1 /*-
2 * SPDX-License-Identifier: BSD-3-Clause
3 *
4 * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
5 * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
6 * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions are met:
10 *
11 * a) Redistributions of source code must retain the above copyright notice,
12 * this list of conditions and the following disclaimer.
13 *
14 * b) Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in
16 * the documentation and/or other materials provided with the distribution.
17 *
18 * c) Neither the name of Cisco Systems, Inc. nor the names of its
19 * contributors may be used to endorse or promote products derived
20 * from this software without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
24 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
26 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
27 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
28 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
29 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
30 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
32 * THE POSSIBILITY OF SUCH DAMAGE.
33 */
34
35 #include <sys/cdefs.h>
36 __FBSDID("$FreeBSD$");
37
38 #include <netinet/sctp_os.h>
39 #include <sys/proc.h>
40 #include <netinet/sctp_var.h>
41 #include <netinet/sctp_sysctl.h>
42 #include <netinet/sctp_pcb.h>
43 #include <netinet/sctputil.h>
44 #include <netinet/sctp.h>
45 #include <netinet/sctp_header.h>
46 #include <netinet/sctp_asconf.h>
47 #include <netinet/sctp_output.h>
48 #include <netinet/sctp_timer.h>
49 #include <netinet/sctp_bsd_addr.h>
50 #if defined(INET) || defined(INET6)
51 #include <netinet/udp.h>
52 #endif
53 #ifdef INET6
54 #include <netinet6/ip6_var.h>
55 #endif
56 #include <sys/sched.h>
57 #include <sys/smp.h>
58 #include <sys/unistd.h>
59
60 /* FIX: we don't handle multiple link local scopes */
61 /* "scopeless" replacement IN6_ARE_ADDR_EQUAL */
62 #ifdef INET6
63 int
64 SCTP6_ARE_ADDR_EQUAL(struct sockaddr_in6 *a, struct sockaddr_in6 *b)
65 {
66 struct sockaddr_in6 tmp_a, tmp_b;
67
68 memcpy(&tmp_a, a, sizeof(struct sockaddr_in6));
69 if (sa6_embedscope(&tmp_a, MODULE_GLOBAL(ip6_use_defzone)) != 0) {
70 return (0);
71 }
72 memcpy(&tmp_b, b, sizeof(struct sockaddr_in6));
73 if (sa6_embedscope(&tmp_b, MODULE_GLOBAL(ip6_use_defzone)) != 0) {
74 return (0);
75 }
76 return (IN6_ARE_ADDR_EQUAL(&tmp_a.sin6_addr, &tmp_b.sin6_addr));
77 }
78 #endif
79
80 void
81 sctp_fill_pcbinfo(struct sctp_pcbinfo *spcb)
82 {
83 /*
84 * We really don't need to lock this, but I will just because it
85 * does not hurt.
86 */
87 SCTP_INP_INFO_RLOCK();
88 spcb->ep_count = SCTP_BASE_INFO(ipi_count_ep);
89 spcb->asoc_count = SCTP_BASE_INFO(ipi_count_asoc);
90 spcb->laddr_count = SCTP_BASE_INFO(ipi_count_laddr);
91 spcb->raddr_count = SCTP_BASE_INFO(ipi_count_raddr);
92 spcb->chk_count = SCTP_BASE_INFO(ipi_count_chunk);
93 spcb->readq_count = SCTP_BASE_INFO(ipi_count_readq);
94 spcb->stream_oque = SCTP_BASE_INFO(ipi_count_strmoq);
95 spcb->free_chunks = SCTP_BASE_INFO(ipi_free_chunks);
96 SCTP_INP_INFO_RUNLOCK();
97 }
98
99 /*-
100 * Addresses are added to VRF's (Virtual Router's). For BSD we
101 * have only the default VRF 0. We maintain a hash list of
102 * VRF's. Each VRF has its own list of sctp_ifn's. Each of
103 * these has a list of addresses. When we add a new address
104 * to a VRF we lookup the ifn/ifn_index, if the ifn does
105 * not exist we create it and add it to the list of IFN's
106 * within the VRF. Once we have the sctp_ifn, we add the
107 * address to the list. So we look something like:
108 *
109 * hash-vrf-table
110 * vrf-> ifn-> ifn -> ifn
111 * vrf |
112 * ... +--ifa-> ifa -> ifa
113 * vrf
114 *
115 * We keep these separate lists since the SCTP subsystem will
116 * point to these from its source address selection nets structure.
117 * When an address is deleted it does not happen right away on
118 * the SCTP side, it gets scheduled. What we do when a
119 * delete happens is immediately remove the address from
120 * the master list and decrement the refcount. As our
121 * addip iterator works through and frees the src address
122 * selection pointing to the sctp_ifa, eventually the refcount
123 * will reach 0 and we will delete it. Note that it is assumed
124 * that any locking on system level ifn/ifa is done at the
125 * caller of these functions and these routines will only
126 * lock the SCTP structures as they add or delete things.
127 *
128 * Other notes on VRF concepts.
129 * - An endpoint can be in multiple VRF's
130 * - An association lives within a VRF and only one VRF.
131 * - Any incoming packet we can deduce the VRF for by
132 * looking at the mbuf/pak inbound (for BSD its VRF=0 :D)
133 * - Any downward send call or connect call must supply the
134 * VRF via ancillary data or via some sort of set default
135 * VRF socket option call (again for BSD no brainer since
136 * the VRF is always 0).
137 * - An endpoint may add multiple VRF's to it.
138 * - Listening sockets can accept associations in any
139 * of the VRF's they are in but the assoc will end up
140 * in only one VRF (gotten from the packet or connect/send).
141 *
142 */
143
144 struct sctp_vrf *
145 sctp_allocate_vrf(int vrf_id)
146 {
147 struct sctp_vrf *vrf = NULL;
148 struct sctp_vrflist *bucket;
149
150 /* First allocate the VRF structure */
151 vrf = sctp_find_vrf(vrf_id);
152 if (vrf) {
153 /* Already allocated */
154 return (vrf);
155 }
156 SCTP_MALLOC(vrf, struct sctp_vrf *, sizeof(struct sctp_vrf),
157 SCTP_M_VRF);
158 if (vrf == NULL) {
159 /* No memory */
160 #ifdef INVARIANTS
161 panic("No memory for VRF:%d", vrf_id);
162 #endif
163 return (NULL);
164 }
165 /* setup the VRF */
166 memset(vrf, 0, sizeof(struct sctp_vrf));
167 vrf->vrf_id = vrf_id;
168 LIST_INIT(&vrf->ifnlist);
169 vrf->total_ifa_count = 0;
170 vrf->refcount = 0;
171 /* now also setup table ids */
172 SCTP_INIT_VRF_TABLEID(vrf);
173 /* Init the HASH of addresses */
174 vrf->vrf_addr_hash = SCTP_HASH_INIT(SCTP_VRF_ADDR_HASH_SIZE,
175 &vrf->vrf_addr_hashmark);
176 if (vrf->vrf_addr_hash == NULL) {
177 /* No memory */
178 #ifdef INVARIANTS
179 panic("No memory for VRF:%d", vrf_id);
180 #endif
181 SCTP_FREE(vrf, SCTP_M_VRF);
182 return (NULL);
183 }
184
185 /* Add it to the hash table */
186 bucket = &SCTP_BASE_INFO(sctp_vrfhash)[(vrf_id & SCTP_BASE_INFO(hashvrfmark))];
187 LIST_INSERT_HEAD(bucket, vrf, next_vrf);
188 atomic_add_int(&SCTP_BASE_INFO(ipi_count_vrfs), 1);
189 return (vrf);
190 }
191
192 struct sctp_ifn *
193 sctp_find_ifn(void *ifn, uint32_t ifn_index)
194 {
195 struct sctp_ifn *sctp_ifnp;
196 struct sctp_ifnlist *hash_ifn_head;
197
198 /*
199 * We assume the lock is held for the addresses if that's wrong
200 * problems could occur :-)
201 */
202 SCTP_IPI_ADDR_LOCK_ASSERT();
203 hash_ifn_head = &SCTP_BASE_INFO(vrf_ifn_hash)[(ifn_index & SCTP_BASE_INFO(vrf_ifn_hashmark))];
204 LIST_FOREACH(sctp_ifnp, hash_ifn_head, next_bucket) {
205 if (sctp_ifnp->ifn_index == ifn_index) {
206 return (sctp_ifnp);
207 }
208 if (sctp_ifnp->ifn_p && ifn && (sctp_ifnp->ifn_p == ifn)) {
209 return (sctp_ifnp);
210 }
211 }
212 return (NULL);
213 }
214
215 struct sctp_vrf *
216 sctp_find_vrf(uint32_t vrf_id)
217 {
218 struct sctp_vrflist *bucket;
219 struct sctp_vrf *liste;
220
221 bucket = &SCTP_BASE_INFO(sctp_vrfhash)[(vrf_id & SCTP_BASE_INFO(hashvrfmark))];
222 LIST_FOREACH(liste, bucket, next_vrf) {
223 if (vrf_id == liste->vrf_id) {
224 return (liste);
225 }
226 }
227 return (NULL);
228 }
229
230 void
231 sctp_free_vrf(struct sctp_vrf *vrf)
232 {
233 if (SCTP_DECREMENT_AND_CHECK_REFCOUNT(&vrf->refcount)) {
234 if (vrf->vrf_addr_hash) {
235 SCTP_HASH_FREE(vrf->vrf_addr_hash, vrf->vrf_addr_hashmark);
236 vrf->vrf_addr_hash = NULL;
237 }
238 /* We zero'd the count */
239 LIST_REMOVE(vrf, next_vrf);
240 SCTP_FREE(vrf, SCTP_M_VRF);
241 atomic_subtract_int(&SCTP_BASE_INFO(ipi_count_vrfs), 1);
242 }
243 }
244
245 void
246 sctp_free_ifn(struct sctp_ifn *sctp_ifnp)
247 {
248 if (SCTP_DECREMENT_AND_CHECK_REFCOUNT(&sctp_ifnp->refcount)) {
249 /* We zero'd the count */
250 if (sctp_ifnp->vrf) {
251 sctp_free_vrf(sctp_ifnp->vrf);
252 }
253 SCTP_FREE(sctp_ifnp, SCTP_M_IFN);
254 atomic_subtract_int(&SCTP_BASE_INFO(ipi_count_ifns), 1);
255 }
256 }
257
258 void
259 sctp_update_ifn_mtu(uint32_t ifn_index, uint32_t mtu)
260 {
261 struct sctp_ifn *sctp_ifnp;
262
263 sctp_ifnp = sctp_find_ifn((void *)NULL, ifn_index);
264 if (sctp_ifnp != NULL) {
265 sctp_ifnp->ifn_mtu = mtu;
266 }
267 }
268
269 void
270 sctp_free_ifa(struct sctp_ifa *sctp_ifap)
271 {
272 if (SCTP_DECREMENT_AND_CHECK_REFCOUNT(&sctp_ifap->refcount)) {
273 /* We zero'd the count */
274 if (sctp_ifap->ifn_p) {
275 sctp_free_ifn(sctp_ifap->ifn_p);
276 }
277 SCTP_FREE(sctp_ifap, SCTP_M_IFA);
278 atomic_subtract_int(&SCTP_BASE_INFO(ipi_count_ifas), 1);
279 }
280 }
281
282 static void
283 sctp_delete_ifn(struct sctp_ifn *sctp_ifnp, int hold_addr_lock)
284 {
285 struct sctp_ifn *found;
286
287 found = sctp_find_ifn(sctp_ifnp->ifn_p, sctp_ifnp->ifn_index);
288 if (found == NULL) {
289 /* Not in the list.. sorry */
290 return;
291 }
292 if (hold_addr_lock == 0) {
293 SCTP_IPI_ADDR_WLOCK();
294 } else {
295 SCTP_IPI_ADDR_WLOCK_ASSERT();
296 }
297 LIST_REMOVE(sctp_ifnp, next_bucket);
298 LIST_REMOVE(sctp_ifnp, next_ifn);
299 if (hold_addr_lock == 0) {
300 SCTP_IPI_ADDR_WUNLOCK();
301 }
302 /* Take away the reference, and possibly free it */
303 sctp_free_ifn(sctp_ifnp);
304 }
305
306 void
307 sctp_mark_ifa_addr_down(uint32_t vrf_id, struct sockaddr *addr,
308 const char *if_name, uint32_t ifn_index)
309 {
310 struct sctp_vrf *vrf;
311 struct sctp_ifa *sctp_ifap;
312
313 SCTP_IPI_ADDR_RLOCK();
314 vrf = sctp_find_vrf(vrf_id);
315 if (vrf == NULL) {
316 SCTPDBG(SCTP_DEBUG_PCB4, "Can't find vrf_id 0x%x\n", vrf_id);
317 goto out;
318 }
319 sctp_ifap = sctp_find_ifa_by_addr(addr, vrf->vrf_id, SCTP_ADDR_LOCKED);
320 if (sctp_ifap == NULL) {
321 SCTPDBG(SCTP_DEBUG_PCB4, "Can't find sctp_ifap for address\n");
322 goto out;
323 }
324 if (sctp_ifap->ifn_p == NULL) {
325 SCTPDBG(SCTP_DEBUG_PCB4, "IFA has no IFN - can't mark unusable\n");
326 goto out;
327 }
328 if (if_name) {
329 if (strncmp(if_name, sctp_ifap->ifn_p->ifn_name, SCTP_IFNAMSIZ) != 0) {
330 SCTPDBG(SCTP_DEBUG_PCB4, "IFN %s of IFA not the same as %s\n",
331 sctp_ifap->ifn_p->ifn_name, if_name);
332 goto out;
333 }
334 } else {
335 if (sctp_ifap->ifn_p->ifn_index != ifn_index) {
336 SCTPDBG(SCTP_DEBUG_PCB4, "IFA owned by ifn_index:%d down command for ifn_index:%d - ignored\n",
337 sctp_ifap->ifn_p->ifn_index, ifn_index);
338 goto out;
339 }
340 }
341
342 sctp_ifap->localifa_flags &= (~SCTP_ADDR_VALID);
343 sctp_ifap->localifa_flags |= SCTP_ADDR_IFA_UNUSEABLE;
344 out:
345 SCTP_IPI_ADDR_RUNLOCK();
346 }
347
348 void
349 sctp_mark_ifa_addr_up(uint32_t vrf_id, struct sockaddr *addr,
350 const char *if_name, uint32_t ifn_index)
351 {
352 struct sctp_vrf *vrf;
353 struct sctp_ifa *sctp_ifap;
354
355 SCTP_IPI_ADDR_RLOCK();
356 vrf = sctp_find_vrf(vrf_id);
357 if (vrf == NULL) {
358 SCTPDBG(SCTP_DEBUG_PCB4, "Can't find vrf_id 0x%x\n", vrf_id);
359 goto out;
360 }
361 sctp_ifap = sctp_find_ifa_by_addr(addr, vrf->vrf_id, SCTP_ADDR_LOCKED);
362 if (sctp_ifap == NULL) {
363 SCTPDBG(SCTP_DEBUG_PCB4, "Can't find sctp_ifap for address\n");
364 goto out;
365 }
366 if (sctp_ifap->ifn_p == NULL) {
367 SCTPDBG(SCTP_DEBUG_PCB4, "IFA has no IFN - can't mark unusable\n");
368 goto out;
369 }
370 if (if_name) {
371 if (strncmp(if_name, sctp_ifap->ifn_p->ifn_name, SCTP_IFNAMSIZ) != 0) {
372 SCTPDBG(SCTP_DEBUG_PCB4, "IFN %s of IFA not the same as %s\n",
373 sctp_ifap->ifn_p->ifn_name, if_name);
374 goto out;
375 }
376 } else {
377 if (sctp_ifap->ifn_p->ifn_index != ifn_index) {
378 SCTPDBG(SCTP_DEBUG_PCB4, "IFA owned by ifn_index:%d down command for ifn_index:%d - ignored\n",
379 sctp_ifap->ifn_p->ifn_index, ifn_index);
380 goto out;
381 }
382 }
383
384 sctp_ifap->localifa_flags &= (~SCTP_ADDR_IFA_UNUSEABLE);
385 sctp_ifap->localifa_flags |= SCTP_ADDR_VALID;
386 out:
387 SCTP_IPI_ADDR_RUNLOCK();
388 }
389
390 /*-
391 * Add an ifa to an ifn.
392 * Register the interface as necessary.
393 * NOTE: ADDR write lock MUST be held.
394 */
395 static void
396 sctp_add_ifa_to_ifn(struct sctp_ifn *sctp_ifnp, struct sctp_ifa *sctp_ifap)
397 {
398 int ifa_af;
399
400 LIST_INSERT_HEAD(&sctp_ifnp->ifalist, sctp_ifap, next_ifa);
401 sctp_ifap->ifn_p = sctp_ifnp;
402 atomic_add_int(&sctp_ifap->ifn_p->refcount, 1);
403 /* update address counts */
404 sctp_ifnp->ifa_count++;
405 ifa_af = sctp_ifap->address.sa.sa_family;
406 switch (ifa_af) {
407 #ifdef INET
408 case AF_INET:
409 sctp_ifnp->num_v4++;
410 break;
411 #endif
412 #ifdef INET6
413 case AF_INET6:
414 sctp_ifnp->num_v6++;
415 break;
416 #endif
417 default:
418 break;
419 }
420 if (sctp_ifnp->ifa_count == 1) {
421 /* register the new interface */
422 sctp_ifnp->registered_af = ifa_af;
423 }
424 }
425
426 /*-
427 * Remove an ifa from its ifn.
428 * If no more addresses exist, remove the ifn too. Otherwise, re-register
429 * the interface based on the remaining address families left.
430 * NOTE: ADDR write lock MUST be held.
431 */
432 static void
433 sctp_remove_ifa_from_ifn(struct sctp_ifa *sctp_ifap)
434 {
435 LIST_REMOVE(sctp_ifap, next_ifa);
436 if (sctp_ifap->ifn_p) {
437 /* update address counts */
438 sctp_ifap->ifn_p->ifa_count--;
439 switch (sctp_ifap->address.sa.sa_family) {
440 #ifdef INET
441 case AF_INET:
442 sctp_ifap->ifn_p->num_v4--;
443 break;
444 #endif
445 #ifdef INET6
446 case AF_INET6:
447 sctp_ifap->ifn_p->num_v6--;
448 break;
449 #endif
450 default:
451 break;
452 }
453
454 if (LIST_EMPTY(&sctp_ifap->ifn_p->ifalist)) {
455 /* remove the ifn, possibly freeing it */
456 sctp_delete_ifn(sctp_ifap->ifn_p, SCTP_ADDR_LOCKED);
457 } else {
458 /* re-register address family type, if needed */
459 if ((sctp_ifap->ifn_p->num_v6 == 0) &&
460 (sctp_ifap->ifn_p->registered_af == AF_INET6)) {
461 sctp_ifap->ifn_p->registered_af = AF_INET;
462 } else if ((sctp_ifap->ifn_p->num_v4 == 0) &&
463 (sctp_ifap->ifn_p->registered_af == AF_INET)) {
464 sctp_ifap->ifn_p->registered_af = AF_INET6;
465 }
466 /* free the ifn refcount */
467 sctp_free_ifn(sctp_ifap->ifn_p);
468 }
469 sctp_ifap->ifn_p = NULL;
470 }
471 }
472
473 struct sctp_ifa *
474 sctp_add_addr_to_vrf(uint32_t vrf_id, void *ifn, uint32_t ifn_index,
475 uint32_t ifn_type, const char *if_name, void *ifa,
476 struct sockaddr *addr, uint32_t ifa_flags,
477 int dynamic_add)
478 {
479 struct sctp_vrf *vrf;
480 struct sctp_ifn *sctp_ifnp, *new_sctp_ifnp;
481 struct sctp_ifa *sctp_ifap, *new_sctp_ifap;
482 struct sctp_ifalist *hash_addr_head;
483 struct sctp_ifnlist *hash_ifn_head;
484 uint32_t hash_of_addr;
485 int new_ifn_af = 0;
486
487 #ifdef SCTP_DEBUG
488 SCTPDBG(SCTP_DEBUG_PCB4, "vrf_id 0x%x: adding address: ", vrf_id);
489 SCTPDBG_ADDR(SCTP_DEBUG_PCB4, addr);
490 #endif
491 SCTP_MALLOC(new_sctp_ifnp, struct sctp_ifn *,
492 sizeof(struct sctp_ifn), SCTP_M_IFN);
493 if (new_sctp_ifnp == NULL) {
494 #ifdef INVARIANTS
495 panic("No memory for IFN");
496 #endif
497 return (NULL);
498 }
499 SCTP_MALLOC(new_sctp_ifap, struct sctp_ifa *, sizeof(struct sctp_ifa), SCTP_M_IFA);
500 if (new_sctp_ifap == NULL) {
501 #ifdef INVARIANTS
502 panic("No memory for IFA");
503 #endif
504 SCTP_FREE(new_sctp_ifnp, SCTP_M_IFN);
505 return (NULL);
506 }
507
508 SCTP_IPI_ADDR_WLOCK();
509 sctp_ifnp = sctp_find_ifn(ifn, ifn_index);
510 if (sctp_ifnp) {
511 vrf = sctp_ifnp->vrf;
512 } else {
513 vrf = sctp_find_vrf(vrf_id);
514 if (vrf == NULL) {
515 vrf = sctp_allocate_vrf(vrf_id);
516 if (vrf == NULL) {
517 SCTP_IPI_ADDR_WUNLOCK();
518 SCTP_FREE(new_sctp_ifnp, SCTP_M_IFN);
519 SCTP_FREE(new_sctp_ifap, SCTP_M_IFA);
520 return (NULL);
521 }
522 }
523 }
524 if (sctp_ifnp == NULL) {
525 /*
526 * build one and add it, can't hold lock until after malloc
527 * done though.
528 */
529 sctp_ifnp = new_sctp_ifnp;
530 new_sctp_ifnp = NULL;
531 memset(sctp_ifnp, 0, sizeof(struct sctp_ifn));
532 sctp_ifnp->ifn_index = ifn_index;
533 sctp_ifnp->ifn_p = ifn;
534 sctp_ifnp->ifn_type = ifn_type;
535 sctp_ifnp->refcount = 0;
536 sctp_ifnp->vrf = vrf;
537 atomic_add_int(&vrf->refcount, 1);
538 sctp_ifnp->ifn_mtu = SCTP_GATHER_MTU_FROM_IFN_INFO(ifn, ifn_index);
539 if (if_name != NULL) {
540 SCTP_SNPRINTF(sctp_ifnp->ifn_name, SCTP_IFNAMSIZ, "%s", if_name);
541 } else {
542 SCTP_SNPRINTF(sctp_ifnp->ifn_name, SCTP_IFNAMSIZ, "%s", "unknown");
543 }
544 hash_ifn_head = &SCTP_BASE_INFO(vrf_ifn_hash)[(ifn_index & SCTP_BASE_INFO(vrf_ifn_hashmark))];
545 LIST_INIT(&sctp_ifnp->ifalist);
546 LIST_INSERT_HEAD(hash_ifn_head, sctp_ifnp, next_bucket);
547 LIST_INSERT_HEAD(&vrf->ifnlist, sctp_ifnp, next_ifn);
548 atomic_add_int(&SCTP_BASE_INFO(ipi_count_ifns), 1);
549 new_ifn_af = 1;
550 }
551 sctp_ifap = sctp_find_ifa_by_addr(addr, vrf->vrf_id, SCTP_ADDR_LOCKED);
552 if (sctp_ifap) {
553 /* Hmm, it already exists? */
554 if ((sctp_ifap->ifn_p) &&
555 (sctp_ifap->ifn_p->ifn_index == ifn_index)) {
556 SCTPDBG(SCTP_DEBUG_PCB4, "Using existing ifn %s (0x%x) for ifa %p\n",
557 sctp_ifap->ifn_p->ifn_name, ifn_index,
558 (void *)sctp_ifap);
559 if (new_ifn_af) {
560 /* Remove the created one that we don't want */
561 sctp_delete_ifn(sctp_ifnp, SCTP_ADDR_LOCKED);
562 }
563 if (sctp_ifap->localifa_flags & SCTP_BEING_DELETED) {
564 /* easy to solve, just switch back to active */
565 SCTPDBG(SCTP_DEBUG_PCB4, "Clearing deleted ifa flag\n");
566 sctp_ifap->localifa_flags = SCTP_ADDR_VALID;
567 sctp_ifap->ifn_p = sctp_ifnp;
568 atomic_add_int(&sctp_ifap->ifn_p->refcount, 1);
569 }
570 exit_stage_left:
571 SCTP_IPI_ADDR_WUNLOCK();
572 if (new_sctp_ifnp != NULL) {
573 SCTP_FREE(new_sctp_ifnp, SCTP_M_IFN);
574 }
575 SCTP_FREE(new_sctp_ifap, SCTP_M_IFA);
576 return (sctp_ifap);
577 } else {
578 if (sctp_ifap->ifn_p) {
579 /*
580 * The last IFN gets the address, remove the
581 * old one
582 */
583 SCTPDBG(SCTP_DEBUG_PCB4, "Moving ifa %p from %s (0x%x) to %s (0x%x)\n",
584 (void *)sctp_ifap, sctp_ifap->ifn_p->ifn_name,
585 sctp_ifap->ifn_p->ifn_index, if_name,
586 ifn_index);
587 /* remove the address from the old ifn */
588 sctp_remove_ifa_from_ifn(sctp_ifap);
589 /* move the address over to the new ifn */
590 sctp_add_ifa_to_ifn(sctp_ifnp, sctp_ifap);
591 goto exit_stage_left;
592 } else {
593 /* repair ifnp which was NULL ? */
594 sctp_ifap->localifa_flags = SCTP_ADDR_VALID;
595 SCTPDBG(SCTP_DEBUG_PCB4, "Repairing ifn %p for ifa %p\n",
596 (void *)sctp_ifnp, (void *)sctp_ifap);
597 sctp_add_ifa_to_ifn(sctp_ifnp, sctp_ifap);
598 }
599 goto exit_stage_left;
600 }
601 }
602 sctp_ifap = new_sctp_ifap;
603 memset(sctp_ifap, 0, sizeof(struct sctp_ifa));
604 sctp_ifap->ifn_p = sctp_ifnp;
605 atomic_add_int(&sctp_ifnp->refcount, 1);
606 sctp_ifap->vrf_id = vrf_id;
607 sctp_ifap->ifa = ifa;
608 memcpy(&sctp_ifap->address, addr, addr->sa_len);
609 sctp_ifap->localifa_flags = SCTP_ADDR_VALID | SCTP_ADDR_DEFER_USE;
610 sctp_ifap->flags = ifa_flags;
611 /* Set scope */
612 switch (sctp_ifap->address.sa.sa_family) {
613 #ifdef INET
614 case AF_INET:
615 {
616 struct sockaddr_in *sin;
617
618 sin = &sctp_ifap->address.sin;
619 if (SCTP_IFN_IS_IFT_LOOP(sctp_ifap->ifn_p) ||
620 (IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) {
621 sctp_ifap->src_is_loop = 1;
622 }
623 if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
624 sctp_ifap->src_is_priv = 1;
625 }
626 sctp_ifnp->num_v4++;
627 if (new_ifn_af)
628 new_ifn_af = AF_INET;
629 break;
630 }
631 #endif
632 #ifdef INET6
633 case AF_INET6:
634 {
635 /* ok to use deprecated addresses? */
636 struct sockaddr_in6 *sin6;
637
638 sin6 = &sctp_ifap->address.sin6;
639 if (SCTP_IFN_IS_IFT_LOOP(sctp_ifap->ifn_p) ||
640 (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr))) {
641 sctp_ifap->src_is_loop = 1;
642 }
643 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
644 sctp_ifap->src_is_priv = 1;
645 }
646 sctp_ifnp->num_v6++;
647 if (new_ifn_af)
648 new_ifn_af = AF_INET6;
649 break;
650 }
651 #endif
652 default:
653 new_ifn_af = 0;
654 break;
655 }
656 hash_of_addr = sctp_get_ifa_hash_val(&sctp_ifap->address.sa);
657
658 if ((sctp_ifap->src_is_priv == 0) &&
659 (sctp_ifap->src_is_loop == 0)) {
660 sctp_ifap->src_is_glob = 1;
661 }
662 hash_addr_head = &vrf->vrf_addr_hash[(hash_of_addr & vrf->vrf_addr_hashmark)];
663 LIST_INSERT_HEAD(hash_addr_head, sctp_ifap, next_bucket);
664 sctp_ifap->refcount = 1;
665 LIST_INSERT_HEAD(&sctp_ifnp->ifalist, sctp_ifap, next_ifa);
666 sctp_ifnp->ifa_count++;
667 vrf->total_ifa_count++;
668 atomic_add_int(&SCTP_BASE_INFO(ipi_count_ifas), 1);
669 if (new_ifn_af) {
670 sctp_ifnp->registered_af = new_ifn_af;
671 }
672 SCTP_IPI_ADDR_WUNLOCK();
673 if (new_sctp_ifnp != NULL) {
674 SCTP_FREE(new_sctp_ifnp, SCTP_M_IFN);
675 }
676
677 if (dynamic_add) {
678 /*
679 * Bump up the refcount so that when the timer completes it
680 * will drop back down.
681 */
682 struct sctp_laddr *wi;
683
684 atomic_add_int(&sctp_ifap->refcount, 1);
685 wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
686 if (wi == NULL) {
687 /*
688 * Gak, what can we do? We have lost an address
689 * change can you say HOSED?
690 */
691 SCTPDBG(SCTP_DEBUG_PCB4, "Lost an address change?\n");
692 /* Opps, must decrement the count */
693 sctp_del_addr_from_vrf(vrf_id, addr, ifn_index,
694 if_name);
695 return (NULL);
696 }
697 SCTP_INCR_LADDR_COUNT();
698 memset(wi, 0, sizeof(*wi));
699 (void)SCTP_GETTIME_TIMEVAL(&wi->start_time);
700 wi->ifa = sctp_ifap;
701 wi->action = SCTP_ADD_IP_ADDRESS;
702
703 SCTP_WQ_ADDR_LOCK();
704 LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
705 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
706 (struct sctp_inpcb *)NULL,
707 (struct sctp_tcb *)NULL,
708 (struct sctp_nets *)NULL);
709 SCTP_WQ_ADDR_UNLOCK();
710 } else {
711 /* it's ready for use */
712 sctp_ifap->localifa_flags &= ~SCTP_ADDR_DEFER_USE;
713 }
714 return (sctp_ifap);
715 }
716
717 void
718 sctp_del_addr_from_vrf(uint32_t vrf_id, struct sockaddr *addr,
719 uint32_t ifn_index, const char *if_name)
720 {
721 struct sctp_vrf *vrf;
722 struct sctp_ifa *sctp_ifap = NULL;
723
724 SCTP_IPI_ADDR_WLOCK();
725 vrf = sctp_find_vrf(vrf_id);
726 if (vrf == NULL) {
727 SCTPDBG(SCTP_DEBUG_PCB4, "Can't find vrf_id 0x%x\n", vrf_id);
728 goto out_now;
729 }
730
731 #ifdef SCTP_DEBUG
732 SCTPDBG(SCTP_DEBUG_PCB4, "vrf_id 0x%x: deleting address:", vrf_id);
733 SCTPDBG_ADDR(SCTP_DEBUG_PCB4, addr);
734 #endif
735 sctp_ifap = sctp_find_ifa_by_addr(addr, vrf->vrf_id, SCTP_ADDR_LOCKED);
736 if (sctp_ifap) {
737 /* Validate the delete */
738 if (sctp_ifap->ifn_p) {
739 int valid = 0;
740
741 /*-
742 * The name has priority over the ifn_index
743 * if its given.
744 */
745 if (if_name) {
746 if (strncmp(if_name, sctp_ifap->ifn_p->ifn_name, SCTP_IFNAMSIZ) == 0) {
747 /* They match its a correct delete */
748 valid = 1;
749 }
750 }
751 if (!valid) {
752 /* last ditch check ifn_index */
753 if (ifn_index == sctp_ifap->ifn_p->ifn_index) {
754 valid = 1;
755 }
756 }
757 if (!valid) {
758 SCTPDBG(SCTP_DEBUG_PCB4, "ifn:%d ifname:%s does not match addresses\n",
759 ifn_index, ((if_name == NULL) ? "NULL" : if_name));
760 SCTPDBG(SCTP_DEBUG_PCB4, "ifn:%d ifname:%s - ignoring delete\n",
761 sctp_ifap->ifn_p->ifn_index, sctp_ifap->ifn_p->ifn_name);
762 SCTP_IPI_ADDR_WUNLOCK();
763 return;
764 }
765 }
766 SCTPDBG(SCTP_DEBUG_PCB4, "Deleting ifa %p\n", (void *)sctp_ifap);
767 sctp_ifap->localifa_flags &= SCTP_ADDR_VALID;
768 /*
769 * We don't set the flag. This means that the structure will
770 * hang around in EP's that have bound specific to it until
771 * they close. This gives us TCP like behavior if someone
772 * removes an address (or for that matter adds it right
773 * back).
774 */
775 /* sctp_ifap->localifa_flags |= SCTP_BEING_DELETED; */
776 vrf->total_ifa_count--;
777 LIST_REMOVE(sctp_ifap, next_bucket);
778 sctp_remove_ifa_from_ifn(sctp_ifap);
779 }
780 #ifdef SCTP_DEBUG
781 else {
782 SCTPDBG(SCTP_DEBUG_PCB4, "Del Addr-ifn:%d Could not find address:",
783 ifn_index);
784 SCTPDBG_ADDR(SCTP_DEBUG_PCB1, addr);
785 }
786 #endif
787
788 out_now:
789 SCTP_IPI_ADDR_WUNLOCK();
790 if (sctp_ifap) {
791 struct sctp_laddr *wi;
792
793 wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
794 if (wi == NULL) {
795 /*
796 * Gak, what can we do? We have lost an address
797 * change can you say HOSED?
798 */
799 SCTPDBG(SCTP_DEBUG_PCB4, "Lost an address change?\n");
800
801 /* Oops, must decrement the count */
802 sctp_free_ifa(sctp_ifap);
803 return;
804 }
805 SCTP_INCR_LADDR_COUNT();
806 memset(wi, 0, sizeof(*wi));
807 (void)SCTP_GETTIME_TIMEVAL(&wi->start_time);
808 wi->ifa = sctp_ifap;
809 wi->action = SCTP_DEL_IP_ADDRESS;
810 SCTP_WQ_ADDR_LOCK();
811 /*
812 * Should this really be a tailq? As it is we will process
813 * the newest first :-0
814 */
815 LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
816 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
817 (struct sctp_inpcb *)NULL,
818 (struct sctp_tcb *)NULL,
819 (struct sctp_nets *)NULL);
820 SCTP_WQ_ADDR_UNLOCK();
821 }
822 return;
823 }
824
825 static int
826 sctp_does_stcb_own_this_addr(struct sctp_tcb *stcb, struct sockaddr *to)
827 {
828 int loopback_scope;
829 #if defined(INET)
830 int ipv4_local_scope, ipv4_addr_legal;
831 #endif
832 #if defined(INET6)
833 int local_scope, site_scope, ipv6_addr_legal;
834 #endif
835 struct sctp_vrf *vrf;
836 struct sctp_ifn *sctp_ifn;
837 struct sctp_ifa *sctp_ifa;
838
839 loopback_scope = stcb->asoc.scope.loopback_scope;
840 #if defined(INET)
841 ipv4_local_scope = stcb->asoc.scope.ipv4_local_scope;
842 ipv4_addr_legal = stcb->asoc.scope.ipv4_addr_legal;
843 #endif
844 #if defined(INET6)
845 local_scope = stcb->asoc.scope.local_scope;
846 site_scope = stcb->asoc.scope.site_scope;
847 ipv6_addr_legal = stcb->asoc.scope.ipv6_addr_legal;
848 #endif
849
850 SCTP_IPI_ADDR_RLOCK();
851 vrf = sctp_find_vrf(stcb->asoc.vrf_id);
852 if (vrf == NULL) {
853 /* no vrf, no addresses */
854 SCTP_IPI_ADDR_RUNLOCK();
855 return (0);
856 }
857
858 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
859 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
860 if ((loopback_scope == 0) &&
861 SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
862 continue;
863 }
864 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
865 if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
866 (!sctp_is_addr_pending(stcb, sctp_ifa))) {
867 /*
868 * We allow pending addresses, where
869 * we have sent an asconf-add to be
870 * considered valid.
871 */
872 continue;
873 }
874 if (sctp_ifa->address.sa.sa_family != to->sa_family) {
875 continue;
876 }
877 switch (sctp_ifa->address.sa.sa_family) {
878 #ifdef INET
879 case AF_INET:
880 if (ipv4_addr_legal) {
881 struct sockaddr_in *sin,
882 *rsin;
883
884 sin = &sctp_ifa->address.sin;
885 rsin = (struct sockaddr_in *)to;
886 if ((ipv4_local_scope == 0) &&
887 IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
888 continue;
889 }
890 if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
891 &sin->sin_addr) != 0) {
892 continue;
893 }
894 if (sin->sin_addr.s_addr == rsin->sin_addr.s_addr) {
895 SCTP_IPI_ADDR_RUNLOCK();
896 return (1);
897 }
898 }
899 break;
900 #endif
901 #ifdef INET6
902 case AF_INET6:
903 if (ipv6_addr_legal) {
904 struct sockaddr_in6 *sin6,
905 *rsin6;
906
907 sin6 = &sctp_ifa->address.sin6;
908 rsin6 = (struct sockaddr_in6 *)to;
909 if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
910 &sin6->sin6_addr) != 0) {
911 continue;
912 }
913 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
914 if (local_scope == 0)
915 continue;
916 if (sin6->sin6_scope_id == 0) {
917 if (sa6_recoverscope(sin6) != 0)
918 continue;
919 }
920 }
921 if ((site_scope == 0) &&
922 (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
923 continue;
924 }
925 if (SCTP6_ARE_ADDR_EQUAL(sin6, rsin6)) {
926 SCTP_IPI_ADDR_RUNLOCK();
927 return (1);
928 }
929 }
930 break;
931 #endif
932 default:
933 /* TSNH */
934 break;
935 }
936 }
937 }
938 } else {
939 struct sctp_laddr *laddr;
940
941 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
942 if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) {
943 SCTPDBG(SCTP_DEBUG_PCB1, "ifa being deleted\n");
944 continue;
945 }
946 if (sctp_is_addr_restricted(stcb, laddr->ifa) &&
947 (!sctp_is_addr_pending(stcb, laddr->ifa))) {
948 /*
949 * We allow pending addresses, where we have
950 * sent an asconf-add to be considered
951 * valid.
952 */
953 continue;
954 }
955 if (laddr->ifa->address.sa.sa_family != to->sa_family) {
956 continue;
957 }
958 switch (to->sa_family) {
959 #ifdef INET
960 case AF_INET:
961 {
962 struct sockaddr_in *sin, *rsin;
963
964 sin = &laddr->ifa->address.sin;
965 rsin = (struct sockaddr_in *)to;
966 if (sin->sin_addr.s_addr == rsin->sin_addr.s_addr) {
967 SCTP_IPI_ADDR_RUNLOCK();
968 return (1);
969 }
970 break;
971 }
972 #endif
973 #ifdef INET6
974 case AF_INET6:
975 {
976 struct sockaddr_in6 *sin6, *rsin6;
977
978 sin6 = &laddr->ifa->address.sin6;
979 rsin6 = (struct sockaddr_in6 *)to;
980 if (SCTP6_ARE_ADDR_EQUAL(sin6, rsin6)) {
981 SCTP_IPI_ADDR_RUNLOCK();
982 return (1);
983 }
984 break;
985 }
986
987 #endif
988 default:
989 /* TSNH */
990 break;
991 }
992 }
993 }
994 SCTP_IPI_ADDR_RUNLOCK();
995 return (0);
996 }
997
998 static struct sctp_tcb *
999 sctp_tcb_special_locate(struct sctp_inpcb **inp_p, struct sockaddr *from,
1000 struct sockaddr *to, struct sctp_nets **netp, uint32_t vrf_id)
1001 {
1002 /**** ASSUMES THE CALLER holds the INP_INFO_RLOCK */
1003 /*
1004 * If we support the TCP model, then we must now dig through to see
1005 * if we can find our endpoint in the list of tcp ep's.
1006 */
1007 uint16_t lport, rport;
1008 struct sctppcbhead *ephead;
1009 struct sctp_inpcb *inp;
1010 struct sctp_laddr *laddr;
1011 struct sctp_tcb *stcb;
1012 struct sctp_nets *net;
1013
1014 if ((to == NULL) || (from == NULL)) {
1015 return (NULL);
1016 }
1017
1018 switch (to->sa_family) {
1019 #ifdef INET
1020 case AF_INET:
1021 if (from->sa_family == AF_INET) {
1022 lport = ((struct sockaddr_in *)to)->sin_port;
1023 rport = ((struct sockaddr_in *)from)->sin_port;
1024 } else {
1025 return (NULL);
1026 }
1027 break;
1028 #endif
1029 #ifdef INET6
1030 case AF_INET6:
1031 if (from->sa_family == AF_INET6) {
1032 lport = ((struct sockaddr_in6 *)to)->sin6_port;
1033 rport = ((struct sockaddr_in6 *)from)->sin6_port;
1034 } else {
1035 return (NULL);
1036 }
1037 break;
1038 #endif
1039 default:
1040 return (NULL);
1041 }
1042 ephead = &SCTP_BASE_INFO(sctp_tcpephash)[SCTP_PCBHASH_ALLADDR((lport | rport), SCTP_BASE_INFO(hashtcpmark))];
1043 /*
1044 * Ok now for each of the guys in this bucket we must look and see:
1045 * - Does the remote port match. - Does there single association's
1046 * addresses match this address (to). If so we update p_ep to point
1047 * to this ep and return the tcb from it.
1048 */
1049 LIST_FOREACH(inp, ephead, sctp_hash) {
1050 SCTP_INP_RLOCK(inp);
1051 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
1052 SCTP_INP_RUNLOCK(inp);
1053 continue;
1054 }
1055 if (lport != inp->sctp_lport) {
1056 SCTP_INP_RUNLOCK(inp);
1057 continue;
1058 }
1059 switch (to->sa_family) {
1060 #ifdef INET
1061 case AF_INET:
1062 {
1063 struct sockaddr_in *sin;
1064
1065 sin = (struct sockaddr_in *)to;
1066 if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
1067 &sin->sin_addr) != 0) {
1068 SCTP_INP_RUNLOCK(inp);
1069 continue;
1070 }
1071 break;
1072 }
1073 #endif
1074 #ifdef INET6
1075 case AF_INET6:
1076 {
1077 struct sockaddr_in6 *sin6;
1078
1079 sin6 = (struct sockaddr_in6 *)to;
1080 if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
1081 &sin6->sin6_addr) != 0) {
1082 SCTP_INP_RUNLOCK(inp);
1083 continue;
1084 }
1085 break;
1086 }
1087 #endif
1088 default:
1089 SCTP_INP_RUNLOCK(inp);
1090 continue;
1091 }
1092 if (inp->def_vrf_id != vrf_id) {
1093 SCTP_INP_RUNLOCK(inp);
1094 continue;
1095 }
1096 /* check to see if the ep has one of the addresses */
1097 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
1098 /* We are NOT bound all, so look further */
1099 int match = 0;
1100
1101 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
1102 if (laddr->ifa == NULL) {
1103 SCTPDBG(SCTP_DEBUG_PCB1, "%s: NULL ifa\n", __func__);
1104 continue;
1105 }
1106 if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) {
1107 SCTPDBG(SCTP_DEBUG_PCB1, "ifa being deleted\n");
1108 continue;
1109 }
1110 if (laddr->ifa->address.sa.sa_family ==
1111 to->sa_family) {
1112 /* see if it matches */
1113 #ifdef INET
1114 if (from->sa_family == AF_INET) {
1115 struct sockaddr_in *intf_addr,
1116 *sin;
1117
1118 intf_addr = &laddr->ifa->address.sin;
1119 sin = (struct sockaddr_in *)to;
1120 if (sin->sin_addr.s_addr ==
1121 intf_addr->sin_addr.s_addr) {
1122 match = 1;
1123 break;
1124 }
1125 }
1126 #endif
1127 #ifdef INET6
1128 if (from->sa_family == AF_INET6) {
1129 struct sockaddr_in6 *intf_addr6;
1130 struct sockaddr_in6 *sin6;
1131
1132 sin6 = (struct sockaddr_in6 *)
1133 to;
1134 intf_addr6 = &laddr->ifa->address.sin6;
1135
1136 if (SCTP6_ARE_ADDR_EQUAL(sin6,
1137 intf_addr6)) {
1138 match = 1;
1139 break;
1140 }
1141 }
1142 #endif
1143 }
1144 }
1145 if (match == 0) {
1146 /* This endpoint does not have this address */
1147 SCTP_INP_RUNLOCK(inp);
1148 continue;
1149 }
1150 }
1151 /*
1152 * Ok if we hit here the ep has the address, does it hold
1153 * the tcb?
1154 */
1155 /* XXX: Why don't we TAILQ_FOREACH through sctp_asoc_list? */
1156 stcb = LIST_FIRST(&inp->sctp_asoc_list);
1157 if (stcb == NULL) {
1158 SCTP_INP_RUNLOCK(inp);
1159 continue;
1160 }
1161 SCTP_TCB_LOCK(stcb);
1162 if (!sctp_does_stcb_own_this_addr(stcb, to)) {
1163 SCTP_TCB_UNLOCK(stcb);
1164 SCTP_INP_RUNLOCK(inp);
1165 continue;
1166 }
1167 if (stcb->rport != rport) {
1168 /* remote port does not match. */
1169 SCTP_TCB_UNLOCK(stcb);
1170 SCTP_INP_RUNLOCK(inp);
1171 continue;
1172 }
1173 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
1174 SCTP_TCB_UNLOCK(stcb);
1175 SCTP_INP_RUNLOCK(inp);
1176 continue;
1177 }
1178 if (!sctp_does_stcb_own_this_addr(stcb, to)) {
1179 SCTP_TCB_UNLOCK(stcb);
1180 SCTP_INP_RUNLOCK(inp);
1181 continue;
1182 }
1183 /* Does this TCB have a matching address? */
1184 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1185 if (net->ro._l_addr.sa.sa_family != from->sa_family) {
1186 /* not the same family, can't be a match */
1187 continue;
1188 }
1189 switch (from->sa_family) {
1190 #ifdef INET
1191 case AF_INET:
1192 {
1193 struct sockaddr_in *sin, *rsin;
1194
1195 sin = (struct sockaddr_in *)&net->ro._l_addr;
1196 rsin = (struct sockaddr_in *)from;
1197 if (sin->sin_addr.s_addr ==
1198 rsin->sin_addr.s_addr) {
1199 /* found it */
1200 if (netp != NULL) {
1201 *netp = net;
1202 }
1203 /*
1204 * Update the endpoint
1205 * pointer
1206 */
1207 *inp_p = inp;
1208 SCTP_INP_RUNLOCK(inp);
1209 return (stcb);
1210 }
1211 break;
1212 }
1213 #endif
1214 #ifdef INET6
1215 case AF_INET6:
1216 {
1217 struct sockaddr_in6 *sin6, *rsin6;
1218
1219 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1220 rsin6 = (struct sockaddr_in6 *)from;
1221 if (SCTP6_ARE_ADDR_EQUAL(sin6,
1222 rsin6)) {
1223 /* found it */
1224 if (netp != NULL) {
1225 *netp = net;
1226 }
1227 /*
1228 * Update the endpoint
1229 * pointer
1230 */
1231 *inp_p = inp;
1232 SCTP_INP_RUNLOCK(inp);
1233 return (stcb);
1234 }
1235 break;
1236 }
1237 #endif
1238 default:
1239 /* TSNH */
1240 break;
1241 }
1242 }
1243 SCTP_TCB_UNLOCK(stcb);
1244 SCTP_INP_RUNLOCK(inp);
1245 }
1246 return (NULL);
1247 }
1248
1249 /*
1250 * rules for use
1251 *
1252 * 1) If I return a NULL you must decrement any INP ref cnt. 2) If I find an
1253 * stcb, both will be locked (locked_tcb and stcb) but decrement will be done
1254 * (if locked == NULL). 3) Decrement happens on return ONLY if locked ==
1255 * NULL.
1256 */
1257
1258 struct sctp_tcb *
1259 sctp_findassociation_ep_addr(struct sctp_inpcb **inp_p, struct sockaddr *remote,
1260 struct sctp_nets **netp, struct sockaddr *local, struct sctp_tcb *locked_tcb)
1261 {
1262 struct sctpasochead *head;
1263 struct sctp_inpcb *inp;
1264 struct sctp_tcb *stcb = NULL;
1265 struct sctp_nets *net;
1266 uint16_t rport;
1267
1268 inp = *inp_p;
1269 switch (remote->sa_family) {
1270 #ifdef INET
1271 case AF_INET:
1272 rport = (((struct sockaddr_in *)remote)->sin_port);
1273 break;
1274 #endif
1275 #ifdef INET6
1276 case AF_INET6:
1277 rport = (((struct sockaddr_in6 *)remote)->sin6_port);
1278 break;
1279 #endif
1280 default:
1281 return (NULL);
1282 }
1283 if (locked_tcb) {
1284 /*
1285 * UN-lock so we can do proper locking here this occurs when
1286 * called from load_addresses_from_init.
1287 */
1288 atomic_add_int(&locked_tcb->asoc.refcnt, 1);
1289 SCTP_TCB_UNLOCK(locked_tcb);
1290 }
1291 SCTP_INP_INFO_RLOCK();
1292 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1293 (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
1294 /*-
1295 * Now either this guy is our listener or it's the
1296 * connector. If it is the one that issued the connect, then
1297 * it's only chance is to be the first TCB in the list. If
1298 * it is the acceptor, then do the special_lookup to hash
1299 * and find the real inp.
1300 */
1301 if ((inp->sctp_socket) && SCTP_IS_LISTENING(inp)) {
1302 /* to is peer addr, from is my addr */
1303 stcb = sctp_tcb_special_locate(inp_p, remote, local,
1304 netp, inp->def_vrf_id);
1305 if ((stcb != NULL) && (locked_tcb == NULL)) {
1306 /* we have a locked tcb, lower refcount */
1307 SCTP_INP_DECR_REF(inp);
1308 }
1309 if ((locked_tcb != NULL) && (locked_tcb != stcb)) {
1310 SCTP_INP_RLOCK(locked_tcb->sctp_ep);
1311 SCTP_TCB_LOCK(locked_tcb);
1312 atomic_subtract_int(&locked_tcb->asoc.refcnt, 1);
1313 SCTP_INP_RUNLOCK(locked_tcb->sctp_ep);
1314 }
1315 SCTP_INP_INFO_RUNLOCK();
1316 return (stcb);
1317 } else {
1318 SCTP_INP_WLOCK(inp);
1319 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
1320 goto null_return;
1321 }
1322 stcb = LIST_FIRST(&inp->sctp_asoc_list);
1323 if (stcb == NULL) {
1324 goto null_return;
1325 }
1326 SCTP_TCB_LOCK(stcb);
1327
1328 if (stcb->rport != rport) {
1329 /* remote port does not match. */
1330 SCTP_TCB_UNLOCK(stcb);
1331 goto null_return;
1332 }
1333 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
1334 SCTP_TCB_UNLOCK(stcb);
1335 goto null_return;
1336 }
1337 if (local && !sctp_does_stcb_own_this_addr(stcb, local)) {
1338 SCTP_TCB_UNLOCK(stcb);
1339 goto null_return;
1340 }
1341 /* now look at the list of remote addresses */
1342 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1343 #ifdef INVARIANTS
1344 if (net == (TAILQ_NEXT(net, sctp_next))) {
1345 panic("Corrupt net list");
1346 }
1347 #endif
1348 if (net->ro._l_addr.sa.sa_family !=
1349 remote->sa_family) {
1350 /* not the same family */
1351 continue;
1352 }
1353 switch (remote->sa_family) {
1354 #ifdef INET
1355 case AF_INET:
1356 {
1357 struct sockaddr_in *sin,
1358 *rsin;
1359
1360 sin = (struct sockaddr_in *)
1361 &net->ro._l_addr;
1362 rsin = (struct sockaddr_in *)remote;
1363 if (sin->sin_addr.s_addr ==
1364 rsin->sin_addr.s_addr) {
1365 /* found it */
1366 if (netp != NULL) {
1367 *netp = net;
1368 }
1369 if (locked_tcb == NULL) {
1370 SCTP_INP_DECR_REF(inp);
1371 } else if (locked_tcb != stcb) {
1372 SCTP_TCB_LOCK(locked_tcb);
1373 }
1374 if (locked_tcb) {
1375 atomic_subtract_int(&locked_tcb->asoc.refcnt, 1);
1376 }
1377
1378 SCTP_INP_WUNLOCK(inp);
1379 SCTP_INP_INFO_RUNLOCK();
1380 return (stcb);
1381 }
1382 break;
1383 }
1384 #endif
1385 #ifdef INET6
1386 case AF_INET6:
1387 {
1388 struct sockaddr_in6 *sin6,
1389 *rsin6;
1390
1391 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1392 rsin6 = (struct sockaddr_in6 *)remote;
1393 if (SCTP6_ARE_ADDR_EQUAL(sin6,
1394 rsin6)) {
1395 /* found it */
1396 if (netp != NULL) {
1397 *netp = net;
1398 }
1399 if (locked_tcb == NULL) {
1400 SCTP_INP_DECR_REF(inp);
1401 } else if (locked_tcb != stcb) {
1402 SCTP_TCB_LOCK(locked_tcb);
1403 }
1404 if (locked_tcb) {
1405 atomic_subtract_int(&locked_tcb->asoc.refcnt, 1);
1406 }
1407 SCTP_INP_WUNLOCK(inp);
1408 SCTP_INP_INFO_RUNLOCK();
1409 return (stcb);
1410 }
1411 break;
1412 }
1413 #endif
1414 default:
1415 /* TSNH */
1416 break;
1417 }
1418 }
1419 SCTP_TCB_UNLOCK(stcb);
1420 }
1421 } else {
1422 SCTP_INP_WLOCK(inp);
1423 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
1424 goto null_return;
1425 }
1426 head = &inp->sctp_tcbhash[SCTP_PCBHASH_ALLADDR(rport,
1427 inp->sctp_hashmark)];
1428 LIST_FOREACH(stcb, head, sctp_tcbhash) {
1429 if (stcb->rport != rport) {
1430 /* remote port does not match */
1431 continue;
1432 }
1433 SCTP_TCB_LOCK(stcb);
1434 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
1435 SCTP_TCB_UNLOCK(stcb);
1436 continue;
1437 }
1438 if (local && !sctp_does_stcb_own_this_addr(stcb, local)) {
1439 SCTP_TCB_UNLOCK(stcb);
1440 continue;
1441 }
1442 /* now look at the list of remote addresses */
1443 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1444 #ifdef INVARIANTS
1445 if (net == (TAILQ_NEXT(net, sctp_next))) {
1446 panic("Corrupt net list");
1447 }
1448 #endif
1449 if (net->ro._l_addr.sa.sa_family !=
1450 remote->sa_family) {
1451 /* not the same family */
1452 continue;
1453 }
1454 switch (remote->sa_family) {
1455 #ifdef INET
1456 case AF_INET:
1457 {
1458 struct sockaddr_in *sin,
1459 *rsin;
1460
1461 sin = (struct sockaddr_in *)
1462 &net->ro._l_addr;
1463 rsin = (struct sockaddr_in *)remote;
1464 if (sin->sin_addr.s_addr ==
1465 rsin->sin_addr.s_addr) {
1466 /* found it */
1467 if (netp != NULL) {
1468 *netp = net;
1469 }
1470 if (locked_tcb == NULL) {
1471 SCTP_INP_DECR_REF(inp);
1472 } else if (locked_tcb != stcb) {
1473 SCTP_TCB_LOCK(locked_tcb);
1474 }
1475 if (locked_tcb) {
1476 atomic_subtract_int(&locked_tcb->asoc.refcnt, 1);
1477 }
1478 SCTP_INP_WUNLOCK(inp);
1479 SCTP_INP_INFO_RUNLOCK();
1480 return (stcb);
1481 }
1482 break;
1483 }
1484 #endif
1485 #ifdef INET6
1486 case AF_INET6:
1487 {
1488 struct sockaddr_in6 *sin6,
1489 *rsin6;
1490
1491 sin6 = (struct sockaddr_in6 *)
1492 &net->ro._l_addr;
1493 rsin6 = (struct sockaddr_in6 *)remote;
1494 if (SCTP6_ARE_ADDR_EQUAL(sin6,
1495 rsin6)) {
1496 /* found it */
1497 if (netp != NULL) {
1498 *netp = net;
1499 }
1500 if (locked_tcb == NULL) {
1501 SCTP_INP_DECR_REF(inp);
1502 } else if (locked_tcb != stcb) {
1503 SCTP_TCB_LOCK(locked_tcb);
1504 }
1505 if (locked_tcb) {
1506 atomic_subtract_int(&locked_tcb->asoc.refcnt, 1);
1507 }
1508 SCTP_INP_WUNLOCK(inp);
1509 SCTP_INP_INFO_RUNLOCK();
1510 return (stcb);
1511 }
1512 break;
1513 }
1514 #endif
1515 default:
1516 /* TSNH */
1517 break;
1518 }
1519 }
1520 SCTP_TCB_UNLOCK(stcb);
1521 }
1522 }
1523 null_return:
1524 /* clean up for returning null */
1525 if (locked_tcb) {
1526 SCTP_TCB_LOCK(locked_tcb);
1527 atomic_subtract_int(&locked_tcb->asoc.refcnt, 1);
1528 }
1529 SCTP_INP_WUNLOCK(inp);
1530 SCTP_INP_INFO_RUNLOCK();
1531 /* not found */
1532 return (NULL);
1533 }
1534
1535 /*
1536 * Find an association for a specific endpoint using the association id given
1537 * out in the COMM_UP notification
1538 */
1539 struct sctp_tcb *
1540 sctp_findasoc_ep_asocid_locked(struct sctp_inpcb *inp, sctp_assoc_t asoc_id, int want_lock)
1541 {
1542 /*
1543 * Use my the assoc_id to find a endpoint
1544 */
1545 struct sctpasochead *head;
1546 struct sctp_tcb *stcb;
1547 uint32_t id;
1548
1549 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
1550 SCTP_PRINTF("TSNH ep_associd0\n");
1551 return (NULL);
1552 }
1553 id = (uint32_t)asoc_id;
1554 head = &inp->sctp_asocidhash[SCTP_PCBHASH_ASOC(id, inp->hashasocidmark)];
1555 if (head == NULL) {
1556 /* invalid id TSNH */
1557 SCTP_PRINTF("TSNH ep_associd1\n");
1558 return (NULL);
1559 }
1560 LIST_FOREACH(stcb, head, sctp_tcbasocidhash) {
1561 if (stcb->asoc.assoc_id == id) {
1562 if (inp != stcb->sctp_ep) {
1563 /*
1564 * some other guy has the same id active (id
1565 * collision ??).
1566 */
1567 SCTP_PRINTF("TSNH ep_associd2\n");
1568 continue;
1569 }
1570 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
1571 continue;
1572 }
1573 if (want_lock) {
1574 SCTP_TCB_LOCK(stcb);
1575 }
1576 return (stcb);
1577 }
1578 }
1579 return (NULL);
1580 }
1581
1582 struct sctp_tcb *
1583 sctp_findassociation_ep_asocid(struct sctp_inpcb *inp, sctp_assoc_t asoc_id, int want_lock)
1584 {
1585 struct sctp_tcb *stcb;
1586
1587 SCTP_INP_RLOCK(inp);
1588 stcb = sctp_findasoc_ep_asocid_locked(inp, asoc_id, want_lock);
1589 SCTP_INP_RUNLOCK(inp);
1590 return (stcb);
1591 }
1592
1593 /*
1594 * Endpoint probe expects that the INP_INFO is locked.
1595 */
1596 static struct sctp_inpcb *
1597 sctp_endpoint_probe(struct sockaddr *nam, struct sctppcbhead *head,
1598 uint16_t lport, uint32_t vrf_id)
1599 {
1600 struct sctp_inpcb *inp;
1601 struct sctp_laddr *laddr;
1602 #ifdef INET
1603 struct sockaddr_in *sin;
1604 #endif
1605 #ifdef INET6
1606 struct sockaddr_in6 *sin6;
1607 struct sockaddr_in6 *intf_addr6;
1608 #endif
1609 int fnd;
1610
1611 #ifdef INET
1612 sin = NULL;
1613 #endif
1614 #ifdef INET6
1615 sin6 = NULL;
1616 #endif
1617 switch (nam->sa_family) {
1618 #ifdef INET
1619 case AF_INET:
1620 sin = (struct sockaddr_in *)nam;
1621 break;
1622 #endif
1623 #ifdef INET6
1624 case AF_INET6:
1625 sin6 = (struct sockaddr_in6 *)nam;
1626 break;
1627 #endif
1628 default:
1629 /* unsupported family */
1630 return (NULL);
1631 }
1632
1633 if (head == NULL)
1634 return (NULL);
1635
1636 LIST_FOREACH(inp, head, sctp_hash) {
1637 SCTP_INP_RLOCK(inp);
1638 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
1639 SCTP_INP_RUNLOCK(inp);
1640 continue;
1641 }
1642 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) &&
1643 (inp->sctp_lport == lport)) {
1644 /* got it */
1645 switch (nam->sa_family) {
1646 #ifdef INET
1647 case AF_INET:
1648 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1649 SCTP_IPV6_V6ONLY(inp)) {
1650 /*
1651 * IPv4 on a IPv6 socket with ONLY
1652 * IPv6 set
1653 */
1654 SCTP_INP_RUNLOCK(inp);
1655 continue;
1656 }
1657 if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
1658 &sin->sin_addr) != 0) {
1659 SCTP_INP_RUNLOCK(inp);
1660 continue;
1661 }
1662 break;
1663 #endif
1664 #ifdef INET6
1665 case AF_INET6:
1666 /*
1667 * A V6 address and the endpoint is NOT
1668 * bound V6
1669 */
1670 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
1671 SCTP_INP_RUNLOCK(inp);
1672 continue;
1673 }
1674 if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
1675 &sin6->sin6_addr) != 0) {
1676 SCTP_INP_RUNLOCK(inp);
1677 continue;
1678 }
1679 break;
1680 #endif
1681 default:
1682 break;
1683 }
1684 /* does a VRF id match? */
1685 fnd = 0;
1686 if (inp->def_vrf_id == vrf_id)
1687 fnd = 1;
1688
1689 SCTP_INP_RUNLOCK(inp);
1690 if (!fnd)
1691 continue;
1692 return (inp);
1693 }
1694 SCTP_INP_RUNLOCK(inp);
1695 }
1696 switch (nam->sa_family) {
1697 #ifdef INET
1698 case AF_INET:
1699 if (sin->sin_addr.s_addr == INADDR_ANY) {
1700 /* Can't hunt for one that has no address specified */
1701 return (NULL);
1702 }
1703 break;
1704 #endif
1705 #ifdef INET6
1706 case AF_INET6:
1707 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1708 /* Can't hunt for one that has no address specified */
1709 return (NULL);
1710 }
1711 break;
1712 #endif
1713 default:
1714 break;
1715 }
1716 /*
1717 * ok, not bound to all so see if we can find a EP bound to this
1718 * address.
1719 */
1720 LIST_FOREACH(inp, head, sctp_hash) {
1721 SCTP_INP_RLOCK(inp);
1722 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
1723 SCTP_INP_RUNLOCK(inp);
1724 continue;
1725 }
1726 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)) {
1727 SCTP_INP_RUNLOCK(inp);
1728 continue;
1729 }
1730 /*
1731 * Ok this could be a likely candidate, look at all of its
1732 * addresses
1733 */
1734 if (inp->sctp_lport != lport) {
1735 SCTP_INP_RUNLOCK(inp);
1736 continue;
1737 }
1738 /* does a VRF id match? */
1739 fnd = 0;
1740 if (inp->def_vrf_id == vrf_id)
1741 fnd = 1;
1742
1743 if (!fnd) {
1744 SCTP_INP_RUNLOCK(inp);
1745 continue;
1746 }
1747 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
1748 if (laddr->ifa == NULL) {
1749 SCTPDBG(SCTP_DEBUG_PCB1, "%s: NULL ifa\n",
1750 __func__);
1751 continue;
1752 }
1753 SCTPDBG(SCTP_DEBUG_PCB1, "Ok laddr->ifa:%p is possible, ",
1754 (void *)laddr->ifa);
1755 if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) {
1756 SCTPDBG(SCTP_DEBUG_PCB1, "Huh IFA being deleted\n");
1757 continue;
1758 }
1759 if (laddr->ifa->address.sa.sa_family == nam->sa_family) {
1760 /* possible, see if it matches */
1761 switch (nam->sa_family) {
1762 #ifdef INET
1763 case AF_INET:
1764 if (sin->sin_addr.s_addr ==
1765 laddr->ifa->address.sin.sin_addr.s_addr) {
1766 SCTP_INP_RUNLOCK(inp);
1767 return (inp);
1768 }
1769 break;
1770 #endif
1771 #ifdef INET6
1772 case AF_INET6:
1773 intf_addr6 = &laddr->ifa->address.sin6;
1774 if (SCTP6_ARE_ADDR_EQUAL(sin6,
1775 intf_addr6)) {
1776 SCTP_INP_RUNLOCK(inp);
1777 return (inp);
1778 }
1779 break;
1780 #endif
1781 }
1782 }
1783 }
1784 SCTP_INP_RUNLOCK(inp);
1785 }
1786 return (NULL);
1787 }
1788
1789 static struct sctp_inpcb *
1790 sctp_isport_inuse(struct sctp_inpcb *inp, uint16_t lport, uint32_t vrf_id)
1791 {
1792 struct sctppcbhead *head;
1793 struct sctp_inpcb *t_inp;
1794 int fnd;
1795
1796 head = &SCTP_BASE_INFO(sctp_ephash)[SCTP_PCBHASH_ALLADDR(lport,
1797 SCTP_BASE_INFO(hashmark))];
1798 LIST_FOREACH(t_inp, head, sctp_hash) {
1799 if (t_inp->sctp_lport != lport) {
1800 continue;
1801 }
1802 /* is it in the VRF in question */
1803 fnd = 0;
1804 if (t_inp->def_vrf_id == vrf_id)
1805 fnd = 1;
1806 if (!fnd)
1807 continue;
1808
1809 /* This one is in use. */
1810 /* check the v6/v4 binding issue */
1811 if ((t_inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1812 SCTP_IPV6_V6ONLY(t_inp)) {
1813 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
1814 /* collision in V6 space */
1815 return (t_inp);
1816 } else {
1817 /* inp is BOUND_V4 no conflict */
1818 continue;
1819 }
1820 } else if (t_inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
1821 /* t_inp is bound v4 and v6, conflict always */
1822 return (t_inp);
1823 } else {
1824 /* t_inp is bound only V4 */
1825 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1826 SCTP_IPV6_V6ONLY(inp)) {
1827 /* no conflict */
1828 continue;
1829 }
1830 /* else fall through to conflict */
1831 }
1832 return (t_inp);
1833 }
1834 return (NULL);
1835 }
1836
1837 int
1838 sctp_swap_inpcb_for_listen(struct sctp_inpcb *inp)
1839 {
1840 /* For 1-2-1 with port reuse */
1841 struct sctppcbhead *head;
1842 struct sctp_inpcb *tinp, *ninp;
1843
1844 SCTP_INP_INFO_WLOCK_ASSERT();
1845 SCTP_INP_WLOCK_ASSERT(inp);
1846
1847 if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_PORTREUSE)) {
1848 /* only works with port reuse on */
1849 return (-1);
1850 }
1851 if ((inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) {
1852 return (0);
1853 }
1854 SCTP_INP_WUNLOCK(inp);
1855 head = &SCTP_BASE_INFO(sctp_ephash)[SCTP_PCBHASH_ALLADDR(inp->sctp_lport,
1856 SCTP_BASE_INFO(hashmark))];
1857 /* Kick out all non-listeners to the TCP hash */
1858 LIST_FOREACH_SAFE(tinp, head, sctp_hash, ninp) {
1859 if (tinp->sctp_lport != inp->sctp_lport) {
1860 continue;
1861 }
1862 if (tinp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
1863 continue;
1864 }
1865 if (tinp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
1866 continue;
1867 }
1868 if (SCTP_IS_LISTENING(tinp)) {
1869 continue;
1870 }
1871 SCTP_INP_WLOCK(tinp);
1872 LIST_REMOVE(tinp, sctp_hash);
1873 head = &SCTP_BASE_INFO(sctp_tcpephash)[SCTP_PCBHASH_ALLADDR(tinp->sctp_lport, SCTP_BASE_INFO(hashtcpmark))];
1874 tinp->sctp_flags |= SCTP_PCB_FLAGS_IN_TCPPOOL;
1875 LIST_INSERT_HEAD(head, tinp, sctp_hash);
1876 SCTP_INP_WUNLOCK(tinp);
1877 }
1878 SCTP_INP_WLOCK(inp);
1879 /* Pull from where he was */
1880 LIST_REMOVE(inp, sctp_hash);
1881 inp->sctp_flags &= ~SCTP_PCB_FLAGS_IN_TCPPOOL;
1882 head = &SCTP_BASE_INFO(sctp_ephash)[SCTP_PCBHASH_ALLADDR(inp->sctp_lport, SCTP_BASE_INFO(hashmark))];
1883 LIST_INSERT_HEAD(head, inp, sctp_hash);
1884 return (0);
1885 }
1886
1887 struct sctp_inpcb *
1888 sctp_pcb_findep(struct sockaddr *nam, int find_tcp_pool, int have_lock,
1889 uint32_t vrf_id)
1890 {
1891 /*
1892 * First we check the hash table to see if someone has this port
1893 * bound with just the port.
1894 */
1895 struct sctp_inpcb *inp;
1896 struct sctppcbhead *head;
1897 int lport;
1898 unsigned int i;
1899 #ifdef INET
1900 struct sockaddr_in *sin;
1901 #endif
1902 #ifdef INET6
1903 struct sockaddr_in6 *sin6;
1904 #endif
1905
1906 switch (nam->sa_family) {
1907 #ifdef INET
1908 case AF_INET:
1909 sin = (struct sockaddr_in *)nam;
1910 lport = sin->sin_port;
1911 break;
1912 #endif
1913 #ifdef INET6
1914 case AF_INET6:
1915 sin6 = (struct sockaddr_in6 *)nam;
1916 lport = sin6->sin6_port;
1917 break;
1918 #endif
1919 default:
1920 return (NULL);
1921 }
1922 /*
1923 * I could cheat here and just cast to one of the types but we will
1924 * do it right. It also provides the check against an Unsupported
1925 * type too.
1926 */
1927 /* Find the head of the ALLADDR chain */
1928 if (have_lock == 0) {
1929 SCTP_INP_INFO_RLOCK();
1930 }
1931 head = &SCTP_BASE_INFO(sctp_ephash)[SCTP_PCBHASH_ALLADDR(lport,
1932 SCTP_BASE_INFO(hashmark))];
1933 inp = sctp_endpoint_probe(nam, head, lport, vrf_id);
1934
1935 /*
1936 * If the TCP model exists it could be that the main listening
1937 * endpoint is gone but there still exists a connected socket for
1938 * this guy. If so we can return the first one that we find. This
1939 * may NOT be the correct one so the caller should be wary on the
1940 * returned INP. Currently the only caller that sets find_tcp_pool
1941 * is in bindx where we are verifying that a user CAN bind the
1942 * address. He either has bound it already, or someone else has, or
1943 * its open to bind, so this is good enough.
1944 */
1945 if (inp == NULL && find_tcp_pool) {
1946 for (i = 0; i < SCTP_BASE_INFO(hashtcpmark) + 1; i++) {
1947 head = &SCTP_BASE_INFO(sctp_tcpephash)[i];
1948 inp = sctp_endpoint_probe(nam, head, lport, vrf_id);
1949 if (inp) {
1950 break;
1951 }
1952 }
1953 }
1954 if (inp) {
1955 SCTP_INP_INCR_REF(inp);
1956 }
1957 if (have_lock == 0) {
1958 SCTP_INP_INFO_RUNLOCK();
1959 }
1960 return (inp);
1961 }
1962
1963 /*
1964 * Find an association for an endpoint with the pointer to whom you want to
1965 * send to and the endpoint pointer. The address can be IPv4 or IPv6. We may
1966 * need to change the *to to some other struct like a mbuf...
1967 */
1968 struct sctp_tcb *
1969 sctp_findassociation_addr_sa(struct sockaddr *from, struct sockaddr *to,
1970 struct sctp_inpcb **inp_p, struct sctp_nets **netp, int find_tcp_pool,
1971 uint32_t vrf_id)
1972 {
1973 struct sctp_inpcb *inp = NULL;
1974 struct sctp_tcb *stcb;
1975
1976 SCTP_INP_INFO_RLOCK();
1977 if (find_tcp_pool) {
1978 if (inp_p != NULL) {
1979 stcb = sctp_tcb_special_locate(inp_p, from, to, netp,
1980 vrf_id);
1981 } else {
1982 stcb = sctp_tcb_special_locate(&inp, from, to, netp,
1983 vrf_id);
1984 }
1985 if (stcb != NULL) {
1986 SCTP_INP_INFO_RUNLOCK();
1987 return (stcb);
1988 }
1989 }
1990 inp = sctp_pcb_findep(to, 0, 1, vrf_id);
1991 if (inp_p != NULL) {
1992 *inp_p = inp;
1993 }
1994 SCTP_INP_INFO_RUNLOCK();
1995 if (inp == NULL) {
1996 return (NULL);
1997 }
1998 /*
1999 * ok, we have an endpoint, now lets find the assoc for it (if any)
2000 * we now place the source address or from in the to of the find
2001 * endpoint call. Since in reality this chain is used from the
2002 * inbound packet side.
2003 */
2004 if (inp_p != NULL) {
2005 stcb = sctp_findassociation_ep_addr(inp_p, from, netp, to,
2006 NULL);
2007 } else {
2008 stcb = sctp_findassociation_ep_addr(&inp, from, netp, to,
2009 NULL);
2010 }
2011 return (stcb);
2012 }
2013
2014 /*
2015 * This routine will grub through the mbuf that is a INIT or INIT-ACK and
2016 * find all addresses that the sender has specified in any address list. Each
2017 * address will be used to lookup the TCB and see if one exits.
2018 */
2019 static struct sctp_tcb *
2020 sctp_findassociation_special_addr(struct mbuf *m, int offset,
2021 struct sctphdr *sh, struct sctp_inpcb **inp_p, struct sctp_nets **netp,
2022 struct sockaddr *dst)
2023 {
2024 struct sctp_paramhdr *phdr, param_buf;
2025 #if defined(INET) || defined(INET6)
2026 struct sctp_tcb *stcb;
2027 uint16_t ptype;
2028 #endif
2029 uint16_t plen;
2030 #ifdef INET
2031 struct sockaddr_in sin4;
2032 #endif
2033 #ifdef INET6
2034 struct sockaddr_in6 sin6;
2035 #endif
2036
2037 #ifdef INET
2038 memset(&sin4, 0, sizeof(sin4));
2039 sin4.sin_len = sizeof(sin4);
2040 sin4.sin_family = AF_INET;
2041 sin4.sin_port = sh->src_port;
2042 #endif
2043 #ifdef INET6
2044 memset(&sin6, 0, sizeof(sin6));
2045 sin6.sin6_len = sizeof(sin6);
2046 sin6.sin6_family = AF_INET6;
2047 sin6.sin6_port = sh->src_port;
2048 #endif
2049
2050 offset += sizeof(struct sctp_init_chunk);
2051
2052 phdr = sctp_get_next_param(m, offset, ¶m_buf, sizeof(param_buf));
2053 while (phdr != NULL) {
2054 /* now we must see if we want the parameter */
2055 #if defined(INET) || defined(INET6)
2056 ptype = ntohs(phdr->param_type);
2057 #endif
2058 plen = ntohs(phdr->param_length);
2059 if (plen == 0) {
2060 break;
2061 }
2062 #ifdef INET
2063 if (ptype == SCTP_IPV4_ADDRESS &&
2064 plen == sizeof(struct sctp_ipv4addr_param)) {
2065 /* Get the rest of the address */
2066 struct sctp_ipv4addr_param ip4_param, *p4;
2067
2068 phdr = sctp_get_next_param(m, offset,
2069 (struct sctp_paramhdr *)&ip4_param, sizeof(ip4_param));
2070 if (phdr == NULL) {
2071 return (NULL);
2072 }
2073 p4 = (struct sctp_ipv4addr_param *)phdr;
2074 memcpy(&sin4.sin_addr, &p4->addr, sizeof(p4->addr));
2075 /* look it up */
2076 stcb = sctp_findassociation_ep_addr(inp_p,
2077 (struct sockaddr *)&sin4, netp, dst, NULL);
2078 if (stcb != NULL) {
2079 return (stcb);
2080 }
2081 }
2082 #endif
2083 #ifdef INET6
2084 if (ptype == SCTP_IPV6_ADDRESS &&
2085 plen == sizeof(struct sctp_ipv6addr_param)) {
2086 /* Get the rest of the address */
2087 struct sctp_ipv6addr_param ip6_param, *p6;
2088
2089 phdr = sctp_get_next_param(m, offset,
2090 (struct sctp_paramhdr *)&ip6_param, sizeof(ip6_param));
2091 if (phdr == NULL) {
2092 return (NULL);
2093 }
2094 p6 = (struct sctp_ipv6addr_param *)phdr;
2095 memcpy(&sin6.sin6_addr, &p6->addr, sizeof(p6->addr));
2096 /* look it up */
2097 stcb = sctp_findassociation_ep_addr(inp_p,
2098 (struct sockaddr *)&sin6, netp, dst, NULL);
2099 if (stcb != NULL) {
2100 return (stcb);
2101 }
2102 }
2103 #endif
2104 offset += SCTP_SIZE32(plen);
2105 phdr = sctp_get_next_param(m, offset, ¶m_buf,
2106 sizeof(param_buf));
2107 }
2108 return (NULL);
2109 }
2110
2111 static struct sctp_tcb *
2112 sctp_findassoc_by_vtag(struct sockaddr *from, struct sockaddr *to, uint32_t vtag,
2113 struct sctp_inpcb **inp_p, struct sctp_nets **netp, uint16_t rport,
2114 uint16_t lport, int skip_src_check, uint32_t vrf_id, uint32_t remote_tag)
2115 {
2116 /*
2117 * Use my vtag to hash. If we find it we then verify the source addr
2118 * is in the assoc. If all goes well we save a bit on rec of a
2119 * packet.
2120 */
2121 struct sctpasochead *head;
2122 struct sctp_nets *net;
2123 struct sctp_tcb *stcb;
2124
2125 SCTP_INP_INFO_RLOCK();
2126 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(vtag,
2127 SCTP_BASE_INFO(hashasocmark))];
2128 LIST_FOREACH(stcb, head, sctp_asocs) {
2129 SCTP_INP_RLOCK(stcb->sctp_ep);
2130 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
2131 SCTP_INP_RUNLOCK(stcb->sctp_ep);
2132 continue;
2133 }
2134 if (stcb->sctp_ep->def_vrf_id != vrf_id) {
2135 SCTP_INP_RUNLOCK(stcb->sctp_ep);
2136 continue;
2137 }
2138 SCTP_TCB_LOCK(stcb);
2139 SCTP_INP_RUNLOCK(stcb->sctp_ep);
2140 if (stcb->asoc.my_vtag == vtag) {
2141 /* candidate */
2142 if (stcb->rport != rport) {
2143 SCTP_TCB_UNLOCK(stcb);
2144 continue;
2145 }
2146 if (stcb->sctp_ep->sctp_lport != lport) {
2147 SCTP_TCB_UNLOCK(stcb);
2148 continue;
2149 }
2150 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
2151 SCTP_TCB_UNLOCK(stcb);
2152 continue;
2153 }
2154 /* RRS:Need toaddr check here */
2155 if (sctp_does_stcb_own_this_addr(stcb, to) == 0) {
2156 /* Endpoint does not own this address */
2157 SCTP_TCB_UNLOCK(stcb);
2158 continue;
2159 }
2160 if (remote_tag) {
2161 /*
2162 * If we have both vtags that's all we match
2163 * on
2164 */
2165 if (stcb->asoc.peer_vtag == remote_tag) {
2166 /*
2167 * If both tags match we consider it
2168 * conclusive and check NO
2169 * source/destination addresses
2170 */
2171 goto conclusive;
2172 }
2173 }
2174 if (skip_src_check) {
2175 conclusive:
2176 if (from) {
2177 *netp = sctp_findnet(stcb, from);
2178 } else {
2179 *netp = NULL; /* unknown */
2180 }
2181 if (inp_p)
2182 *inp_p = stcb->sctp_ep;
2183 SCTP_INP_INFO_RUNLOCK();
2184 return (stcb);
2185 }
2186 net = sctp_findnet(stcb, from);
2187 if (net) {
2188 /* yep its him. */
2189 *netp = net;
2190 SCTP_STAT_INCR(sctps_vtagexpress);
2191 *inp_p = stcb->sctp_ep;
2192 SCTP_INP_INFO_RUNLOCK();
2193 return (stcb);
2194 } else {
2195 /*
2196 * not him, this should only happen in rare
2197 * cases so I peg it.
2198 */
2199 SCTP_STAT_INCR(sctps_vtagbogus);
2200 }
2201 }
2202 SCTP_TCB_UNLOCK(stcb);
2203 }
2204 SCTP_INP_INFO_RUNLOCK();
2205 return (NULL);
2206 }
2207
2208 /*
2209 * Find an association with the pointer to the inbound IP packet. This can be
2210 * a IPv4 or IPv6 packet.
2211 */
2212 struct sctp_tcb *
2213 sctp_findassociation_addr(struct mbuf *m, int offset,
2214 struct sockaddr *src, struct sockaddr *dst,
2215 struct sctphdr *sh, struct sctp_chunkhdr *ch,
2216 struct sctp_inpcb **inp_p, struct sctp_nets **netp, uint32_t vrf_id)
2217 {
2218 struct sctp_tcb *stcb;
2219 struct sctp_inpcb *inp;
2220
2221 if (sh->v_tag) {
2222 /* we only go down this path if vtag is non-zero */
2223 stcb = sctp_findassoc_by_vtag(src, dst, ntohl(sh->v_tag),
2224 inp_p, netp, sh->src_port, sh->dest_port, 0, vrf_id, 0);
2225 if (stcb) {
2226 return (stcb);
2227 }
2228 }
2229
2230 if (inp_p) {
2231 stcb = sctp_findassociation_addr_sa(src, dst, inp_p, netp,
2232 1, vrf_id);
2233 inp = *inp_p;
2234 } else {
2235 stcb = sctp_findassociation_addr_sa(src, dst, &inp, netp,
2236 1, vrf_id);
2237 }
2238 SCTPDBG(SCTP_DEBUG_PCB1, "stcb:%p inp:%p\n", (void *)stcb, (void *)inp);
2239 if (stcb == NULL && inp) {
2240 /* Found a EP but not this address */
2241 if ((ch->chunk_type == SCTP_INITIATION) ||
2242 (ch->chunk_type == SCTP_INITIATION_ACK)) {
2243 /*-
2244 * special hook, we do NOT return linp or an
2245 * association that is linked to an existing
2246 * association that is under the TCP pool (i.e. no
2247 * listener exists). The endpoint finding routine
2248 * will always find a listener before examining the
2249 * TCP pool.
2250 */
2251 if (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) {
2252 if (inp_p) {
2253 *inp_p = NULL;
2254 }
2255 return (NULL);
2256 }
2257 stcb = sctp_findassociation_special_addr(m,
2258 offset, sh, &inp, netp, dst);
2259 if (inp_p != NULL) {
2260 *inp_p = inp;
2261 }
2262 }
2263 }
2264 SCTPDBG(SCTP_DEBUG_PCB1, "stcb is %p\n", (void *)stcb);
2265 return (stcb);
2266 }
2267
2268 /*
2269 * lookup an association by an ASCONF lookup address.
2270 * if the lookup address is 0.0.0.0 or ::0, use the vtag to do the lookup
2271 */
2272 struct sctp_tcb *
2273 sctp_findassociation_ep_asconf(struct mbuf *m, int offset,
2274 struct sockaddr *dst, struct sctphdr *sh,
2275 struct sctp_inpcb **inp_p, struct sctp_nets **netp, uint32_t vrf_id)
2276 {
2277 struct sctp_tcb *stcb;
2278 union sctp_sockstore remote_store;
2279 struct sctp_paramhdr param_buf, *phdr;
2280 int ptype;
2281 int zero_address = 0;
2282 #ifdef INET
2283 struct sockaddr_in *sin;
2284 #endif
2285 #ifdef INET6
2286 struct sockaddr_in6 *sin6;
2287 #endif
2288
2289 memset(&remote_store, 0, sizeof(remote_store));
2290 phdr = sctp_get_next_param(m, offset + sizeof(struct sctp_asconf_chunk),
2291 ¶m_buf, sizeof(struct sctp_paramhdr));
2292 if (phdr == NULL) {
2293 SCTPDBG(SCTP_DEBUG_INPUT3, "%s: failed to get asconf lookup addr\n",
2294 __func__);
2295 return NULL;
2296 }
2297 ptype = (int)((uint32_t)ntohs(phdr->param_type));
2298 /* get the correlation address */
2299 switch (ptype) {
2300 #ifdef INET6
2301 case SCTP_IPV6_ADDRESS:
2302 {
2303 /* ipv6 address param */
2304 struct sctp_ipv6addr_param *p6, p6_buf;
2305
2306 if (ntohs(phdr->param_length) != sizeof(struct sctp_ipv6addr_param)) {
2307 return NULL;
2308 }
2309 p6 = (struct sctp_ipv6addr_param *)sctp_get_next_param(m,
2310 offset + sizeof(struct sctp_asconf_chunk),
2311 &p6_buf.ph, sizeof(p6_buf));
2312 if (p6 == NULL) {
2313 SCTPDBG(SCTP_DEBUG_INPUT3, "%s: failed to get asconf v6 lookup addr\n",
2314 __func__);
2315 return (NULL);
2316 }
2317 sin6 = &remote_store.sin6;
2318 sin6->sin6_family = AF_INET6;
2319 sin6->sin6_len = sizeof(*sin6);
2320 sin6->sin6_port = sh->src_port;
2321 memcpy(&sin6->sin6_addr, &p6->addr, sizeof(struct in6_addr));
2322 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
2323 zero_address = 1;
2324 break;
2325 }
2326 #endif
2327 #ifdef INET
2328 case SCTP_IPV4_ADDRESS:
2329 {
2330 /* ipv4 address param */
2331 struct sctp_ipv4addr_param *p4, p4_buf;
2332
2333 if (ntohs(phdr->param_length) != sizeof(struct sctp_ipv4addr_param)) {
2334 return NULL;
2335 }
2336 p4 = (struct sctp_ipv4addr_param *)sctp_get_next_param(m,
2337 offset + sizeof(struct sctp_asconf_chunk),
2338 &p4_buf.ph, sizeof(p4_buf));
2339 if (p4 == NULL) {
2340 SCTPDBG(SCTP_DEBUG_INPUT3, "%s: failed to get asconf v4 lookup addr\n",
2341 __func__);
2342 return (NULL);
2343 }
2344 sin = &remote_store.sin;
2345 sin->sin_family = AF_INET;
2346 sin->sin_len = sizeof(*sin);
2347 sin->sin_port = sh->src_port;
2348 memcpy(&sin->sin_addr, &p4->addr, sizeof(struct in_addr));
2349 if (sin->sin_addr.s_addr == INADDR_ANY)
2350 zero_address = 1;
2351 break;
2352 }
2353 #endif
2354 default:
2355 /* invalid address param type */
2356 return NULL;
2357 }
2358
2359 if (zero_address) {
2360 stcb = sctp_findassoc_by_vtag(NULL, dst, ntohl(sh->v_tag), inp_p,
2361 netp, sh->src_port, sh->dest_port, 1, vrf_id, 0);
2362 if (stcb != NULL) {
2363 SCTP_INP_DECR_REF(*inp_p);
2364 }
2365 } else {
2366 stcb = sctp_findassociation_ep_addr(inp_p,
2367 &remote_store.sa, netp,
2368 dst, NULL);
2369 }
2370 return (stcb);
2371 }
2372
2373 /*
2374 * allocate a sctp_inpcb and setup a temporary binding to a port/all
2375 * addresses. This way if we don't get a bind we by default pick a ephemeral
2376 * port with all addresses bound.
2377 */
2378 int
2379 sctp_inpcb_alloc(struct socket *so, uint32_t vrf_id)
2380 {
2381 /*
2382 * we get called when a new endpoint starts up. We need to allocate
2383 * the sctp_inpcb structure from the zone and init it. Mark it as
2384 * unbound and find a port that we can use as an ephemeral with
2385 * INADDR_ANY. If the user binds later no problem we can then add in
2386 * the specific addresses. And setup the default parameters for the
2387 * EP.
2388 */
2389 int i, error;
2390 struct sctp_inpcb *inp;
2391 struct sctp_pcb *m;
2392 struct timeval time;
2393 sctp_sharedkey_t *null_key;
2394
2395 error = 0;
2396
2397 SCTP_INP_INFO_WLOCK();
2398 inp = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_ep), struct sctp_inpcb);
2399 if (inp == NULL) {
2400 SCTP_PRINTF("Out of SCTP-INPCB structures - no resources\n");
2401 SCTP_INP_INFO_WUNLOCK();
2402 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, ENOBUFS);
2403 return (ENOBUFS);
2404 }
2405 /* zap it */
2406 memset(inp, 0, sizeof(*inp));
2407
2408 /* bump generations */
2409 /* setup socket pointers */
2410 inp->sctp_socket = so;
2411 inp->ip_inp.inp.inp_socket = so;
2412 inp->ip_inp.inp.inp_cred = crhold(so->so_cred);
2413 #ifdef INET6
2414 if (INP_SOCKAF(so) == AF_INET6) {
2415 if (MODULE_GLOBAL(ip6_auto_flowlabel)) {
2416 inp->ip_inp.inp.inp_flags |= IN6P_AUTOFLOWLABEL;
2417 }
2418 if (MODULE_GLOBAL(ip6_v6only)) {
2419 inp->ip_inp.inp.inp_flags |= IN6P_IPV6_V6ONLY;
2420 }
2421 }
2422 #endif
2423 inp->sctp_associd_counter = 1;
2424 inp->partial_delivery_point = SCTP_SB_LIMIT_RCV(so) >> SCTP_PARTIAL_DELIVERY_SHIFT;
2425 inp->sctp_frag_point = 0;
2426 inp->max_cwnd = 0;
2427 inp->sctp_cmt_on_off = SCTP_BASE_SYSCTL(sctp_cmt_on_off);
2428 inp->ecn_supported = (uint8_t)SCTP_BASE_SYSCTL(sctp_ecn_enable);
2429 inp->prsctp_supported = (uint8_t)SCTP_BASE_SYSCTL(sctp_pr_enable);
2430 inp->auth_supported = (uint8_t)SCTP_BASE_SYSCTL(sctp_auth_enable);
2431 inp->asconf_supported = (uint8_t)SCTP_BASE_SYSCTL(sctp_asconf_enable);
2432 inp->reconfig_supported = (uint8_t)SCTP_BASE_SYSCTL(sctp_reconfig_enable);
2433 inp->nrsack_supported = (uint8_t)SCTP_BASE_SYSCTL(sctp_nrsack_enable);
2434 inp->pktdrop_supported = (uint8_t)SCTP_BASE_SYSCTL(sctp_pktdrop_enable);
2435 inp->idata_supported = 0;
2436
2437 inp->fibnum = so->so_fibnum;
2438 /* init the small hash table we use to track asocid <-> tcb */
2439 inp->sctp_asocidhash = SCTP_HASH_INIT(SCTP_STACK_VTAG_HASH_SIZE, &inp->hashasocidmark);
2440 if (inp->sctp_asocidhash == NULL) {
2441 crfree(inp->ip_inp.inp.inp_cred);
2442 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_ep), inp);
2443 SCTP_INP_INFO_WUNLOCK();
2444 return (ENOBUFS);
2445 }
2446 SCTP_INCR_EP_COUNT();
2447 inp->ip_inp.inp.inp_ip_ttl = MODULE_GLOBAL(ip_defttl);
2448 SCTP_INP_INFO_WUNLOCK();
2449
2450 so->so_pcb = (caddr_t)inp;
2451
2452 if (SCTP_SO_TYPE(so) == SOCK_SEQPACKET) {
2453 /* UDP style socket */
2454 inp->sctp_flags = (SCTP_PCB_FLAGS_UDPTYPE |
2455 SCTP_PCB_FLAGS_UNBOUND);
2456 /* Be sure it is NON-BLOCKING IO for UDP */
2457 /* SCTP_SET_SO_NBIO(so); */
2458 } else if (SCTP_SO_TYPE(so) == SOCK_STREAM) {
2459 /* TCP style socket */
2460 inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE |
2461 SCTP_PCB_FLAGS_UNBOUND);
2462 /* Be sure we have blocking IO by default */
2463 SOCK_LOCK(so);
2464 SCTP_CLEAR_SO_NBIO(so);
2465 SOCK_UNLOCK(so);
2466 } else {
2467 /*
2468 * unsupported socket type (RAW, etc)- in case we missed it
2469 * in protosw
2470 */
2471 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EOPNOTSUPP);
2472 so->so_pcb = NULL;
2473 crfree(inp->ip_inp.inp.inp_cred);
2474 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_ep), inp);
2475 return (EOPNOTSUPP);
2476 }
2477 if (SCTP_BASE_SYSCTL(sctp_default_frag_interleave) == SCTP_FRAG_LEVEL_1) {
2478 sctp_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE);
2479 sctp_feature_off(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS);
2480 } else if (SCTP_BASE_SYSCTL(sctp_default_frag_interleave) == SCTP_FRAG_LEVEL_2) {
2481 sctp_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE);
2482 sctp_feature_on(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS);
2483 } else if (SCTP_BASE_SYSCTL(sctp_default_frag_interleave) == SCTP_FRAG_LEVEL_0) {
2484 sctp_feature_off(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE);
2485 sctp_feature_off(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS);
2486 }
2487 inp->sctp_tcbhash = SCTP_HASH_INIT(SCTP_BASE_SYSCTL(sctp_pcbtblsize),
2488 &inp->sctp_hashmark);
2489 if (inp->sctp_tcbhash == NULL) {
2490 SCTP_PRINTF("Out of SCTP-INPCB->hashinit - no resources\n");
2491 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, ENOBUFS);
2492 so->so_pcb = NULL;
2493 crfree(inp->ip_inp.inp.inp_cred);
2494 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_ep), inp);
2495 return (ENOBUFS);
2496 }
2497 inp->def_vrf_id = vrf_id;
2498
2499 SCTP_INP_INFO_WLOCK();
2500 SCTP_INP_LOCK_INIT(inp);
2501 rw_init_flags(&inp->ip_inp.inp.inp_lock, "sctpinp",
2502 RW_RECURSE | RW_DUPOK);
2503 SCTP_INP_READ_INIT(inp);
2504 SCTP_ASOC_CREATE_LOCK_INIT(inp);
2505 /* lock the new ep */
2506 SCTP_INP_WLOCK(inp);
2507
2508 /* add it to the info area */
2509 LIST_INSERT_HEAD(&SCTP_BASE_INFO(listhead), inp, sctp_list);
2510 SCTP_INP_INFO_WUNLOCK();
2511
2512 TAILQ_INIT(&inp->read_queue);
2513 LIST_INIT(&inp->sctp_addr_list);
2514
2515 LIST_INIT(&inp->sctp_asoc_list);
2516
2517 #ifdef SCTP_TRACK_FREED_ASOCS
2518 /* TEMP CODE */
2519 LIST_INIT(&inp->sctp_asoc_free_list);
2520 #endif
2521 /* Init the timer structure for signature change */
2522 SCTP_OS_TIMER_INIT(&inp->sctp_ep.signature_change.timer);
2523 inp->sctp_ep.signature_change.type = SCTP_TIMER_TYPE_NEWCOOKIE;
2524
2525 /* now init the actual endpoint default data */
2526 m = &inp->sctp_ep;
2527
2528 /* setup the base timeout information */
2529 m->sctp_timeoutticks[SCTP_TIMER_SEND] = sctp_secs_to_ticks(SCTP_SEND_SEC); /* needed ? */
2530 m->sctp_timeoutticks[SCTP_TIMER_INIT] = sctp_secs_to_ticks(SCTP_INIT_SEC); /* needed ? */
2531 m->sctp_timeoutticks[SCTP_TIMER_RECV] = sctp_msecs_to_ticks(SCTP_BASE_SYSCTL(sctp_delayed_sack_time_default));
2532 m->sctp_timeoutticks[SCTP_TIMER_HEARTBEAT] = sctp_msecs_to_ticks(SCTP_BASE_SYSCTL(sctp_heartbeat_interval_default));
2533 m->sctp_timeoutticks[SCTP_TIMER_PMTU] = sctp_secs_to_ticks(SCTP_BASE_SYSCTL(sctp_pmtu_raise_time_default));
2534 m->sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN] = sctp_secs_to_ticks(SCTP_BASE_SYSCTL(sctp_shutdown_guard_time_default));
2535 m->sctp_timeoutticks[SCTP_TIMER_SIGNATURE] = sctp_secs_to_ticks(SCTP_BASE_SYSCTL(sctp_secret_lifetime_default));
2536 /* all max/min max are in ms */
2537 m->sctp_maxrto = SCTP_BASE_SYSCTL(sctp_rto_max_default);
2538 m->sctp_minrto = SCTP_BASE_SYSCTL(sctp_rto_min_default);
2539 m->initial_rto = SCTP_BASE_SYSCTL(sctp_rto_initial_default);
2540 m->initial_init_rto_max = SCTP_BASE_SYSCTL(sctp_init_rto_max_default);
2541 m->sctp_sack_freq = SCTP_BASE_SYSCTL(sctp_sack_freq_default);
2542 m->max_init_times = SCTP_BASE_SYSCTL(sctp_init_rtx_max_default);
2543 m->max_send_times = SCTP_BASE_SYSCTL(sctp_assoc_rtx_max_default);
2544 m->def_net_failure = SCTP_BASE_SYSCTL(sctp_path_rtx_max_default);
2545 m->def_net_pf_threshold = SCTP_BASE_SYSCTL(sctp_path_pf_threshold);
2546 m->sctp_sws_sender = SCTP_SWS_SENDER_DEF;
2547 m->sctp_sws_receiver = SCTP_SWS_RECEIVER_DEF;
2548 m->max_burst = SCTP_BASE_SYSCTL(sctp_max_burst_default);
2549 m->fr_max_burst = SCTP_BASE_SYSCTL(sctp_fr_max_burst_default);
2550
2551 m->sctp_default_cc_module = SCTP_BASE_SYSCTL(sctp_default_cc_module);
2552 m->sctp_default_ss_module = SCTP_BASE_SYSCTL(sctp_default_ss_module);
2553 m->max_open_streams_intome = SCTP_BASE_SYSCTL(sctp_nr_incoming_streams_default);
2554 /* number of streams to pre-open on a association */
2555 m->pre_open_stream_count = SCTP_BASE_SYSCTL(sctp_nr_outgoing_streams_default);
2556
2557 m->default_mtu = 0;
2558 /* Add adaptation cookie */
2559 m->adaptation_layer_indicator = 0;
2560 m->adaptation_layer_indicator_provided = 0;
2561
2562 /* seed random number generator */
2563 m->random_counter = 1;
2564 m->store_at = SCTP_SIGNATURE_SIZE;
2565 SCTP_READ_RANDOM(m->random_numbers, sizeof(m->random_numbers));
2566 sctp_fill_random_store(m);
2567
2568 /* Minimum cookie size */
2569 m->size_of_a_cookie = (sizeof(struct sctp_init_msg) * 2) +
2570 sizeof(struct sctp_state_cookie);
2571 m->size_of_a_cookie += SCTP_SIGNATURE_SIZE;
2572
2573 /* Setup the initial secret */
2574 (void)SCTP_GETTIME_TIMEVAL(&time);
2575 m->time_of_secret_change = (unsigned int)time.tv_sec;
2576
2577 for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
2578 m->secret_key[0][i] = sctp_select_initial_TSN(m);
2579 }
2580 sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL);
2581
2582 /* How long is a cookie good for ? */
2583 m->def_cookie_life = sctp_msecs_to_ticks(SCTP_BASE_SYSCTL(sctp_valid_cookie_life_default));
2584 /*
2585 * Initialize authentication parameters
2586 */
2587 m->local_hmacs = sctp_default_supported_hmaclist();
2588 m->local_auth_chunks = sctp_alloc_chunklist();
2589 if (inp->asconf_supported) {
2590 sctp_auth_add_chunk(SCTP_ASCONF, m->local_auth_chunks);
2591 sctp_auth_add_chunk(SCTP_ASCONF_ACK, m->local_auth_chunks);
2592 }
2593 m->default_dscp = 0;
2594 #ifdef INET6
2595 m->default_flowlabel = 0;
2596 #endif
2597 m->port = 0; /* encapsulation disabled by default */
2598 LIST_INIT(&m->shared_keys);
2599 /* add default NULL key as key id 0 */
2600 null_key = sctp_alloc_sharedkey();
2601 sctp_insert_sharedkey(&m->shared_keys, null_key);
2602 SCTP_INP_WUNLOCK(inp);
2603 #ifdef SCTP_LOG_CLOSING
2604 sctp_log_closing(inp, NULL, 12);
2605 #endif
2606 return (error);
2607 }
2608
2609 void
2610 sctp_move_pcb_and_assoc(struct sctp_inpcb *old_inp, struct sctp_inpcb *new_inp,
2611 struct sctp_tcb *stcb)
2612 {
2613 struct sctp_nets *net;
2614 uint16_t lport, rport;
2615 struct sctppcbhead *head;
2616 struct sctp_laddr *laddr, *oladdr;
2617
2618 atomic_add_int(&stcb->asoc.refcnt, 1);
2619 SCTP_TCB_UNLOCK(stcb);
2620 SCTP_INP_INFO_WLOCK();
2621 SCTP_INP_WLOCK(old_inp);
2622 SCTP_INP_WLOCK(new_inp);
2623 SCTP_TCB_LOCK(stcb);
2624 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2625
2626 #ifdef INET6
2627 if (old_inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
2628 new_inp->ip_inp.inp.inp_flags |= old_inp->ip_inp.inp.inp_flags & INP_CONTROLOPTS;
2629 if (old_inp->ip_inp.inp.in6p_outputopts) {
2630 new_inp->ip_inp.inp.in6p_outputopts = ip6_copypktopts(old_inp->ip_inp.inp.in6p_outputopts, M_NOWAIT);
2631 }
2632 }
2633 #endif
2634 #if defined(INET) && defined(INET6)
2635 else
2636 #endif
2637 #ifdef INET
2638 {
2639 new_inp->ip_inp.inp.inp_ip_tos = old_inp->ip_inp.inp.inp_ip_tos;
2640 new_inp->ip_inp.inp.inp_ip_ttl = old_inp->ip_inp.inp.inp_ip_ttl;
2641 }
2642 #endif
2643 new_inp->sctp_ep.time_of_secret_change =
2644 old_inp->sctp_ep.time_of_secret_change;
2645 memcpy(new_inp->sctp_ep.secret_key, old_inp->sctp_ep.secret_key,
2646 sizeof(old_inp->sctp_ep.secret_key));
2647 new_inp->sctp_ep.current_secret_number =
2648 old_inp->sctp_ep.current_secret_number;
2649 new_inp->sctp_ep.last_secret_number =
2650 old_inp->sctp_ep.last_secret_number;
2651 new_inp->sctp_ep.size_of_a_cookie = old_inp->sctp_ep.size_of_a_cookie;
2652
2653 /* make it so new data pours into the new socket */
2654 stcb->sctp_socket = new_inp->sctp_socket;
2655 stcb->sctp_ep = new_inp;
2656
2657 /* Copy the port across */
2658 lport = new_inp->sctp_lport = old_inp->sctp_lport;
2659 rport = stcb->rport;
2660 /* Pull the tcb from the old association */
2661 LIST_REMOVE(stcb, sctp_tcbhash);
2662 LIST_REMOVE(stcb, sctp_tcblist);
2663 if (stcb->asoc.in_asocid_hash) {
2664 LIST_REMOVE(stcb, sctp_tcbasocidhash);
2665 }
2666 /* Now insert the new_inp into the TCP connected hash */
2667 head = &SCTP_BASE_INFO(sctp_tcpephash)[SCTP_PCBHASH_ALLADDR((lport | rport), SCTP_BASE_INFO(hashtcpmark))];
2668
2669 LIST_INSERT_HEAD(head, new_inp, sctp_hash);
2670 /* Its safe to access */
2671 new_inp->sctp_flags &= ~SCTP_PCB_FLAGS_UNBOUND;
2672
2673 /* Now move the tcb into the endpoint list */
2674 LIST_INSERT_HEAD(&new_inp->sctp_asoc_list, stcb, sctp_tcblist);
2675 /*
2676 * Question, do we even need to worry about the ep-hash since we
2677 * only have one connection? Probably not :> so lets get rid of it
2678 * and not suck up any kernel memory in that.
2679 */
2680 if (stcb->asoc.in_asocid_hash) {
2681 struct sctpasochead *lhd;
2682
2683 lhd = &new_inp->sctp_asocidhash[SCTP_PCBHASH_ASOC(stcb->asoc.assoc_id,
2684 new_inp->hashasocidmark)];
2685 LIST_INSERT_HEAD(lhd, stcb, sctp_tcbasocidhash);
2686 }
2687 /* Ok. Let's restart timer. */
2688 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2689 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, new_inp,
2690 stcb, net);
2691 }
2692
2693 SCTP_INP_INFO_WUNLOCK();
2694 if (new_inp->sctp_tcbhash != NULL) {
2695 SCTP_HASH_FREE(new_inp->sctp_tcbhash, new_inp->sctp_hashmark);
2696 new_inp->sctp_tcbhash = NULL;
2697 }
2698 if ((new_inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
2699 /* Subset bound, so copy in the laddr list from the old_inp */
2700 LIST_FOREACH(oladdr, &old_inp->sctp_addr_list, sctp_nxt_addr) {
2701 laddr = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
2702 if (laddr == NULL) {
2703 /*
2704 * Gak, what can we do? This assoc is really
2705 * HOSED. We probably should send an abort
2706 * here.
2707 */
2708 SCTPDBG(SCTP_DEBUG_PCB1, "Association hosed in TCP model, out of laddr memory\n");
2709 continue;
2710 }
2711 SCTP_INCR_LADDR_COUNT();
2712 memset(laddr, 0, sizeof(*laddr));
2713 (void)SCTP_GETTIME_TIMEVAL(&laddr->start_time);
2714 laddr->ifa = oladdr->ifa;
2715 atomic_add_int(&laddr->ifa->refcount, 1);
2716 LIST_INSERT_HEAD(&new_inp->sctp_addr_list, laddr,
2717 sctp_nxt_addr);
2718 new_inp->laddr_count++;
2719 if (oladdr == stcb->asoc.last_used_address) {
2720 stcb->asoc.last_used_address = laddr;
2721 }
2722 }
2723 }
2724 /* Now any running timers need to be adjusted. */
2725 if (stcb->asoc.dack_timer.ep == old_inp) {
2726 SCTP_INP_DECR_REF(old_inp);
2727 stcb->asoc.dack_timer.ep = new_inp;
2728 SCTP_INP_INCR_REF(new_inp);
2729 }
2730 if (stcb->asoc.asconf_timer.ep == old_inp) {
2731 SCTP_INP_DECR_REF(old_inp);
2732 stcb->asoc.asconf_timer.ep = new_inp;
2733 SCTP_INP_INCR_REF(new_inp);
2734 }
2735 if (stcb->asoc.strreset_timer.ep == old_inp) {
2736 SCTP_INP_DECR_REF(old_inp);
2737 stcb->asoc.strreset_timer.ep = new_inp;
2738 SCTP_INP_INCR_REF(new_inp);
2739 }
2740 if (stcb->asoc.shut_guard_timer.ep == old_inp) {
2741 SCTP_INP_DECR_REF(old_inp);
2742 stcb->asoc.shut_guard_timer.ep = new_inp;
2743 SCTP_INP_INCR_REF(new_inp);
2744 }
2745 if (stcb->asoc.autoclose_timer.ep == old_inp) {
2746 SCTP_INP_DECR_REF(old_inp);
2747 stcb->asoc.autoclose_timer.ep = new_inp;
2748 SCTP_INP_INCR_REF(new_inp);
2749 }
2750 if (stcb->asoc.delete_prim_timer.ep == old_inp) {
2751 SCTP_INP_DECR_REF(old_inp);
2752 stcb->asoc.delete_prim_timer.ep = new_inp;
2753 SCTP_INP_INCR_REF(new_inp);
2754 }
2755 /* now what about the nets? */
2756 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2757 if (net->pmtu_timer.ep == old_inp) {
2758 SCTP_INP_DECR_REF(old_inp);
2759 net->pmtu_timer.ep = new_inp;
2760 SCTP_INP_INCR_REF(new_inp);
2761 }
2762 if (net->hb_timer.ep == old_inp) {
2763 SCTP_INP_DECR_REF(old_inp);
2764 net->hb_timer.ep = new_inp;
2765 SCTP_INP_INCR_REF(new_inp);
2766 }
2767 if (net->rxt_timer.ep == old_inp) {
2768 SCTP_INP_DECR_REF(old_inp);
2769 net->rxt_timer.ep = new_inp;
2770 SCTP_INP_INCR_REF(new_inp);
2771 }
2772 }
2773 SCTP_INP_WUNLOCK(new_inp);
2774 SCTP_INP_WUNLOCK(old_inp);
2775 }
2776
2777 /*
2778 * insert an laddr entry with the given ifa for the desired list
2779 */
2780 static int
2781 sctp_insert_laddr(struct sctpladdr *list, struct sctp_ifa *ifa, uint32_t act)
2782 {
2783 struct sctp_laddr *laddr;
2784
2785 laddr = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
2786 if (laddr == NULL) {
2787 /* out of memory? */
2788 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
2789 return (EINVAL);
2790 }
2791 SCTP_INCR_LADDR_COUNT();
2792 memset(laddr, 0, sizeof(*laddr));
2793 (void)SCTP_GETTIME_TIMEVAL(&laddr->start_time);
2794 laddr->ifa = ifa;
2795 laddr->action = act;
2796 atomic_add_int(&ifa->refcount, 1);
2797 /* insert it */
2798 LIST_INSERT_HEAD(list, laddr, sctp_nxt_addr);
2799
2800 return (0);
2801 }
2802
2803 /*
2804 * Remove an laddr entry from the local address list (on an assoc)
2805 */
2806 static void
2807 sctp_remove_laddr(struct sctp_laddr *laddr)
2808 {
2809
2810 /* remove from the list */
2811 LIST_REMOVE(laddr, sctp_nxt_addr);
2812 sctp_free_ifa(laddr->ifa);
2813 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_laddr), laddr);
2814 SCTP_DECR_LADDR_COUNT();
2815 }
2816
2817 /*
2818 * Bind the socket, with the PCB and global info locks held. Note, if a
2819 * socket address is specified, the PCB lock may be dropped and re-acquired.
2820 *
2821 * sctp_ifap is used to bypass normal local address validation checks.
2822 */
2823 int
2824 sctp_inpcb_bind_locked(struct sctp_inpcb *inp, struct sockaddr *addr,
2825 struct sctp_ifa *sctp_ifap, struct thread *td)
2826 {
2827 /* bind a ep to a socket address */
2828 struct sctppcbhead *head;
2829 struct sctp_inpcb *inp_tmp;
2830 struct inpcb *ip_inp;
2831 int port_reuse_active = 0;
2832 int bindall;
2833 uint16_t lport;
2834 int error;
2835 uint32_t vrf_id;
2836
2837 KASSERT(td != NULL, ("%s: null thread", __func__));
2838
2839 error = 0;
2840 lport = 0;
2841 bindall = 1;
2842 ip_inp = &inp->ip_inp.inp;
2843
2844 SCTP_INP_INFO_WLOCK_ASSERT();
2845 SCTP_INP_WLOCK_ASSERT(inp);
2846
2847 #ifdef SCTP_DEBUG
2848 if (addr) {
2849 SCTPDBG(SCTP_DEBUG_PCB1, "Bind called port: %d\n",
2850 ntohs(((struct sockaddr_in *)addr)->sin_port));
2851 SCTPDBG(SCTP_DEBUG_PCB1, "Addr: ");
2852 SCTPDBG_ADDR(SCTP_DEBUG_PCB1, addr);
2853 }
2854 #endif
2855 if ((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) == 0) {
2856 error = EINVAL;
2857 /* already did a bind, subsequent binds NOT allowed ! */
2858 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
2859 goto out;
2860 }
2861 if (addr != NULL) {
2862 switch (addr->sa_family) {
2863 #ifdef INET
2864 case AF_INET:
2865 {
2866 struct sockaddr_in *sin;
2867
2868 /* IPV6_V6ONLY socket? */
2869 if (SCTP_IPV6_V6ONLY(inp)) {
2870 error = EINVAL;
2871 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
2872 goto out;
2873 }
2874 if (addr->sa_len != sizeof(*sin)) {
2875 error = EINVAL;
2876 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
2877 goto out;
2878 }
2879
2880 sin = (struct sockaddr_in *)addr;
2881 lport = sin->sin_port;
2882 /*
2883 * For LOOPBACK the prison_local_ip4() call
2884 * will transmute the ip address to the
2885 * proper value.
2886 */
2887 if ((error = prison_local_ip4(td->td_ucred, &sin->sin_addr)) != 0) {
2888 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
2889 goto out;
2890 }
2891 if (sin->sin_addr.s_addr != INADDR_ANY) {
2892 bindall = 0;
2893 }
2894 break;
2895 }
2896 #endif
2897 #ifdef INET6
2898 case AF_INET6:
2899 {
2900 /*
2901 * Only for pure IPv6 Address. (No IPv4
2902 * Mapped!)
2903 */
2904 struct sockaddr_in6 *sin6;
2905
2906 sin6 = (struct sockaddr_in6 *)addr;
2907 if (addr->sa_len != sizeof(*sin6)) {
2908 error = EINVAL;
2909 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
2910 goto out;
2911 }
2912 lport = sin6->sin6_port;
2913 /*
2914 * For LOOPBACK the prison_local_ip6() call
2915 * will transmute the ipv6 address to the
2916 * proper value.
2917 */
2918 if ((error = prison_local_ip6(td->td_ucred, &sin6->sin6_addr,
2919 (SCTP_IPV6_V6ONLY(inp) != 0))) != 0) {
2920 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
2921 goto out;
2922 }
2923 if (!IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2924 bindall = 0;
2925 /* KAME hack: embed scopeid */
2926 if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) {
2927 error = EINVAL;
2928 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
2929 goto out;
2930 }
2931 }
2932 /* this must be cleared for ifa_ifwithaddr() */
2933 sin6->sin6_scope_id = 0;
2934 break;
2935 }
2936 #endif
2937 default:
2938 error = EAFNOSUPPORT;
2939 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
2940 goto out;
2941 }
2942 }
2943 /* Setup a vrf_id to be the default for the non-bind-all case. */
2944 vrf_id = inp->def_vrf_id;
2945
2946 if (lport) {
2947 /*
2948 * Did the caller specify a port? if so we must see if an ep
2949 * already has this one bound.
2950 */
2951 /* got to be root to get at low ports */
2952 if (ntohs(lport) < IPPORT_RESERVED &&
2953 (error = priv_check(td, PRIV_NETINET_RESERVEDPORT)) != 0) {
2954 goto out;
2955 }
2956 SCTP_INP_INCR_REF(inp);
2957 SCTP_INP_WUNLOCK(inp);
2958 if (bindall) {
2959 vrf_id = inp->def_vrf_id;
2960 inp_tmp = sctp_pcb_findep(addr, 0, 1, vrf_id);
2961 if (inp_tmp != NULL) {
2962 /*
2963 * lock guy returned and lower count note
2964 * that we are not bound so inp_tmp should
2965 * NEVER be inp. And it is this inp
2966 * (inp_tmp) that gets the reference bump,
2967 * so we must lower it.
2968 */
2969 SCTP_INP_DECR_REF(inp_tmp);
2970 /* unlock info */
2971 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_PORTREUSE)) &&
2972 (sctp_is_feature_on(inp_tmp, SCTP_PCB_FLAGS_PORTREUSE))) {
2973 /*
2974 * Ok, must be one-2-one and
2975 * allowing port re-use
2976 */
2977 port_reuse_active = 1;
2978 goto continue_anyway;
2979 }
2980 SCTP_INP_WLOCK(inp);
2981 SCTP_INP_DECR_REF(inp);
2982 error = EADDRINUSE;
2983 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
2984 goto out;
2985 }
2986 } else {
2987 inp_tmp = sctp_pcb_findep(addr, 0, 1, vrf_id);
2988 if (inp_tmp != NULL) {
2989 /*
2990 * lock guy returned and lower count note
2991 * that we are not bound so inp_tmp should
2992 * NEVER be inp. And it is this inp
2993 * (inp_tmp) that gets the reference bump,
2994 * so we must lower it.
2995 */
2996 SCTP_INP_DECR_REF(inp_tmp);
2997 /* unlock info */
2998 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_PORTREUSE)) &&
2999 (sctp_is_feature_on(inp_tmp, SCTP_PCB_FLAGS_PORTREUSE))) {
3000 /*
3001 * Ok, must be one-2-one and
3002 * allowing port re-use
3003 */
3004 port_reuse_active = 1;
3005 goto continue_anyway;
3006 }
3007 SCTP_INP_WLOCK(inp);
3008 SCTP_INP_DECR_REF(inp);
3009 error = EADDRINUSE;
3010 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
3011 goto out;
3012 }
3013 }
3014 continue_anyway:
3015 SCTP_INP_WLOCK(inp);
3016 SCTP_INP_DECR_REF(inp);
3017 if (bindall) {
3018 /* verify that no lport is not used by a singleton */
3019 if ((port_reuse_active == 0) &&
3020 (inp_tmp = sctp_isport_inuse(inp, lport, vrf_id))) {
3021 /* Sorry someone already has this one bound */
3022 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_PORTREUSE)) &&
3023 (sctp_is_feature_on(inp_tmp, SCTP_PCB_FLAGS_PORTREUSE))) {
3024 port_reuse_active = 1;
3025 } else {
3026 error = EADDRINUSE;
3027 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
3028 goto out;
3029 }
3030 }
3031 }
3032 } else {
3033 uint16_t first, last, candidate;
3034 uint16_t count;
3035
3036 if (ip_inp->inp_flags & INP_HIGHPORT) {
3037 first = MODULE_GLOBAL(ipport_hifirstauto);
3038 last = MODULE_GLOBAL(ipport_hilastauto);
3039 } else if (ip_inp->inp_flags & INP_LOWPORT) {
3040 if ((error = priv_check(td, PRIV_NETINET_RESERVEDPORT)) != 0) {
3041 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
3042 goto out;
3043 }
3044 first = MODULE_GLOBAL(ipport_lowfirstauto);
3045 last = MODULE_GLOBAL(ipport_lowlastauto);
3046 } else {
3047 first = MODULE_GLOBAL(ipport_firstauto);
3048 last = MODULE_GLOBAL(ipport_lastauto);
3049 }
3050 if (first > last) {
3051 uint16_t temp;
3052
3053 temp = first;
3054 first = last;
3055 last = temp;
3056 }
3057 count = last - first + 1; /* number of candidates */
3058 candidate = first + sctp_select_initial_TSN(&inp->sctp_ep) % (count);
3059
3060 for (;;) {
3061 if (sctp_isport_inuse(inp, htons(candidate), inp->def_vrf_id) == NULL) {
3062 lport = htons(candidate);
3063 break;
3064 }
3065 if (--count == 0) {
3066 error = EADDRINUSE;
3067 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
3068 goto out;
3069 }
3070 if (candidate == last)
3071 candidate = first;
3072 else
3073 candidate = candidate + 1;
3074 }
3075 }
3076 if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE |
3077 SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
3078 /*
3079 * this really should not happen. The guy did a non-blocking
3080 * bind and then did a close at the same time.
3081 */
3082 error = EINVAL;
3083 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
3084 goto out;
3085 }
3086 /* ok we look clear to give out this port, so lets setup the binding */
3087 if (bindall) {
3088 /* binding to all addresses, so just set in the proper flags */
3089 inp->sctp_flags |= SCTP_PCB_FLAGS_BOUNDALL;
3090 /* set the automatic addr changes from kernel flag */
3091 if (SCTP_BASE_SYSCTL(sctp_auto_asconf) == 0) {
3092 sctp_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF);
3093 sctp_feature_off(inp, SCTP_PCB_FLAGS_AUTO_ASCONF);
3094 } else {
3095 sctp_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF);
3096 sctp_feature_on(inp, SCTP_PCB_FLAGS_AUTO_ASCONF);
3097 }
3098 if (SCTP_BASE_SYSCTL(sctp_multiple_asconfs) == 0) {
3099 sctp_feature_off(inp, SCTP_PCB_FLAGS_MULTIPLE_ASCONFS);
3100 } else {
3101 sctp_feature_on(inp, SCTP_PCB_FLAGS_MULTIPLE_ASCONFS);
3102 }
3103 /*
3104 * set the automatic mobility_base from kernel flag (by
3105 * micchie)
3106 */
3107 if (SCTP_BASE_SYSCTL(sctp_mobility_base) == 0) {
3108 sctp_mobility_feature_off(inp, SCTP_MOBILITY_BASE);
3109 sctp_mobility_feature_off(inp, SCTP_MOBILITY_PRIM_DELETED);
3110 } else {
3111 sctp_mobility_feature_on(inp, SCTP_MOBILITY_BASE);
3112 sctp_mobility_feature_off(inp, SCTP_MOBILITY_PRIM_DELETED);
3113 }
3114 /*
3115 * set the automatic mobility_fasthandoff from kernel flag
3116 * (by micchie)
3117 */
3118 if (SCTP_BASE_SYSCTL(sctp_mobility_fasthandoff) == 0) {
3119 sctp_mobility_feature_off(inp, SCTP_MOBILITY_FASTHANDOFF);
3120 sctp_mobility_feature_off(inp, SCTP_MOBILITY_PRIM_DELETED);
3121 } else {
3122 sctp_mobility_feature_on(inp, SCTP_MOBILITY_FASTHANDOFF);
3123 sctp_mobility_feature_off(inp, SCTP_MOBILITY_PRIM_DELETED);
3124 }
3125 } else {
3126 /*
3127 * bind specific, make sure flags is off and add a new
3128 * address structure to the sctp_addr_list inside the ep
3129 * structure.
3130 *
3131 * We will need to allocate one and insert it at the head.
3132 * The socketopt call can just insert new addresses in there
3133 * as well. It will also have to do the embed scope kame
3134 * hack too (before adding).
3135 */
3136 struct sctp_ifa *ifa;
3137 union sctp_sockstore store;
3138
3139 memset(&store, 0, sizeof(store));
3140 switch (addr->sa_family) {
3141 #ifdef INET
3142 case AF_INET:
3143 memcpy(&store.sin, addr, sizeof(struct sockaddr_in));
3144 store.sin.sin_port = 0;
3145 break;
3146 #endif
3147 #ifdef INET6
3148 case AF_INET6:
3149 memcpy(&store.sin6, addr, sizeof(struct sockaddr_in6));
3150 store.sin6.sin6_port = 0;
3151 break;
3152 #endif
3153 default:
3154 break;
3155 }
3156 /*
3157 * first find the interface with the bound address need to
3158 * zero out the port to find the address! yuck! can't do
3159 * this earlier since need port for sctp_pcb_findep()
3160 */
3161 if (sctp_ifap != NULL) {
3162 ifa = sctp_ifap;
3163 } else {
3164 /*
3165 * Note for BSD we hit here always other O/S's will
3166 * pass things in via the sctp_ifap argument.
3167 */
3168 ifa = sctp_find_ifa_by_addr(&store.sa,
3169 vrf_id, SCTP_ADDR_NOT_LOCKED);
3170 }
3171 if (ifa == NULL) {
3172 error = EADDRNOTAVAIL;
3173 /* Can't find an interface with that address */
3174 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
3175 goto out;
3176 }
3177 #ifdef INET6
3178 if (addr->sa_family == AF_INET6) {
3179 /* GAK, more FIXME IFA lock? */
3180 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
3181 /* Can't bind a non-existent addr. */
3182 error = EINVAL;
3183 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
3184 goto out;
3185 }
3186 }
3187 #endif
3188 /* we're not bound all */
3189 inp->sctp_flags &= ~SCTP_PCB_FLAGS_BOUNDALL;
3190 /* allow bindx() to send ASCONF's for binding changes */
3191 sctp_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF);
3192 /* clear automatic addr changes from kernel flag */
3193 sctp_feature_off(inp, SCTP_PCB_FLAGS_AUTO_ASCONF);
3194
3195 /* add this address to the endpoint list */
3196 error = sctp_insert_laddr(&inp->sctp_addr_list, ifa, 0);
3197 if (error != 0)
3198 goto out;
3199 inp->laddr_count++;
3200 }
3201 /* find the bucket */
3202 if (port_reuse_active) {
3203 /* Put it into tcp 1-2-1 hash */
3204 head = &SCTP_BASE_INFO(sctp_tcpephash)[SCTP_PCBHASH_ALLADDR(lport, SCTP_BASE_INFO(hashtcpmark))];
3205 inp->sctp_flags |= SCTP_PCB_FLAGS_IN_TCPPOOL;
3206 } else {
3207 head = &SCTP_BASE_INFO(sctp_ephash)[SCTP_PCBHASH_ALLADDR(lport, SCTP_BASE_INFO(hashmark))];
3208 }
3209 /* put it in the bucket */
3210 LIST_INSERT_HEAD(head, inp, sctp_hash);
3211 SCTPDBG(SCTP_DEBUG_PCB1, "Main hash to bind at head:%p, bound port:%d - in tcp_pool=%d\n",
3212 (void *)head, ntohs(lport), port_reuse_active);
3213 /* set in the port */
3214 inp->sctp_lport = lport;
3215
3216 /* turn off just the unbound flag */
3217 KASSERT((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) != 0,
3218 ("%s: inp %p is already bound", __func__, inp));
3219 inp->sctp_flags &= ~SCTP_PCB_FLAGS_UNBOUND;
3220 out:
3221 return (error);
3222 }
3223
3224 int
3225 sctp_inpcb_bind(struct socket *so, struct sockaddr *addr,
3226 struct sctp_ifa *sctp_ifap, struct thread *td)
3227 {
3228 struct sctp_inpcb *inp;
3229 int error;
3230
3231 inp = so->so_pcb;
3232 SCTP_INP_INFO_WLOCK();
3233 SCTP_INP_WLOCK(inp);
3234 error = sctp_inpcb_bind_locked(inp, addr, sctp_ifap, td);
3235 SCTP_INP_WUNLOCK(inp);
3236 SCTP_INP_INFO_WUNLOCK();
3237 return (error);
3238 }
3239
3240 static void
3241 sctp_iterator_inp_being_freed(struct sctp_inpcb *inp)
3242 {
3243 struct sctp_iterator *it, *nit;
3244
3245 /*
3246 * We enter with the only the ITERATOR_LOCK in place and a write
3247 * lock on the inp_info stuff.
3248 */
3249 it = sctp_it_ctl.cur_it;
3250 if (it && (it->vn != curvnet)) {
3251 /* Its not looking at our VNET */
3252 return;
3253 }
3254 if (it && (it->inp == inp)) {
3255 /*
3256 * This is tricky and we hold the iterator lock, but when it
3257 * returns and gets the lock (when we release it) the
3258 * iterator will try to operate on inp. We need to stop that
3259 * from happening. But of course the iterator has a
3260 * reference on the stcb and inp. We can mark it and it will
3261 * stop.
3262 *
3263 * If its a single iterator situation, we set the end
3264 * iterator flag. Otherwise we set the iterator to go to the
3265 * next inp.
3266 *
3267 */
3268 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
3269 sctp_it_ctl.iterator_flags |= SCTP_ITERATOR_STOP_CUR_IT;
3270 } else {
3271 sctp_it_ctl.iterator_flags |= SCTP_ITERATOR_STOP_CUR_INP;
3272 }
3273 }
3274 /*
3275 * Now go through and remove any single reference to our inp that
3276 * may be still pending on the list
3277 */
3278 SCTP_IPI_ITERATOR_WQ_LOCK();
3279 TAILQ_FOREACH_SAFE(it, &sctp_it_ctl.iteratorhead, sctp_nxt_itr, nit) {
3280 if (it->vn != curvnet) {
3281 continue;
3282 }
3283 if (it->inp == inp) {
3284 /* This one points to me is it inp specific? */
3285 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
3286 /* Remove and free this one */
3287 TAILQ_REMOVE(&sctp_it_ctl.iteratorhead,
3288 it, sctp_nxt_itr);
3289 if (it->function_atend != NULL) {
3290 (*it->function_atend) (it->pointer, it->val);
3291 }
3292 SCTP_FREE(it, SCTP_M_ITER);
3293 } else {
3294 it->inp = LIST_NEXT(it->inp, sctp_list);
3295 if (it->inp) {
3296 SCTP_INP_INCR_REF(it->inp);
3297 }
3298 }
3299 /*
3300 * When its put in the refcnt is incremented so decr
3301 * it
3302 */
3303 SCTP_INP_DECR_REF(inp);
3304 }
3305 }
3306 SCTP_IPI_ITERATOR_WQ_UNLOCK();
3307 }
3308
3309 /* release sctp_inpcb unbind the port */
3310 void
3311 sctp_inpcb_free(struct sctp_inpcb *inp, int immediate, int from)
3312 {
3313 /*
3314 * Here we free a endpoint. We must find it (if it is in the Hash
3315 * table) and remove it from there. Then we must also find it in the
3316 * overall list and remove it from there. After all removals are
3317 * complete then any timer has to be stopped. Then start the actual
3318 * freeing. a) Any local lists. b) Any associations. c) The hash of
3319 * all associations. d) finally the ep itself.
3320 */
3321 struct sctp_tcb *stcb, *nstcb;
3322 struct sctp_laddr *laddr, *nladdr;
3323 struct inpcb *ip_pcb;
3324 struct socket *so;
3325 int being_refed = 0;
3326 struct sctp_queued_to_read *sq, *nsq;
3327 int cnt;
3328 sctp_sharedkey_t *shared_key, *nshared_key;
3329
3330 #ifdef SCTP_LOG_CLOSING
3331 sctp_log_closing(inp, NULL, 0);
3332 #endif
3333 SCTP_ITERATOR_LOCK();
3334 /* mark any iterators on the list or being processed */
3335 sctp_iterator_inp_being_freed(inp);
3336 SCTP_ITERATOR_UNLOCK();
3337
3338 SCTP_ASOC_CREATE_LOCK(inp);
3339 SCTP_INP_INFO_WLOCK();
3340 SCTP_INP_WLOCK(inp);
3341 so = inp->sctp_socket;
3342 KASSERT((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) != 0,
3343 ("%s: inp %p still has socket", __func__, inp));
3344 KASSERT((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) == 0,
3345 ("%s: double free of inp %p", __func__, inp));
3346 if (from == SCTP_CALLED_AFTER_CMPSET_OFCLOSE) {
3347 inp->sctp_flags &= ~SCTP_PCB_FLAGS_CLOSE_IP;
3348 /* socket is gone, so no more wakeups allowed */
3349 inp->sctp_flags |= SCTP_PCB_FLAGS_DONT_WAKE;
3350 inp->sctp_flags &= ~SCTP_PCB_FLAGS_WAKEINPUT;
3351 inp->sctp_flags &= ~SCTP_PCB_FLAGS_WAKEOUTPUT;
3352 }
3353 /* First time through we have the socket lock, after that no more. */
3354 sctp_timer_stop(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL,
3355 SCTP_FROM_SCTP_PCB + SCTP_LOC_1);
3356
3357 if (inp->control) {
3358 sctp_m_freem(inp->control);
3359 inp->control = NULL;
3360 }
3361 if (inp->pkt) {
3362 sctp_m_freem(inp->pkt);
3363 inp->pkt = NULL;
3364 }
3365 ip_pcb = &inp->ip_inp.inp; /* we could just cast the main pointer
3366 * here but I will be nice :> (i.e.
3367 * ip_pcb = ep;) */
3368 if (immediate == SCTP_FREE_SHOULD_USE_GRACEFUL_CLOSE) {
3369 int cnt_in_sd;
3370
3371 cnt_in_sd = 0;
3372 LIST_FOREACH_SAFE(stcb, &inp->sctp_asoc_list, sctp_tcblist, nstcb) {
3373 SCTP_TCB_LOCK(stcb);
3374 /* Disconnect the socket please. */
3375 stcb->sctp_socket = NULL;
3376 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_CLOSED_SOCKET);
3377 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
3378 /* Skip guys being freed */
3379 cnt_in_sd++;
3380 if (stcb->asoc.state & SCTP_STATE_IN_ACCEPT_QUEUE) {
3381 /*
3382 * Special case - we did not start a
3383 * kill timer on the asoc due to it
3384 * was not closed. So go ahead and
3385 * start it now.
3386 */
3387 SCTP_CLEAR_SUBSTATE(stcb, SCTP_STATE_IN_ACCEPT_QUEUE);
3388 sctp_timer_start(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL);
3389 }
3390 SCTP_TCB_UNLOCK(stcb);
3391 continue;
3392 }
3393 if (((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
3394 (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) &&
3395 (stcb->asoc.total_output_queue_size == 0)) {
3396 /*
3397 * If we have data in queue, we don't want
3398 * to just free since the app may have done,
3399 * send()/close or connect/send/close. And
3400 * it wants the data to get across first.
3401 */
3402 /* Just abandon things in the front states */
3403 if (sctp_free_assoc(inp, stcb, SCTP_PCBFREE_NOFORCE,
3404 SCTP_FROM_SCTP_PCB + SCTP_LOC_2) == 0) {
3405 cnt_in_sd++;
3406 }
3407 continue;
3408 }
3409 if ((stcb->asoc.size_on_reasm_queue > 0) ||
3410 (stcb->asoc.control_pdapi) ||
3411 (stcb->asoc.size_on_all_streams > 0) ||
3412 ((so != NULL) && (SCTP_SBAVAIL(&so->so_rcv) > 0))) {
3413 /* Left with Data unread */
3414 struct mbuf *op_err;
3415
3416 op_err = sctp_generate_cause(SCTP_CAUSE_USER_INITIATED_ABT, "");
3417 stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_PCB + SCTP_LOC_3;
3418 sctp_send_abort_tcb(stcb, op_err, SCTP_SO_LOCKED);
3419 SCTP_STAT_INCR_COUNTER32(sctps_aborted);
3420 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
3421 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
3422 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
3423 }
3424 if (sctp_free_assoc(inp, stcb,
3425 SCTP_PCBFREE_NOFORCE, SCTP_FROM_SCTP_PCB + SCTP_LOC_4) == 0) {
3426 cnt_in_sd++;
3427 }
3428 continue;
3429 } else if (TAILQ_EMPTY(&stcb->asoc.send_queue) &&
3430 TAILQ_EMPTY(&stcb->asoc.sent_queue) &&
3431 (stcb->asoc.stream_queue_cnt == 0)) {
3432 if ((*stcb->asoc.ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, &stcb->asoc)) {
3433 goto abort_anyway;
3434 }
3435 if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) &&
3436 (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
3437 struct sctp_nets *netp;
3438
3439 /*
3440 * there is nothing queued to send,
3441 * so I send shutdown
3442 */
3443 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
3444 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
3445 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
3446 }
3447 SCTP_SET_STATE(stcb, SCTP_STATE_SHUTDOWN_SENT);
3448 sctp_stop_timers_for_shutdown(stcb);
3449 if (stcb->asoc.alternate) {
3450 netp = stcb->asoc.alternate;
3451 } else {
3452 netp = stcb->asoc.primary_destination;
3453 }
3454 sctp_send_shutdown(stcb, netp);
3455 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
3456 netp);
3457 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, NULL);
3458 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_TMR, SCTP_SO_LOCKED);
3459 }
3460 } else {
3461 /* mark into shutdown pending */
3462 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_SHUTDOWN_PENDING);
3463 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, NULL);
3464 if ((*stcb->asoc.ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, &stcb->asoc)) {
3465 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_PARTIAL_MSG_LEFT);
3466 }
3467 if (TAILQ_EMPTY(&stcb->asoc.send_queue) &&
3468 TAILQ_EMPTY(&stcb->asoc.sent_queue) &&
3469 (stcb->asoc.state & SCTP_STATE_PARTIAL_MSG_LEFT)) {
3470 struct mbuf *op_err;
3471
3472 abort_anyway:
3473 op_err = sctp_generate_cause(SCTP_CAUSE_USER_INITIATED_ABT, "");
3474 stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_PCB + SCTP_LOC_5;
3475 sctp_send_abort_tcb(stcb, op_err, SCTP_SO_LOCKED);
3476 SCTP_STAT_INCR_COUNTER32(sctps_aborted);
3477 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
3478 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
3479 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
3480 }
3481 if (sctp_free_assoc(inp, stcb,
3482 SCTP_PCBFREE_NOFORCE,
3483 SCTP_FROM_SCTP_PCB + SCTP_LOC_6) == 0) {
3484 cnt_in_sd++;
3485 }
3486 continue;
3487 } else {
3488 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CLOSING, SCTP_SO_LOCKED);
3489 }
3490 }
3491 cnt_in_sd++;
3492 SCTP_TCB_UNLOCK(stcb);
3493 }
3494 /* now is there some left in our SHUTDOWN state? */
3495 if (cnt_in_sd) {
3496 #ifdef SCTP_LOG_CLOSING
3497 sctp_log_closing(inp, NULL, 2);
3498 #endif
3499 inp->sctp_socket = NULL;
3500 SCTP_INP_WUNLOCK(inp);
3501 SCTP_ASOC_CREATE_UNLOCK(inp);
3502 SCTP_INP_INFO_WUNLOCK();
3503 return;
3504 }
3505 }
3506 inp->sctp_socket = NULL;
3507 if ((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) == 0) {
3508 /*
3509 * ok, this guy has been bound. It's port is somewhere in
3510 * the SCTP_BASE_INFO(hash table). Remove it!
3511 */
3512 LIST_REMOVE(inp, sctp_hash);
3513 inp->sctp_flags |= SCTP_PCB_FLAGS_UNBOUND;
3514 }
3515
3516 /*
3517 * If there is a timer running to kill us, forget it, since it may
3518 * have a contest on the INP lock.. which would cause us to die ...
3519 */
3520 cnt = 0;
3521 LIST_FOREACH_SAFE(stcb, &inp->sctp_asoc_list, sctp_tcblist, nstcb) {
3522 SCTP_TCB_LOCK(stcb);
3523 if (immediate != SCTP_FREE_SHOULD_USE_GRACEFUL_CLOSE) {
3524 /* Disconnect the socket please */
3525 stcb->sctp_socket = NULL;
3526 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_CLOSED_SOCKET);
3527 }
3528 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
3529 if (stcb->asoc.state & SCTP_STATE_IN_ACCEPT_QUEUE) {
3530 SCTP_CLEAR_SUBSTATE(stcb, SCTP_STATE_IN_ACCEPT_QUEUE);
3531 sctp_timer_start(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL);
3532 }
3533 cnt++;
3534 SCTP_TCB_UNLOCK(stcb);
3535 continue;
3536 }
3537 /* Free associations that are NOT killing us */
3538 if ((SCTP_GET_STATE(stcb) != SCTP_STATE_COOKIE_WAIT) &&
3539 ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0)) {
3540 struct mbuf *op_err;
3541
3542 op_err = sctp_generate_cause(SCTP_CAUSE_USER_INITIATED_ABT, "");
3543 stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_PCB + SCTP_LOC_7;
3544 sctp_send_abort_tcb(stcb, op_err, SCTP_SO_LOCKED);
3545 SCTP_STAT_INCR_COUNTER32(sctps_aborted);
3546 } else if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
3547 cnt++;
3548 SCTP_TCB_UNLOCK(stcb);
3549 continue;
3550 }
3551 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
3552 (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
3553 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
3554 }
3555 if (sctp_free_assoc(inp, stcb, SCTP_PCBFREE_FORCE,
3556 SCTP_FROM_SCTP_PCB + SCTP_LOC_8) == 0) {
3557 cnt++;
3558 }
3559 }
3560 if (cnt) {
3561 /* Ok we have someone out there that will kill us */
3562 #ifdef SCTP_LOG_CLOSING
3563 sctp_log_closing(inp, NULL, 3);
3564 #endif
3565 SCTP_INP_WUNLOCK(inp);
3566 SCTP_ASOC_CREATE_UNLOCK(inp);
3567 SCTP_INP_INFO_WUNLOCK();
3568 return;
3569 }
3570 if (SCTP_INP_LOCK_CONTENDED(inp))
3571 being_refed++;
3572 if (SCTP_INP_READ_CONTENDED(inp))
3573 being_refed++;
3574 if (SCTP_ASOC_CREATE_LOCK_CONTENDED(inp))
3575 being_refed++;
3576 /* NOTE: 0 refcount also means no timers are referencing us. */
3577 if ((inp->refcount) ||
3578 (being_refed) ||
3579 (inp->sctp_flags & SCTP_PCB_FLAGS_CLOSE_IP)) {
3580 #ifdef SCTP_LOG_CLOSING
3581 sctp_log_closing(inp, NULL, 4);
3582 #endif
3583 sctp_timer_start(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL);
3584 SCTP_INP_WUNLOCK(inp);
3585 SCTP_ASOC_CREATE_UNLOCK(inp);
3586 SCTP_INP_INFO_WUNLOCK();
3587 return;
3588 }
3589 inp->sctp_ep.signature_change.type = 0;
3590 inp->sctp_flags |= SCTP_PCB_FLAGS_SOCKET_ALLGONE;
3591 /*
3592 * Remove it from the list .. last thing we need a lock for.
3593 */
3594 LIST_REMOVE(inp, sctp_list);
3595 SCTP_INP_WUNLOCK(inp);
3596 SCTP_ASOC_CREATE_UNLOCK(inp);
3597 SCTP_INP_INFO_WUNLOCK();
3598
3599 #ifdef SCTP_LOG_CLOSING
3600 sctp_log_closing(inp, NULL, 5);
3601 #endif
3602 if ((inp->sctp_asocidhash) != NULL) {
3603 SCTP_HASH_FREE(inp->sctp_asocidhash, inp->hashasocidmark);
3604 inp->sctp_asocidhash = NULL;
3605 }
3606 /* sa_ignore FREED_MEMORY */
3607 TAILQ_FOREACH_SAFE(sq, &inp->read_queue, next, nsq) {
3608 /* Its only abandoned if it had data left */
3609 if (sq->length)
3610 SCTP_STAT_INCR(sctps_left_abandon);
3611
3612 TAILQ_REMOVE(&inp->read_queue, sq, next);
3613 sctp_free_remote_addr(sq->whoFrom);
3614 if (so)
3615 so->so_rcv.sb_cc -= sq->length;
3616 if (sq->data) {
3617 sctp_m_freem(sq->data);
3618 sq->data = NULL;
3619 }
3620 /*
3621 * no need to free the net count, since at this point all
3622 * assoc's are gone.
3623 */
3624 sctp_free_a_readq(NULL, sq);
3625 }
3626 /* Now the sctp_pcb things */
3627 /*
3628 * free each asoc if it is not already closed/free. we can't use the
3629 * macro here since le_next will get freed as part of the
3630 * sctp_free_assoc() call.
3631 */
3632 if (ip_pcb->inp_options) {
3633 (void)sctp_m_free(ip_pcb->inp_options);
3634 ip_pcb->inp_options = 0;
3635 }
3636 #ifdef INET6
3637 if (ip_pcb->inp_vflag & INP_IPV6) {
3638 ip6_freepcbopts(ip_pcb->in6p_outputopts);
3639 }
3640 #endif /* INET6 */
3641 ip_pcb->inp_vflag = 0;
3642 /* free up authentication fields */
3643 if (inp->sctp_ep.local_auth_chunks != NULL)
3644 sctp_free_chunklist(inp->sctp_ep.local_auth_chunks);
3645 if (inp->sctp_ep.local_hmacs != NULL)
3646 sctp_free_hmaclist(inp->sctp_ep.local_hmacs);
3647
3648 LIST_FOREACH_SAFE(shared_key, &inp->sctp_ep.shared_keys, next, nshared_key) {
3649 LIST_REMOVE(shared_key, next);
3650 sctp_free_sharedkey(shared_key);
3651 /* sa_ignore FREED_MEMORY */
3652 }
3653
3654 /*
3655 * if we have an address list the following will free the list of
3656 * ifaddr's that are set into this ep. Again macro limitations here,
3657 * since the LIST_FOREACH could be a bad idea.
3658 */
3659 LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
3660 sctp_remove_laddr(laddr);
3661 }
3662
3663 #ifdef SCTP_TRACK_FREED_ASOCS
3664 /* TEMP CODE */
3665 LIST_FOREACH_SAFE(stcb, &inp->sctp_asoc_free_list, sctp_tcblist, nstcb) {
3666 LIST_REMOVE(stcb, sctp_tcblist);
3667 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asoc), stcb);
3668 SCTP_DECR_ASOC_COUNT();
3669 }
3670 /* *** END TEMP CODE *** */
3671 #endif
3672 /* Now lets see about freeing the EP hash table. */
3673 if (inp->sctp_tcbhash != NULL) {
3674 SCTP_HASH_FREE(inp->sctp_tcbhash, inp->sctp_hashmark);
3675 inp->sctp_tcbhash = NULL;
3676 }
3677 /* Now we must put the ep memory back into the zone pool */
3678 crfree(inp->ip_inp.inp.inp_cred);
3679 INP_LOCK_DESTROY(&inp->ip_inp.inp);
3680 SCTP_INP_LOCK_DESTROY(inp);
3681 SCTP_INP_READ_DESTROY(inp);
3682 SCTP_ASOC_CREATE_LOCK_DESTROY(inp);
3683 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_ep), inp);
3684 SCTP_DECR_EP_COUNT();
3685 }
3686
3687 struct sctp_nets *
3688 sctp_findnet(struct sctp_tcb *stcb, struct sockaddr *addr)
3689 {
3690 struct sctp_nets *net;
3691
3692 /* locate the address */
3693 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
3694 if (sctp_cmpaddr(addr, (struct sockaddr *)&net->ro._l_addr))
3695 return (net);
3696 }
3697 return (NULL);
3698 }
3699
3700 int
3701 sctp_is_address_on_local_host(struct sockaddr *addr, uint32_t vrf_id)
3702 {
3703 struct sctp_ifa *sctp_ifa;
3704
3705 sctp_ifa = sctp_find_ifa_by_addr(addr, vrf_id, SCTP_ADDR_NOT_LOCKED);
3706 if (sctp_ifa) {
3707 return (1);
3708 } else {
3709 return (0);
3710 }
3711 }
3712
3713 /*
3714 * add's a remote endpoint address, done with the INIT/INIT-ACK as well as
3715 * when a ASCONF arrives that adds it. It will also initialize all the cwnd
3716 * stats of stuff.
3717 */
3718 int
3719 sctp_add_remote_addr(struct sctp_tcb *stcb, struct sockaddr *newaddr,
3720 struct sctp_nets **netp, uint16_t port, int set_scope, int from)
3721 {
3722 /*
3723 * The following is redundant to the same lines in the
3724 * sctp_aloc_assoc() but is needed since others call the add address
3725 * function
3726 */
3727 struct sctp_nets *net, *netfirst;
3728 int addr_inscope;
3729
3730 SCTPDBG(SCTP_DEBUG_PCB1, "Adding an address (from:%d) to the peer: ",
3731 from);
3732 SCTPDBG_ADDR(SCTP_DEBUG_PCB1, newaddr);
3733
3734 netfirst = sctp_findnet(stcb, newaddr);
3735 if (netfirst) {
3736 /*
3737 * Lie and return ok, we don't want to make the association
3738 * go away for this behavior. It will happen in the TCP
3739 * model in a connected socket. It does not reach the hash
3740 * table until after the association is built so it can't be
3741 * found. Mark as reachable, since the initial creation will
3742 * have been cleared and the NOT_IN_ASSOC flag will have
3743 * been added... and we don't want to end up removing it
3744 * back out.
3745 */
3746 if (netfirst->dest_state & SCTP_ADDR_UNCONFIRMED) {
3747 netfirst->dest_state = (SCTP_ADDR_REACHABLE |
3748 SCTP_ADDR_UNCONFIRMED);
3749 } else {
3750 netfirst->dest_state = SCTP_ADDR_REACHABLE;
3751 }
3752
3753 return (0);
3754 }
3755 addr_inscope = 1;
3756 switch (newaddr->sa_family) {
3757 #ifdef INET
3758 case AF_INET:
3759 {
3760 struct sockaddr_in *sin;
3761
3762 sin = (struct sockaddr_in *)newaddr;
3763 if (sin->sin_addr.s_addr == 0) {
3764 /* Invalid address */
3765 return (-1);
3766 }
3767 /* zero out the zero area */
3768 memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
3769
3770 /* assure len is set */
3771 sin->sin_len = sizeof(struct sockaddr_in);
3772 if (set_scope) {
3773 if (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
3774 stcb->asoc.scope.ipv4_local_scope = 1;
3775 }
3776 } else {
3777 /* Validate the address is in scope */
3778 if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) &&
3779 (stcb->asoc.scope.ipv4_local_scope == 0)) {
3780 addr_inscope = 0;
3781 }
3782 }
3783 break;
3784 }
3785 #endif
3786 #ifdef INET6
3787 case AF_INET6:
3788 {
3789 struct sockaddr_in6 *sin6;
3790
3791 sin6 = (struct sockaddr_in6 *)newaddr;
3792 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
3793 /* Invalid address */
3794 return (-1);
3795 }
3796 /* assure len is set */
3797 sin6->sin6_len = sizeof(struct sockaddr_in6);
3798 if (set_scope) {
3799 if (sctp_is_address_on_local_host(newaddr, stcb->asoc.vrf_id)) {
3800 stcb->asoc.scope.loopback_scope = 1;
3801 stcb->asoc.scope.local_scope = 0;
3802 stcb->asoc.scope.ipv4_local_scope = 1;
3803 stcb->asoc.scope.site_scope = 1;
3804 } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
3805 /*
3806 * If the new destination is a
3807 * LINK_LOCAL we must have common
3808 * site scope. Don't set the local
3809 * scope since we may not share all
3810 * links, only loopback can do this.
3811 * Links on the local network would
3812 * also be on our private network
3813 * for v4 too.
3814 */
3815 stcb->asoc.scope.ipv4_local_scope = 1;
3816 stcb->asoc.scope.site_scope = 1;
3817 } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
3818 /*
3819 * If the new destination is
3820 * SITE_LOCAL then we must have site
3821 * scope in common.
3822 */
3823 stcb->asoc.scope.site_scope = 1;
3824 }
3825 } else {
3826 /* Validate the address is in scope */
3827 if (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr) &&
3828 (stcb->asoc.scope.loopback_scope == 0)) {
3829 addr_inscope = 0;
3830 } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) &&
3831 (stcb->asoc.scope.local_scope == 0)) {
3832 addr_inscope = 0;
3833 } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr) &&
3834 (stcb->asoc.scope.site_scope == 0)) {
3835 addr_inscope = 0;
3836 }
3837 }
3838 break;
3839 }
3840 #endif
3841 default:
3842 /* not supported family type */
3843 return (-1);
3844 }
3845 net = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_net), struct sctp_nets);
3846 if (net == NULL) {
3847 return (-1);
3848 }
3849 SCTP_INCR_RADDR_COUNT();
3850 memset(net, 0, sizeof(struct sctp_nets));
3851 (void)SCTP_GETTIME_TIMEVAL(&net->start_time);
3852 memcpy(&net->ro._l_addr, newaddr, newaddr->sa_len);
3853 switch (newaddr->sa_family) {
3854 #ifdef INET
3855 case AF_INET:
3856 ((struct sockaddr_in *)&net->ro._l_addr)->sin_port = stcb->rport;
3857 break;
3858 #endif
3859 #ifdef INET6
3860 case AF_INET6:
3861 ((struct sockaddr_in6 *)&net->ro._l_addr)->sin6_port = stcb->rport;
3862 break;
3863 #endif
3864 default:
3865 break;
3866 }
3867 net->addr_is_local = sctp_is_address_on_local_host(newaddr, stcb->asoc.vrf_id);
3868 if (net->addr_is_local && ((set_scope || (from == SCTP_ADDR_IS_CONFIRMED)))) {
3869 stcb->asoc.scope.loopback_scope = 1;
3870 stcb->asoc.scope.ipv4_local_scope = 1;
3871 stcb->asoc.scope.local_scope = 0;
3872 stcb->asoc.scope.site_scope = 1;
3873 addr_inscope = 1;
3874 }
3875 net->failure_threshold = stcb->asoc.def_net_failure;
3876 net->pf_threshold = stcb->asoc.def_net_pf_threshold;
3877 if (addr_inscope == 0) {
3878 net->dest_state = (SCTP_ADDR_REACHABLE |
3879 SCTP_ADDR_OUT_OF_SCOPE);
3880 } else {
3881 if (from == SCTP_ADDR_IS_CONFIRMED)
3882 /* SCTP_ADDR_IS_CONFIRMED is passed by connect_x */
3883 net->dest_state = SCTP_ADDR_REACHABLE;
3884 else
3885 net->dest_state = SCTP_ADDR_REACHABLE |
3886 SCTP_ADDR_UNCONFIRMED;
3887 }
3888 /*
3889 * We set this to 0, the timer code knows that this means its an
3890 * initial value
3891 */
3892 net->rto_needed = 1;
3893 net->RTO = 0;
3894 net->RTO_measured = 0;
3895 stcb->asoc.numnets++;
3896 net->ref_count = 1;
3897 net->cwr_window_tsn = net->last_cwr_tsn = stcb->asoc.sending_seq - 1;
3898 net->port = port;
3899 net->dscp = stcb->asoc.default_dscp;
3900 #ifdef INET6
3901 net->flowlabel = stcb->asoc.default_flowlabel;
3902 #endif
3903 if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_DONOT_HEARTBEAT)) {
3904 net->dest_state |= SCTP_ADDR_NOHB;
3905 } else {
3906 net->dest_state &= ~SCTP_ADDR_NOHB;
3907 }
3908 if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_DO_NOT_PMTUD)) {
3909 net->dest_state |= SCTP_ADDR_NO_PMTUD;
3910 } else {
3911 net->dest_state &= ~SCTP_ADDR_NO_PMTUD;
3912 }
3913 net->heart_beat_delay = stcb->asoc.heart_beat_delay;
3914 /* Init the timer structure */
3915 SCTP_OS_TIMER_INIT(&net->rxt_timer.timer);
3916 SCTP_OS_TIMER_INIT(&net->pmtu_timer.timer);
3917 SCTP_OS_TIMER_INIT(&net->hb_timer.timer);
3918
3919 /* Now generate a route for this guy */
3920 #ifdef INET6
3921 /* KAME hack: embed scopeid */
3922 if (newaddr->sa_family == AF_INET6) {
3923 struct sockaddr_in6 *sin6;
3924
3925 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
3926 (void)sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone));
3927 sin6->sin6_scope_id = 0;
3928 }
3929 #endif
3930 SCTP_RTALLOC((sctp_route_t *)&net->ro,
3931 stcb->asoc.vrf_id,
3932 stcb->sctp_ep->fibnum);
3933
3934 net->src_addr_selected = 0;
3935 if (SCTP_ROUTE_HAS_VALID_IFN(&net->ro)) {
3936 /* Get source address */
3937 net->ro._s_addr = sctp_source_address_selection(stcb->sctp_ep,
3938 stcb,
3939 (sctp_route_t *)&net->ro,
3940 net,
3941 0,
3942 stcb->asoc.vrf_id);
3943 if (stcb->asoc.default_mtu > 0) {
3944 net->mtu = stcb->asoc.default_mtu;
3945 switch (net->ro._l_addr.sa.sa_family) {
3946 #ifdef INET
3947 case AF_INET:
3948 net->mtu += SCTP_MIN_V4_OVERHEAD;
3949 break;
3950 #endif
3951 #ifdef INET6
3952 case AF_INET6:
3953 net->mtu += SCTP_MIN_OVERHEAD;
3954 break;
3955 #endif
3956 default:
3957 break;
3958 }
3959 #if defined(INET) || defined(INET6)
3960 if (net->port) {
3961 net->mtu += (uint32_t)sizeof(struct udphdr);
3962 }
3963 #endif
3964 } else if (net->ro._s_addr != NULL) {
3965 uint32_t imtu, rmtu, hcmtu;
3966
3967 net->src_addr_selected = 1;
3968 /* Now get the interface MTU */
3969 if (net->ro._s_addr->ifn_p != NULL) {
3970 /*
3971 * XXX: Should we here just use
3972 * net->ro._s_addr->ifn_p->ifn_mtu
3973 */
3974 imtu = SCTP_GATHER_MTU_FROM_IFN_INFO(net->ro._s_addr->ifn_p->ifn_p,
3975 net->ro._s_addr->ifn_p->ifn_index);
3976 } else {
3977 imtu = 0;
3978 }
3979 rmtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._l_addr.sa, net->ro.ro_nh);
3980 hcmtu = sctp_hc_get_mtu(&net->ro._l_addr, stcb->sctp_ep->fibnum);
3981 net->mtu = sctp_min_mtu(hcmtu, rmtu, imtu);
3982 }
3983 }
3984 if (net->mtu == 0) {
3985 if (stcb->asoc.default_mtu > 0) {
3986 net->mtu = stcb->asoc.default_mtu;
3987 switch (net->ro._l_addr.sa.sa_family) {
3988 #ifdef INET
3989 case AF_INET:
3990 net->mtu += SCTP_MIN_V4_OVERHEAD;
3991 break;
3992 #endif
3993 #ifdef INET6
3994 case AF_INET6:
3995 net->mtu += SCTP_MIN_OVERHEAD;
3996 break;
3997 #endif
3998 default:
3999 break;
4000 }
4001 #if defined(INET) || defined(INET6)
4002 if (net->port) {
4003 net->mtu += (uint32_t)sizeof(struct udphdr);
4004 }
4005 #endif
4006 } else {
4007 switch (newaddr->sa_family) {
4008 #ifdef INET
4009 case AF_INET:
4010 net->mtu = SCTP_DEFAULT_MTU;
4011 break;
4012 #endif
4013 #ifdef INET6
4014 case AF_INET6:
4015 net->mtu = 1280;
4016 break;
4017 #endif
4018 default:
4019 break;
4020 }
4021 }
4022 }
4023 #if defined(INET) || defined(INET6)
4024 if (net->port) {
4025 net->mtu -= (uint32_t)sizeof(struct udphdr);
4026 }
4027 #endif
4028 if (from == SCTP_ALLOC_ASOC) {
4029 stcb->asoc.smallest_mtu = net->mtu;
4030 }
4031 if (stcb->asoc.smallest_mtu > net->mtu) {
4032 sctp_pathmtu_adjustment(stcb, net->mtu, true);
4033 }
4034 #ifdef INET6
4035 if (newaddr->sa_family == AF_INET6) {
4036 struct sockaddr_in6 *sin6;
4037
4038 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
4039 (void)sa6_recoverscope(sin6);
4040 }
4041 #endif
4042
4043 /* JRS - Use the congestion control given in the CC module */
4044 if (stcb->asoc.cc_functions.sctp_set_initial_cc_param != NULL)
4045 (*stcb->asoc.cc_functions.sctp_set_initial_cc_param) (stcb, net);
4046
4047 /*
4048 * CMT: CUC algo - set find_pseudo_cumack to TRUE (1) at beginning
4049 * of assoc (2005/06/27, iyengar@cis.udel.edu)
4050 */
4051 net->find_pseudo_cumack = 1;
4052 net->find_rtx_pseudo_cumack = 1;
4053 /* Choose an initial flowid. */
4054 net->flowid = stcb->asoc.my_vtag ^
4055 ntohs(stcb->rport) ^
4056 ntohs(stcb->sctp_ep->sctp_lport);
4057 net->flowtype = M_HASHTYPE_OPAQUE_HASH;
4058 if (netp) {
4059 *netp = net;
4060 }
4061 netfirst = TAILQ_FIRST(&stcb->asoc.nets);
4062 if (net->ro.ro_nh == NULL) {
4063 /* Since we have no route put it at the back */
4064 TAILQ_INSERT_TAIL(&stcb->asoc.nets, net, sctp_next);
4065 } else if (netfirst == NULL) {
4066 /* We are the first one in the pool. */
4067 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next);
4068 } else if (netfirst->ro.ro_nh == NULL) {
4069 /*
4070 * First one has NO route. Place this one ahead of the first
4071 * one.
4072 */
4073 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next);
4074 } else if (net->ro.ro_nh->nh_ifp != netfirst->ro.ro_nh->nh_ifp) {
4075 /*
4076 * This one has a different interface than the one at the
4077 * top of the list. Place it ahead.
4078 */
4079 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next);
4080 } else {
4081 /*
4082 * Ok we have the same interface as the first one. Move
4083 * forward until we find either a) one with a NULL route...
4084 * insert ahead of that b) one with a different ifp.. insert
4085 * after that. c) end of the list.. insert at the tail.
4086 */
4087 struct sctp_nets *netlook;
4088
4089 do {
4090 netlook = TAILQ_NEXT(netfirst, sctp_next);
4091 if (netlook == NULL) {
4092 /* End of the list */
4093 TAILQ_INSERT_TAIL(&stcb->asoc.nets, net, sctp_next);
4094 break;
4095 } else if (netlook->ro.ro_nh == NULL) {
4096 /* next one has NO route */
4097 TAILQ_INSERT_BEFORE(netfirst, net, sctp_next);
4098 break;
4099 } else if (netlook->ro.ro_nh->nh_ifp != net->ro.ro_nh->nh_ifp) {
4100 TAILQ_INSERT_AFTER(&stcb->asoc.nets, netlook,
4101 net, sctp_next);
4102 break;
4103 }
4104 /* Shift forward */
4105 netfirst = netlook;
4106 } while (netlook != NULL);
4107 }
4108
4109 /* got to have a primary set */
4110 if (stcb->asoc.primary_destination == 0) {
4111 stcb->asoc.primary_destination = net;
4112 } else if ((stcb->asoc.primary_destination->ro.ro_nh == NULL) &&
4113 (net->ro.ro_nh) &&
4114 ((net->dest_state & SCTP_ADDR_UNCONFIRMED) == 0)) {
4115 /* No route to current primary adopt new primary */
4116 stcb->asoc.primary_destination = net;
4117 }
4118 /* Validate primary is first */
4119 net = TAILQ_FIRST(&stcb->asoc.nets);
4120 if ((net != stcb->asoc.primary_destination) &&
4121 (stcb->asoc.primary_destination)) {
4122 /*
4123 * first one on the list is NOT the primary sctp_cmpaddr()
4124 * is much more efficient if the primary is the first on the
4125 * list, make it so.
4126 */
4127 TAILQ_REMOVE(&stcb->asoc.nets,
4128 stcb->asoc.primary_destination, sctp_next);
4129 TAILQ_INSERT_HEAD(&stcb->asoc.nets,
4130 stcb->asoc.primary_destination, sctp_next);
4131 }
4132 return (0);
4133 }
4134
4135 static uint32_t
4136 sctp_aloc_a_assoc_id(struct sctp_inpcb *inp, struct sctp_tcb *stcb)
4137 {
4138 uint32_t id;
4139 struct sctpasochead *head;
4140 struct sctp_tcb *lstcb;
4141
4142 try_again:
4143 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
4144 /* TSNH */
4145 return (0);
4146 }
4147 /*
4148 * We don't allow assoc id to be one of SCTP_FUTURE_ASSOC,
4149 * SCTP_CURRENT_ASSOC and SCTP_ALL_ASSOC.
4150 */
4151 if (inp->sctp_associd_counter <= SCTP_ALL_ASSOC) {
4152 inp->sctp_associd_counter = SCTP_ALL_ASSOC + 1;
4153 }
4154 id = inp->sctp_associd_counter;
4155 inp->sctp_associd_counter++;
4156 lstcb = sctp_findasoc_ep_asocid_locked(inp, (sctp_assoc_t)id, 0);
4157 if (lstcb) {
4158 goto try_again;
4159 }
4160 head = &inp->sctp_asocidhash[SCTP_PCBHASH_ASOC(id, inp->hashasocidmark)];
4161 LIST_INSERT_HEAD(head, stcb, sctp_tcbasocidhash);
4162 stcb->asoc.in_asocid_hash = 1;
4163 return (id);
4164 }
4165
4166 /*
4167 * allocate an association and add it to the endpoint. The caller must be
4168 * careful to add all additional addresses once they are know right away or
4169 * else the assoc will be may experience a blackout scenario.
4170 */
4171 static struct sctp_tcb *
4172 sctp_aloc_assoc_locked(struct sctp_inpcb *inp, struct sockaddr *firstaddr,
4173 int *error, uint32_t override_tag, uint32_t initial_tsn,
4174 uint32_t vrf_id, uint16_t o_streams, uint16_t port,
4175 struct thread *p,
4176 int initialize_auth_params)
4177 {
4178 /* note the p argument is only valid in unbound sockets */
4179
4180 struct sctp_tcb *stcb;
4181 struct sctp_association *asoc;
4182 struct sctpasochead *head;
4183 uint16_t rport;
4184 int err;
4185
4186 SCTP_INP_INFO_WLOCK_ASSERT();
4187 SCTP_INP_WLOCK_ASSERT(inp);
4188
4189 /*
4190 * Assumption made here: Caller has done a
4191 * sctp_findassociation_ep_addr(ep, addr's); to make sure the
4192 * address does not exist already.
4193 */
4194 if (SCTP_BASE_INFO(ipi_count_asoc) >= SCTP_MAX_NUM_OF_ASOC) {
4195 /* Hit max assoc, sorry no more */
4196 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, ENOBUFS);
4197 *error = ENOBUFS;
4198 return (NULL);
4199 }
4200 if (firstaddr == NULL) {
4201 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
4202 *error = EINVAL;
4203 return (NULL);
4204 }
4205 if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE | SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
4206 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
4207 *error = EINVAL;
4208 return (NULL);
4209 }
4210 if ((inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) &&
4211 ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_PORTREUSE)) ||
4212 (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED))) {
4213 /*
4214 * If its in the TCP pool, its NOT allowed to create an
4215 * association. The parent listener needs to call
4216 * sctp_aloc_assoc.. or the one-2-many socket. If a peeled
4217 * off, or connected one does this.. its an error.
4218 */
4219 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
4220 *error = EINVAL;
4221 return (NULL);
4222 }
4223 if ((inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) ||
4224 (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)) {
4225 if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) ||
4226 (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED)) {
4227 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
4228 *error = EINVAL;
4229 return (NULL);
4230 }
4231 }
4232 SCTPDBG(SCTP_DEBUG_PCB3, "Allocate an association for peer:");
4233 #ifdef SCTP_DEBUG
4234 if (firstaddr) {
4235 SCTPDBG_ADDR(SCTP_DEBUG_PCB3, firstaddr);
4236 switch (firstaddr->sa_family) {
4237 #ifdef INET
4238 case AF_INET:
4239 SCTPDBG(SCTP_DEBUG_PCB3, "Port:%d\n",
4240 ntohs(((struct sockaddr_in *)firstaddr)->sin_port));
4241 break;
4242 #endif
4243 #ifdef INET6
4244 case AF_INET6:
4245 SCTPDBG(SCTP_DEBUG_PCB3, "Port:%d\n",
4246 ntohs(((struct sockaddr_in6 *)firstaddr)->sin6_port));
4247 break;
4248 #endif
4249 default:
4250 break;
4251 }
4252 } else {
4253 SCTPDBG(SCTP_DEBUG_PCB3, "None\n");
4254 }
4255 #endif /* SCTP_DEBUG */
4256 switch (firstaddr->sa_family) {
4257 #ifdef INET
4258 case AF_INET:
4259 {
4260 struct sockaddr_in *sin;
4261
4262 sin = (struct sockaddr_in *)firstaddr;
4263 if ((ntohs(sin->sin_port) == 0) ||
4264 (sin->sin_addr.s_addr == INADDR_ANY) ||
4265 (sin->sin_addr.s_addr == INADDR_BROADCAST) ||
4266 IN_MULTICAST(ntohl(sin->sin_addr.s_addr)) ||
4267 ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
4268 (SCTP_IPV6_V6ONLY(inp) != 0))) {
4269 /* Invalid address */
4270 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
4271 *error = EINVAL;
4272 return (NULL);
4273 }
4274 rport = sin->sin_port;
4275 break;
4276 }
4277 #endif
4278 #ifdef INET6
4279 case AF_INET6:
4280 {
4281 struct sockaddr_in6 *sin6;
4282
4283 sin6 = (struct sockaddr_in6 *)firstaddr;
4284 if ((ntohs(sin6->sin6_port) == 0) ||
4285 IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) ||
4286 IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr) ||
4287 ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0)) {
4288 /* Invalid address */
4289 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
4290 *error = EINVAL;
4291 return (NULL);
4292 }
4293 rport = sin6->sin6_port;
4294 break;
4295 }
4296 #endif
4297 default:
4298 /* not supported family type */
4299 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
4300 *error = EINVAL;
4301 return (NULL);
4302 }
4303 if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) {
4304 /*
4305 * If you have not performed a bind, then we need to do the
4306 * ephemeral bind for you.
4307 */
4308 if ((err = sctp_inpcb_bind_locked(inp, NULL, NULL, p))) {
4309 /* bind error, probably perm */
4310 *error = err;
4311 return (NULL);
4312 }
4313 }
4314 stcb = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_asoc), struct sctp_tcb);
4315 if (stcb == NULL) {
4316 /* out of memory? */
4317 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, ENOMEM);
4318 *error = ENOMEM;
4319 return (NULL);
4320 }
4321 SCTP_INCR_ASOC_COUNT();
4322
4323 memset(stcb, 0, sizeof(*stcb));
4324 asoc = &stcb->asoc;
4325
4326 SCTP_TCB_LOCK_INIT(stcb);
4327 stcb->rport = rport;
4328 /* setup back pointer's */
4329 stcb->sctp_ep = inp;
4330 stcb->sctp_socket = inp->sctp_socket;
4331 if ((err = sctp_init_asoc(inp, stcb, override_tag, initial_tsn, vrf_id, o_streams))) {
4332 /* failed */
4333 SCTP_TCB_LOCK_DESTROY(stcb);
4334 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asoc), stcb);
4335 SCTP_DECR_ASOC_COUNT();
4336 *error = err;
4337 return (NULL);
4338 }
4339 SCTP_TCB_LOCK(stcb);
4340
4341 asoc->assoc_id = sctp_aloc_a_assoc_id(inp, stcb);
4342 /* now that my_vtag is set, add it to the hash */
4343 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, SCTP_BASE_INFO(hashasocmark))];
4344 /* put it in the bucket in the vtag hash of assoc's for the system */
4345 LIST_INSERT_HEAD(head, stcb, sctp_asocs);
4346
4347 if (sctp_add_remote_addr(stcb, firstaddr, NULL, port, SCTP_DO_SETSCOPE, SCTP_ALLOC_ASOC)) {
4348 /* failure.. memory error? */
4349 if (asoc->strmout) {
4350 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
4351 asoc->strmout = NULL;
4352 }
4353 if (asoc->mapping_array) {
4354 SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
4355 asoc->mapping_array = NULL;
4356 }
4357 if (asoc->nr_mapping_array) {
4358 SCTP_FREE(asoc->nr_mapping_array, SCTP_M_MAP);
4359 asoc->nr_mapping_array = NULL;
4360 }
4361 SCTP_DECR_ASOC_COUNT();
4362 SCTP_TCB_UNLOCK(stcb);
4363 SCTP_TCB_LOCK_DESTROY(stcb);
4364 LIST_REMOVE(stcb, sctp_asocs);
4365 LIST_REMOVE(stcb, sctp_tcbasocidhash);
4366 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asoc), stcb);
4367 SCTP_INP_WUNLOCK(inp);
4368 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, ENOBUFS);
4369 *error = ENOBUFS;
4370 return (NULL);
4371 }
4372 /* Init all the timers */
4373 SCTP_OS_TIMER_INIT(&asoc->dack_timer.timer);
4374 SCTP_OS_TIMER_INIT(&asoc->strreset_timer.timer);
4375 SCTP_OS_TIMER_INIT(&asoc->asconf_timer.timer);
4376 SCTP_OS_TIMER_INIT(&asoc->shut_guard_timer.timer);
4377 SCTP_OS_TIMER_INIT(&asoc->autoclose_timer.timer);
4378 SCTP_OS_TIMER_INIT(&asoc->delete_prim_timer.timer);
4379
4380 LIST_INSERT_HEAD(&inp->sctp_asoc_list, stcb, sctp_tcblist);
4381 /* now file the port under the hash as well */
4382 if (inp->sctp_tcbhash != NULL) {
4383 head = &inp->sctp_tcbhash[SCTP_PCBHASH_ALLADDR(stcb->rport,
4384 inp->sctp_hashmark)];
4385 LIST_INSERT_HEAD(head, stcb, sctp_tcbhash);
4386 }
4387 if (initialize_auth_params == SCTP_INITIALIZE_AUTH_PARAMS) {
4388 sctp_initialize_auth_params(inp, stcb);
4389 }
4390 SCTPDBG(SCTP_DEBUG_PCB1, "Association %p now allocated\n", (void *)stcb);
4391 return (stcb);
4392 }
4393
4394 struct sctp_tcb *
4395 sctp_aloc_assoc(struct sctp_inpcb *inp, struct sockaddr *firstaddr,
4396 int *error, uint32_t override_tag, uint32_t initial_tsn,
4397 uint32_t vrf_id, uint16_t o_streams, uint16_t port,
4398 struct thread *p,
4399 int initialize_auth_params)
4400 {
4401 struct sctp_tcb *stcb;
4402
4403 SCTP_INP_INFO_WLOCK();
4404 SCTP_INP_WLOCK(inp);
4405 stcb = sctp_aloc_assoc_locked(inp, firstaddr, error, override_tag,
4406 initial_tsn, vrf_id, o_streams, port, p, initialize_auth_params);
4407 SCTP_INP_INFO_WUNLOCK();
4408 SCTP_INP_WUNLOCK(inp);
4409 return (stcb);
4410 }
4411
4412 struct sctp_tcb *
4413 sctp_aloc_assoc_connected(struct sctp_inpcb *inp, struct sockaddr *firstaddr,
4414 int *error, uint32_t override_tag, uint32_t initial_tsn,
4415 uint32_t vrf_id, uint16_t o_streams, uint16_t port,
4416 struct thread *p,
4417 int initialize_auth_params)
4418 {
4419 struct sctp_tcb *stcb;
4420
4421 SCTP_INP_INFO_WLOCK();
4422 SCTP_INP_WLOCK(inp);
4423 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
4424 SCTP_IS_LISTENING(inp)) {
4425 SCTP_INP_INFO_WUNLOCK();
4426 SCTP_INP_WUNLOCK(inp);
4427 *error = EINVAL;
4428 return (NULL);
4429 }
4430 stcb = sctp_aloc_assoc_locked(inp, firstaddr, error, override_tag,
4431 initial_tsn, vrf_id, o_streams, port, p, initialize_auth_params);
4432 SCTP_INP_INFO_WUNLOCK();
4433 if (stcb != NULL && (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)) {
4434 inp->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
4435 soisconnecting(inp->sctp_socket);
4436 }
4437 SCTP_INP_WUNLOCK(inp);
4438 return (stcb);
4439 }
4440
4441 void
4442 sctp_remove_net(struct sctp_tcb *stcb, struct sctp_nets *net)
4443 {
4444 struct sctp_inpcb *inp;
4445 struct sctp_association *asoc;
4446
4447 inp = stcb->sctp_ep;
4448 asoc = &stcb->asoc;
4449 asoc->numnets--;
4450 TAILQ_REMOVE(&asoc->nets, net, sctp_next);
4451 if (net == asoc->primary_destination) {
4452 /* Reset primary */
4453 struct sctp_nets *lnet;
4454
4455 lnet = TAILQ_FIRST(&asoc->nets);
4456 /*
4457 * Mobility adaptation Ideally, if deleted destination is
4458 * the primary, it becomes a fast retransmission trigger by
4459 * the subsequent SET PRIMARY. (by micchie)
4460 */
4461 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
4462 SCTP_MOBILITY_BASE) ||
4463 sctp_is_mobility_feature_on(stcb->sctp_ep,
4464 SCTP_MOBILITY_FASTHANDOFF)) {
4465 SCTPDBG(SCTP_DEBUG_ASCONF1, "remove_net: primary dst is deleting\n");
4466 if (asoc->deleted_primary != NULL) {
4467 SCTPDBG(SCTP_DEBUG_ASCONF1, "remove_net: deleted primary may be already stored\n");
4468 goto out;
4469 }
4470 asoc->deleted_primary = net;
4471 atomic_add_int(&net->ref_count, 1);
4472 memset(&net->lastsa, 0, sizeof(net->lastsa));
4473 memset(&net->lastsv, 0, sizeof(net->lastsv));
4474 sctp_mobility_feature_on(stcb->sctp_ep,
4475 SCTP_MOBILITY_PRIM_DELETED);
4476 sctp_timer_start(SCTP_TIMER_TYPE_PRIM_DELETED,
4477 stcb->sctp_ep, stcb, NULL);
4478 }
4479 out:
4480 /* Try to find a confirmed primary */
4481 asoc->primary_destination = sctp_find_alternate_net(stcb, lnet, 0);
4482 }
4483 if (net == asoc->last_data_chunk_from) {
4484 /* Reset primary */
4485 asoc->last_data_chunk_from = TAILQ_FIRST(&asoc->nets);
4486 }
4487 if (net == asoc->last_control_chunk_from) {
4488 /* Clear net */
4489 asoc->last_control_chunk_from = NULL;
4490 }
4491 if (net == asoc->last_net_cmt_send_started) {
4492 /* Clear net */
4493 asoc->last_net_cmt_send_started = NULL;
4494 }
4495 if (net == stcb->asoc.alternate) {
4496 sctp_free_remote_addr(stcb->asoc.alternate);
4497 stcb->asoc.alternate = NULL;
4498 }
4499 sctp_timer_stop(SCTP_TIMER_TYPE_PATHMTURAISE, inp, stcb, net,
4500 SCTP_FROM_SCTP_PCB + SCTP_LOC_9);
4501 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net,
4502 SCTP_FROM_SCTP_PCB + SCTP_LOC_10);
4503 net->dest_state |= SCTP_ADDR_BEING_DELETED;
4504 sctp_free_remote_addr(net);
4505 }
4506
4507 /*
4508 * remove a remote endpoint address from an association, it will fail if the
4509 * address does not exist.
4510 */
4511 int
4512 sctp_del_remote_addr(struct sctp_tcb *stcb, struct sockaddr *remaddr)
4513 {
4514 /*
4515 * Here we need to remove a remote address. This is quite simple, we
4516 * first find it in the list of address for the association
4517 * (tasoc->asoc.nets) and then if it is there, we do a LIST_REMOVE
4518 * on that item. Note we do not allow it to be removed if there are
4519 * no other addresses.
4520 */
4521 struct sctp_association *asoc;
4522 struct sctp_nets *net, *nnet;
4523
4524 asoc = &stcb->asoc;
4525
4526 /* locate the address */
4527 TAILQ_FOREACH_SAFE(net, &asoc->nets, sctp_next, nnet) {
4528 if (net->ro._l_addr.sa.sa_family != remaddr->sa_family) {
4529 continue;
4530 }
4531 if (sctp_cmpaddr((struct sockaddr *)&net->ro._l_addr,
4532 remaddr)) {
4533 /* we found the guy */
4534 if (asoc->numnets < 2) {
4535 /* Must have at LEAST two remote addresses */
4536 return (-1);
4537 } else {
4538 sctp_remove_net(stcb, net);
4539 return (0);
4540 }
4541 }
4542 }
4543 /* not found. */
4544 return (-2);
4545 }
4546
4547 static bool
4548 sctp_is_in_timewait(uint32_t tag, uint16_t lport, uint16_t rport, uint32_t now)
4549 {
4550 struct sctpvtaghead *chain;
4551 struct sctp_tagblock *twait_block;
4552 int i;
4553
4554 SCTP_INP_INFO_LOCK_ASSERT();
4555 chain = &SCTP_BASE_INFO(vtag_timewait)[(tag % SCTP_STACK_VTAG_HASH_SIZE)];
4556 LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) {
4557 for (i = 0; i < SCTP_NUMBER_IN_VTAG_BLOCK; i++) {
4558 if ((twait_block->vtag_block[i].tv_sec_at_expire >= now) &&
4559 (twait_block->vtag_block[i].v_tag == tag) &&
4560 (twait_block->vtag_block[i].lport == lport) &&
4561 (twait_block->vtag_block[i].rport == rport)) {
4562 return (true);
4563 }
4564 }
4565 }
4566 return (false);
4567 }
4568
4569 static void
4570 sctp_set_vtag_block(struct sctp_timewait *vtag_block, uint32_t time,
4571 uint32_t tag, uint16_t lport, uint16_t rport)
4572 {
4573 vtag_block->tv_sec_at_expire = time;
4574 vtag_block->v_tag = tag;
4575 vtag_block->lport = lport;
4576 vtag_block->rport = rport;
4577 }
4578
4579 static void
4580 sctp_add_vtag_to_timewait(uint32_t tag, uint16_t lport, uint16_t rport)
4581 {
4582 struct sctpvtaghead *chain;
4583 struct sctp_tagblock *twait_block;
4584 struct timeval now;
4585 uint32_t time;
4586 int i;
4587 bool set;
4588
4589 SCTP_INP_INFO_WLOCK_ASSERT();
4590 (void)SCTP_GETTIME_TIMEVAL(&now);
4591 time = (uint32_t)now.tv_sec + SCTP_BASE_SYSCTL(sctp_vtag_time_wait);
4592 chain = &SCTP_BASE_INFO(vtag_timewait)[(tag % SCTP_STACK_VTAG_HASH_SIZE)];
4593 set = false;
4594 LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) {
4595 /* Block(s) present, lets find space, and expire on the fly */
4596 for (i = 0; i < SCTP_NUMBER_IN_VTAG_BLOCK; i++) {
4597 if ((twait_block->vtag_block[i].v_tag == 0) && !set) {
4598 sctp_set_vtag_block(twait_block->vtag_block + i, time, tag, lport, rport);
4599 set = true;
4600 continue;
4601 }
4602 if ((twait_block->vtag_block[i].v_tag != 0) &&
4603 (twait_block->vtag_block[i].tv_sec_at_expire < (uint32_t)now.tv_sec)) {
4604 if (set) {
4605 /* Audit expires this guy */
4606 sctp_set_vtag_block(twait_block->vtag_block + i, 0, 0, 0, 0);
4607 } else {
4608 /* Reuse it for the new tag */
4609 sctp_set_vtag_block(twait_block->vtag_block + i, time, tag, lport, rport);
4610 set = true;
4611 }
4612 }
4613 }
4614 if (set) {
4615 /*
4616 * We only do up to the block where we can place our
4617 * tag for audits
4618 */
4619 break;
4620 }
4621 }
4622 /* Need to add a new block to chain */
4623 if (!set) {
4624 SCTP_MALLOC(twait_block, struct sctp_tagblock *,
4625 sizeof(struct sctp_tagblock), SCTP_M_TIMW);
4626 if (twait_block == NULL) {
4627 return;
4628 }
4629 memset(twait_block, 0, sizeof(struct sctp_tagblock));
4630 LIST_INSERT_HEAD(chain, twait_block, sctp_nxt_tagblock);
4631 sctp_set_vtag_block(twait_block->vtag_block, time, tag, lport, rport);
4632 }
4633 }
4634
4635 void
4636 sctp_clean_up_stream(struct sctp_tcb *stcb, struct sctp_readhead *rh)
4637 {
4638 struct sctp_tmit_chunk *chk, *nchk;
4639 struct sctp_queued_to_read *control, *ncontrol;
4640
4641 TAILQ_FOREACH_SAFE(control, rh, next_instrm, ncontrol) {
4642 TAILQ_REMOVE(rh, control, next_instrm);
4643 control->on_strm_q = 0;
4644 if (control->on_read_q == 0) {
4645 sctp_free_remote_addr(control->whoFrom);
4646 if (control->data) {
4647 sctp_m_freem(control->data);
4648 control->data = NULL;
4649 }
4650 }
4651 /* Reassembly free? */
4652 TAILQ_FOREACH_SAFE(chk, &control->reasm, sctp_next, nchk) {
4653 TAILQ_REMOVE(&control->reasm, chk, sctp_next);
4654 if (chk->data) {
4655 sctp_m_freem(chk->data);
4656 chk->data = NULL;
4657 }
4658 if (chk->holds_key_ref)
4659 sctp_auth_key_release(stcb, chk->auth_keyid, SCTP_SO_LOCKED);
4660 sctp_free_remote_addr(chk->whoTo);
4661 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_chunk), chk);
4662 SCTP_DECR_CHK_COUNT();
4663 /* sa_ignore FREED_MEMORY */
4664 }
4665 /*
4666 * We don't free the address here since all the net's were
4667 * freed above.
4668 */
4669 if (control->on_read_q == 0) {
4670 sctp_free_a_readq(stcb, control);
4671 }
4672 }
4673 }
4674
4675 /*-
4676 * Free the association after un-hashing the remote port. This
4677 * function ALWAYS returns holding NO LOCK on the stcb. It DOES
4678 * expect that the input to this function IS a locked TCB.
4679 * It will return 0, if it did NOT destroy the association (instead
4680 * it unlocks it. It will return NON-zero if it either destroyed the
4681 * association OR the association is already destroyed.
4682 */
4683 int
4684 sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int from_inpcbfree, int from_location)
4685 {
4686 int i;
4687 struct sctp_association *asoc;
4688 struct sctp_nets *net, *nnet;
4689 struct sctp_laddr *laddr, *naddr;
4690 struct sctp_tmit_chunk *chk, *nchk;
4691 struct sctp_asconf_addr *aparam, *naparam;
4692 struct sctp_asconf_ack *aack, *naack;
4693 struct sctp_stream_reset_list *strrst, *nstrrst;
4694 struct sctp_queued_to_read *sq, *nsq;
4695 struct sctp_stream_queue_pending *sp, *nsp;
4696 sctp_sharedkey_t *shared_key, *nshared_key;
4697 struct socket *so;
4698
4699 /* first, lets purge the entry from the hash table. */
4700 SCTP_TCB_LOCK_ASSERT(stcb);
4701
4702 #ifdef SCTP_LOG_CLOSING
4703 sctp_log_closing(inp, stcb, 6);
4704 #endif
4705 if (stcb->asoc.state == 0) {
4706 #ifdef SCTP_LOG_CLOSING
4707 sctp_log_closing(inp, NULL, 7);
4708 #endif
4709 /* there is no asoc, really TSNH :-0 */
4710 return (1);
4711 }
4712 if (stcb->asoc.alternate) {
4713 sctp_free_remote_addr(stcb->asoc.alternate);
4714 stcb->asoc.alternate = NULL;
4715 }
4716 /* TEMP CODE */
4717 if (stcb->freed_from_where == 0) {
4718 /* Only record the first place free happened from */
4719 stcb->freed_from_where = from_location;
4720 }
4721 /* TEMP CODE */
4722
4723 asoc = &stcb->asoc;
4724 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
4725 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE))
4726 /* nothing around */
4727 so = NULL;
4728 else
4729 so = inp->sctp_socket;
4730
4731 /*
4732 * We used timer based freeing if a reader or writer is in the way.
4733 * So we first check if we are actually being called from a timer,
4734 * if so we abort early if a reader or writer is still in the way.
4735 */
4736 if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) &&
4737 (from_inpcbfree == SCTP_NORMAL_PROC)) {
4738 /*
4739 * is it the timer driving us? if so are the reader/writers
4740 * gone?
4741 */
4742 if (stcb->asoc.refcnt) {
4743 /* nope, reader or writer in the way */
4744 sctp_timer_start(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL);
4745 /* no asoc destroyed */
4746 SCTP_TCB_UNLOCK(stcb);
4747 #ifdef SCTP_LOG_CLOSING
4748 sctp_log_closing(inp, stcb, 8);
4749 #endif
4750 return (0);
4751 }
4752 }
4753 /* Now clean up any other timers */
4754 sctp_stop_association_timers(stcb, false);
4755 /* Now the read queue needs to be cleaned up (only once) */
4756 if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0) {
4757 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_ABOUT_TO_BE_FREED);
4758 SCTP_INP_READ_LOCK(inp);
4759 TAILQ_FOREACH(sq, &inp->read_queue, next) {
4760 if (sq->stcb == stcb) {
4761 sq->do_not_ref_stcb = 1;
4762 sq->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
4763 /*
4764 * If there is no end, there never will be
4765 * now.
4766 */
4767 if (sq->end_added == 0) {
4768 /* Held for PD-API clear that. */
4769 sq->pdapi_aborted = 1;
4770 sq->held_length = 0;
4771 if (sctp_stcb_is_feature_on(inp, stcb, SCTP_PCB_FLAGS_PDAPIEVNT) && (so != NULL)) {
4772 /*
4773 * Need to add a PD-API
4774 * aborted indication.
4775 * Setting the control_pdapi
4776 * assures that it will be
4777 * added right after this
4778 * msg.
4779 */
4780 uint32_t strseq;
4781
4782 stcb->asoc.control_pdapi = sq;
4783 strseq = (sq->sinfo_stream << 16) | (sq->mid & 0x0000ffff);
4784 sctp_ulp_notify(SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION,
4785 stcb,
4786 SCTP_PARTIAL_DELIVERY_ABORTED,
4787 (void *)&strseq,
4788 SCTP_SO_LOCKED);
4789 stcb->asoc.control_pdapi = NULL;
4790 }
4791 }
4792 /* Add an end to wake them */
4793 sq->end_added = 1;
4794 }
4795 }
4796 SCTP_INP_READ_UNLOCK(inp);
4797 if (stcb->block_entry) {
4798 SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_PCB, ECONNRESET);
4799 stcb->block_entry->error = ECONNRESET;
4800 stcb->block_entry = NULL;
4801 }
4802 }
4803 if ((stcb->asoc.refcnt) || (stcb->asoc.state & SCTP_STATE_IN_ACCEPT_QUEUE)) {
4804 /*
4805 * Someone holds a reference OR the socket is unaccepted
4806 * yet.
4807 */
4808 if ((stcb->asoc.refcnt) ||
4809 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
4810 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
4811 SCTP_CLEAR_SUBSTATE(stcb, SCTP_STATE_IN_ACCEPT_QUEUE);
4812 sctp_timer_start(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL);
4813 }
4814 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
4815 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE))
4816 /* nothing around */
4817 so = NULL;
4818 if (so) {
4819 /* Wake any reader/writers */
4820 sctp_sorwakeup(inp, so);
4821 sctp_sowwakeup(inp, so);
4822 }
4823 SCTP_TCB_UNLOCK(stcb);
4824
4825 #ifdef SCTP_LOG_CLOSING
4826 sctp_log_closing(inp, stcb, 9);
4827 #endif
4828 /* no asoc destroyed */
4829 return (0);
4830 }
4831 #ifdef SCTP_LOG_CLOSING
4832 sctp_log_closing(inp, stcb, 10);
4833 #endif
4834 /*
4835 * When I reach here, no others want to kill the assoc yet.. and I
4836 * own the lock. Now its possible an abort comes in when I do the
4837 * lock exchange below to grab all the locks to do the final take
4838 * out. to prevent this we increment the count, which will start a
4839 * timer and blow out above thus assuring us that we hold exclusive
4840 * killing of the asoc. Note that after getting back the TCB lock we
4841 * will go ahead and increment the counter back up and stop any
4842 * timer a passing stranger may have started :-S
4843 */
4844 if (from_inpcbfree == SCTP_NORMAL_PROC) {
4845 atomic_add_int(&stcb->asoc.refcnt, 1);
4846
4847 SCTP_TCB_UNLOCK(stcb);
4848 SCTP_INP_INFO_WLOCK();
4849 SCTP_INP_WLOCK(inp);
4850 SCTP_TCB_LOCK(stcb);
4851 }
4852 /* Double check the GONE flag */
4853 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
4854 (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE))
4855 /* nothing around */
4856 so = NULL;
4857
4858 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
4859 (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
4860 /*
4861 * For TCP type we need special handling when we are
4862 * connected. We also include the peel'ed off ones to.
4863 */
4864 if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
4865 inp->sctp_flags &= ~SCTP_PCB_FLAGS_CONNECTED;
4866 inp->sctp_flags |= SCTP_PCB_FLAGS_WAS_CONNECTED;
4867 if (so) {
4868 SOCKBUF_LOCK(&so->so_rcv);
4869 so->so_state &= ~(SS_ISCONNECTING |
4870 SS_ISDISCONNECTING |
4871 SS_ISCONFIRMING |
4872 SS_ISCONNECTED);
4873 so->so_state |= SS_ISDISCONNECTED;
4874 socantrcvmore_locked(so);
4875 socantsendmore(so);
4876 sctp_sowwakeup(inp, so);
4877 sctp_sorwakeup(inp, so);
4878 SCTP_SOWAKEUP(so);
4879 }
4880 }
4881 }
4882
4883 /*
4884 * Make it invalid too, that way if its about to run it will abort
4885 * and return.
4886 */
4887 /* re-increment the lock */
4888 if (from_inpcbfree == SCTP_NORMAL_PROC) {
4889 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4890 }
4891 if (stcb->asoc.refcnt) {
4892 SCTP_CLEAR_SUBSTATE(stcb, SCTP_STATE_IN_ACCEPT_QUEUE);
4893 sctp_timer_start(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL);
4894 if (from_inpcbfree == SCTP_NORMAL_PROC) {
4895 SCTP_INP_INFO_WUNLOCK();
4896 SCTP_INP_WUNLOCK(inp);
4897 }
4898 SCTP_TCB_UNLOCK(stcb);
4899 return (0);
4900 }
4901 asoc->state = 0;
4902 if (inp->sctp_tcbhash) {
4903 LIST_REMOVE(stcb, sctp_tcbhash);
4904 }
4905 if (stcb->asoc.in_asocid_hash) {
4906 LIST_REMOVE(stcb, sctp_tcbasocidhash);
4907 }
4908 if (inp->sctp_socket == NULL) {
4909 stcb->sctp_socket = NULL;
4910 }
4911 /* Now lets remove it from the list of ALL associations in the EP */
4912 LIST_REMOVE(stcb, sctp_tcblist);
4913 if (from_inpcbfree == SCTP_NORMAL_PROC) {
4914 SCTP_INP_INCR_REF(inp);
4915 SCTP_INP_WUNLOCK(inp);
4916 }
4917 /* pull from vtag hash */
4918 LIST_REMOVE(stcb, sctp_asocs);
4919 sctp_add_vtag_to_timewait(asoc->my_vtag, inp->sctp_lport, stcb->rport);
4920
4921 /*
4922 * Now restop the timers to be sure this is paranoia at is finest!
4923 */
4924 sctp_stop_association_timers(stcb, true);
4925
4926 /*
4927 * The chunk lists and such SHOULD be empty but we check them just
4928 * in case.
4929 */
4930 /* anything on the wheel needs to be removed */
4931 for (i = 0; i < asoc->streamoutcnt; i++) {
4932 struct sctp_stream_out *outs;
4933
4934 outs = &asoc->strmout[i];
4935 /* now clean up any chunks here */
4936 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
4937 atomic_subtract_int(&asoc->stream_queue_cnt, 1);
4938 TAILQ_REMOVE(&outs->outqueue, sp, next);
4939 stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp);
4940 sctp_free_spbufspace(stcb, asoc, sp);
4941 if (sp->data) {
4942 if (so) {
4943 /* Still an open socket - report */
4944 sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, stcb,
4945 0, (void *)sp, SCTP_SO_LOCKED);
4946 }
4947 if (sp->data) {
4948 sctp_m_freem(sp->data);
4949 sp->data = NULL;
4950 sp->tail_mbuf = NULL;
4951 sp->length = 0;
4952 }
4953 }
4954 if (sp->net) {
4955 sctp_free_remote_addr(sp->net);
4956 sp->net = NULL;
4957 }
4958 sctp_free_a_strmoq(stcb, sp, SCTP_SO_LOCKED);
4959 }
4960 }
4961 /* sa_ignore FREED_MEMORY */
4962 TAILQ_FOREACH_SAFE(strrst, &asoc->resetHead, next_resp, nstrrst) {
4963 TAILQ_REMOVE(&asoc->resetHead, strrst, next_resp);
4964 SCTP_FREE(strrst, SCTP_M_STRESET);
4965 }
4966 TAILQ_FOREACH_SAFE(sq, &asoc->pending_reply_queue, next, nsq) {
4967 TAILQ_REMOVE(&asoc->pending_reply_queue, sq, next);
4968 if (sq->data) {
4969 sctp_m_freem(sq->data);
4970 sq->data = NULL;
4971 }
4972 sctp_free_remote_addr(sq->whoFrom);
4973 sq->whoFrom = NULL;
4974 sq->stcb = NULL;
4975 /* Free the ctl entry */
4976 sctp_free_a_readq(stcb, sq);
4977 /* sa_ignore FREED_MEMORY */
4978 }
4979 TAILQ_FOREACH_SAFE(chk, &asoc->free_chunks, sctp_next, nchk) {
4980 TAILQ_REMOVE(&asoc->free_chunks, chk, sctp_next);
4981 if (chk->data) {
4982 sctp_m_freem(chk->data);
4983 chk->data = NULL;
4984 }
4985 if (chk->holds_key_ref)
4986 sctp_auth_key_release(stcb, chk->auth_keyid, SCTP_SO_LOCKED);
4987 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_chunk), chk);
4988 SCTP_DECR_CHK_COUNT();
4989 atomic_subtract_int(&SCTP_BASE_INFO(ipi_free_chunks), 1);
4990 asoc->free_chunk_cnt--;
4991 /* sa_ignore FREED_MEMORY */
4992 }
4993 /* pending send queue SHOULD be empty */
4994 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
4995 if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
4996 asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
4997 #ifdef INVARIANTS
4998 } else {
4999 panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
5000 #endif
5001 }
5002 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
5003 if (chk->data) {
5004 if (so) {
5005 /* Still a socket? */
5006 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb,
5007 0, chk, SCTP_SO_LOCKED);
5008 }
5009 if (chk->data) {
5010 sctp_m_freem(chk->data);
5011 chk->data = NULL;
5012 }
5013 }
5014 if (chk->holds_key_ref)
5015 sctp_auth_key_release(stcb, chk->auth_keyid, SCTP_SO_LOCKED);
5016 if (chk->whoTo) {
5017 sctp_free_remote_addr(chk->whoTo);
5018 chk->whoTo = NULL;
5019 }
5020 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_chunk), chk);
5021 SCTP_DECR_CHK_COUNT();
5022 /* sa_ignore FREED_MEMORY */
5023 }
5024 /* sent queue SHOULD be empty */
5025 TAILQ_FOREACH_SAFE(chk, &asoc->sent_queue, sctp_next, nchk) {
5026 if (chk->sent != SCTP_DATAGRAM_NR_ACKED) {
5027 if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
5028 asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
5029 #ifdef INVARIANTS
5030 } else {
5031 panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
5032 #endif
5033 }
5034 }
5035 TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
5036 if (chk->data) {
5037 if (so) {
5038 /* Still a socket? */
5039 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb,
5040 0, chk, SCTP_SO_LOCKED);
5041 }
5042 if (chk->data) {
5043 sctp_m_freem(chk->data);
5044 chk->data = NULL;
5045 }
5046 }
5047 if (chk->holds_key_ref)
5048 sctp_auth_key_release(stcb, chk->auth_keyid, SCTP_SO_LOCKED);
5049 sctp_free_remote_addr(chk->whoTo);
5050 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_chunk), chk);
5051 SCTP_DECR_CHK_COUNT();
5052 /* sa_ignore FREED_MEMORY */
5053 }
5054 #ifdef INVARIANTS
5055 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
5056 if (stcb->asoc.strmout[i].chunks_on_queues > 0) {
5057 panic("%u chunks left for stream %u.", stcb->asoc.strmout[i].chunks_on_queues, i);
5058 }
5059 }
5060 #endif
5061 /* control queue MAY not be empty */
5062 TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) {
5063 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
5064 if (chk->data) {
5065 sctp_m_freem(chk->data);
5066 chk->data = NULL;
5067 }
5068 if (chk->holds_key_ref)
5069 sctp_auth_key_release(stcb, chk->auth_keyid, SCTP_SO_LOCKED);
5070 sctp_free_remote_addr(chk->whoTo);
5071 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_chunk), chk);
5072 SCTP_DECR_CHK_COUNT();
5073 /* sa_ignore FREED_MEMORY */
5074 }
5075 /* ASCONF queue MAY not be empty */
5076 TAILQ_FOREACH_SAFE(chk, &asoc->asconf_send_queue, sctp_next, nchk) {
5077 TAILQ_REMOVE(&asoc->asconf_send_queue, chk, sctp_next);
5078 if (chk->data) {
5079 sctp_m_freem(chk->data);
5080 chk->data = NULL;
5081 }
5082 if (chk->holds_key_ref)
5083 sctp_auth_key_release(stcb, chk->auth_keyid, SCTP_SO_LOCKED);
5084 sctp_free_remote_addr(chk->whoTo);
5085 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_chunk), chk);
5086 SCTP_DECR_CHK_COUNT();
5087 /* sa_ignore FREED_MEMORY */
5088 }
5089 if (asoc->mapping_array) {
5090 SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
5091 asoc->mapping_array = NULL;
5092 }
5093 if (asoc->nr_mapping_array) {
5094 SCTP_FREE(asoc->nr_mapping_array, SCTP_M_MAP);
5095 asoc->nr_mapping_array = NULL;
5096 }
5097 /* the stream outs */
5098 if (asoc->strmout) {
5099 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
5100 asoc->strmout = NULL;
5101 }
5102 asoc->strm_realoutsize = asoc->streamoutcnt = 0;
5103 if (asoc->strmin) {
5104 for (i = 0; i < asoc->streamincnt; i++) {
5105 sctp_clean_up_stream(stcb, &asoc->strmin[i].inqueue);
5106 sctp_clean_up_stream(stcb, &asoc->strmin[i].uno_inqueue);
5107 }
5108 SCTP_FREE(asoc->strmin, SCTP_M_STRMI);
5109 asoc->strmin = NULL;
5110 }
5111 asoc->streamincnt = 0;
5112 TAILQ_FOREACH_SAFE(net, &asoc->nets, sctp_next, nnet) {
5113 #ifdef INVARIANTS
5114 if (SCTP_BASE_INFO(ipi_count_raddr) == 0) {
5115 panic("no net's left alloc'ed, or list points to itself");
5116 }
5117 #endif
5118 TAILQ_REMOVE(&asoc->nets, net, sctp_next);
5119 sctp_free_remote_addr(net);
5120 }
5121 LIST_FOREACH_SAFE(laddr, &asoc->sctp_restricted_addrs, sctp_nxt_addr, naddr) {
5122 /* sa_ignore FREED_MEMORY */
5123 sctp_remove_laddr(laddr);
5124 }
5125
5126 /* pending asconf (address) parameters */
5127 TAILQ_FOREACH_SAFE(aparam, &asoc->asconf_queue, next, naparam) {
5128 /* sa_ignore FREED_MEMORY */
5129 TAILQ_REMOVE(&asoc->asconf_queue, aparam, next);
5130 SCTP_FREE(aparam, SCTP_M_ASC_ADDR);
5131 }
5132 TAILQ_FOREACH_SAFE(aack, &asoc->asconf_ack_sent, next, naack) {
5133 /* sa_ignore FREED_MEMORY */
5134 TAILQ_REMOVE(&asoc->asconf_ack_sent, aack, next);
5135 if (aack->data != NULL) {
5136 sctp_m_freem(aack->data);
5137 }
5138 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asconf_ack), aack);
5139 }
5140 /* clean up auth stuff */
5141 if (asoc->local_hmacs)
5142 sctp_free_hmaclist(asoc->local_hmacs);
5143 if (asoc->peer_hmacs)
5144 sctp_free_hmaclist(asoc->peer_hmacs);
5145
5146 if (asoc->local_auth_chunks)
5147 sctp_free_chunklist(asoc->local_auth_chunks);
5148 if (asoc->peer_auth_chunks)
5149 sctp_free_chunklist(asoc->peer_auth_chunks);
5150
5151 sctp_free_authinfo(&asoc->authinfo);
5152
5153 LIST_FOREACH_SAFE(shared_key, &asoc->shared_keys, next, nshared_key) {
5154 LIST_REMOVE(shared_key, next);
5155 sctp_free_sharedkey(shared_key);
5156 /* sa_ignore FREED_MEMORY */
5157 }
5158
5159 /* Insert new items here :> */
5160
5161 /* Get rid of LOCK */
5162 SCTP_TCB_UNLOCK(stcb);
5163 SCTP_TCB_LOCK_DESTROY(stcb);
5164 if (from_inpcbfree == SCTP_NORMAL_PROC) {
5165 SCTP_INP_INFO_WUNLOCK();
5166 SCTP_INP_RLOCK(inp);
5167 }
5168 #ifdef SCTP_TRACK_FREED_ASOCS
5169 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5170 /* now clean up the tasoc itself */
5171 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asoc), stcb);
5172 SCTP_DECR_ASOC_COUNT();
5173 } else {
5174 LIST_INSERT_HEAD(&inp->sctp_asoc_free_list, stcb, sctp_tcblist);
5175 }
5176 #else
5177 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asoc), stcb);
5178 SCTP_DECR_ASOC_COUNT();
5179 #endif
5180 if (from_inpcbfree == SCTP_NORMAL_PROC) {
5181 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5182 /*
5183 * If its NOT the inp_free calling us AND sctp_close
5184 * as been called, we call back...
5185 */
5186 SCTP_INP_RUNLOCK(inp);
5187 /*
5188 * This will start the kill timer (if we are the
5189 * last one) since we hold an increment yet. But
5190 * this is the only safe way to do this since
5191 * otherwise if the socket closes at the same time
5192 * we are here we might collide in the cleanup.
5193 */
5194 sctp_inpcb_free(inp,
5195 SCTP_FREE_SHOULD_USE_GRACEFUL_CLOSE,
5196 SCTP_CALLED_DIRECTLY_NOCMPSET);
5197 SCTP_INP_DECR_REF(inp);
5198 } else {
5199 /* The socket is still open. */
5200 SCTP_INP_DECR_REF(inp);
5201 SCTP_INP_RUNLOCK(inp);
5202 }
5203 }
5204 /* destroyed the asoc */
5205 #ifdef SCTP_LOG_CLOSING
5206 sctp_log_closing(inp, NULL, 11);
5207 #endif
5208 return (1);
5209 }
5210
5211 /*
5212 * determine if a destination is "reachable" based upon the addresses bound
5213 * to the current endpoint (e.g. only v4 or v6 currently bound)
5214 */
5215 /*
5216 * FIX: if we allow assoc-level bindx(), then this needs to be fixed to use
5217 * assoc level v4/v6 flags, as the assoc *may* not have the same address
5218 * types bound as its endpoint
5219 */
5220 int
5221 sctp_destination_is_reachable(struct sctp_tcb *stcb, struct sockaddr *destaddr)
5222 {
5223 struct sctp_inpcb *inp;
5224 int answer;
5225
5226 /*
5227 * No locks here, the TCB, in all cases is already locked and an
5228 * assoc is up. There is either a INP lock by the caller applied (in
5229 * asconf case when deleting an address) or NOT in the HB case,
5230 * however if HB then the INP increment is up and the INP will not
5231 * be removed (on top of the fact that we have a TCB lock). So we
5232 * only want to read the sctp_flags, which is either bound-all or
5233 * not.. no protection needed since once an assoc is up you can't be
5234 * changing your binding.
5235 */
5236 inp = stcb->sctp_ep;
5237 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
5238 /* if bound all, destination is not restricted */
5239 /*
5240 * RRS: Question during lock work: Is this correct? If you
5241 * are bound-all you still might need to obey the V4--V6
5242 * flags??? IMO this bound-all stuff needs to be removed!
5243 */
5244 return (1);
5245 }
5246 /* NOTE: all "scope" checks are done when local addresses are added */
5247 switch (destaddr->sa_family) {
5248 #ifdef INET6
5249 case AF_INET6:
5250 answer = inp->ip_inp.inp.inp_vflag & INP_IPV6;
5251 break;
5252 #endif
5253 #ifdef INET
5254 case AF_INET:
5255 answer = inp->ip_inp.inp.inp_vflag & INP_IPV4;
5256 break;
5257 #endif
5258 default:
5259 /* invalid family, so it's unreachable */
5260 answer = 0;
5261 break;
5262 }
5263 return (answer);
5264 }
5265
5266 /*
5267 * update the inp_vflags on an endpoint
5268 */
5269 static void
5270 sctp_update_ep_vflag(struct sctp_inpcb *inp)
5271 {
5272 struct sctp_laddr *laddr;
5273
5274 /* first clear the flag */
5275 inp->ip_inp.inp.inp_vflag = 0;
5276 /* set the flag based on addresses on the ep list */
5277 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
5278 if (laddr->ifa == NULL) {
5279 SCTPDBG(SCTP_DEBUG_PCB1, "%s: NULL ifa\n",
5280 __func__);
5281 continue;
5282 }
5283
5284 if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) {
5285 continue;
5286 }
5287 switch (laddr->ifa->address.sa.sa_family) {
5288 #ifdef INET6
5289 case AF_INET6:
5290 inp->ip_inp.inp.inp_vflag |= INP_IPV6;
5291 break;
5292 #endif
5293 #ifdef INET
5294 case AF_INET:
5295 inp->ip_inp.inp.inp_vflag |= INP_IPV4;
5296 break;
5297 #endif
5298 default:
5299 break;
5300 }
5301 }
5302 }
5303
5304 /*
5305 * Add the address to the endpoint local address list There is nothing to be
5306 * done if we are bound to all addresses
5307 */
5308 void
5309 sctp_add_local_addr_ep(struct sctp_inpcb *inp, struct sctp_ifa *ifa, uint32_t action)
5310 {
5311 struct sctp_laddr *laddr;
5312 struct sctp_tcb *stcb;
5313 int fnd, error = 0;
5314
5315 fnd = 0;
5316
5317 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
5318 /* You are already bound to all. You have it already */
5319 return;
5320 }
5321 #ifdef INET6
5322 if (ifa->address.sa.sa_family == AF_INET6) {
5323 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
5324 /* Can't bind a non-useable addr. */
5325 return;
5326 }
5327 }
5328 #endif
5329 /* first, is it already present? */
5330 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
5331 if (laddr->ifa == ifa) {
5332 fnd = 1;
5333 break;
5334 }
5335 }
5336
5337 if (fnd == 0) {
5338 /* Not in the ep list */
5339 error = sctp_insert_laddr(&inp->sctp_addr_list, ifa, action);
5340 if (error != 0)
5341 return;
5342 inp->laddr_count++;
5343 /* update inp_vflag flags */
5344 switch (ifa->address.sa.sa_family) {
5345 #ifdef INET6
5346 case AF_INET6:
5347 inp->ip_inp.inp.inp_vflag |= INP_IPV6;
5348 break;
5349 #endif
5350 #ifdef INET
5351 case AF_INET:
5352 inp->ip_inp.inp.inp_vflag |= INP_IPV4;
5353 break;
5354 #endif
5355 default:
5356 break;
5357 }
5358 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
5359 sctp_add_local_addr_restricted(stcb, ifa);
5360 }
5361 }
5362 return;
5363 }
5364
5365 /*
5366 * select a new (hopefully reachable) destination net (should only be used
5367 * when we deleted an ep addr that is the only usable source address to reach
5368 * the destination net)
5369 */
5370 static void
5371 sctp_select_primary_destination(struct sctp_tcb *stcb)
5372 {
5373 struct sctp_nets *net;
5374
5375 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
5376 /* for now, we'll just pick the first reachable one we find */
5377 if (net->dest_state & SCTP_ADDR_UNCONFIRMED)
5378 continue;
5379 if (sctp_destination_is_reachable(stcb,
5380 (struct sockaddr *)&net->ro._l_addr)) {
5381 /* found a reachable destination */
5382 stcb->asoc.primary_destination = net;
5383 }
5384 }
5385 /* I can't there from here! ...we're gonna die shortly... */
5386 }
5387
5388 /*
5389 * Delete the address from the endpoint local address list. There is nothing
5390 * to be done if we are bound to all addresses
5391 */
5392 void
5393 sctp_del_local_addr_ep(struct sctp_inpcb *inp, struct sctp_ifa *ifa)
5394 {
5395 struct sctp_laddr *laddr;
5396 int fnd;
5397
5398 fnd = 0;
5399 if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
5400 /* You are already bound to all. You have it already */
5401 return;
5402 }
5403 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
5404 if (laddr->ifa == ifa) {
5405 fnd = 1;
5406 break;
5407 }
5408 }
5409 if (fnd && (inp->laddr_count < 2)) {
5410 /* can't delete unless there are at LEAST 2 addresses */
5411 return;
5412 }
5413 if (fnd) {
5414 /*
5415 * clean up any use of this address go through our
5416 * associations and clear any last_used_address that match
5417 * this one for each assoc, see if a new primary_destination
5418 * is needed
5419 */
5420 struct sctp_tcb *stcb;
5421
5422 /* clean up "next_addr_touse" */
5423 if (inp->next_addr_touse == laddr)
5424 /* delete this address */
5425 inp->next_addr_touse = NULL;
5426
5427 /* clean up "last_used_address" */
5428 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
5429 struct sctp_nets *net;
5430
5431 SCTP_TCB_LOCK(stcb);
5432 if (stcb->asoc.last_used_address == laddr)
5433 /* delete this address */
5434 stcb->asoc.last_used_address = NULL;
5435 /*
5436 * Now spin through all the nets and purge any ref
5437 * to laddr
5438 */
5439 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
5440 if (net->ro._s_addr == laddr->ifa) {
5441 /* Yep, purge src address selected */
5442 RO_NHFREE(&net->ro);
5443 sctp_free_ifa(net->ro._s_addr);
5444 net->ro._s_addr = NULL;
5445 net->src_addr_selected = 0;
5446 }
5447 }
5448 SCTP_TCB_UNLOCK(stcb);
5449 } /* for each tcb */
5450 /* remove it from the ep list */
5451 sctp_remove_laddr(laddr);
5452 inp->laddr_count--;
5453 /* update inp_vflag flags */
5454 sctp_update_ep_vflag(inp);
5455 }
5456 return;
5457 }
5458
5459 /*
5460 * Add the address to the TCB local address restricted list.
5461 * This is a "pending" address list (eg. addresses waiting for an
5462 * ASCONF-ACK response) and cannot be used as a valid source address.
5463 */
5464 void
5465 sctp_add_local_addr_restricted(struct sctp_tcb *stcb, struct sctp_ifa *ifa)
5466 {
5467 struct sctp_laddr *laddr;
5468 struct sctpladdr *list;
5469
5470 /*
5471 * Assumes TCB is locked.. and possibly the INP. May need to
5472 * confirm/fix that if we need it and is not the case.
5473 */
5474 list = &stcb->asoc.sctp_restricted_addrs;
5475
5476 #ifdef INET6
5477 if (ifa->address.sa.sa_family == AF_INET6) {
5478 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
5479 /* Can't bind a non-existent addr. */
5480 return;
5481 }
5482 }
5483 #endif
5484 /* does the address already exist? */
5485 LIST_FOREACH(laddr, list, sctp_nxt_addr) {
5486 if (laddr->ifa == ifa) {
5487 return;
5488 }
5489 }
5490
5491 /* add to the list */
5492 (void)sctp_insert_laddr(list, ifa, 0);
5493 return;
5494 }
5495
5496 /*
5497 * Remove a local address from the TCB local address restricted list
5498 */
5499 void
5500 sctp_del_local_addr_restricted(struct sctp_tcb *stcb, struct sctp_ifa *ifa)
5501 {
5502 struct sctp_inpcb *inp;
5503 struct sctp_laddr *laddr;
5504
5505 /*
5506 * This is called by asconf work. It is assumed that a) The TCB is
5507 * locked and b) The INP is locked. This is true in as much as I can
5508 * trace through the entry asconf code where I did these locks.
5509 * Again, the ASCONF code is a bit different in that it does lock
5510 * the INP during its work often times. This must be since we don't
5511 * want other proc's looking up things while what they are looking
5512 * up is changing :-D
5513 */
5514
5515 inp = stcb->sctp_ep;
5516 /* if subset bound and don't allow ASCONF's, can't delete last */
5517 if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) &&
5518 sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
5519 if (stcb->sctp_ep->laddr_count < 2) {
5520 /* can't delete last address */
5521 return;
5522 }
5523 }
5524 LIST_FOREACH(laddr, &stcb->asoc.sctp_restricted_addrs, sctp_nxt_addr) {
5525 /* remove the address if it exists */
5526 if (laddr->ifa == NULL)
5527 continue;
5528 if (laddr->ifa == ifa) {
5529 sctp_remove_laddr(laddr);
5530 return;
5531 }
5532 }
5533
5534 /* address not found! */
5535 return;
5536 }
5537
5538 /* sysctl */
5539 static int sctp_max_number_of_assoc = SCTP_MAX_NUM_OF_ASOC;
5540 static int sctp_scale_up_for_address = SCTP_SCALE_FOR_ADDR;
5541
5542 #if defined(SCTP_MCORE_INPUT) && defined(SMP)
5543 struct sctp_mcore_ctrl *sctp_mcore_workers = NULL;
5544 int *sctp_cpuarry = NULL;
5545
5546 void
5547 sctp_queue_to_mcore(struct mbuf *m, int off, int cpu_to_use)
5548 {
5549 /* Queue a packet to a processor for the specified core */
5550 struct sctp_mcore_queue *qent;
5551 struct sctp_mcore_ctrl *wkq;
5552 int need_wake = 0;
5553
5554 if (sctp_mcore_workers == NULL) {
5555 /* Something went way bad during setup */
5556 sctp_input_with_port(m, off, 0);
5557 return;
5558 }
5559 SCTP_MALLOC(qent, struct sctp_mcore_queue *,
5560 (sizeof(struct sctp_mcore_queue)),
5561 SCTP_M_MCORE);
5562 if (qent == NULL) {
5563 /* This is trouble */
5564 sctp_input_with_port(m, off, 0);
5565 return;
5566 }
5567 qent->vn = curvnet;
5568 qent->m = m;
5569 qent->off = off;
5570 qent->v6 = 0;
5571 wkq = &sctp_mcore_workers[cpu_to_use];
5572 SCTP_MCORE_QLOCK(wkq);
5573
5574 TAILQ_INSERT_TAIL(&wkq->que, qent, next);
5575 if (wkq->running == 0) {
5576 need_wake = 1;
5577 }
5578 SCTP_MCORE_QUNLOCK(wkq);
5579 if (need_wake) {
5580 wakeup(&wkq->running);
5581 }
5582 }
5583
5584 static void
5585 sctp_mcore_thread(void *arg)
5586 {
5587
5588 struct sctp_mcore_ctrl *wkq;
5589 struct sctp_mcore_queue *qent;
5590
5591 wkq = (struct sctp_mcore_ctrl *)arg;
5592 struct mbuf *m;
5593 int off, v6;
5594
5595 /* Wait for first tickle */
5596 SCTP_MCORE_LOCK(wkq);
5597 wkq->running = 0;
5598 msleep(&wkq->running,
5599 &wkq->core_mtx,
5600 0, "wait for pkt", 0);
5601 SCTP_MCORE_UNLOCK(wkq);
5602
5603 /* Bind to our cpu */
5604 thread_lock(curthread);
5605 sched_bind(curthread, wkq->cpuid);
5606 thread_unlock(curthread);
5607
5608 /* Now lets start working */
5609 SCTP_MCORE_LOCK(wkq);
5610 /* Now grab lock and go */
5611 for (;;) {
5612 SCTP_MCORE_QLOCK(wkq);
5613 skip_sleep:
5614 wkq->running = 1;
5615 qent = TAILQ_FIRST(&wkq->que);
5616 if (qent) {
5617 TAILQ_REMOVE(&wkq->que, qent, next);
5618 SCTP_MCORE_QUNLOCK(wkq);
5619 CURVNET_SET(qent->vn);
5620 m = qent->m;
5621 off = qent->off;
5622 v6 = qent->v6;
5623 SCTP_FREE(qent, SCTP_M_MCORE);
5624 if (v6 == 0) {
5625 sctp_input_with_port(m, off, 0);
5626 } else {
5627 SCTP_PRINTF("V6 not yet supported\n");
5628 sctp_m_freem(m);
5629 }
5630 CURVNET_RESTORE();
5631 SCTP_MCORE_QLOCK(wkq);
5632 }
5633 wkq->running = 0;
5634 if (!TAILQ_EMPTY(&wkq->que)) {
5635 goto skip_sleep;
5636 }
5637 SCTP_MCORE_QUNLOCK(wkq);
5638 msleep(&wkq->running,
5639 &wkq->core_mtx,
5640 0, "wait for pkt", 0);
5641 }
5642 }
5643
5644 static void
5645 sctp_startup_mcore_threads(void)
5646 {
5647 int i, cpu;
5648
5649 if (mp_ncpus == 1)
5650 return;
5651
5652 if (sctp_mcore_workers != NULL) {
5653 /*
5654 * Already been here in some previous vnet?
5655 */
5656 return;
5657 }
5658 SCTP_MALLOC(sctp_mcore_workers, struct sctp_mcore_ctrl *,
5659 ((mp_maxid + 1) * sizeof(struct sctp_mcore_ctrl)),
5660 SCTP_M_MCORE);
5661 if (sctp_mcore_workers == NULL) {
5662 /* TSNH I hope */
5663 return;
5664 }
5665 memset(sctp_mcore_workers, 0, ((mp_maxid + 1) *
5666 sizeof(struct sctp_mcore_ctrl)));
5667 /* Init the structures */
5668 for (i = 0; i <= mp_maxid; i++) {
5669 TAILQ_INIT(&sctp_mcore_workers[i].que);
5670 SCTP_MCORE_LOCK_INIT(&sctp_mcore_workers[i]);
5671 SCTP_MCORE_QLOCK_INIT(&sctp_mcore_workers[i]);
5672 sctp_mcore_workers[i].cpuid = i;
5673 }
5674 if (sctp_cpuarry == NULL) {
5675 SCTP_MALLOC(sctp_cpuarry, int *,
5676 (mp_ncpus * sizeof(int)),
5677 SCTP_M_MCORE);
5678 i = 0;
5679 CPU_FOREACH(cpu) {
5680 sctp_cpuarry[i] = cpu;
5681 i++;
5682 }
5683 }
5684 /* Now start them all */
5685 CPU_FOREACH(cpu) {
5686 (void)kproc_create(sctp_mcore_thread,
5687 (void *)&sctp_mcore_workers[cpu],
5688 &sctp_mcore_workers[cpu].thread_proc,
5689 0,
5690 SCTP_KTHREAD_PAGES,
5691 SCTP_MCORE_NAME);
5692 }
5693 }
5694 #endif
5695
5696 void
5697 sctp_pcb_init(void)
5698 {
5699 /*
5700 * SCTP initialization for the PCB structures should be called by
5701 * the sctp_init() function.
5702 */
5703 int i;
5704 struct timeval tv;
5705
5706 if (SCTP_BASE_VAR(sctp_pcb_initialized) != 0) {
5707 /* error I was called twice */
5708 return;
5709 }
5710 SCTP_BASE_VAR(sctp_pcb_initialized) = 1;
5711
5712 #if defined(SCTP_LOCAL_TRACE_BUF)
5713 memset(&SCTP_BASE_SYSCTL(sctp_log), 0, sizeof(struct sctp_log));
5714 #endif
5715 #if defined(SMP) && defined(SCTP_USE_PERCPU_STAT)
5716 SCTP_MALLOC(SCTP_BASE_STATS, struct sctpstat *,
5717 ((mp_maxid + 1) * sizeof(struct sctpstat)),
5718 SCTP_M_MCORE);
5719 #endif
5720 (void)SCTP_GETTIME_TIMEVAL(&tv);
5721 #if defined(SMP) && defined(SCTP_USE_PERCPU_STAT)
5722 memset(SCTP_BASE_STATS, 0, sizeof(struct sctpstat) * (mp_maxid + 1));
5723 SCTP_BASE_STATS[PCPU_GET(cpuid)].sctps_discontinuitytime.tv_sec = (uint32_t)tv.tv_sec;
5724 SCTP_BASE_STATS[PCPU_GET(cpuid)].sctps_discontinuitytime.tv_usec = (uint32_t)tv.tv_usec;
5725 #else
5726 memset(&SCTP_BASE_STATS, 0, sizeof(struct sctpstat));
5727 SCTP_BASE_STAT(sctps_discontinuitytime).tv_sec = (uint32_t)tv.tv_sec;
5728 SCTP_BASE_STAT(sctps_discontinuitytime).tv_usec = (uint32_t)tv.tv_usec;
5729 #endif
5730 /* init the empty list of (All) Endpoints */
5731 LIST_INIT(&SCTP_BASE_INFO(listhead));
5732
5733 /* init the hash table of endpoints */
5734 TUNABLE_INT_FETCH("net.inet.sctp.tcbhashsize", &SCTP_BASE_SYSCTL(sctp_hashtblsize));
5735 TUNABLE_INT_FETCH("net.inet.sctp.pcbhashsize", &SCTP_BASE_SYSCTL(sctp_pcbtblsize));
5736 TUNABLE_INT_FETCH("net.inet.sctp.chunkscale", &SCTP_BASE_SYSCTL(sctp_chunkscale));
5737 SCTP_BASE_INFO(sctp_asochash) = SCTP_HASH_INIT((SCTP_BASE_SYSCTL(sctp_hashtblsize) * 31),
5738 &SCTP_BASE_INFO(hashasocmark));
5739 SCTP_BASE_INFO(sctp_ephash) = SCTP_HASH_INIT(SCTP_BASE_SYSCTL(sctp_hashtblsize),
5740 &SCTP_BASE_INFO(hashmark));
5741 SCTP_BASE_INFO(sctp_tcpephash) = SCTP_HASH_INIT(SCTP_BASE_SYSCTL(sctp_hashtblsize),
5742 &SCTP_BASE_INFO(hashtcpmark));
5743 SCTP_BASE_INFO(hashtblsize) = SCTP_BASE_SYSCTL(sctp_hashtblsize);
5744 SCTP_BASE_INFO(sctp_vrfhash) = SCTP_HASH_INIT(SCTP_SIZE_OF_VRF_HASH,
5745 &SCTP_BASE_INFO(hashvrfmark));
5746
5747 SCTP_BASE_INFO(vrf_ifn_hash) = SCTP_HASH_INIT(SCTP_VRF_IFN_HASH_SIZE,
5748 &SCTP_BASE_INFO(vrf_ifn_hashmark));
5749 /* init the zones */
5750 /*
5751 * FIX ME: Should check for NULL returns, but if it does fail we are
5752 * doomed to panic anyways... add later maybe.
5753 */
5754 SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_ep), "sctp_ep",
5755 sizeof(struct sctp_inpcb), maxsockets);
5756
5757 SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_asoc), "sctp_asoc",
5758 sizeof(struct sctp_tcb), sctp_max_number_of_assoc);
5759
5760 SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_laddr), "sctp_laddr",
5761 sizeof(struct sctp_laddr),
5762 (sctp_max_number_of_assoc * sctp_scale_up_for_address));
5763
5764 SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_net), "sctp_raddr",
5765 sizeof(struct sctp_nets),
5766 (sctp_max_number_of_assoc * sctp_scale_up_for_address));
5767
5768 SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_chunk), "sctp_chunk",
5769 sizeof(struct sctp_tmit_chunk),
5770 (sctp_max_number_of_assoc * SCTP_BASE_SYSCTL(sctp_chunkscale)));
5771
5772 SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_readq), "sctp_readq",
5773 sizeof(struct sctp_queued_to_read),
5774 (sctp_max_number_of_assoc * SCTP_BASE_SYSCTL(sctp_chunkscale)));
5775
5776 SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_strmoq), "sctp_stream_msg_out",
5777 sizeof(struct sctp_stream_queue_pending),
5778 (sctp_max_number_of_assoc * SCTP_BASE_SYSCTL(sctp_chunkscale)));
5779
5780 SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_asconf), "sctp_asconf",
5781 sizeof(struct sctp_asconf),
5782 (sctp_max_number_of_assoc * SCTP_BASE_SYSCTL(sctp_chunkscale)));
5783
5784 SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_asconf_ack), "sctp_asconf_ack",
5785 sizeof(struct sctp_asconf_ack),
5786 (sctp_max_number_of_assoc * SCTP_BASE_SYSCTL(sctp_chunkscale)));
5787
5788 /* Master Lock INIT for info structure */
5789 SCTP_INP_INFO_LOCK_INIT();
5790 SCTP_STATLOG_INIT_LOCK();
5791
5792 SCTP_IPI_COUNT_INIT();
5793 SCTP_IPI_ADDR_INIT();
5794 #ifdef SCTP_PACKET_LOGGING
5795 SCTP_IP_PKTLOG_INIT();
5796 #endif
5797 LIST_INIT(&SCTP_BASE_INFO(addr_wq));
5798
5799 SCTP_WQ_ADDR_INIT();
5800 /* not sure if we need all the counts */
5801 SCTP_BASE_INFO(ipi_count_ep) = 0;
5802 /* assoc/tcb zone info */
5803 SCTP_BASE_INFO(ipi_count_asoc) = 0;
5804 /* local addrlist zone info */
5805 SCTP_BASE_INFO(ipi_count_laddr) = 0;
5806 /* remote addrlist zone info */
5807 SCTP_BASE_INFO(ipi_count_raddr) = 0;
5808 /* chunk info */
5809 SCTP_BASE_INFO(ipi_count_chunk) = 0;
5810
5811 /* socket queue zone info */
5812 SCTP_BASE_INFO(ipi_count_readq) = 0;
5813
5814 /* stream out queue cont */
5815 SCTP_BASE_INFO(ipi_count_strmoq) = 0;
5816
5817 SCTP_BASE_INFO(ipi_free_strmoq) = 0;
5818 SCTP_BASE_INFO(ipi_free_chunks) = 0;
5819
5820 SCTP_OS_TIMER_INIT(&SCTP_BASE_INFO(addr_wq_timer.timer));
5821
5822 /* Init the TIMEWAIT list */
5823 for (i = 0; i < SCTP_STACK_VTAG_HASH_SIZE; i++) {
5824 LIST_INIT(&SCTP_BASE_INFO(vtag_timewait)[i]);
5825 }
5826 sctp_startup_iterator();
5827
5828 #if defined(SCTP_MCORE_INPUT) && defined(SMP)
5829 sctp_startup_mcore_threads();
5830 #endif
5831
5832 /*
5833 * INIT the default VRF which for BSD is the only one, other O/S's
5834 * may have more. But initially they must start with one and then
5835 * add the VRF's as addresses are added.
5836 */
5837 sctp_init_vrf_list(SCTP_DEFAULT_VRF);
5838 }
5839
5840 /*
5841 * Assumes that the SCTP_BASE_INFO() lock is NOT held.
5842 */
5843 void
5844 sctp_pcb_finish(void)
5845 {
5846 struct sctp_vrflist *vrf_bucket;
5847 struct sctp_vrf *vrf, *nvrf;
5848 struct sctp_ifn *ifn, *nifn;
5849 struct sctp_ifa *ifa, *nifa;
5850 struct sctpvtaghead *chain;
5851 struct sctp_tagblock *twait_block, *prev_twait_block;
5852 struct sctp_laddr *wi, *nwi;
5853 int i;
5854 struct sctp_iterator *it, *nit;
5855
5856 if (SCTP_BASE_VAR(sctp_pcb_initialized) == 0) {
5857 SCTP_PRINTF("%s: race condition on teardown.\n", __func__);
5858 return;
5859 }
5860 SCTP_BASE_VAR(sctp_pcb_initialized) = 0;
5861 /*
5862 * In FreeBSD the iterator thread never exits but we do clean up.
5863 * The only way FreeBSD reaches here is if we have VRF's but we
5864 * still add the ifdef to make it compile on old versions.
5865 */
5866 retry:
5867 SCTP_IPI_ITERATOR_WQ_LOCK();
5868 /*
5869 * sctp_iterator_worker() might be working on an it entry without
5870 * holding the lock. We won't find it on the list either and
5871 * continue and free/destroy it. While holding the lock, spin, to
5872 * avoid the race condition as sctp_iterator_worker() will have to
5873 * wait to re-acquire the lock.
5874 */
5875 if (sctp_it_ctl.iterator_running != 0 || sctp_it_ctl.cur_it != NULL) {
5876 SCTP_IPI_ITERATOR_WQ_UNLOCK();
5877 SCTP_PRINTF("%s: Iterator running while we held the lock. Retry. "
5878 "cur_it=%p\n", __func__, sctp_it_ctl.cur_it);
5879 DELAY(10);
5880 goto retry;
5881 }
5882 TAILQ_FOREACH_SAFE(it, &sctp_it_ctl.iteratorhead, sctp_nxt_itr, nit) {
5883 if (it->vn != curvnet) {
5884 continue;
5885 }
5886 TAILQ_REMOVE(&sctp_it_ctl.iteratorhead, it, sctp_nxt_itr);
5887 if (it->function_atend != NULL) {
5888 (*it->function_atend) (it->pointer, it->val);
5889 }
5890 SCTP_FREE(it, SCTP_M_ITER);
5891 }
5892 SCTP_IPI_ITERATOR_WQ_UNLOCK();
5893 SCTP_ITERATOR_LOCK();
5894 if ((sctp_it_ctl.cur_it) &&
5895 (sctp_it_ctl.cur_it->vn == curvnet)) {
5896 sctp_it_ctl.iterator_flags |= SCTP_ITERATOR_STOP_CUR_IT;
5897 }
5898 SCTP_ITERATOR_UNLOCK();
5899 SCTP_OS_TIMER_STOP_DRAIN(&SCTP_BASE_INFO(addr_wq_timer.timer));
5900 SCTP_WQ_ADDR_LOCK();
5901 LIST_FOREACH_SAFE(wi, &SCTP_BASE_INFO(addr_wq), sctp_nxt_addr, nwi) {
5902 LIST_REMOVE(wi, sctp_nxt_addr);
5903 SCTP_DECR_LADDR_COUNT();
5904 if (wi->action == SCTP_DEL_IP_ADDRESS) {
5905 SCTP_FREE(wi->ifa, SCTP_M_IFA);
5906 }
5907 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_laddr), wi);
5908 }
5909 SCTP_WQ_ADDR_UNLOCK();
5910
5911 /*
5912 * free the vrf/ifn/ifa lists and hashes (be sure address monitor is
5913 * destroyed first).
5914 */
5915 SCTP_IPI_ADDR_WLOCK();
5916 vrf_bucket = &SCTP_BASE_INFO(sctp_vrfhash)[(SCTP_DEFAULT_VRFID & SCTP_BASE_INFO(hashvrfmark))];
5917 LIST_FOREACH_SAFE(vrf, vrf_bucket, next_vrf, nvrf) {
5918 LIST_FOREACH_SAFE(ifn, &vrf->ifnlist, next_ifn, nifn) {
5919 LIST_FOREACH_SAFE(ifa, &ifn->ifalist, next_ifa, nifa) {
5920 /* free the ifa */
5921 LIST_REMOVE(ifa, next_bucket);
5922 LIST_REMOVE(ifa, next_ifa);
5923 SCTP_FREE(ifa, SCTP_M_IFA);
5924 }
5925 /* free the ifn */
5926 LIST_REMOVE(ifn, next_bucket);
5927 LIST_REMOVE(ifn, next_ifn);
5928 SCTP_FREE(ifn, SCTP_M_IFN);
5929 }
5930 SCTP_HASH_FREE(vrf->vrf_addr_hash, vrf->vrf_addr_hashmark);
5931 /* free the vrf */
5932 LIST_REMOVE(vrf, next_vrf);
5933 SCTP_FREE(vrf, SCTP_M_VRF);
5934 }
5935 SCTP_IPI_ADDR_WUNLOCK();
5936 /* free the vrf hashes */
5937 SCTP_HASH_FREE(SCTP_BASE_INFO(sctp_vrfhash), SCTP_BASE_INFO(hashvrfmark));
5938 SCTP_HASH_FREE(SCTP_BASE_INFO(vrf_ifn_hash), SCTP_BASE_INFO(vrf_ifn_hashmark));
5939
5940 /*
5941 * free the TIMEWAIT list elements malloc'd in the function
5942 * sctp_add_vtag_to_timewait()...
5943 */
5944 for (i = 0; i < SCTP_STACK_VTAG_HASH_SIZE; i++) {
5945 chain = &SCTP_BASE_INFO(vtag_timewait)[i];
5946 if (!LIST_EMPTY(chain)) {
5947 prev_twait_block = NULL;
5948 LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) {
5949 if (prev_twait_block) {
5950 SCTP_FREE(prev_twait_block, SCTP_M_TIMW);
5951 }
5952 prev_twait_block = twait_block;
5953 }
5954 SCTP_FREE(prev_twait_block, SCTP_M_TIMW);
5955 }
5956 }
5957
5958 /* free the locks and mutexes */
5959 #ifdef SCTP_PACKET_LOGGING
5960 SCTP_IP_PKTLOG_DESTROY();
5961 #endif
5962 SCTP_IPI_ADDR_DESTROY();
5963 SCTP_STATLOG_DESTROY();
5964 SCTP_INP_INFO_LOCK_DESTROY();
5965
5966 SCTP_WQ_ADDR_DESTROY();
5967
5968 /* Get rid of other stuff too. */
5969 if (SCTP_BASE_INFO(sctp_asochash) != NULL)
5970 SCTP_HASH_FREE(SCTP_BASE_INFO(sctp_asochash), SCTP_BASE_INFO(hashasocmark));
5971 if (SCTP_BASE_INFO(sctp_ephash) != NULL)
5972 SCTP_HASH_FREE(SCTP_BASE_INFO(sctp_ephash), SCTP_BASE_INFO(hashmark));
5973 if (SCTP_BASE_INFO(sctp_tcpephash) != NULL)
5974 SCTP_HASH_FREE(SCTP_BASE_INFO(sctp_tcpephash), SCTP_BASE_INFO(hashtcpmark));
5975
5976 SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_ep));
5977 SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_asoc));
5978 SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_laddr));
5979 SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_net));
5980 SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_chunk));
5981 SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_readq));
5982 SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_strmoq));
5983 SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_asconf));
5984 SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_asconf_ack));
5985 #if defined(SMP) && defined(SCTP_USE_PERCPU_STAT)
5986 SCTP_FREE(SCTP_BASE_STATS, SCTP_M_MCORE);
5987 #endif
5988 }
5989
5990 int
5991 sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m,
5992 int offset, int limit,
5993 struct sockaddr *src, struct sockaddr *dst,
5994 struct sockaddr *altsa, uint16_t port)
5995 {
5996 /*
5997 * grub through the INIT pulling addresses and loading them to the
5998 * nets structure in the asoc. The from address in the mbuf should
5999 * also be loaded (if it is not already). This routine can be called
6000 * with either INIT or INIT-ACK's as long as the m points to the IP
6001 * packet and the offset points to the beginning of the parameters.
6002 */
6003 struct sctp_inpcb *inp;
6004 struct sctp_nets *net, *nnet, *net_tmp;
6005 struct sctp_paramhdr *phdr, param_buf;
6006 struct sctp_tcb *stcb_tmp;
6007 uint16_t ptype, plen;
6008 struct sockaddr *sa;
6009 uint8_t random_store[SCTP_PARAM_BUFFER_SIZE];
6010 struct sctp_auth_random *p_random = NULL;
6011 uint16_t random_len = 0;
6012 uint8_t hmacs_store[SCTP_PARAM_BUFFER_SIZE];
6013 struct sctp_auth_hmac_algo *hmacs = NULL;
6014 uint16_t hmacs_len = 0;
6015 uint8_t saw_asconf = 0;
6016 uint8_t saw_asconf_ack = 0;
6017 uint8_t chunks_store[SCTP_PARAM_BUFFER_SIZE];
6018 struct sctp_auth_chunk_list *chunks = NULL;
6019 uint16_t num_chunks = 0;
6020 sctp_key_t *new_key;
6021 uint32_t keylen;
6022 int got_random = 0, got_hmacs = 0, got_chklist = 0;
6023 uint8_t peer_supports_ecn;
6024 uint8_t peer_supports_prsctp;
6025 uint8_t peer_supports_auth;
6026 uint8_t peer_supports_asconf;
6027 uint8_t peer_supports_asconf_ack;
6028 uint8_t peer_supports_reconfig;
6029 uint8_t peer_supports_nrsack;
6030 uint8_t peer_supports_pktdrop;
6031 uint8_t peer_supports_idata;
6032 #ifdef INET
6033 struct sockaddr_in sin;
6034 #endif
6035 #ifdef INET6
6036 struct sockaddr_in6 sin6;
6037 #endif
6038
6039 /* First get the destination address setup too. */
6040 #ifdef INET
6041 memset(&sin, 0, sizeof(sin));
6042 sin.sin_family = AF_INET;
6043 sin.sin_len = sizeof(sin);
6044 sin.sin_port = stcb->rport;
6045 #endif
6046 #ifdef INET6
6047 memset(&sin6, 0, sizeof(sin6));
6048 sin6.sin6_family = AF_INET6;
6049 sin6.sin6_len = sizeof(struct sockaddr_in6);
6050 sin6.sin6_port = stcb->rport;
6051 #endif
6052 if (altsa) {
6053 sa = altsa;
6054 } else {
6055 sa = src;
6056 }
6057 peer_supports_idata = 0;
6058 peer_supports_ecn = 0;
6059 peer_supports_prsctp = 0;
6060 peer_supports_auth = 0;
6061 peer_supports_asconf = 0;
6062 peer_supports_asconf_ack = 0;
6063 peer_supports_reconfig = 0;
6064 peer_supports_nrsack = 0;
6065 peer_supports_pktdrop = 0;
6066 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
6067 /* mark all addresses that we have currently on the list */
6068 net->dest_state |= SCTP_ADDR_NOT_IN_ASSOC;
6069 }
6070 /* does the source address already exist? if so skip it */
6071 inp = stcb->sctp_ep;
6072 atomic_add_int(&stcb->asoc.refcnt, 1);
6073 stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net_tmp, dst, stcb);
6074 atomic_subtract_int(&stcb->asoc.refcnt, 1);
6075
6076 if ((stcb_tmp == NULL && inp == stcb->sctp_ep) || inp == NULL) {
6077 /* we must add the source address */
6078 /* no scope set here since we have a tcb already. */
6079 switch (sa->sa_family) {
6080 #ifdef INET
6081 case AF_INET:
6082 if (stcb->asoc.scope.ipv4_addr_legal) {
6083 if (sctp_add_remote_addr(stcb, sa, NULL, port, SCTP_DONOT_SETSCOPE, SCTP_LOAD_ADDR_2)) {
6084 return (-1);
6085 }
6086 }
6087 break;
6088 #endif
6089 #ifdef INET6
6090 case AF_INET6:
6091 if (stcb->asoc.scope.ipv6_addr_legal) {
6092 if (sctp_add_remote_addr(stcb, sa, NULL, port, SCTP_DONOT_SETSCOPE, SCTP_LOAD_ADDR_3)) {
6093 return (-2);
6094 }
6095 }
6096 break;
6097 #endif
6098 default:
6099 break;
6100 }
6101 } else {
6102 if (net_tmp != NULL && stcb_tmp == stcb) {
6103 net_tmp->dest_state &= ~SCTP_ADDR_NOT_IN_ASSOC;
6104 } else if (stcb_tmp != stcb) {
6105 /* It belongs to another association? */
6106 if (stcb_tmp)
6107 SCTP_TCB_UNLOCK(stcb_tmp);
6108 return (-3);
6109 }
6110 }
6111 if (stcb->asoc.state == 0) {
6112 /* the assoc was freed? */
6113 return (-4);
6114 }
6115 /* now we must go through each of the params. */
6116 phdr = sctp_get_next_param(m, offset, ¶m_buf, sizeof(param_buf));
6117 while (phdr) {
6118 ptype = ntohs(phdr->param_type);
6119 plen = ntohs(phdr->param_length);
6120 /*
6121 * SCTP_PRINTF("ptype => %0x, plen => %d\n",
6122 * (uint32_t)ptype, (int)plen);
6123 */
6124 if (offset + plen > limit) {
6125 break;
6126 }
6127 if (plen < sizeof(struct sctp_paramhdr)) {
6128 break;
6129 }
6130 #ifdef INET
6131 if (ptype == SCTP_IPV4_ADDRESS) {
6132 if (stcb->asoc.scope.ipv4_addr_legal) {
6133 struct sctp_ipv4addr_param *p4, p4_buf;
6134
6135 /* ok get the v4 address and check/add */
6136 phdr = sctp_get_next_param(m, offset,
6137 (struct sctp_paramhdr *)&p4_buf,
6138 sizeof(p4_buf));
6139 if (plen != sizeof(struct sctp_ipv4addr_param) ||
6140 phdr == NULL) {
6141 return (-5);
6142 }
6143 p4 = (struct sctp_ipv4addr_param *)phdr;
6144 sin.sin_addr.s_addr = p4->addr;
6145 if (IN_MULTICAST(ntohl(sin.sin_addr.s_addr))) {
6146 /* Skip multi-cast addresses */
6147 goto next_param;
6148 }
6149 if ((sin.sin_addr.s_addr == INADDR_BROADCAST) ||
6150 (sin.sin_addr.s_addr == INADDR_ANY)) {
6151 goto next_param;
6152 }
6153 sa = (struct sockaddr *)&sin;
6154 inp = stcb->sctp_ep;
6155 atomic_add_int(&stcb->asoc.refcnt, 1);
6156 stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net,
6157 dst, stcb);
6158 atomic_subtract_int(&stcb->asoc.refcnt, 1);
6159
6160 if ((stcb_tmp == NULL && inp == stcb->sctp_ep) ||
6161 inp == NULL) {
6162 /* we must add the source address */
6163 /*
6164 * no scope set since we have a tcb
6165 * already
6166 */
6167
6168 /*
6169 * we must validate the state again
6170 * here
6171 */
6172 add_it_now:
6173 if (stcb->asoc.state == 0) {
6174 /* the assoc was freed? */
6175 return (-7);
6176 }
6177 if (sctp_add_remote_addr(stcb, sa, NULL, port, SCTP_DONOT_SETSCOPE, SCTP_LOAD_ADDR_4)) {
6178 return (-8);
6179 }
6180 } else if (stcb_tmp == stcb) {
6181 if (stcb->asoc.state == 0) {
6182 /* the assoc was freed? */
6183 return (-10);
6184 }
6185 if (net != NULL) {
6186 /* clear flag */
6187 net->dest_state &=
6188 ~SCTP_ADDR_NOT_IN_ASSOC;
6189 }
6190 } else {
6191 /*
6192 * strange, address is in another
6193 * assoc? straighten out locks.
6194 */
6195 if (stcb_tmp) {
6196 if (SCTP_GET_STATE(stcb_tmp) == SCTP_STATE_COOKIE_WAIT) {
6197 struct mbuf *op_err;
6198 char msg[SCTP_DIAG_INFO_LEN];
6199
6200 /*
6201 * in setup state we
6202 * abort this guy
6203 */
6204 SCTP_SNPRINTF(msg, sizeof(msg),
6205 "%s:%d at %s", __FILE__, __LINE__, __func__);
6206 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
6207 msg);
6208 sctp_abort_an_association(stcb_tmp->sctp_ep,
6209 stcb_tmp, op_err, false,
6210 SCTP_SO_NOT_LOCKED);
6211 goto add_it_now;
6212 }
6213 SCTP_TCB_UNLOCK(stcb_tmp);
6214 }
6215
6216 if (stcb->asoc.state == 0) {
6217 /* the assoc was freed? */
6218 return (-12);
6219 }
6220 return (-13);
6221 }
6222 }
6223 } else
6224 #endif
6225 #ifdef INET6
6226 if (ptype == SCTP_IPV6_ADDRESS) {
6227 if (stcb->asoc.scope.ipv6_addr_legal) {
6228 /* ok get the v6 address and check/add */
6229 struct sctp_ipv6addr_param *p6, p6_buf;
6230
6231 phdr = sctp_get_next_param(m, offset,
6232 (struct sctp_paramhdr *)&p6_buf,
6233 sizeof(p6_buf));
6234 if (plen != sizeof(struct sctp_ipv6addr_param) ||
6235 phdr == NULL) {
6236 return (-14);
6237 }
6238 p6 = (struct sctp_ipv6addr_param *)phdr;
6239 memcpy((caddr_t)&sin6.sin6_addr, p6->addr,
6240 sizeof(p6->addr));
6241 if (IN6_IS_ADDR_MULTICAST(&sin6.sin6_addr)) {
6242 /* Skip multi-cast addresses */
6243 goto next_param;
6244 }
6245 if (IN6_IS_ADDR_LINKLOCAL(&sin6.sin6_addr)) {
6246 /*
6247 * Link local make no sense without
6248 * scope
6249 */
6250 goto next_param;
6251 }
6252 sa = (struct sockaddr *)&sin6;
6253 inp = stcb->sctp_ep;
6254 atomic_add_int(&stcb->asoc.refcnt, 1);
6255 stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net,
6256 dst, stcb);
6257 atomic_subtract_int(&stcb->asoc.refcnt, 1);
6258 if (stcb_tmp == NULL &&
6259 (inp == stcb->sctp_ep || inp == NULL)) {
6260 /*
6261 * we must validate the state again
6262 * here
6263 */
6264 add_it_now6:
6265 if (stcb->asoc.state == 0) {
6266 /* the assoc was freed? */
6267 return (-16);
6268 }
6269 /*
6270 * we must add the address, no scope
6271 * set
6272 */
6273 if (sctp_add_remote_addr(stcb, sa, NULL, port, SCTP_DONOT_SETSCOPE, SCTP_LOAD_ADDR_5)) {
6274 return (-17);
6275 }
6276 } else if (stcb_tmp == stcb) {
6277 /*
6278 * we must validate the state again
6279 * here
6280 */
6281 if (stcb->asoc.state == 0) {
6282 /* the assoc was freed? */
6283 return (-19);
6284 }
6285 if (net != NULL) {
6286 /* clear flag */
6287 net->dest_state &=
6288 ~SCTP_ADDR_NOT_IN_ASSOC;
6289 }
6290 } else {
6291 /*
6292 * strange, address is in another
6293 * assoc? straighten out locks.
6294 */
6295 if (stcb_tmp) {
6296 if (SCTP_GET_STATE(stcb_tmp) == SCTP_STATE_COOKIE_WAIT) {
6297 struct mbuf *op_err;
6298 char msg[SCTP_DIAG_INFO_LEN];
6299
6300 /*
6301 * in setup state we
6302 * abort this guy
6303 */
6304 SCTP_SNPRINTF(msg, sizeof(msg),
6305 "%s:%d at %s", __FILE__, __LINE__, __func__);
6306 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
6307 msg);
6308 sctp_abort_an_association(stcb_tmp->sctp_ep,
6309 stcb_tmp, op_err, false,
6310 SCTP_SO_NOT_LOCKED);
6311 goto add_it_now6;
6312 }
6313 SCTP_TCB_UNLOCK(stcb_tmp);
6314 }
6315 if (stcb->asoc.state == 0) {
6316 /* the assoc was freed? */
6317 return (-21);
6318 }
6319 return (-22);
6320 }
6321 }
6322 } else
6323 #endif
6324 if (ptype == SCTP_ECN_CAPABLE) {
6325 peer_supports_ecn = 1;
6326 } else if (ptype == SCTP_ULP_ADAPTATION) {
6327 if (stcb->asoc.state != SCTP_STATE_OPEN) {
6328 struct sctp_adaptation_layer_indication ai,
6329 *aip;
6330
6331 phdr = sctp_get_next_param(m, offset,
6332 (struct sctp_paramhdr *)&ai, sizeof(ai));
6333 aip = (struct sctp_adaptation_layer_indication *)phdr;
6334 if (aip) {
6335 stcb->asoc.peers_adaptation = ntohl(aip->indication);
6336 stcb->asoc.adaptation_needed = 1;
6337 }
6338 }
6339 } else if (ptype == SCTP_SET_PRIM_ADDR) {
6340 struct sctp_asconf_addr_param lstore, *fee;
6341 int lptype;
6342 struct sockaddr *lsa = NULL;
6343 #ifdef INET
6344 struct sctp_asconf_addrv4_param *fii;
6345 #endif
6346
6347 if (stcb->asoc.asconf_supported == 0) {
6348 return (-100);
6349 }
6350 if (plen > sizeof(lstore)) {
6351 return (-23);
6352 }
6353 if (plen < sizeof(struct sctp_asconf_addrv4_param)) {
6354 return (-101);
6355 }
6356 phdr = sctp_get_next_param(m, offset,
6357 (struct sctp_paramhdr *)&lstore,
6358 plen);
6359 if (phdr == NULL) {
6360 return (-24);
6361 }
6362 fee = (struct sctp_asconf_addr_param *)phdr;
6363 lptype = ntohs(fee->addrp.ph.param_type);
6364 switch (lptype) {
6365 #ifdef INET
6366 case SCTP_IPV4_ADDRESS:
6367 if (plen !=
6368 sizeof(struct sctp_asconf_addrv4_param)) {
6369 SCTP_PRINTF("Sizeof setprim in init/init ack not %d but %d - ignored\n",
6370 (int)sizeof(struct sctp_asconf_addrv4_param),
6371 plen);
6372 } else {
6373 fii = (struct sctp_asconf_addrv4_param *)fee;
6374 sin.sin_addr.s_addr = fii->addrp.addr;
6375 lsa = (struct sockaddr *)&sin;
6376 }
6377 break;
6378 #endif
6379 #ifdef INET6
6380 case SCTP_IPV6_ADDRESS:
6381 if (plen !=
6382 sizeof(struct sctp_asconf_addr_param)) {
6383 SCTP_PRINTF("Sizeof setprim (v6) in init/init ack not %d but %d - ignored\n",
6384 (int)sizeof(struct sctp_asconf_addr_param),
6385 plen);
6386 } else {
6387 memcpy(sin6.sin6_addr.s6_addr,
6388 fee->addrp.addr,
6389 sizeof(fee->addrp.addr));
6390 lsa = (struct sockaddr *)&sin6;
6391 }
6392 break;
6393 #endif
6394 default:
6395 break;
6396 }
6397 if (lsa) {
6398 (void)sctp_set_primary_addr(stcb, sa, NULL);
6399 }
6400 } else if (ptype == SCTP_HAS_NAT_SUPPORT) {
6401 stcb->asoc.peer_supports_nat = 1;
6402 } else if (ptype == SCTP_PRSCTP_SUPPORTED) {
6403 /* Peer supports pr-sctp */
6404 peer_supports_prsctp = 1;
6405 } else if (ptype == SCTP_SUPPORTED_CHUNK_EXT) {
6406 /* A supported extension chunk */
6407 struct sctp_supported_chunk_types_param *pr_supported;
6408 uint8_t local_store[SCTP_PARAM_BUFFER_SIZE];
6409 int num_ent, i;
6410
6411 if (plen > sizeof(local_store)) {
6412 return (-35);
6413 }
6414 phdr = sctp_get_next_param(m, offset,
6415 (struct sctp_paramhdr *)&local_store, plen);
6416 if (phdr == NULL) {
6417 return (-25);
6418 }
6419 pr_supported = (struct sctp_supported_chunk_types_param *)phdr;
6420 num_ent = plen - sizeof(struct sctp_paramhdr);
6421 for (i = 0; i < num_ent; i++) {
6422 switch (pr_supported->chunk_types[i]) {
6423 case SCTP_ASCONF:
6424 peer_supports_asconf = 1;
6425 break;
6426 case SCTP_ASCONF_ACK:
6427 peer_supports_asconf_ack = 1;
6428 break;
6429 case SCTP_FORWARD_CUM_TSN:
6430 peer_supports_prsctp = 1;
6431 break;
6432 case SCTP_PACKET_DROPPED:
6433 peer_supports_pktdrop = 1;
6434 break;
6435 case SCTP_NR_SELECTIVE_ACK:
6436 peer_supports_nrsack = 1;
6437 break;
6438 case SCTP_STREAM_RESET:
6439 peer_supports_reconfig = 1;
6440 break;
6441 case SCTP_AUTHENTICATION:
6442 peer_supports_auth = 1;
6443 break;
6444 case SCTP_IDATA:
6445 peer_supports_idata = 1;
6446 break;
6447 default:
6448 /* one I have not learned yet */
6449 break;
6450 }
6451 }
6452 } else if (ptype == SCTP_RANDOM) {
6453 if (plen > sizeof(random_store))
6454 break;
6455 if (got_random) {
6456 /* already processed a RANDOM */
6457 goto next_param;
6458 }
6459 phdr = sctp_get_next_param(m, offset,
6460 (struct sctp_paramhdr *)random_store,
6461 plen);
6462 if (phdr == NULL)
6463 return (-26);
6464 p_random = (struct sctp_auth_random *)phdr;
6465 random_len = plen - sizeof(*p_random);
6466 /* enforce the random length */
6467 if (random_len != SCTP_AUTH_RANDOM_SIZE_REQUIRED) {
6468 SCTPDBG(SCTP_DEBUG_AUTH1, "SCTP: invalid RANDOM len\n");
6469 return (-27);
6470 }
6471 got_random = 1;
6472 } else if (ptype == SCTP_HMAC_LIST) {
6473 uint16_t num_hmacs;
6474 uint16_t i;
6475
6476 if (plen > sizeof(hmacs_store))
6477 break;
6478 if (got_hmacs) {
6479 /* already processed a HMAC list */
6480 goto next_param;
6481 }
6482 phdr = sctp_get_next_param(m, offset,
6483 (struct sctp_paramhdr *)hmacs_store,
6484 plen);
6485 if (phdr == NULL)
6486 return (-28);
6487 hmacs = (struct sctp_auth_hmac_algo *)phdr;
6488 hmacs_len = plen - sizeof(*hmacs);
6489 num_hmacs = hmacs_len / sizeof(hmacs->hmac_ids[0]);
6490 /* validate the hmac list */
6491 if (sctp_verify_hmac_param(hmacs, num_hmacs)) {
6492 return (-29);
6493 }
6494 if (stcb->asoc.peer_hmacs != NULL)
6495 sctp_free_hmaclist(stcb->asoc.peer_hmacs);
6496 stcb->asoc.peer_hmacs = sctp_alloc_hmaclist(num_hmacs);
6497 if (stcb->asoc.peer_hmacs != NULL) {
6498 for (i = 0; i < num_hmacs; i++) {
6499 (void)sctp_auth_add_hmacid(stcb->asoc.peer_hmacs,
6500 ntohs(hmacs->hmac_ids[i]));
6501 }
6502 }
6503 got_hmacs = 1;
6504 } else if (ptype == SCTP_CHUNK_LIST) {
6505 int i;
6506
6507 if (plen > sizeof(chunks_store))
6508 break;
6509 if (got_chklist) {
6510 /* already processed a Chunks list */
6511 goto next_param;
6512 }
6513 phdr = sctp_get_next_param(m, offset,
6514 (struct sctp_paramhdr *)chunks_store,
6515 plen);
6516 if (phdr == NULL)
6517 return (-30);
6518 chunks = (struct sctp_auth_chunk_list *)phdr;
6519 num_chunks = plen - sizeof(*chunks);
6520 if (stcb->asoc.peer_auth_chunks != NULL)
6521 sctp_clear_chunklist(stcb->asoc.peer_auth_chunks);
6522 else
6523 stcb->asoc.peer_auth_chunks = sctp_alloc_chunklist();
6524 for (i = 0; i < num_chunks; i++) {
6525 (void)sctp_auth_add_chunk(chunks->chunk_types[i],
6526 stcb->asoc.peer_auth_chunks);
6527 /* record asconf/asconf-ack if listed */
6528 if (chunks->chunk_types[i] == SCTP_ASCONF)
6529 saw_asconf = 1;
6530 if (chunks->chunk_types[i] == SCTP_ASCONF_ACK)
6531 saw_asconf_ack = 1;
6532 }
6533 got_chklist = 1;
6534 } else if ((ptype == SCTP_HEARTBEAT_INFO) ||
6535 (ptype == SCTP_STATE_COOKIE) ||
6536 (ptype == SCTP_UNRECOG_PARAM) ||
6537 (ptype == SCTP_COOKIE_PRESERVE) ||
6538 (ptype == SCTP_SUPPORTED_ADDRTYPE) ||
6539 (ptype == SCTP_ADD_IP_ADDRESS) ||
6540 (ptype == SCTP_DEL_IP_ADDRESS) ||
6541 (ptype == SCTP_ERROR_CAUSE_IND) ||
6542 (ptype == SCTP_SUCCESS_REPORT)) {
6543 /* don't care */
6544 } else {
6545 if ((ptype & 0x8000) == 0x0000) {
6546 /*
6547 * must stop processing the rest of the
6548 * param's. Any report bits were handled
6549 * with the call to
6550 * sctp_arethere_unrecognized_parameters()
6551 * when the INIT or INIT-ACK was first seen.
6552 */
6553 break;
6554 }
6555 }
6556
6557 next_param:
6558 offset += SCTP_SIZE32(plen);
6559 if (offset >= limit) {
6560 break;
6561 }
6562 phdr = sctp_get_next_param(m, offset, ¶m_buf,
6563 sizeof(param_buf));
6564 }
6565 /* Now check to see if we need to purge any addresses */
6566 TAILQ_FOREACH_SAFE(net, &stcb->asoc.nets, sctp_next, nnet) {
6567 if ((net->dest_state & SCTP_ADDR_NOT_IN_ASSOC) ==
6568 SCTP_ADDR_NOT_IN_ASSOC) {
6569 /* This address has been removed from the asoc */
6570 /* remove and free it */
6571 stcb->asoc.numnets--;
6572 TAILQ_REMOVE(&stcb->asoc.nets, net, sctp_next);
6573 if (net == stcb->asoc.alternate) {
6574 sctp_free_remote_addr(stcb->asoc.alternate);
6575 stcb->asoc.alternate = NULL;
6576 }
6577 if (net == stcb->asoc.primary_destination) {
6578 stcb->asoc.primary_destination = NULL;
6579 sctp_select_primary_destination(stcb);
6580 }
6581 sctp_free_remote_addr(net);
6582 }
6583 }
6584 if ((stcb->asoc.ecn_supported == 1) &&
6585 (peer_supports_ecn == 0)) {
6586 stcb->asoc.ecn_supported = 0;
6587 }
6588 if ((stcb->asoc.prsctp_supported == 1) &&
6589 (peer_supports_prsctp == 0)) {
6590 stcb->asoc.prsctp_supported = 0;
6591 }
6592 if ((stcb->asoc.auth_supported == 1) &&
6593 ((peer_supports_auth == 0) ||
6594 (got_random == 0) || (got_hmacs == 0))) {
6595 stcb->asoc.auth_supported = 0;
6596 }
6597 if ((stcb->asoc.asconf_supported == 1) &&
6598 ((peer_supports_asconf == 0) || (peer_supports_asconf_ack == 0) ||
6599 (stcb->asoc.auth_supported == 0) ||
6600 (saw_asconf == 0) || (saw_asconf_ack == 0))) {
6601 stcb->asoc.asconf_supported = 0;
6602 }
6603 if ((stcb->asoc.reconfig_supported == 1) &&
6604 (peer_supports_reconfig == 0)) {
6605 stcb->asoc.reconfig_supported = 0;
6606 }
6607 if ((stcb->asoc.idata_supported == 1) &&
6608 (peer_supports_idata == 0)) {
6609 stcb->asoc.idata_supported = 0;
6610 }
6611 if ((stcb->asoc.nrsack_supported == 1) &&
6612 (peer_supports_nrsack == 0)) {
6613 stcb->asoc.nrsack_supported = 0;
6614 }
6615 if ((stcb->asoc.pktdrop_supported == 1) &&
6616 (peer_supports_pktdrop == 0)) {
6617 stcb->asoc.pktdrop_supported = 0;
6618 }
6619 /* validate authentication required parameters */
6620 if ((peer_supports_auth == 0) && (got_chklist == 1)) {
6621 /* peer does not support auth but sent a chunks list? */
6622 return (-31);
6623 }
6624 if ((peer_supports_asconf == 1) && (peer_supports_auth == 0)) {
6625 /* peer supports asconf but not auth? */
6626 return (-32);
6627 } else if ((peer_supports_asconf == 1) &&
6628 (peer_supports_auth == 1) &&
6629 ((saw_asconf == 0) || (saw_asconf_ack == 0))) {
6630 return (-33);
6631 }
6632 /* concatenate the full random key */
6633 keylen = sizeof(*p_random) + random_len + sizeof(*hmacs) + hmacs_len;
6634 if (chunks != NULL) {
6635 keylen += sizeof(*chunks) + num_chunks;
6636 }
6637 new_key = sctp_alloc_key(keylen);
6638 if (new_key != NULL) {
6639 /* copy in the RANDOM */
6640 if (p_random != NULL) {
6641 keylen = sizeof(*p_random) + random_len;
6642 memcpy(new_key->key, p_random, keylen);
6643 } else {
6644 keylen = 0;
6645 }
6646 /* append in the AUTH chunks */
6647 if (chunks != NULL) {
6648 memcpy(new_key->key + keylen, chunks,
6649 sizeof(*chunks) + num_chunks);
6650 keylen += sizeof(*chunks) + num_chunks;
6651 }
6652 /* append in the HMACs */
6653 if (hmacs != NULL) {
6654 memcpy(new_key->key + keylen, hmacs,
6655 sizeof(*hmacs) + hmacs_len);
6656 }
6657 } else {
6658 /* failed to get memory for the key */
6659 return (-34);
6660 }
6661 if (stcb->asoc.authinfo.peer_random != NULL)
6662 sctp_free_key(stcb->asoc.authinfo.peer_random);
6663 stcb->asoc.authinfo.peer_random = new_key;
6664 sctp_clear_cachedkeys(stcb, stcb->asoc.authinfo.assoc_keyid);
6665 sctp_clear_cachedkeys(stcb, stcb->asoc.authinfo.recv_keyid);
6666
6667 return (0);
6668 }
6669
6670 int
6671 sctp_set_primary_addr(struct sctp_tcb *stcb, struct sockaddr *sa,
6672 struct sctp_nets *net)
6673 {
6674 /* make sure the requested primary address exists in the assoc */
6675 if (net == NULL && sa)
6676 net = sctp_findnet(stcb, sa);
6677
6678 if (net == NULL) {
6679 /* didn't find the requested primary address! */
6680 return (-1);
6681 } else {
6682 /* set the primary address */
6683 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) {
6684 /* Must be confirmed, so queue to set */
6685 net->dest_state |= SCTP_ADDR_REQ_PRIMARY;
6686 return (0);
6687 }
6688 stcb->asoc.primary_destination = net;
6689 if (((net->dest_state & SCTP_ADDR_PF) == 0) &&
6690 (stcb->asoc.alternate != NULL)) {
6691 sctp_free_remote_addr(stcb->asoc.alternate);
6692 stcb->asoc.alternate = NULL;
6693 }
6694 net = TAILQ_FIRST(&stcb->asoc.nets);
6695 if (net != stcb->asoc.primary_destination) {
6696 /*
6697 * first one on the list is NOT the primary
6698 * sctp_cmpaddr() is much more efficient if the
6699 * primary is the first on the list, make it so.
6700 */
6701 TAILQ_REMOVE(&stcb->asoc.nets, stcb->asoc.primary_destination, sctp_next);
6702 TAILQ_INSERT_HEAD(&stcb->asoc.nets, stcb->asoc.primary_destination, sctp_next);
6703 }
6704 return (0);
6705 }
6706 }
6707
6708 bool
6709 sctp_is_vtag_good(uint32_t tag, uint16_t lport, uint16_t rport, struct timeval *now)
6710 {
6711 struct sctpasochead *head;
6712 struct sctp_tcb *stcb;
6713
6714 SCTP_INP_INFO_LOCK_ASSERT();
6715
6716 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(tag, SCTP_BASE_INFO(hashasocmark))];
6717 LIST_FOREACH(stcb, head, sctp_asocs) {
6718 /*
6719 * We choose not to lock anything here. TCB's can't be
6720 * removed since we have the read lock, so they can't be
6721 * freed on us, same thing for the INP. I may be wrong with
6722 * this assumption, but we will go with it for now :-)
6723 */
6724 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
6725 continue;
6726 }
6727 if (stcb->asoc.my_vtag == tag) {
6728 /* candidate */
6729 if (stcb->rport != rport) {
6730 continue;
6731 }
6732 if (stcb->sctp_ep->sctp_lport != lport) {
6733 continue;
6734 }
6735 /* The tag is currently used, so don't use it. */
6736 return (false);
6737 }
6738 }
6739 return (!sctp_is_in_timewait(tag, lport, rport, (uint32_t)now->tv_sec));
6740 }
6741
6742 static void
6743 sctp_drain_mbufs(struct sctp_tcb *stcb)
6744 {
6745 /*
6746 * We must hunt this association for MBUF's past the cumack (i.e.
6747 * out of order data that we can renege on).
6748 */
6749 struct sctp_association *asoc;
6750 struct sctp_tmit_chunk *chk, *nchk;
6751 uint32_t cumulative_tsn_p1;
6752 struct sctp_queued_to_read *control, *ncontrol;
6753 int cnt, strmat;
6754 uint32_t gap, i;
6755 int fnd = 0;
6756
6757 /* We look for anything larger than the cum-ack + 1 */
6758
6759 asoc = &stcb->asoc;
6760 if (asoc->cumulative_tsn == asoc->highest_tsn_inside_map) {
6761 /* none we can reneg on. */
6762 return;
6763 }
6764 SCTP_STAT_INCR(sctps_protocol_drains_done);
6765 cumulative_tsn_p1 = asoc->cumulative_tsn + 1;
6766 cnt = 0;
6767 /* Ok that was fun, now we will drain all the inbound streams? */
6768 for (strmat = 0; strmat < asoc->streamincnt; strmat++) {
6769 TAILQ_FOREACH_SAFE(control, &asoc->strmin[strmat].inqueue, next_instrm, ncontrol) {
6770 #ifdef INVARIANTS
6771 if (control->on_strm_q != SCTP_ON_ORDERED) {
6772 panic("Huh control: %p on_q: %d -- not ordered?",
6773 control, control->on_strm_q);
6774 }
6775 #endif
6776 if (SCTP_TSN_GT(control->sinfo_tsn, cumulative_tsn_p1)) {
6777 /* Yep it is above cum-ack */
6778 cnt++;
6779 SCTP_CALC_TSN_TO_GAP(gap, control->sinfo_tsn, asoc->mapping_array_base_tsn);
6780 KASSERT(control->length > 0, ("control has zero length"));
6781 if (asoc->size_on_all_streams >= control->length) {
6782 asoc->size_on_all_streams -= control->length;
6783 } else {
6784 #ifdef INVARIANTS
6785 panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
6786 #else
6787 asoc->size_on_all_streams = 0;
6788 #endif
6789 }
6790 sctp_ucount_decr(asoc->cnt_on_all_streams);
6791 SCTP_UNSET_TSN_PRESENT(asoc->mapping_array, gap);
6792 if (control->on_read_q) {
6793 TAILQ_REMOVE(&stcb->sctp_ep->read_queue, control, next);
6794 control->on_read_q = 0;
6795 }
6796 TAILQ_REMOVE(&asoc->strmin[strmat].inqueue, control, next_instrm);
6797 control->on_strm_q = 0;
6798 if (control->data) {
6799 sctp_m_freem(control->data);
6800 control->data = NULL;
6801 }
6802 sctp_free_remote_addr(control->whoFrom);
6803 /* Now its reasm? */
6804 TAILQ_FOREACH_SAFE(chk, &control->reasm, sctp_next, nchk) {
6805 cnt++;
6806 SCTP_CALC_TSN_TO_GAP(gap, chk->rec.data.tsn, asoc->mapping_array_base_tsn);
6807 KASSERT(chk->send_size > 0, ("chunk has zero length"));
6808 if (asoc->size_on_reasm_queue >= chk->send_size) {
6809 asoc->size_on_reasm_queue -= chk->send_size;
6810 } else {
6811 #ifdef INVARIANTS
6812 panic("size_on_reasm_queue = %u smaller than chunk length %u", asoc->size_on_reasm_queue, chk->send_size);
6813 #else
6814 asoc->size_on_reasm_queue = 0;
6815 #endif
6816 }
6817 sctp_ucount_decr(asoc->cnt_on_reasm_queue);
6818 SCTP_UNSET_TSN_PRESENT(asoc->mapping_array, gap);
6819 TAILQ_REMOVE(&control->reasm, chk, sctp_next);
6820 if (chk->data) {
6821 sctp_m_freem(chk->data);
6822 chk->data = NULL;
6823 }
6824 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
6825 }
6826 sctp_free_a_readq(stcb, control);
6827 }
6828 }
6829 TAILQ_FOREACH_SAFE(control, &asoc->strmin[strmat].uno_inqueue, next_instrm, ncontrol) {
6830 #ifdef INVARIANTS
6831 if (control->on_strm_q != SCTP_ON_UNORDERED) {
6832 panic("Huh control: %p on_q: %d -- not unordered?",
6833 control, control->on_strm_q);
6834 }
6835 #endif
6836 if (SCTP_TSN_GT(control->sinfo_tsn, cumulative_tsn_p1)) {
6837 /* Yep it is above cum-ack */
6838 cnt++;
6839 SCTP_CALC_TSN_TO_GAP(gap, control->sinfo_tsn, asoc->mapping_array_base_tsn);
6840 KASSERT(control->length > 0, ("control has zero length"));
6841 if (asoc->size_on_all_streams >= control->length) {
6842 asoc->size_on_all_streams -= control->length;
6843 } else {
6844 #ifdef INVARIANTS
6845 panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
6846 #else
6847 asoc->size_on_all_streams = 0;
6848 #endif
6849 }
6850 sctp_ucount_decr(asoc->cnt_on_all_streams);
6851 SCTP_UNSET_TSN_PRESENT(asoc->mapping_array, gap);
6852 if (control->on_read_q) {
6853 TAILQ_REMOVE(&stcb->sctp_ep->read_queue, control, next);
6854 control->on_read_q = 0;
6855 }
6856 TAILQ_REMOVE(&asoc->strmin[strmat].uno_inqueue, control, next_instrm);
6857 control->on_strm_q = 0;
6858 if (control->data) {
6859 sctp_m_freem(control->data);
6860 control->data = NULL;
6861 }
6862 sctp_free_remote_addr(control->whoFrom);
6863 /* Now its reasm? */
6864 TAILQ_FOREACH_SAFE(chk, &control->reasm, sctp_next, nchk) {
6865 cnt++;
6866 SCTP_CALC_TSN_TO_GAP(gap, chk->rec.data.tsn, asoc->mapping_array_base_tsn);
6867 KASSERT(chk->send_size > 0, ("chunk has zero length"));
6868 if (asoc->size_on_reasm_queue >= chk->send_size) {
6869 asoc->size_on_reasm_queue -= chk->send_size;
6870 } else {
6871 #ifdef INVARIANTS
6872 panic("size_on_reasm_queue = %u smaller than chunk length %u", asoc->size_on_reasm_queue, chk->send_size);
6873 #else
6874 asoc->size_on_reasm_queue = 0;
6875 #endif
6876 }
6877 sctp_ucount_decr(asoc->cnt_on_reasm_queue);
6878 SCTP_UNSET_TSN_PRESENT(asoc->mapping_array, gap);
6879 TAILQ_REMOVE(&control->reasm, chk, sctp_next);
6880 if (chk->data) {
6881 sctp_m_freem(chk->data);
6882 chk->data = NULL;
6883 }
6884 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
6885 }
6886 sctp_free_a_readq(stcb, control);
6887 }
6888 }
6889 }
6890 if (cnt) {
6891 /* We must back down to see what the new highest is */
6892 for (i = asoc->highest_tsn_inside_map; SCTP_TSN_GE(i, asoc->mapping_array_base_tsn); i--) {
6893 SCTP_CALC_TSN_TO_GAP(gap, i, asoc->mapping_array_base_tsn);
6894 if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, gap)) {
6895 asoc->highest_tsn_inside_map = i;
6896 fnd = 1;
6897 break;
6898 }
6899 }
6900 if (!fnd) {
6901 asoc->highest_tsn_inside_map = asoc->mapping_array_base_tsn - 1;
6902 }
6903
6904 /*
6905 * Question, should we go through the delivery queue? The
6906 * only reason things are on here is the app not reading OR
6907 * a p-d-api up. An attacker COULD send enough in to
6908 * initiate the PD-API and then send a bunch of stuff to
6909 * other streams... these would wind up on the delivery
6910 * queue.. and then we would not get to them. But in order
6911 * to do this I then have to back-track and un-deliver
6912 * sequence numbers in streams.. el-yucko. I think for now
6913 * we will NOT look at the delivery queue and leave it to be
6914 * something to consider later. An alternative would be to
6915 * abort the P-D-API with a notification and then deliver
6916 * the data.... Or another method might be to keep track of
6917 * how many times the situation occurs and if we see a
6918 * possible attack underway just abort the association.
6919 */
6920 #ifdef SCTP_DEBUG
6921 SCTPDBG(SCTP_DEBUG_PCB1, "Freed %d chunks from reneg harvest\n", cnt);
6922 #endif
6923 /*
6924 * Now do we need to find a new
6925 * asoc->highest_tsn_inside_map?
6926 */
6927 asoc->last_revoke_count = cnt;
6928 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL,
6929 SCTP_FROM_SCTP_PCB + SCTP_LOC_11);
6930 /* sa_ignore NO_NULL_CHK */
6931 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
6932 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_DRAIN, SCTP_SO_NOT_LOCKED);
6933 }
6934 /*
6935 * Another issue, in un-setting the TSN's in the mapping array we
6936 * DID NOT adjust the highest_tsn marker. This will cause one of
6937 * two things to occur. It may cause us to do extra work in checking
6938 * for our mapping array movement. More importantly it may cause us
6939 * to SACK every datagram. This may not be a bad thing though since
6940 * we will recover once we get our cum-ack above and all this stuff
6941 * we dumped recovered.
6942 */
6943 }
6944
6945 static void
6946 sctp_drain(void)
6947 {
6948 struct epoch_tracker et;
6949
6950 VNET_ITERATOR_DECL(vnet_iter);
6951
6952 NET_EPOCH_ENTER(et);
6953 /*
6954 * We must walk the PCB lists for ALL associations here. The system
6955 * is LOW on MBUF's and needs help. This is where reneging will
6956 * occur. We really hope this does NOT happen!
6957 */
6958 VNET_LIST_RLOCK_NOSLEEP();
6959 VNET_FOREACH(vnet_iter) {
6960 CURVNET_SET(vnet_iter);
6961 struct sctp_inpcb *inp;
6962 struct sctp_tcb *stcb;
6963
6964 SCTP_STAT_INCR(sctps_protocol_drain_calls);
6965 if (SCTP_BASE_SYSCTL(sctp_do_drain) == 0) {
6966 #ifdef VIMAGE
6967 continue;
6968 #else
6969 NET_EPOCH_EXIT(et);
6970 return;
6971 #endif
6972 }
6973 SCTP_INP_INFO_RLOCK();
6974 LIST_FOREACH(inp, &SCTP_BASE_INFO(listhead), sctp_list) {
6975 /* For each endpoint */
6976 SCTP_INP_RLOCK(inp);
6977 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
6978 /* For each association */
6979 SCTP_TCB_LOCK(stcb);
6980 sctp_drain_mbufs(stcb);
6981 SCTP_TCB_UNLOCK(stcb);
6982 }
6983 SCTP_INP_RUNLOCK(inp);
6984 }
6985 SCTP_INP_INFO_RUNLOCK();
6986 CURVNET_RESTORE();
6987 }
6988 VNET_LIST_RUNLOCK_NOSLEEP();
6989 NET_EPOCH_EXIT(et);
6990 }
6991
6992 EVENTHANDLER_DEFINE(vm_lowmem, sctp_drain, NULL, LOWMEM_PRI_DEFAULT);
6993 EVENTHANDLER_DEFINE(mbuf_lowmem, sctp_drain, NULL, LOWMEM_PRI_DEFAULT);
6994
6995 /*
6996 * start a new iterator
6997 * iterates through all endpoints and associations based on the pcb_state
6998 * flags and asoc_state. "af" (mandatory) is executed for all matching
6999 * assocs and "ef" (optional) is executed when the iterator completes.
7000 * "inpf" (optional) is executed for each new endpoint as it is being
7001 * iterated through. inpe (optional) is called when the inp completes
7002 * its way through all the stcbs.
7003 */
7004 int
7005 sctp_initiate_iterator(inp_func inpf,
7006 asoc_func af,
7007 inp_func inpe,
7008 uint32_t pcb_state,
7009 uint32_t pcb_features,
7010 uint32_t asoc_state,
7011 void *argp,
7012 uint32_t argi,
7013 end_func ef,
7014 struct sctp_inpcb *s_inp,
7015 uint8_t chunk_output_off)
7016 {
7017 struct sctp_iterator *it = NULL;
7018
7019 if (af == NULL) {
7020 return (-1);
7021 }
7022 if (SCTP_BASE_VAR(sctp_pcb_initialized) == 0) {
7023 SCTP_PRINTF("%s: abort on initialize being %d\n", __func__,
7024 SCTP_BASE_VAR(sctp_pcb_initialized));
7025 return (-1);
7026 }
7027 SCTP_MALLOC(it, struct sctp_iterator *, sizeof(struct sctp_iterator),
7028 SCTP_M_ITER);
7029 if (it == NULL) {
7030 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_PCB, ENOMEM);
7031 return (-1);
7032 }
7033 memset(it, 0, sizeof(*it));
7034 it->function_assoc = af;
7035 it->function_inp = inpf;
7036 if (inpf)
7037 it->done_current_ep = 0;
7038 else
7039 it->done_current_ep = 1;
7040 it->function_atend = ef;
7041 it->pointer = argp;
7042 it->val = argi;
7043 it->pcb_flags = pcb_state;
7044 it->pcb_features = pcb_features;
7045 it->asoc_state = asoc_state;
7046 it->function_inp_end = inpe;
7047 it->no_chunk_output = chunk_output_off;
7048 it->vn = curvnet;
7049 if (s_inp) {
7050 /* Assume lock is held here */
7051 it->inp = s_inp;
7052 SCTP_INP_INCR_REF(it->inp);
7053 it->iterator_flags = SCTP_ITERATOR_DO_SINGLE_INP;
7054 } else {
7055 SCTP_INP_INFO_RLOCK();
7056 it->inp = LIST_FIRST(&SCTP_BASE_INFO(listhead));
7057 if (it->inp) {
7058 SCTP_INP_INCR_REF(it->inp);
7059 }
7060 SCTP_INP_INFO_RUNLOCK();
7061 it->iterator_flags = SCTP_ITERATOR_DO_ALL_INP;
7062 }
7063 SCTP_IPI_ITERATOR_WQ_LOCK();
7064 if (SCTP_BASE_VAR(sctp_pcb_initialized) == 0) {
7065 SCTP_IPI_ITERATOR_WQ_UNLOCK();
7066 SCTP_PRINTF("%s: rollback on initialize being %d it=%p\n", __func__,
7067 SCTP_BASE_VAR(sctp_pcb_initialized), it);
7068 SCTP_FREE(it, SCTP_M_ITER);
7069 return (-1);
7070 }
7071 TAILQ_INSERT_TAIL(&sctp_it_ctl.iteratorhead, it, sctp_nxt_itr);
7072 if (sctp_it_ctl.iterator_running == 0) {
7073 sctp_wakeup_iterator();
7074 }
7075 SCTP_IPI_ITERATOR_WQ_UNLOCK();
7076 /* sa_ignore MEMLEAK {memory is put on the tailq for the iterator} */
7077 return (0);
7078 }
7079
7080 /*
7081 * Atomically add flags to the sctp_flags of an inp.
7082 * To be used when the write lock of the inp is not held.
7083 */
7084 void
7085 sctp_pcb_add_flags(struct sctp_inpcb *inp, uint32_t flags)
7086 {
7087 uint32_t old_flags, new_flags;
7088
7089 do {
7090 old_flags = inp->sctp_flags;
7091 new_flags = old_flags | flags;
7092 } while (atomic_cmpset_int(&inp->sctp_flags, old_flags, new_flags) == 0);
7093 }
Cache object: cb294f500a6ad6f531fbcc0fff237660
|