, we must go ahead and start the INIT process */
10240 if ((use_rcvinfo) &&
10241 (srcv.sinfo_flags & MSG_ABORT)) {
10242 /* User asks to abort a non-existant asoc */
10243 error = ENOENT;
10244 crit_exit();
10245 goto out;
10246 }
10247 /* get an asoc/stcb struct */
10248 stcb = sctp_aloc_assoc(inp, addr, 1, &error, 0);
10249 if (stcb == NULL) {
10250 /* Error is setup for us in the call */
10251 crit_exit();
10252 goto out;
10253 }
10254 if (create_lock_applied) {
10255 SCTP_ASOC_CREATE_UNLOCK(inp);
10256 create_lock_applied = 0;
10257 } else {
10258 kprintf("Huh-3? create lock should have been on??\n");
10259 }
10260 /* Turn on queue only flag to prevent data from being sent */
10261 queue_only = 1;
10262 asoc = &stcb->asoc;
10263 asoc->state = SCTP_STATE_COOKIE_WAIT;
10264 SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
10265 if (control) {
10266 /* see if a init structure exists in cmsg headers */
10267 struct sctp_initmsg initm;
10268 int i;
10269 if (sctp_find_cmsg(SCTP_INIT, (void *)&initm, control, sizeof(initm))) {
10270 /* we have an INIT override of the default */
10271 if (initm.sinit_max_attempts)
10272 asoc->max_init_times = initm.sinit_max_attempts;
10273 if (initm.sinit_num_ostreams)
10274 asoc->pre_open_streams = initm.sinit_num_ostreams;
10275 if (initm.sinit_max_instreams)
10276 asoc->max_inbound_streams = initm.sinit_max_instreams;
10277 if (initm.sinit_max_init_timeo)
10278 asoc->initial_init_rto_max = initm.sinit_max_init_timeo;
10279 if (asoc->streamoutcnt < asoc->pre_open_streams) {
10280 /* Default is NOT correct */
10281 #ifdef SCTP_DEBUG
10282 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
10283 kprintf("Ok, defout:%d pre_open:%d\n",
10284 asoc->streamoutcnt, asoc->pre_open_streams);
10285 }
10286 #endif
10287 FREE(asoc->strmout, M_PCB);
10288 asoc->strmout = NULL;
10289 asoc->streamoutcnt = asoc->pre_open_streams;
10290
10291 /* What happesn if this fails? .. we panic ...*/
10292 MALLOC(asoc->strmout,
10293 struct sctp_stream_out *,
10294 asoc->streamoutcnt *
10295 sizeof(struct sctp_stream_out),
10296 M_PCB, MB_WAIT);
10297 for (i = 0; i < asoc->streamoutcnt; i++) {
10298 /*
10299 * inbound side must be set to 0xffff,
10300 * also NOTE when we get the INIT-ACK
10301 * back (for INIT sender) we MUST
10302 * reduce the count (streamoutcnt) but
10303 * first check if we sent to any of the
10304 * upper streams that were dropped (if
10305 * some were). Those that were dropped
10306 * must be notified to the upper layer
10307 * as failed to send.
10308 */
10309 asoc->strmout[i].next_sequence_sent = 0x0;
10310 TAILQ_INIT(&asoc->strmout[i].outqueue);
10311 asoc->strmout[i].stream_no = i;
10312 asoc->strmout[i].next_spoke.tqe_next = 0;
10313 asoc->strmout[i].next_spoke.tqe_prev = 0;
10314 }
10315 }
10316 }
10317
10318 }
10319 /* out with the INIT */
10320 queue_only_for_init = 1;
10321 sctp_send_initiate(inp, stcb);
10322 /*
10323 * we may want to dig in after this call and adjust the MTU
10324 * value. It defaulted to 1500 (constant) but the ro structure
10325 * may now have an update and thus we may need to change it
10326 * BEFORE we append the message.
10327 */
10328 net = stcb->asoc.primary_destination;
10329 asoc = &stcb->asoc;
10330 } else {
10331 asoc = &stcb->asoc;
10332 }
10333 if (create_lock_applied) {
10334 SCTP_ASOC_CREATE_UNLOCK(inp);
10335 create_lock_applied = 0;
10336 }
10337 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
10338 (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
10339 queue_only = 1;
10340 }
10341 if (use_rcvinfo == 0) {
10342 /* Grab the default stuff from the asoc */
10343 srcv = stcb->asoc.def_send;
10344 }
10345 /* we are now done with all control */
10346 if (control) {
10347 sctp_m_freem(control);
10348 control = NULL;
10349 }
10350
10351 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
10352 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
10353 (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
10354 (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
10355 if ((use_rcvinfo) &&
10356 (srcv.sinfo_flags & MSG_ABORT)) {
10357 ;
10358 } else {
10359 error = ECONNRESET;
10360 crit_exit();
10361 goto out;
10362 }
10363 }
10364 /* Ok, we will attempt a msgsnd :> */
10365 if (p)
10366 #if (defined(__FreeBSD__) && __FreeBSD_version >= 500000) || defined(__DragonFly__)
10367 p->td_lwp->lwp_ru.ru_msgsnd++;
10368 #else
10369 p->p_stats->p_ru.ru_msgsnd++;
10370 #endif
10371
10372 if (stcb) {
10373 if (net && ((srcv.sinfo_flags & MSG_ADDR_OVER))) {
10374 /* we take the override or the unconfirmed */
10375 ;
10376 } else {
10377 net = stcb->asoc.primary_destination;
10378 }
10379 }
10380
10381 if (top == NULL) {
10382 /* Must copy it all in from user land. The
10383 * socket buf is locked but we don't suspend
10384 * protocol processing until we are ready to
10385 * send/queue it.
10386 */
10387 crit_exit();
10388 error = sctp_copy_it_in(inp, stcb, asoc, net, &srcv, uio, flags);
10389 if (error)
10390 goto out;
10391 } else {
10392 /* Here we must either pull in the user data to chunk
10393 * buffers, or use top to do a msg_append.
10394 */
10395 error = sctp_msg_append(stcb, net, top, &srcv, flags);
10396 crit_exit();
10397 if (error)
10398 goto out;
10399 /* zap the top since it is now being used */
10400 top = 0;
10401 }
10402
10403 if (net->flight_size > net->cwnd) {
10404 sctp_pegs[SCTP_SENDTO_FULL_CWND]++;
10405 queue_only = 1;
10406
10407 } else if (asoc->ifp_had_enobuf) {
10408 sctp_pegs[SCTP_QUEONLY_BURSTLMT]++;
10409 queue_only = 1;
10410 } else {
10411 un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
10412 ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * sizeof(struct sctp_data_chunk)) +
10413 SCTP_MED_OVERHEAD);
10414
10415 if (((inp->sctp_flags & SCTP_PCB_FLAGS_NODELAY) == 0) &&
10416 (stcb->asoc.total_flight > 0) &&
10417 (un_sent < (int)stcb->asoc.smallest_mtu)) {
10418
10419 /* Ok, Nagle is set on and we have data outstanding. Don't
10420 * send anything and let SACKs drive out the data unless we
10421 * have a "full" segment to send.
10422 */
10423 sctp_pegs[SCTP_NAGLE_NOQ]++;
10424 queue_only = 1;
10425 } else {
10426 sctp_pegs[SCTP_NAGLE_OFF]++;
10427 }
10428 }
10429 if (queue_only_for_init) {
10430 /* It is possible to have a turn around of the
10431 * INIT/INIT-ACK/COOKIE before I have a chance to
10432 * copy in the data. In such a case I DO want to
10433 * send it out by reversing the queue only flag.
10434 */
10435 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) ||
10436 (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) {
10437 /* yep, reverse it */
10438 queue_only = 0;
10439 }
10440 }
10441
10442 if ((queue_only == 0) && (stcb->asoc.peers_rwnd && un_sent)) {
10443 /* we can attempt to send too.*/
10444 #ifdef SCTP_DEBUG
10445 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
10446 kprintf("USR Send calls sctp_chunk_output\n");
10447 }
10448 #endif
10449 crit_enter();
10450 sctp_pegs[SCTP_OUTPUT_FRM_SND]++;
10451 sctp_chunk_output(inp, stcb, 0);
10452 crit_exit();
10453 } else if ((queue_only == 0) &&
10454 (stcb->asoc.peers_rwnd == 0) &&
10455 (stcb->asoc.total_flight == 0)) {
10456 /* We get to have a probe outstanding */
10457 crit_enter();
10458 sctp_from_user_send = 1;
10459 sctp_chunk_output(inp, stcb, 0);
10460 sctp_from_user_send = 0;
10461 crit_exit();
10462
10463 } else if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
10464 int num_out, reason, cwnd_full;
10465 /* Here we do control only */
10466 crit_enter();
10467 sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out,
10468 &reason, 1, &cwnd_full, 1, &now, &now_filled);
10469 crit_exit();
10470 }
10471 #ifdef SCTP_DEBUG
10472 if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
10473 kprintf("USR Send complete qo:%d prw:%d unsent:%d tf:%d cooq:%d toqs:%d \n",
10474 queue_only, stcb->asoc.peers_rwnd, un_sent,
10475 stcb->asoc.total_flight, stcb->asoc.chunks_on_out_queue,
10476 stcb->asoc.total_output_queue_size);
10477 }
10478 #endif
10479 out:
10480 if (create_lock_applied) {
10481 SCTP_ASOC_CREATE_UNLOCK(inp);
10482 create_lock_applied = 0;
10483 }
10484 if (stcb)
10485 SCTP_TCB_UNLOCK(stcb);
10486 if (top)
10487 sctp_m_freem(top);
10488 if (control)
10489 sctp_m_freem(control);
10490 return (error);
10491 }
DragonFly BSD