/*- * SPDX - License - Identifier : BSD - 3 - Clause * * Copyright ( c ) 2001 - 2008 , by Cisco Systems , Inc . All rights reserved . * Copyright ( c ) 2008 - 2012 , by Randall Stewart . All rights reserved . * Copyright ( c ) 2008 - 2012 , by Michael Tuexen . All rights reserved . * * Redistribution and use in source and binary forms , with or without * modification , are permitted provided that the following conditions are met : * * a ) Redistributions of source code must retain the above copyright notice , * this list of conditions and the following disclaimer . * * b ) Redistributions in binary form must reproduce the above copyright * notice , this list of conditions and the following disclaimer in * the documentation and / or other materials provided with the distribution . * * c ) Neither the name of Cisco Systems , Inc . nor the names of its * contributors may be used to endorse or promote products derived * from this software without specific prior written permission . * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * " AS IS " AND ANY EXPRESS OR IMPLIED WARRANTIES , INCLUDING , BUT NOT LIMITED TO , * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED . IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE * LIABLE FOR ANY DIRECT , INDIRECT , INCIDENTAL , SPECIAL , EXEMPLARY , OR * CONSEQUENTIAL DAMAGES ( INCLUDING , BUT NOT LIMITED TO , PROCUREMENT OF * SUBSTITUTE GOODS OR SERVICES ; LOSS OF USE , DATA , OR PROFITS ; OR BUSINESS * INTERRUPTION ) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY , WHETHER IN * CONTRACT , STRICT LIABILITY , OR TORT ( INCLUDING NEGLIGENCE OR OTHERWISE ) * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE , EVEN IF ADVISED OF * THE POSSIBILITY OF SUCH DAMAGE . #include <netinet/sctp_os.h>#include <netinet/sctp_var.h>#include <netinet/sctp_sysctl.h>#include <netinet/sctp_pcb.h>#include <netinet/sctp_header.h>#include <netinet/sctputil.h>#include <netinet/sctp_output.h>#include <netinet/sctp_input.h>#include <netinet/sctp_auth.h>#include <netinet/sctp_indata.h>#include <netinet/sctp_asconf.h>#include <netinet/sctp_bsd_addr.h>#include <netinet/sctp_timer.h>#include <netinet/sctp_crc32.h>#if defined (__FreeBSD__) && !defined (__Userspace__)#include <netinet/sctp_kdtrace.h>#endif #if defined (INET) || defined (INET6)#if !defined (_WIN32)#include <netinet/udp.h>#endif #endif #if defined (__FreeBSD__) && !defined (__Userspace__)#include <sys/smp.h>#endif static void struct sctp_tcb *stcb)struct sctp_nets *net;/* This now not only stops all cookie timers * it also stops any INIT timers as well . This * will make sure that the timers are stopped in * all collision cases . if (net->rxt_timer.type == SCTP_TIMER_TYPE_COOKIE) {else if (net->rxt_timer.type == SCTP_TIMER_TYPE_INIT) {/* INIT handler */ static void struct mbuf *m, int iphlen, int offset,struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,struct sctp_init_chunk *cp, struct sctp_inpcb *inp,struct sctp_tcb *stcb, struct sctp_nets *net,#if defined (__FreeBSD__) && !defined (__Userspace__)#endif struct sctp_init *init;struct mbuf *op_err;"sctp_handle_init: handling INIT tcb:%p\n" ,void *)stcb);if (stcb == NULL) {/* Validate parameters */ if (ntohl(init->initiate_tag) == 0 ) {goto outnow;if ((ntohl(init->a_rwnd) < SCTP_MIN_RWND) ||0 ) ||0 )) {/* protocol error... send abort */ "" );#if defined (__FreeBSD__) && !defined (__Userspace__)#endif goto outnow;if (sctp_validate_init_auth_params(m, offset + sizeof (*cp),/* auth parameter(s) error... send abort */ "Problem with AUTH parameters" );#if defined (__FreeBSD__) && !defined (__Userspace__)#endif goto outnow;/* We are only accepting if we have a listening socket.*/ if ((stcb == NULL) &&/* * FIX ME ? ? What about TCP model and we have a * match / restart case ? Actually no fix is needed . * the lookup will always find the existing assoc so stcb * would not be NULL . It may be questionable to do this * since we COULD just send back the INIT - ACK and hope that * the app did accept ( ) ' s by the time the COOKIE was sent . But * there is a price to pay for COOKIE generation and I don ' t * want to pay it on the chance that the app will actually do * some accepts ( ) . The App just looses and should NOT be in * this state : - ) if (SCTP_BASE_SYSCTL(sctp_blackhole) == 0 ) {"No listener" );0 , op_err,#if defined (__FreeBSD__) && !defined (__Userspace__)#endif goto outnow;if ((stcb != NULL) &&"sctp_handle_init: sending SHUTDOWN-ACK\n" );else {"sctp_handle_init: sending INIT-ACK\n" );#if defined (__FreeBSD__) && !defined (__Userspace__)#endif if (stcb == NULL) {/* * process peer " INIT / INIT - ACK " chunk returns value < 0 on error int struct sctp_tcb *stcb, int so_locked)int unsent_data;unsigned int i;struct sctp_stream_queue_pending *sp;struct sctp_association *asoc;/* This function returns if any stream has true unsent data on it. * Note that as it looks through it will clean up any places that * have old data that has been sent but left at top of stream queue . 0 ;if (!stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc)) {/* Check to see if some data queued */ for (i = 0 ; i < stcb->asoc.streamoutcnt; i++) {/*sa_ignore FREED_MEMORY*/ if (sp == NULL) {continue ;if ((sp->msg_is_complete) &&0 ) &&/* We are doing differed cleanup. Last * time through when we took all the data * the sender_all_done was not set . if (sp->put_last_out == 0 ) {"Gak, put out entire msg with NO end!-1\n" );"sender_done:%d len:%d msg_comp:%d put_last_out:%d\n" ,1 );if (sp->net) {if (sp->data) {if (!TAILQ_EMPTY(&stcb->asoc.strmout[i].outqueue)) {else {if (unsent_data > 0 ) {break ;return (unsent_data);static int struct sctp_init_chunk *cp, struct sctp_tcb *stcb)struct sctp_init *init;struct sctp_association *asoc;struct sctp_nets *lnet;unsigned int i;/* save off parameters */ /* init tsn's */ 1 ;if (!TAILQ_EMPTY(&asoc->nets)) {/* update any ssthresh's that may have a default */ if (SCTP_BASE_SYSCTL(sctp_logging_level) & (SCTP_CWND_MONITOR_ENABLE|SCTP_CWND_LOGGING_ENABLE)) {0 , SCTP_CWND_INITIALIZATION);if (asoc->pre_open_streams > ntohs(init->num_inbound_streams)) {unsigned int newcnt;struct sctp_stream_out *outs;struct sctp_stream_queue_pending *sp, *nsp;struct sctp_tmit_chunk *chk, *nchk;/* abandon the upper streams */ if (chk->rec.data.sid >= newcnt) {if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0 ) {#ifdef INVARIANTSelse {"No chunks on the queues for sid %u." , chk->rec.data.sid);#endif if (chk->data != NULL) {1 );0 , chk, SCTP_SO_NOT_LOCKED);if (chk->data) {/*sa_ignore FREED_MEMORY*/ if (asoc->strmout) {for (i = newcnt; i < asoc->pre_open_streams; i++) {1 );0 , sp, SCTP_SO_NOT_LOCKED);if (sp->data) {if (sp->net) {/* Free the chunk */ /*sa_ignore FREED_MEMORY*/ /* cut back the count */ if (asoc->strmout) {for (i = 0 ; i < asoc->streamoutcnt; i++) {/* EY - nr_sack: initialize highest tsn in nr_mapping_array */ if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {0 , 5 , asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);/* This is the next one we expect */ 1 ;/* open the requested streams */ if (asoc->strmin != NULL) {/* Free the old ones */ for (i = 0 ; i < asoc->streamincnt; i++) {if (asoc->max_inbound_streams > ntohs(init->num_outbound_streams)) {else {struct sctp_stream_in *, asoc->streamincnt *sizeof (struct sctp_stream_in), SCTP_M_STRMI);if (asoc->strmin == NULL) {/* we didn't get memory for the streams! */ "process_init: couldn't get memory for the streams!\n" );return (-1 );for (i = 0 ; i < asoc->streamincnt; i++) {0 xffffffff;0 ;0 ;/* * load_address_from_init will put the addresses into the * association when the COOKIE is processed or the INIT - ACK is * processed . Both types of COOKIE ' s existing and new call this * routine . It will remove addresses that are no longer in the * association ( for the restarting case where addresses are * removed ) . Up front when the INIT arrives we will discard it if it * is a restart and new addresses have been added . /* sa_ignore MEMLEAK */ return (0 );/* * INIT - ACK message processing / consumption returns value < 0 on error static int struct mbuf *m, int iphlen, int offset,struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,struct sctp_nets *net, int *abort_no_unlock,#if defined (__FreeBSD__) && !defined (__Userspace__)#endif struct sctp_association *asoc;struct mbuf *op_err;int retval, abort_flag, cookie_found;int initack_limit;int nat_friendly = 0 ;/* First verify that we have no illegal param's */ 0 ;0 ;sizeof (struct sctp_init_chunk)),struct sctp_chunkhdr *)cp,if (abort_flag) {/* Send an abort and notify peer */ #if defined (__FreeBSD__) && !defined (__Userspace__)#endif 1 ;return (-1 );if (!cookie_found) {/* Only report the missing cookie parameter */ if (op_err != NULL) {sizeof (struct sctp_error_missing_param) + sizeof (uint16_t));/* We abort with an error of missing mandatory param */ 0 , M_NOWAIT, 1 , MT_DATA);if (op_err != NULL) {struct sctp_error_missing_param *cause;struct sctp_error_missing_param *);/* Subtract the reserved param */ 1 );0 ] = htons(SCTP_STATE_COOKIE);#if defined (__FreeBSD__) && !defined (__Userspace__)#endif 1 ;return (-3 );/* process the peer's parameters in the INIT-ACK */ if (sctp_process_init((struct sctp_init_chunk *)cp, stcb) < 0 ) {if (op_err != NULL) {"" );"sctp_process_init() failed\n" );#if defined (__FreeBSD__) && !defined (__Userspace__)#endif 1 ;return (-1 );/* load all addresses */ if ((retval = sctp_load_addresses_from_init(stcb, m,sizeof (struct sctp_init_chunk),0 ) {if (op_err != NULL) {"Problem with address parameters" );"Load addresses from INIT causes an abort %d\n" ,#if defined (__FreeBSD__) && !defined (__Userspace__)#endif 1 ;return (-1 );/* if the peer doesn't support asconf, flush the asconf queue */ if (asoc->asconf_supported == 0 ) {struct sctp_asconf_addr *param, *nparam;if (op_err) {/* queuing will steal away the mbuf chain to the out queue */ /* extract the cookie and queue it to "echo" it back... */ if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {0 ,/* * Cancel the INIT timer , We do this first before queueing the * cookie . We always cancel at the primary to assume that we are * canceling the timer started by the INIT which always goes to the * primary . /* calculate the RTO */ if (asoc->overall_error_count == 0 ) {0 ;0 ;#if defined (__Userspace__)if (stcb->sctp_ep->recv_callback) {if (stcb->sctp_socket) {struct sctp_inpcb *inp;sizeof (struct sctp_data_chunk));_resv);/* check if the amount free in the send socket buffer crossed the threshold */ if (inp->send_callback &&0 ) &&0 ))) {1 );1 );#endif return (retval);static void struct sctp_heartbeat_chunk *cp,struct sctp_tcb *stcb, struct sctp_nets *net)union sctp_sockstore store;struct sctp_nets *r_net, *f_net;struct timeval tv;int req_prim = 0 ;if (ntohs(cp->ch.chunk_length) != sizeof (struct sctp_heartbeat_chunk)) {/* Invalid length */ return ;0 , sizeof (store));switch (cp->heartbeat.hb_info.addr_family) {#ifdef INETcase AF_INET:if (cp->heartbeat.hb_info.addr_len == sizeof (struct sockaddr_in)) {#ifdef HAVE_SIN_LEN#endif sizeof (store.sin.sin_addr));else {return ;break ;#endif #ifdef INET6case AF_INET6:if (cp->heartbeat.hb_info.addr_len == sizeof (struct sockaddr_in6)) {#ifdef HAVE_SIN6_LEN#endif sizeof (struct in6_addr));else {return ;break ;#endif #if defined (__Userspace__)case AF_CONN:if (cp->heartbeat.hb_info.addr_len == sizeof (struct sockaddr_conn)) {#ifdef HAVE_SCONN_LEN#endif sizeof (void *));else {return ;break ;#endif default :return ;if (r_net == NULL) {"Huh? I can't find the address I sent it to, discard\n" );return ;if ((r_net && (r_net->dest_state & SCTP_ADDR_UNCONFIRMED)) &&/* * If the its a HB and it ' s random value is correct when can * confirm the destination . if (r_net->dest_state & SCTP_ADDR_REQ_PRIMARY) {if (f_net != r_net) {/* first one on the list is NOT the primary * sctp_cmpaddr ( ) is much more efficient if * the primary is the first on the list , make it * so . 1 ;0 , (void *)r_net, SCTP_SO_NOT_LOCKED);if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {0 ,0 ;0 ;1 ;/* Now lets do a RTO with this */ if ((r_net->dest_state & SCTP_ADDR_REACHABLE) == 0 ) {0 , (void *)r_net, SCTP_SO_NOT_LOCKED);if (r_net->dest_state & SCTP_ADDR_PF) {if (old_error_counter > 0 ) {if (r_net == stcb->asoc.primary_destination) {if (stcb->asoc.alternate) {/* release the alternate, primary is good */ /* Mobility adaptation */ if (req_prim) {if ((sctp_is_mobility_feature_on(stcb->sctp_ep,if (sctp_is_mobility_feature_on(stcb->sctp_ep,if (sctp_is_mobility_feature_on(stcb->sctp_ep,static int struct sctp_tcb *stcb)/* * Return 0 means we want you to proceed with the abort * non - zero means no abort processing . struct sctpasochead *head;if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||1 );1 );else {return (0 );1 );if (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) {/* generate a new vtag and send init */ /* put it in the bucket in the vtag hash of assoc's for the system */ return (1 );else {/* treat like a case where the cookie expired i.e.: * - dump current cookie . * - generate a new vtag . * - resend init . /* generate a new vtag and send init */ /* put it in the bucket in the vtag hash of assoc's for the system */ return (1 );return (0 );static int struct sctp_tcb *stcb,struct sctp_nets *net)/* return 0 means we want you to proceed with the abort * non - zero means no abort processing if (stcb->asoc.auth_supported == 0 ) {"sctp_handle_nat_missing_state: Peer does not support AUTH, cannot send an asconf\n" );return (0 );return (1 );/* Returns 1 if the stcb was aborted, 0 otherwise */ static int struct sctp_abort_chunk *abort,struct sctp_tcb *stcb, struct sctp_nets *net)#if defined (__APPLE__) && !defined (__Userspace__)struct socket *so;#endif "sctp_handle_abort: handling ABORT\n" );if (stcb == NULL)return (0 );if (len >= sizeof (struct sctp_chunkhdr) + sizeof (struct sctp_error_cause)) {/* Need to check the cause codes for our * two magic nat aborts which don ' t kill the assoc * necessarily . struct sctp_error_cause *cause;struct sctp_error_cause *)(abort + 1 );if (error == SCTP_CAUSE_NAT_COLLIDING_STATE) {"Received Colliding state, ABORT flags:%x\n" ,if (sctp_handle_nat_colliding_state(stcb)) {return (0 );else if (error == SCTP_CAUSE_NAT_MISSING_STATE) {"Received missing state, ABORT flags:%x\n" ,if (sctp_handle_nat_missing_state(stcb, net)) {return (0 );else {0 ;/* stop any receive timers */ /* notify user of the abort and clean up... */ false , error, abort, SCTP_SO_NOT_LOCKED);/* free the tcb */ if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||#ifdef SCTP_ASOCLOG_OF_TSNS#endif #if defined (__APPLE__) && !defined (__Userspace__)1 );1 );1 );#endif void )sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,#if defined (__APPLE__) && !defined (__Userspace__)1 );#endif "sctp_handle_abort: finished\n" );return (1 );static void struct sctp_tcb *stcb)struct sctp_nets *net;0 ;/* For each network start: * 1 ) A pmtu timer . * 2 ) A HB timer * 3 ) If the dest in unconfirmed send * a hb as well if under max_hb_burst have * been sent . if ((net->dest_state & SCTP_ADDR_UNCONFIRMED) &&if (cnt_hb_sent) {static void struct sctp_tcb *stcb, int *abort_flag)char msg[SCTP_DIAG_INFO_LEN];struct sctp_association *asoc;struct mbuf *op_err;unsigned int i;0 ;if (SCTP_TSN_GT(asoc->highest_tsn_inside_map, asoc->cumulative_tsn) ||sizeof (msg), "Missing TSN" );1 ;if (!*abort_flag) {for (i = 0 ; i < asoc->streamincnt; i++) {if (!TAILQ_EMPTY(&asoc->strmin[i].inqueue) ||sizeof (msg), "Missing user data" );1 ;break ;if (*abort_flag) {false , SCTP_SO_NOT_LOCKED);static void struct sctp_shutdown_chunk *cp,struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_flag)int some_on_streamwheel;int old_state;#if defined (__APPLE__) && !defined (__Userspace__)struct socket *so;#endif "sctp_handle_shutdown: handling SHUTDOWN\n" );if (stcb == NULL)return ;if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||return ;if (ntohs(cp->ch.chunk_length) != sizeof (struct sctp_shutdown_chunk)) {/* Shutdown NOT the expected size */ return ;if (*abort_flag) {return ;if (*abort_flag) {return ;if (stcb->sctp_socket) {if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_RECEIVED) &&/* notify upper layer that peer has initiated a shutdown */ 0 , NULL, SCTP_SO_NOT_LOCKED);/* reset time */ void )SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);if (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_SENT) {/* * stop the shutdown timer , since we WILL move to * SHUTDOWN - ACK - SENT . /* Now is there unsent data on a stream somewhere? */ if (!TAILQ_EMPTY(&stcb->asoc.send_queue) ||/* By returning we will push more data out */ return ;else {/* no outstanding data to send, so move on... */ /* send SHUTDOWN-ACK */ /* move to SHUTDOWN-ACK-SENT state */ if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||if (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT) {else if (old_state == SCTP_STATE_SHUTDOWN_ACK_SENT) {static void struct sctp_shutdown_ack_chunk *cp SCTP_UNUSED,struct sctp_tcb *stcb,struct sctp_nets *net)int abort_flag;#if defined (__APPLE__) && !defined (__Userspace__)struct socket *so;#endif "sctp_handle_shutdown_ack: handling SHUTDOWN ACK\n" );if (stcb == NULL) {return ;/* process according to association state */ if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||/* unexpected SHUTDOWN-ACK... do OOTB handling... */ 1 );return ;if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) &&/* unexpected SHUTDOWN-ACK... so ignore... */ return ;if (abort_flag) {return ;#ifdef INVARIANTSif (!TAILQ_EMPTY(&stcb->asoc.send_queue) ||"Queues are not empty when handling SHUTDOWN-ACK" );#endif /* stop the timer */ /* send SHUTDOWN-COMPLETE */ 0 );/* notify upper layer protocol */ if (stcb->sctp_socket) {if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||0 , NULL, SCTP_SO_NOT_LOCKED);/* free the TCB but first save off the ep */ #if defined (__APPLE__) && !defined (__Userspace__)1 );1 );1 );#endif void )sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,#if defined (__APPLE__) && !defined (__Userspace__)1 );#endif static void struct sctp_tcb *stcb, uint8_t chunk_type)switch (chunk_type) {case SCTP_ASCONF_ACK:case SCTP_ASCONF:break ;case SCTP_IFORWARD_CUM_TSN:case SCTP_FORWARD_CUM_TSN:0 ;break ;default :"Peer does not support chunk type %d (0x%x).\n" ,break ;/* * Skip past the param header and then we will find the param that caused the * problem . There are a number of param ' s in a ASCONF OR the prsctp param * these will turn of specific features . * XXX : Is this the right thing to do ? static void struct sctp_tcb *stcb, uint16_t parameter_type)switch (parameter_type) {/* pr-sctp draft */ case SCTP_PRSCTP_SUPPORTED:0 ;break ;case SCTP_SUPPORTED_CHUNK_EXT:break ;/* draft-ietf-tsvwg-addip-sctp */ case SCTP_HAS_NAT_SUPPORT:0 ;break ;case SCTP_ADD_IP_ADDRESS:case SCTP_DEL_IP_ADDRESS:case SCTP_SET_PRIM_ADDR:0 ;break ;case SCTP_SUCCESS_REPORT:case SCTP_ERROR_CAUSE_IND:"Huh, the peer does not support success? or error cause?\n" );"Turning off ASCONF to this strange peer\n" );0 ;break ;default :"Peer does not support param type %d (0x%x)??\n" ,break ;static int struct sctp_chunkhdr *ch,struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t limit)struct sctp_error_cause *cause;struct sctp_association *asoc;#if defined (__APPLE__) && !defined (__Userspace__)struct socket *so;#endif /* parse through all of the errors and process */ struct sctp_error_cause *)((caddr_t)ch +sizeof (struct sctp_chunkhdr));if (remaining_length > limit) {if (remaining_length >= sizeof (struct sctp_chunkhdr)) {sizeof (struct sctp_chunkhdr);else {0 ;0 ;while (remaining_length >= sizeof (struct sctp_error_cause)) {/* Process an Error Cause */ if ((cause_length > remaining_length) || (cause_length == 0 )) {/* Invalid cause length, possibly due to truncation. */ "Bogus length in cause - bytes left: %u cause length: %u\n" ,return (0 );if (code == 0 ) {/* report the first error cause */ switch (cause_code) {case SCTP_CAUSE_INVALID_STREAM:case SCTP_CAUSE_MISSING_PARAM:case SCTP_CAUSE_INVALID_PARAM:case SCTP_CAUSE_NO_USER_DATA:"Software error we got a %u back? We have a bug :/ (or do they?)\n" ,break ;case SCTP_CAUSE_NAT_COLLIDING_STATE:"Received Colliding state, ERROR flags: %x\n" ,if (sctp_handle_nat_colliding_state(stcb)) {return (0 );break ;case SCTP_CAUSE_NAT_MISSING_STATE:"Received missing state, ERROR flags: %x\n" ,if (sctp_handle_nat_missing_state(stcb, net)) {return (0 );break ;case SCTP_CAUSE_STALE_COOKIE:/* * We only act if we have echoed a cookie and are * waiting . if ((cause_length >= sizeof (struct sctp_error_stale_cookie)) &&struct timeval now;struct sctp_error_stale_cookie *stale_cookie;if (asoc->stale_cookie_count > asoc->max_init_times) {false , true, 0 , NULL, SCTP_SO_NOT_LOCKED);#if defined (__APPLE__) && !defined (__Userspace__)1 );1 );1 );#endif void )sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,#if defined (__APPLE__) && !defined (__Userspace__)1 );#endif return (-1 );struct sctp_error_stale_cookie *)cause;if (stale_time == 0 ) {/* Use an RTT as an approximation. */ void )SCTP_GETTIME_TIMEVAL(&now);1000000 * (uint64_t)now.tv_sec + (uint64_t)now.tv_usec;if (stale_time == 0 ) {1 ;/* * stale_time is in usec , convert it to msec . * Round upwards , to ensure that it is non - zero . 999 ) / 1000 ;/* Double it, to be more robust on RTX. */ 2 * stale_time;if (asoc->overall_error_count == 0 ) {0 ;/* Blast back to INIT state */ void )SCTP_GETTIME_TIMEVAL(&asoc->time_entered);break ;case SCTP_CAUSE_UNRESOLVABLE_ADDR:/* * Nothing we can do here , we don ' t do hostname * addresses so if the peer does not like my IPv6 * ( or IPv4 for that matter ) it does not matter . If * they don ' t support that type of address , they can * NOT possibly get that packet type . . . i . e . with no * IPv6 you can ' t receive a IPv6 packet . so we can * safely ignore this one . If we ever added support * for HOSTNAME Addresses , then we would need to do * something here . break ;case SCTP_CAUSE_UNRECOG_CHUNK:if (cause_length >= sizeof (struct sctp_error_unrecognized_chunk)) {struct sctp_error_unrecognized_chunk *unrec_chunk;struct sctp_error_unrecognized_chunk *)cause;break ;case SCTP_CAUSE_UNRECOG_PARAM:/* XXX: We only consider the first parameter */ if (cause_length >= sizeof (struct sctp_error_cause) + sizeof (struct sctp_paramhdr)) {struct sctp_paramhdr *unrec_parameter;struct sctp_paramhdr *)(cause + 1 );break ;case SCTP_CAUSE_COOKIE_IN_SHUTDOWN:/* * We ignore this since the timer will drive out a * new cookie anyway and there timer will drive us * to send a SHUTDOWN_COMPLETE . We can ' t send one * here since we don ' t have their tag . break ;case SCTP_CAUSE_DELETING_LAST_ADDR:case SCTP_CAUSE_RESOURCE_SHORTAGE:case SCTP_CAUSE_DELETING_SRC_ADDR:/* * We should NOT get these here , but in a * ASCONF - ACK . "Peer sends ASCONF errors in a error cause with code %u.\n" ,break ;case SCTP_CAUSE_OUT_OF_RESC:/* * And what , pray tell do we do with the fact that * the peer is out of resources ? Not really sure we * could do anything but abort . I suspect this * should have came WITH an abort instead of in a * OP - ERROR . break ;default :"sctp_handle_error: unknown code 0x%x\n" ,break ;if (remaining_length >= adjust) {else {0 ;struct sctp_error_cause *)((caddr_t)cause + adjust);return (0 );static int struct mbuf *m, int iphlen, int offset,struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,struct sctp_nets *net, int *abort_no_unlock,#if defined (__FreeBSD__) && !defined (__Userspace__)#endif struct sctp_init_ack *init_ack;struct mbuf *op_err;"sctp_handle_init_ack: handling INIT-ACK\n" );if (stcb == NULL) {"sctp_handle_init_ack: TCB is null\n" );return (-1 );/* Only process the INIT-ACK chunk in COOKIE WAIT state.*/ if (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) {/* Validate parameters. */ if ((ntohl(init_ack->initiate_tag) == 0 ) ||0 ) ||0 )) {/* One of the mandatory parameters is illegal. */ "" );#if defined (__FreeBSD__) && !defined (__Userspace__)#endif 1 ;return (-1 );if (stcb->asoc.primary_destination->dest_state &/* * The primary is where we sent the INIT , we can * always consider it confirmed when the INIT - ACK is * returned . Do this before we load addresses * though . 0 , (void *)stcb->asoc.primary_destination, SCTP_SO_NOT_LOCKED);if (sctp_process_init_ack(m, iphlen, offset, src, dst, sh, cp, stcb,#if defined (__FreeBSD__) && !defined (__Userspace__)#endif 0 ) {/* error in parsing parameters */ return (-1 );/* Update our state. */ "moving to COOKIE-ECHOED state\n" );/* Reset the RTO calculation. */ if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {0 ,0 ;void )SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);/* * Collapse the init timer back in case of a exponential * backoff . /* * The output routine at the end of the inbound data processing * will cause the cookie to be sent . "Leaving handle-init-ack end\n" );return (0 );else {return (-1 );static struct sctp_tcb *struct mbuf *m, int iphlen, int offset,struct sockaddr *src, struct sockaddr *dst,struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,struct sctp_inpcb *inp, struct sctp_nets **netp,struct sockaddr *init_src, int *notification,int auth_skipped, uint32_t auth_offset, uint32_t auth_len,#if defined (__FreeBSD__) && !defined (__Userspace__)#endif /* * handle a state cookie for an existing association m : input packet mbuf * chain - - assumes a pullup on IP / SCTP / COOKIE - ECHO chunk note : this is a * " split " mbuf and the cookie signature does not exist offset : offset into * mbuf to the cookie - echo chunk static struct sctp_tcb *struct mbuf *m, int iphlen, int offset,struct sockaddr *src, struct sockaddr *dst,struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets **netp,struct sockaddr *init_src, int *notification,int auth_skipped, uint32_t auth_offset, uint32_t auth_len,#if defined (__FreeBSD__) && !defined (__Userspace__)#endif struct sctp_association *asoc;struct sctp_init_chunk *init_cp, init_buf;struct sctp_init_ack_chunk *initack_cp, initack_buf;struct sctp_asconf_addr *aparam, *naparam;struct sctp_asconf_ack *aack, *naack;struct sctp_tmit_chunk *chk, *nchk;struct sctp_stream_reset_list *strrst, *nstrrst;struct sctp_queued_to_read *sq, *nsq;struct sctp_nets *net;struct mbuf *op_err;int init_offset, initack_offset, i;int retval;int spec_flag = 0 ;#if defined (SCTP_DETAILED_STR_STATS)int j;#endif /* I know that the TCB is non-NULL from the caller */ for (how_indx = 0 ; how_indx < sizeof (asoc->cookie_how); how_indx++) {if (asoc->cookie_how[how_indx] == 0 )break ;if (how_indx < sizeof (asoc->cookie_how)) {1 ;if (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) {/* SHUTDOWN came in after sending INIT-ACK */ "" );#if defined (__FreeBSD__) && !defined (__Userspace__)#endif if (how_indx < sizeof (asoc->cookie_how))2 ;return (NULL);/* * find and validate the INIT chunk in the cookie ( peer ' s info ) the * INIT should start after the cookie - echo header struct ( chunk * header , state cookie header struct ) sizeof (struct sctp_cookie_echo_chunk);struct sctp_init_chunk *)sizeof (struct sctp_init_chunk),if (init_cp == NULL) {/* could not pull a INIT chunk in cookie */ return (NULL);if (init_cp->ch.chunk_type != SCTP_INITIATION) {return (NULL);/* * find and validate the INIT - ACK chunk in the cookie ( my info ) the * INIT - ACK follows the INIT chunk struct sctp_init_ack_chunk *)sizeof (struct sctp_init_ack_chunk),if (initack_cp == NULL) {/* could not pull INIT-ACK chunk in cookie */ return (NULL);if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {return (NULL);if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&/* * case D in Section 5 . 2 . 4 Table 2 : MMAA process accordingly * to get into the OPEN state if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {/*- * Opps , this means that we somehow generated two vtag ' s * the same . I . e . we did : * Us Peer * < - - - INIT ( tag = a ) - - - - - - * - - - - INIT - ACK ( tag = t ) - - > * - - - - INIT ( tag = t ) - - - - - - > * 1 * < - - - INIT - ACK ( tag = a ) - - - * < - - - - CE ( tag = t ) - - - - - - - - - - - - - * 2 * * At point * 1 we should be generating a different * tag t ' . Which means we would throw away the CE and send * ours instead . Basically this is case C ( throw away side ) . if (how_indx < sizeof (asoc->cookie_how))17 ;return (NULL);switch (SCTP_GET_STATE(stcb)) {case SCTP_STATE_COOKIE_WAIT:case SCTP_STATE_COOKIE_ECHOED:/* * INIT was sent but got a COOKIE_ECHO with the * correct tags . . . just accept it . . . but we must * process the init so that we can make sure we * have the right seq no ' s . /* First we must process the INIT !! */ if (sctp_process_init(init_cp, stcb) < 0 ) {if (how_indx < sizeof (asoc->cookie_how))3 ;"" );"sctp_process_init() failed\n" );#if defined (__FreeBSD__) && !defined (__Userspace__)#endif return (NULL);/* we have already processed the INIT so no problem */ /* update current state */ if (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)else if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||#if defined (__APPLE__) && !defined (__Userspace__)struct socket *so;#endif /* * Here is where collision would go if we * did a connect ( ) and instead got a * init / init - ack / cookie done before the * init - ack came back . . #if defined (__APPLE__) && !defined (__Userspace__)1 );1 );1 );if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {1 );return (NULL);#endif #if defined (__APPLE__) && !defined (__Userspace__)1 );#endif /* notify upper layer */ 1 ;if (stcb->asoc.sctp_autoclose_ticks &&break ;default :/* * we ' re in the OPEN state ( or beyond ) , so * peer must have simply lost the COOKIE - ACK break ;/* end switch */ if ((retval = sctp_load_addresses_from_init(stcb, m,sizeof (struct sctp_init_chunk),0 ) {if (how_indx < sizeof (asoc->cookie_how))4 ;"Problem with address parameters" );"Load addresses from INIT causes an abort %d\n" ,#if defined (__FreeBSD__) && !defined (__Userspace__)#endif return (NULL);/* respond with a COOKIE-ACK */ if (how_indx < sizeof (asoc->cookie_how))5 ;return (stcb);if (ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&0 &&0 ) {/* * case C in Section 5 . 2 . 4 Table 2 : XMOO silently discard if (how_indx < sizeof (asoc->cookie_how))6 ;return (NULL);/* If nat support, and the below and stcb is established, * send back a ABORT ( colliding state ) if we are established . if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) &&0 )))) {/* Special case - Peer's support nat. We may have * two init ' s that we gave out the same tag on since * one was not established . . i . e . we get INIT from host - 1 * behind the nat and we respond tag - a , we get a INIT from * host - 2 behind the nat and we get tag - a again . Then we * bring up host - 1 ( or 2 ' s ) assoc , Then comes the cookie * from hsot - 2 ( or 1 ) . Now we have colliding state . We must * send an abort here with colliding state indication . "" );0 , op_err,#if defined (__FreeBSD__) && !defined (__Userspace__)#endif return (NULL);if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&0 ))) {/* * case B in Section 5 . 2 . 4 Table 2 : MXAA or MOAA my info * should be ok , re - accept peer info if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {/* Extension of case C. * If we hit this , then the random number * generator returned the same vtag when we * first sent our INIT - ACK and when we later sent * our INIT . The side with the seq numbers that are * different will be the one that normally would * have hit case C . This in effect " extends " our vtags * in this collision case to be 64 bits . The same collision * could occur aka you get both vtag and seq number the * same twice in a row . . but is much less likely . If it * did happen then we would proceed through and bring * up the assoc . . we may end up with the wrong stream * setup however . . which would be bad . . but there is * no way to tell . . until we send on a stream that does * not exist : - ) if (how_indx < sizeof (asoc->cookie_how))7 ;return (NULL);if (how_indx < sizeof (asoc->cookie_how))8 ;/* * since we did not send a HB make sure we don ' t double * things 1 ;if (stcb->asoc.sctp_autoclose_ticks &&if (asoc->pre_open_streams < asoc->streamoutcnt) {if (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) {/* Ok the peer probably discarded our * data ( if we echoed a cookie + data ) . So anything * on the sent_queue should be marked for * retransmit , we may not get something to * kick us so it COULD still take a timeout * to move these . . but it can ' t hurt to mark them . if (chk->sent < SCTP_DATAGRAM_RESEND) {/* process the INIT info (peer's info) */ if (sctp_process_init(init_cp, stcb) < 0 ) {if (how_indx < sizeof (asoc->cookie_how))9 ;"" );"sctp_process_init() failed\n" );#if defined (__FreeBSD__) && !defined (__Userspace__)#endif return (NULL);if ((retval = sctp_load_addresses_from_init(stcb, m,sizeof (struct sctp_init_chunk),0 ) {if (how_indx < sizeof (asoc->cookie_how))10 ;"Problem with address parameters" );"Load addresses from INIT causes an abort %d\n" ,#if defined (__FreeBSD__) && !defined (__Userspace__)#endif return (NULL);if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||#if defined (__APPLE__) && !defined (__Userspace__)struct socket *so;#endif #if defined (__APPLE__) && !defined (__Userspace__)1 );1 );1 );if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {1 );return (NULL);#endif #if defined (__APPLE__) && !defined (__Userspace__)1 );#endif if (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)else else if (SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) {else {if (spec_flag) {/* only if we have retrans set do we do this. What * this call does is get only the COOKIE - ACK out * and then when we return the normal call to * sctp_chunk_output will get the retrans out * behind this . if (how_indx < sizeof (asoc->cookie_how))11 ;return (stcb);if ((ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&0 ) {struct sctpasochead *head;#if defined (__APPLE__) && !defined (__Userspace__)struct socket *so;#endif if (asoc->peer_supports_nat) {struct sctp_tcb *local_stcb;/* This is a gross gross hack. * Just call the cookie_new code since we * are allowing a duplicate association . * I hope this works . . . #if defined (__FreeBSD__) && !defined (__Userspace__)#endif if (local_stcb == NULL) {return (local_stcb);/* * case A in Section 5 . 2 . 4 Table 2 : XXMM ( peer restarted ) /* temp code */ if (how_indx < sizeof (asoc->cookie_how))12 ;false );/* notify upper layer */ 1 );if ((SCTP_GET_STATE(stcb) != SCTP_STATE_OPEN) &&if (SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) {else if (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) {if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {else if (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) {/* move to OPEN state, if not in SHUTDOWN_SENT */ if (asoc->pre_open_streams < asoc->streamoutcnt) {;1 ;1 ;1 ;0 ;if (asoc->mapping_array) {0 ,if (asoc->nr_mapping_array) {0 ,#if defined (__APPLE__) && !defined (__Userspace__)1 );#endif 1 );/* send up all the data */ 0 , SCTP_SO_LOCKED);for (i = 0 ; i < stcb->asoc.streamoutcnt; i++) {0 ;#if defined (SCTP_DETAILED_STR_STATS)for (j = 0 ; j < SCTP_PR_SCTP_MAX + 1 ; j++) {0 ;0 ;#else 0 ] = 0 ;0 ] = 0 ;#endif 0 ;0 ;0 ;if (sq->data) {if (chk->data) {if (chk->holds_key_ref)0 ;0 ;if (chk->data) {if (chk->holds_key_ref)if (aack->data != NULL) {/* process the INIT-ACK info (my info) */ /* pull from vtag hash */ /* re-insert to new vtag position */ /* * put it in the bucket in the vtag hash of assoc ' s for the * system #if defined (__APPLE__) && !defined (__Userspace__)1 );#endif 0 ;0 ;/* process the INIT info (peer's info) */ if (sctp_process_init(init_cp, stcb) < 0 ) {if (how_indx < sizeof (asoc->cookie_how))13 ;"" );"sctp_process_init() failed\n" );#if defined (__FreeBSD__) && !defined (__Userspace__)#endif return (NULL);/* * since we did not send a HB make sure we don ' t double * things 1 ;if ((retval = sctp_load_addresses_from_init(stcb, m,sizeof (struct sctp_init_chunk),0 ) {if (how_indx < sizeof (asoc->cookie_how))14 ;"Problem with address parameters" );"Load addresses from INIT causes an abort %d\n" ,#if defined (__FreeBSD__) && !defined (__Userspace__)#endif return (NULL);/* respond with a COOKIE-ACK */ if (how_indx < sizeof (asoc->cookie_how))15 ;if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE) &&0 )) {return (stcb);if (how_indx < sizeof (asoc->cookie_how))16 ;/* all other cases... */ return (NULL);/* * handle a state cookie for a new association m : input packet mbuf chain - - * assumes a pullup on IP / SCTP / COOKIE - ECHO chunk note : this is a " split " mbuf * and the cookie signature does not exist offset : offset into mbuf to the * cookie - echo chunk length : length of the cookie chunk to : where the init * was from returns a new TCB static struct sctp_tcb *struct mbuf *m, int iphlen, int offset,struct sockaddr *src, struct sockaddr *dst,struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,struct sctp_inpcb *inp, struct sctp_nets **netp,struct sockaddr *init_src, int *notification,int auth_skipped, uint32_t auth_offset, uint32_t auth_len,#if defined (__FreeBSD__) && !defined (__Userspace__)#endif struct sctp_tcb *stcb;struct sctp_init_chunk *init_cp, init_buf;struct sctp_init_ack_chunk *initack_cp, initack_buf;union sctp_sockstore store;struct sctp_association *asoc;int init_offset, initack_offset, initack_limit;int error = 0 ;#if defined (__APPLE__) && !defined (__Userspace__)struct socket *so;#endif /* * find and validate the INIT chunk in the cookie ( peer ' s info ) the * INIT should start after the cookie - echo header struct ( chunk * header , state cookie header struct ) sizeof (struct sctp_cookie_echo_chunk);struct sctp_init_chunk *)sizeof (struct sctp_init_chunk),if (init_cp == NULL) {/* could not pull a INIT chunk in cookie */ "process_cookie_new: could not pull INIT chunk hdr\n" );return (NULL);if (init_cp->ch.chunk_type != SCTP_INITIATION) {"HUH? process_cookie_new: could not find INIT chunk!\n" );return (NULL);/* * find and validate the INIT - ACK chunk in the cookie ( my info ) the * INIT - ACK follows the INIT chunk struct sctp_init_ack_chunk *)sizeof (struct sctp_init_ack_chunk),if (initack_cp == NULL) {/* could not pull INIT-ACK chunk in cookie */ "process_cookie_new: could not pull INIT-ACK chunk hdr\n" );return (NULL);if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {return (NULL);/* * NOTE : We can ' t use the INIT_ACK ' s chk_length to determine the * " initack_limit " value . This is because the chk_length field * includes the length of the cookie , but the cookie is omitted when * the INIT and INIT_ACK are tacked onto the cookie . . . /* * now that we know the INIT / INIT - ACK are in place , create a new TCB * and populate /* * Here we do a trick , we set in NULL for the proc / thread argument . We * do this since in effect we only use the p argument when * the socket is unbound and we must do an implicit bind . * Since we are getting a cookie , we cannot be unbound . #if defined (__FreeBSD__) && !defined (__Userspace__)struct thread *)NULL,#elif defined (_WIN32) && !defined (__Userspace__)#else struct proc *)NULL,#endif if (stcb == NULL) {struct mbuf *op_err;/* memory problem? */ "process_cookie_new: no room for another TCB!\n" );"" );struct sctp_tcb *)NULL, m, iphlen,#if defined (__FreeBSD__) && !defined (__Userspace__)#endif return (NULL);/* get scope variables out of cookie */ #if defined (__Userspace__)if ((asoc->scope.ipv4_addr_legal != cookie->ipv4_addr_legal) ||#else if ((asoc->scope.ipv4_addr_legal != cookie->ipv4_addr_legal) ||#endif struct mbuf *op_err;/* * Houston we have a problem . The EP changed while the * cookie was in flight . Only recourse is to abort the * association . "" );struct sctp_tcb *)NULL, m, iphlen,#if defined (__FreeBSD__) && !defined (__Userspace__)#endif #if defined (__APPLE__) && !defined (__Userspace__)1 );1 );1 );#endif void )sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,#if defined (__APPLE__) && !defined (__Userspace__)1 );#endif return (NULL);/* process the INIT-ACK info (my info) */ /* process the INIT info (peer's info) */ if (sctp_process_init(init_cp, stcb) < 0 ) {#if defined (__APPLE__) && !defined (__Userspace__)1 );1 );1 );#endif void )sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,#if defined (__APPLE__) && !defined (__Userspace__)1 );#endif return (NULL);/* load all addresses */ if (sctp_load_addresses_from_init(stcb, m,sizeof (struct sctp_init_chunk),0 ) {#if defined (__APPLE__) && !defined (__Userspace__)1 );1 );1 );#endif void )sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,#if defined (__APPLE__) && !defined (__Userspace__)1 );#endif return (NULL);/* * verify any preceding AUTH chunk that was skipped /* pull the local authentication parameters from the cookie/init-ack */ sizeof (struct sctp_init_ack_chunk),sizeof (struct sctp_init_ack_chunk)));if (auth_skipped) {struct sctp_auth_chunk *auth;if (auth_len <= SCTP_CHUNK_BUFFER_SIZE) {struct sctp_auth_chunk *)sctp_m_getptr(m, auth_offset, auth_len, auth_chunk_buf);else {if ((auth == NULL) || sctp_handle_auth(stcb, auth, m, auth_offset)) {/* auth HMAC failed, dump the assoc and packet */ "COOKIE-ECHO: AUTH failed\n" );#if defined (__APPLE__) && !defined (__Userspace__)1 );1 );1 );#endif void )sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,#if defined (__APPLE__) && !defined (__Userspace__)1 );#endif return (NULL);else {/* remaining chunks checked... good to go */ 1 ;/* * if we ' re doing ASCONFs , check to see if we have any new local * addresses that need to get added to the peer ( eg . addresses * changed while cookie echo in flight ) . This needs to be done * after we go to the OPEN state to do the correct asconf * processing . else , make sure we have the correct addresses in our * lists /* warning, we re-use sin, sin6, sa_store here! */ /* pull in local_address (our "from" address) */ switch (cookie->laddr_type) {#ifdef INETcase SCTP_IPV4_ADDRESS:/* source addr is IPv4 */ 0 , sizeof (struct sockaddr_in));#ifdef HAVE_SIN_LENsizeof (struct sockaddr_in);#endif 0 ];break ;#endif #ifdef INET6case SCTP_IPV6_ADDRESS:/* source addr is IPv6 */ 0 , sizeof (struct sockaddr_in6));#ifdef HAVE_SIN6_LENsizeof (struct sockaddr_in6);#endif sizeof (struct in6_addr));break ;#endif #if defined (__Userspace__)case SCTP_CONN_ADDRESS:/* source addr is conn */ 0 , sizeof (struct sockaddr_conn));#ifdef HAVE_SCONN_LENsizeof (struct sockaddr_conn);#endif sizeof (void *));break ;#endif default :#if defined (__APPLE__) && !defined (__Userspace__)1 );1 );1 );#endif void )sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,#if defined (__APPLE__) && !defined (__Userspace__)1 );#endif return (NULL);/* update current state */ "moving to OPEN state\n" );/* set up to notify upper layer */ if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||/* * This is an endpoint that called connect ( ) how it got a * cookie that is NEW is a bit of a mystery . It must be that * the INIT was sent , but before it got there . . a complete * INIT / INIT - ACK / COOKIE arrived . But of course then it * should have went to the other code . . not here . . oh well . . * a bit of protection is worth having . . * * XXXMJ unlocked #if defined (__APPLE__) && !defined (__Userspace__)1 );1 );1 );if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {1 );return (NULL);#endif #if defined (__APPLE__) && !defined (__Userspace__)1 );#endif else if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&/* * We don ' t want to do anything with this one . Since it is * the listening guy . The timer will get started for * accepted connections in the caller . if (stcb->asoc.sctp_autoclose_ticks &&void )SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);if (*netp != NULL) {/* * Since we did not send a HB , make sure we don ' t double * things . 1 ;/* respond with a COOKIE-ACK */ /* * check the address lists for any ASCONFs that need to be sent * AFTER the cookie - ack is sent sizeof (struct sctp_init_ack_chunk),sizeof (struct sctp_init_ack_chunk)),return (stcb);/* * CODE LIKE THIS NEEDS TO RUN IF the peer supports the NAT extension , i . e * we NEED to make sure we are not already using the vtag . If so we * need to send back an ABORT - TRY - AGAIN - WITH - NEW - TAG No middle box bit ! head = & SCTP_BASE_INFO ( sctp_asochash ) [ SCTP_PCBHASH_ASOC ( tag , SCTP_BASE_INFO ( hashasocmark ) ) ] ; LIST_FOREACH ( stcb , head , sctp_asocs ) { if ( ( stcb - > asoc . my_vtag = = tag ) & & ( stcb - > rport = = rport ) & & ( inp = = stcb - > sctp_ep ) ) { - - SEND ABORT - TRY AGAIN - - } } /* * handles a COOKIE - ECHO message stcb : modified to either a new or left as * existing ( non - NULL ) TCB static struct mbuf *struct mbuf *m, int iphlen, int offset,struct sockaddr *src, struct sockaddr *dst,struct sctphdr *sh, struct sctp_cookie_echo_chunk *cp,struct sctp_inpcb **inp_p, struct sctp_tcb **stcb, struct sctp_nets **netp,int auth_skipped, uint32_t auth_offset, uint32_t auth_len,struct sctp_tcb **locked_tcb,#if defined (__FreeBSD__) && !defined (__Userspace__)#endif struct sctp_state_cookie *cookie;struct sctp_tcb *l_stcb = *stcb;struct sctp_inpcb *l_inp;struct sockaddr *to;struct sctp_pcb *ep;struct mbuf *m_sig;#if defined (__Userspace__) && defined (FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)1 ;#else 0 ;#endif unsigned int sig_offset, cookie_offset;unsigned int cookie_len;struct timeval now;struct timeval time_entered, time_expires;int notification = 0 ;struct sctp_nets *netl;int had_a_existing_tcb = 0 ;int send_int_conf = 0 ;#ifdef INETstruct sockaddr_in sin;#endif #ifdef INET6struct sockaddr_in6 sin6;#endif #if defined (__Userspace__)struct sockaddr_conn sconn;#endif "sctp_handle_cookie: handling COOKIE-ECHO\n" );if (inp_p == NULL) {return (NULL);sizeof (struct sctp_chunkhdr);if (cookie_len < sizeof (struct sctp_cookie_echo_chunk) +sizeof (struct sctp_init_chunk) +sizeof (struct sctp_init_ack_chunk) + SCTP_SIGNATURE_SIZE) {/* cookie too small */ return (NULL);if ((cookie->peerport != sh->src_port) ||/* * invalid ports or bad tag . Note that we always leave the * v_tag in the header in network order and when we stored * it in the my_vtag slot we also left it in network order . * This maintains the match even though it may be in the * opposite byte order of the machine : - > return (NULL);#if defined (__Userspace__)/* * Recover the AF_CONN addresses within the cookie . * This needs to be done in the buffer provided for later processing * of the cookie and in the mbuf chain for HMAC validation . if ((cookie->addr_type == SCTP_CONN_ADDRESS) && (src->sa_family == AF_CONN)) {struct sockaddr_conn *sconnp = (struct sockaddr_conn *)src;sizeof (void *));struct sctp_state_cookie, address),int )sizeof (void *), (caddr_t)&sconnp->sconn_addr);if ((cookie->laddr_type == SCTP_CONN_ADDRESS) && (dst->sa_family == AF_CONN)) {struct sockaddr_conn *sconnp = (struct sockaddr_conn *)dst;sizeof (void *));struct sctp_state_cookie, laddress),int )sizeof (void *), (caddr_t)&sconnp->sconn_addr);#endif /* * split off the signature into its own mbuf ( since it should not be * calculated in the sctp_hmac_m ( ) call ) . if (m_sig == NULL) {/* out of memory or ?? */ return (NULL);#ifdef SCTP_MBUF_LOGGINGif (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {#endif /* * compute the signature / digest for the cookie if (l_stcb != NULL) {1 );if (l_stcb != NULL) {1 );if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE | SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {return (NULL);/* which cookie is it? */ if ((cookie->time_entered.tv_sec < ep->time_of_secret_change) &&/* it's the old cookie */ void )sctp_hmac_m(SCTP_HMAC,int )ep->last_secret_number],0 );else {/* it's the current cookie */ void )sctp_hmac_m(SCTP_HMAC,int )ep->current_secret_number],0 );/* get the signature */ 0 , SCTP_SIGNATURE_SIZE, (uint8_t *) & tmp_sig);if (sig == NULL) {/* couldn't find signature */ return (NULL);/* compare the received digest with the computed digest */ if (timingsafe_bcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) != 0 ) {/* try the old cookie? */ if ((cookie->time_entered.tv_sec == ep->time_of_secret_change) &&/* compute digest with old */ void )sctp_hmac_m(SCTP_HMAC,int )ep->last_secret_number],0 );/* compare */ if (timingsafe_bcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) == 0 )1 ;else {1 ;/* * Now before we continue we must reconstruct our mbuf so that * normal processing of any other chunks will work . struct mbuf *m_at;while (SCTP_BUF_NEXT(m_at) != NULL) {if (cookie_ok == 0 ) {"handle_cookie_echo: cookie signature validation failed!\n" );"offset = %u, cookie_offset = %u, sig_offset = %u\n" ,return (NULL);if (sctp_ticks_to_msecs(cookie->cookie_life) > SCTP_MAX_COOKIE_LIFE) {"handle_cookie_echo: Invalid cookie lifetime\n" );return (NULL);if ((time_entered.tv_sec < 0 ) ||0 ) ||1000000 )) {/* Invalid time stamp. Cookie must have been modified. */ "handle_cookie_echo: Invalid time stamp\n" );return (NULL);void )SCTP_GETTIME_TIMEVAL(&now);#if !(defined (__FreeBSD__) && !defined (__Userspace__))if (timercmp(&now, &time_entered, <)) {#else if (timevalcmp(&now, &time_entered, <)) {#endif "handle_cookie_echo: cookie generated in the future!\n" );return (NULL);/* * Check the cookie timestamps to be sure it ' s not stale . * cookie_life is in ticks , so we convert to seconds . #if !(defined (__FreeBSD__) && !defined (__Userspace__))if (timercmp(&now, &time_expires, >))#else if (timevalcmp(&now, &time_expires, >))#endif /* cookie is stale! */ struct mbuf *op_err;struct sctp_error_stale_cookie *cause;struct timeval diff;sizeof (struct sctp_error_stale_cookie),0 , M_NOWAIT, 1 , MT_DATA);if (op_err == NULL) {/* FOOBAR */ return (NULL);/* Set the len */ sizeof (struct sctp_error_stale_cookie);struct sctp_error_stale_cookie *);sizeof (struct sctp_error_stale_cookie));#if !(defined (__FreeBSD__) && !defined (__Userspace__))#else #endif if ((uint32_t)diff.tv_sec > UINT32_MAX / 1000000 ) {else {1000000 ;if (UINT32_MAX - staleness >= (uint32_t)diff.tv_usec) {else {#if defined (__FreeBSD__) && !defined (__Userspace__)#endif return (NULL);/* * Now we must see with the lookup address if we have an existing * asoc . This will only happen if we were in the COOKIE - WAIT state * and a INIT collided with us and somewhere the peer sent the * cookie on another address besides the single address our assoc * had for him . In this case we will have one of the tie - tags set at * least AND the address field in the cookie can be used to look it * up . switch (cookie->addr_type) {#ifdef INET6case SCTP_IPV6_ADDRESS:0 , sizeof (sin6));#ifdef HAVE_SIN6_LENsizeof (sin6);#endif sizeof (sin6.sin6_addr.s6_addr));struct sockaddr *)&sin6;break ;#endif #ifdef INETcase SCTP_IPV4_ADDRESS:0 , sizeof (sin));#ifdef HAVE_SIN_LENsizeof (sin);#endif 0 ];struct sockaddr *)&sin;break ;#endif #if defined (__Userspace__)case SCTP_CONN_ADDRESS:0 , sizeof (struct sockaddr_conn));#ifdef HAVE_SCONN_LENsizeof (struct sockaddr_conn);#endif sizeof (void *));struct sockaddr *)&sconn;break ;#endif default :/* This should not happen */ return (NULL);if (*stcb == NULL) {/* Yep, lets check */ if (*stcb == NULL) {/* * We should have only got back the same inp . If we * got back a different ep we have a problem . The * original findep got back l_inp and now if (l_inp != *inp_p) {"Bad problem find_ep got a diff inp then special_locate?\n" );else {if (*locked_tcb == NULL) {/* In this case we found the assoc only * after we locked the create lock . This means * we are in a colliding case and we must make * sure that we unlock the tcb if its one of the * cases where we throw away the incoming packets . /* We must also increment the inp ref count * since the ref_count flags was set when we * did not find the TCB , now we found it which * reduces the refcount . . we must raise it back * out to balance it all : - ) if ((*stcb)->sctp_ep != l_inp) {"Huh? ep:%p diff then l_inp:%p?\n" ,void *)(*stcb)->sctp_ep, (void *)l_inp);if (*stcb == NULL) {/* this is the "normal" case... get a new TCB */ #if defined (__FreeBSD__) && !defined (__Userspace__)#endif else {/* this is abnormal... cookie-echo on existing TCB */ 1 ;#if defined (__FreeBSD__) && !defined (__Userspace__)#endif if (*stcb == NULL) {if (*stcb == NULL) {/* still no TCB... must be bad cookie-echo */ return (NULL);#if defined (__FreeBSD__) && !defined (__Userspace__)if (*netp != NULL) {#endif /* * Ok , we built an association so confirm the address we sent the * INIT - ACK to . /* * This code should in theory NOT run but if (netl == NULL) {/* TSNH! Huh, why do I need to add this address here? */ if (sctp_add_remote_addr(*stcb, to, NULL, port,return (NULL);if (netl) {if (netl->dest_state & SCTP_ADDR_UNCONFIRMED) {void )sctp_set_primary_addr((*stcb), (struct sockaddr *)NULL,1 ;if ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {if (!had_a_existing_tcb ||0 )) {/* * If we have a NEW cookie or the connect never * reached the connected state during collision we * must do the TCP accept thing . struct socket *so, *oso;struct sctp_inpcb *inp;if (notification == SCTP_NOTIFY_ASSOC_RESTART) {/* * For a restart we will keep the same * socket , no need to do anything . I THINK ! ! 0 , NULL, SCTP_SO_NOT_LOCKED);if (send_int_conf) {0 , (void *)netl, SCTP_SO_NOT_LOCKED);return (m);1 );#if defined (__FreeBSD__) && !defined (__Userspace__)#endif #if defined (__APPLE__) && !defined (__Userspace__)1 );#endif 0 #if defined (__APPLE__) && !defined (__Userspace__)#endif #if defined (__APPLE__) && !defined (__Userspace__)1 );#endif #if defined (__FreeBSD__) && !defined (__Userspace__)#endif 1 );if (so == NULL) {struct mbuf *op_err;#if defined (__APPLE__) && !defined (__Userspace__)struct socket *pcb_so;#endif /* Too many sockets */ "process_cookie_new: no room for another socket!\n" );"" );#if defined (__FreeBSD__) && !defined (__Userspace__)#endif #if defined (__APPLE__) && !defined (__Userspace__)1 );1 );1 );#endif void )sctp_free_assoc(*inp_p, *stcb, SCTP_NORMAL_PROC,#if defined (__APPLE__) && !defined (__Userspace__)1 );#endif return (NULL);struct sctp_inpcb *)so->so_pcb;/* * We add the unbound flag here so that * if we get an soabort ( ) before we get the * move_pcb done , we will properly cleanup . #if defined (__Userspace__)#endif /* * copy in the authentication parameters from the * original endpoint if (inp->sctp_ep.local_hmacs)if (inp->sctp_ep.local_auth_chunks)/* * Now we must move it from one hash table to * another and get the tcb in the right place . /* This is where the one-2-one socket is put into * the accept state waiting for the accept ! if (*stcb) {1 );#if defined (__FreeBSD__) && !defined (__Userspace__)0 );#else #endif 1 );/* now we must check to see if we were aborted while * the move was going on and the lock / unlock happened . if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {/* yep it was, we leave the * assoc attached to the socket since * the sctp_inpcb_free ( ) call will send * an abort for us . return (NULL);/* Switch over to the new guy */ 0 , NULL, SCTP_SO_NOT_LOCKED);if (send_int_conf) {0 , (void *)netl, SCTP_SO_NOT_LOCKED);/* Pull it from the incomplete queue and wake the guy */ #if defined (__APPLE__) && !defined (__Userspace__)1 );1 );#endif #if defined (__APPLE__) && !defined (__Userspace__)1 );1 );#endif return (m);if (notification) {0 , NULL, SCTP_SO_NOT_LOCKED);if (send_int_conf) {0 , (void *)netl, SCTP_SO_NOT_LOCKED);return (m);static void struct sctp_cookie_ack_chunk *cp SCTP_UNUSED,struct sctp_tcb *stcb, struct sctp_nets *net)/* cp must not be used, others call this without a c-ack :-) */ struct sctp_association *asoc;struct sctp_tmit_chunk *chk;"sctp_handle_cookie_ack: handling COOKIE-ACK\n" );if ((stcb == NULL) || (net == NULL)) {return ;if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {0 ,/* process according to association state */ if (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED) {/* state change only needed when I am in right state */ "moving to OPEN state\n" );/* update RTO */ if (asoc->overall_error_count == 0 ) {/* * Since we did not send a HB make sure we don ' t double * things . 0 ;1 ;void )SCTP_GETTIME_TIMEVAL(&asoc->time_entered);0 , NULL, SCTP_SO_NOT_LOCKED);if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||#if defined (__APPLE__) && !defined (__Userspace__)struct socket *so;#endif #if defined (__APPLE__) && !defined (__Userspace__)1 );1 );1 );#endif if ((stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) == 0 ) {#if defined (__APPLE__) && !defined (__Userspace__)1 );#endif if ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) &&0 )) {if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {/* We don't need to do the asconf thing, * nor hb or autoclose if the socket is closed . goto closed_socket;if (stcb->asoc.sctp_autoclose_ticks &&/* * send ASCONF if parameters are pending and ASCONFs are * allowed ( eg . addresses changed when init / cookie echo were * in flight ) if ((sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_DO_ASCONF)) &&1 ) &&#ifdef SCTP_TIMER_BASED_ASCONF#else #endif /* Restart the timer if we have pending data */ if (chk->whoTo != NULL) {break ;if (chk != NULL) {static void struct sctp_ecne_chunk *cp,struct sctp_tcb *stcb)struct sctp_nets *net;struct sctp_tmit_chunk *lchk;struct sctp_ecne_chunk bkup;int len;unsigned int pkt_cnt;if (len == sizeof (struct old_sctp_ecne_chunk)) {/* Its the old format */ sizeof (struct old_sctp_ecne_chunk));1 );if (lchk == NULL) {1 ;else {/* Find where it was sent to if possible. */ if (lchk->rec.data.tsn == tsn) {break ;if (SCTP_TSN_GT(lchk->rec.data.tsn, tsn)) {break ;if (net == NULL) {/* * What to do . A previous send of a * CWR was possibly lost . See how old it is , we * may have it marked on the actual net . if (tsn == net->last_cwr_tsn) {/* Found him, send it off */ break ;if (net == NULL) {/* * If we reach here , we need to send a special * CWR that says hey , we did this a long time * ago and you lost the response . if (net == NULL) {/* TSNH */ return ;else {0 ;else {0 ;if (SCTP_TSN_GT(tsn, net->cwr_window_tsn) &&0 )) {/* JRS - Use the congestion control given in the pluggable CC module */ 0 , pkt_cnt);/* * We reduce once every RTT . So we will only lower cwnd at * the next sending seq i . e . the window_data_tsn else {if (SCTP_TSN_GT(tsn, net->last_cwr_tsn) &&0 )) {/* * Another loss in the same window update how * many marks / packets lost we have had . int cnt = 1 ;if (pkt_cnt > net->lost_cnt) {/* Should be the case */ /* * Most CC functions will ignore this call , since we are in - window * yet of the initial CE the peer saw . 1 , cnt);/* * We always send a CWR this way if our previous one was lost our * peer will get an update , or if it is not time again to reduce we * still get the cwr to the peer . Note we set the override when we * could not find the TSN on the chunk or the destination network . static void struct sctp_cwr_chunk *cp, struct sctp_tcb *stcb, struct sctp_nets *net)/* * Here we get a CWR from the peer . We must look in the outqueue and * make sure that we have a covered ECNE in the control chunk part . * If so remove it . struct sctp_tmit_chunk *chk, *nchk;struct sctp_ecne_chunk *ecne;int override;if (chk->rec.chunk_id.id != SCTP_ECN_ECHO) {continue ;if ((override == 0 ) && (chk->whoTo != net)) {/* Must be from the right src unless override is set */ continue ;struct sctp_ecne_chunk *);if (SCTP_TSN_GE(cwr_tsn, ntohl(ecne->tsn))) {/* this covers this ECNE, we can remove it */ if (override == 0 ) {break ;static void struct sctp_shutdown_complete_chunk *cp SCTP_UNUSED,struct sctp_tcb *stcb, struct sctp_nets *net)#if defined (__APPLE__) && !defined (__Userspace__)struct socket *so;#endif "sctp_handle_shutdown_complete: handling SHUTDOWN-COMPLETE\n" );if (stcb == NULL)return ;/* process according to association state */ if (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT) {/* unexpected SHUTDOWN-COMPLETE... so ignore... */ "sctp_handle_shutdown_complete: not in SCTP_STATE_SHUTDOWN_ACK_SENT --- ignore\n" );return ;/* notify upper layer protocol */ if (stcb->sctp_socket) {0 , NULL, SCTP_SO_NOT_LOCKED);#ifdef INVARIANTSif (!TAILQ_EMPTY(&stcb->asoc.send_queue) ||"Queues are not empty when handling SHUTDOWN-COMPLETE" );#endif /* stop the timer */ /* free the TCB */ "sctp_handle_shutdown_complete: calls free-asoc\n" );#if defined (__APPLE__) && !defined (__Userspace__)1 );1 );1 );#endif void )sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,#if defined (__APPLE__) && !defined (__Userspace__)1 );#endif return ;static int struct sctp_tcb *stcb, struct sctp_chunk_desc *desc,struct sctp_nets *net, uint8_t flg)switch (desc->chunk_type) {case SCTP_DATA:case SCTP_IDATA:/* find the tsn to resend (possibly) */ struct sctp_tmit_chunk *tp1;if (tp1->rec.data.tsn == tsn) {/* found it */ break ;if (SCTP_TSN_GT(tp1->rec.data.tsn, tsn)) {/* not found */ break ;if (tp1 == NULL) {/* * Do it the other way , aka without paying * attention to queue seq order . if (tp1->rec.data.tsn == tsn) {/* found it */ break ;if (tp1 == NULL) {if ((tp1) && (tp1->sent < SCTP_DATAGRAM_ACKED)) {if (((flg & SCTP_BADCRC) == 0 ) &&0 )) {return (0 );if ((stcb->asoc.peers_rwnd == 0 ) &&0 )) {return (0 );if (stcb->asoc.peers_rwnd == 0 &&return (0 );if ((uint32_t)SCTP_BUF_LEN(tp1->data) </* Payload not matching. */ return (-1 );if (memcmp(mtod(tp1->data, caddr_t) + SCTP_DATA_CHUNK_OVERHEAD(stcb),0 ) {/* Payload not matching. */ return (-1 );if (tp1->do_rtt) {/* * this guy had a RTO calculation * pending on it , cancel it if (tp1->whoTo->rto_needed == 0 ) {1 ;0 ;if (tp1->sent != SCTP_DATAGRAM_RESEND)/* * mark it as if we were doing a FR , since * we will be getting gap ack reports behind * the info from the router . 1 ;/* * mark the tsn with what sequences can * cause a new FR . if (TAILQ_EMPTY(&stcb->asoc.send_queue)) {else {/* restart the timer */ /* fix counts and things */ if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {if (tp1->sent < SCTP_DATAGRAM_RESEND) {/* audit code */ unsigned int audit;0 ;if (tp1->sent == SCTP_DATAGRAM_RESEND)if (tp1->sent == SCTP_DATAGRAM_RESEND)if (audit != stcb->asoc.sent_queue_retran_cnt) {"**Local Audit finds cnt:%d asoc cnt:%d\n" ,#ifndef SCTP_AUDITING_ENABLED#endif break ;case SCTP_ASCONF:struct sctp_tmit_chunk *asconf;if (asconf->rec.chunk_id.id == SCTP_ASCONF) {break ;if (asconf) {if (asconf->sent != SCTP_DATAGRAM_RESEND)break ;case SCTP_INITIATION:/* resend the INIT */ if (stcb->asoc.dropped_special_cnt < SCTP_RETRY_DROPPED_THRESH) {/* * If we can get it in , in a few attempts we do * this , otherwise we let the timer fire . break ;case SCTP_SELECTIVE_ACK:case SCTP_NR_SELECTIVE_ACK:/* resend the sack */ break ;case SCTP_HEARTBEAT_REQUEST:/* resend a demand HB */ if ((stcb->asoc.overall_error_count + 3 ) < stcb->asoc.max_send_times) {/* Only retransmit if we KNOW we wont destroy the tcb */ break ;case SCTP_SHUTDOWN:break ;case SCTP_SHUTDOWN_ACK:break ;case SCTP_COOKIE_ECHO:struct sctp_tmit_chunk *cookie;if (cookie->rec.chunk_id.id == SCTP_COOKIE_ECHO) {break ;if (cookie) {if (cookie->sent != SCTP_DATAGRAM_RESEND)break ;case SCTP_COOKIE_ACK:break ;case SCTP_ASCONF_ACK:/* resend last asconf ack */ break ;case SCTP_IFORWARD_CUM_TSN:case SCTP_FORWARD_CUM_TSN:break ;/* can't do anything with these */ case SCTP_PACKET_DROPPED:case SCTP_INITIATION_ACK: /* this should not happen */ case SCTP_HEARTBEAT_ACK:case SCTP_ABORT_ASSOCIATION:case SCTP_OPERATION_ERROR:case SCTP_SHUTDOWN_COMPLETE:case SCTP_ECN_ECHO:case SCTP_ECN_CWR:default :break ;return (0 );void struct sctp_tcb *stcb, uint32_t number_entries, uint16_t *list)/* * We set things to 0 xffffffff since this is the last delivered sequence * and we will be sending in 0 after the reset . if (number_entries) {for (i = 0 ; i < number_entries; i++) {if (temp >= stcb->asoc.streamincnt) {continue ;0 xffffffff;else {for (i = 0 ; i < stcb->asoc.streamincnt; i++) {0 xffffffff;void *)list, SCTP_SO_NOT_LOCKED);static void struct sctp_tcb *stcb, uint32_t number_entries, uint16_t *list)if (number_entries > 0 ) {for (i = 0 ; i < number_entries; i++) {if (temp >= stcb->asoc.streamoutcnt) {/* no such stream */ continue ;0 ;0 ;else {for (i = 0 ; i < stcb->asoc.streamoutcnt; i++) {0 ;0 ;void *)list, SCTP_SO_NOT_LOCKED);static void struct sctp_tcb *stcb, uint32_t number_entries, uint16_t *list)if (number_entries > 0 ) {for (i = 0 ; i < number_entries; i++) {if (temp >= stcb->asoc.streamoutcnt) {/* no such stream */ continue ;else {for (i = 0 ; i < stcb->asoc.streamoutcnt; i++) {struct sctp_stream_reset_request *struct sctp_tcb *stcb, uint32_t seq, struct sctp_tmit_chunk **bchk)struct sctp_association *asoc;struct sctp_chunkhdr *ch;struct sctp_stream_reset_request *r;struct sctp_tmit_chunk *chk;int len, clen;if (TAILQ_EMPTY(&asoc->control_send_queue) ||0 ;return (NULL);if (chk->data == NULL) {return (NULL);if (bchk != NULL) {/* he wants a copy of the chk pointer */ struct sctp_chunkhdr *);struct sctp_stream_reset_request *)(ch + 1 );if (ntohl(r->request_seq) == seq) {/* found it */ return (r);if (clen > (len + (int )sizeof (struct sctp_chunkhdr))) {/* move to the next one, there can only be a max of two */ struct sctp_stream_reset_request *)((caddr_t)r + len);if (ntohl(r->request_seq) == seq) {return (r);/* that seq is not here */ return (NULL);static void struct sctp_tcb *stcb)struct sctp_association *asoc;struct sctp_tmit_chunk *chk;if (chk == NULL) {return ;if (chk->data) {static int struct sctp_tcb *stcb,struct sctp_stream_reset_response *respin)int lparam_len;struct sctp_association *asoc = &stcb->asoc;struct sctp_tmit_chunk *chk;struct sctp_stream_reset_request *req_param;struct sctp_stream_reset_out_request *req_out_param;struct sctp_stream_reset_in_request *req_in_param;if (asoc->stream_reset_outstanding == 0 ) {/* duplicate */ return (0 );if (seq == stcb->asoc.str_reset_seq_out) {if (req_param != NULL) {if (type == SCTP_STR_RESET_OUT_REQUEST) {int no_clear = 0 ;struct sctp_stream_reset_out_request *)req_param;sizeof (struct sctp_stream_reset_out_request)) / sizeof (uint16_t);0 ;if (asoc->stream_reset_outstanding)if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {/* do it */ else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {am->list_of_streams, SCTP_SO_NOT_LOCKED);else if (action == SCTP_STREAM_RESET_RESULT_IN_PROGRESS) {/* Set it up so we don't stop retransmitting */ 1 ;1 ;else {am->list_of_streams, SCTP_SO_NOT_LOCKED);if (no_clear == 0 ) {else if (type == SCTP_STR_RESET_IN_REQUEST) {struct sctp_stream_reset_in_request *)req_param;sizeof (struct sctp_stream_reset_in_request)) / sizeof (uint16_t);if (asoc->stream_reset_outstanding)if (action == SCTP_STREAM_RESET_RESULT_DENIED) {else if (action != SCTP_STREAM_RESET_RESULT_PERFORMED) {else if (type == SCTP_STR_RESET_ADD_OUT_STREAMS) {/* Ok we now may have more streams */ int num_stream;if (num_stream > (stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt)) {/* TSNH */ 0 ;if (asoc->stream_reset_outstanding)if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {/* Put the new streams into effect */ int i;for (i = asoc->streamoutcnt; i < (asoc->streamoutcnt + num_stream); i++) {0 , NULL, SCTP_SO_NOT_LOCKED);else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {TP_SO_NOT_LOCKED);else {TP_SO_NOT_LOCKED);else if (type == SCTP_STR_RESET_ADD_IN_STREAMS) {if (asoc->stream_reset_outstanding)if (action == SCTP_STREAM_RESET_RESULT_DENIED) {TP_SO_NOT_LOCKED);else if (action != SCTP_STREAM_RESET_RESULT_PERFORMED) {TP_SO_NOT_LOCKED);else if (type == SCTP_STR_RESET_TSN_REQUEST) {/** * a ) Adopt the new in tsn . * b ) reset the map * c ) Adopt the new out - tsn struct sctp_stream_reset_response_tsn *resp;struct sctp_forward_tsn_chunk fwdtsn;int abort_flag = 0 ;if (respin == NULL) {/* huh ? */ return (0 );if (ntohs(respin->ph.param_length) < sizeof (struct sctp_stream_reset_response_tsn)) {return (0 );if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {struct sctp_stream_reset_response_tsn *)respin;sizeof (struct sctp_forward_tsn_chunk));1 );0 );if (abort_flag) {return (1 );1 );if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {0 , 7 , asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);de_map;0 , stcb->asoc.mapping_array_size);0 , stcb->asoc.mapping_array_size);0 , (uint16_t *) NULL);0 , (uint16_t *) NULL);0 , NULL, SCTP_SO_NOT_LOCKED);else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {_SO_NOT_LOCKED);else {_SO_NOT_LOCKED);/* get rid of the request and get the request flags */ if (asoc->stream_reset_outstanding == 0 ) {if (asoc->stream_reset_outstanding == 0 ) {return (0 );static void struct sctp_tcb *stcb,struct sctp_tmit_chunk *chk,struct sctp_stream_reset_in_request *req, int trunc)int len, i;int number_entries;/* * peer wants me to send a str - reset to him for my outgoing seq ' s if * seq_in is right . struct sctp_association *asoc = &stcb->asoc;if (asoc->str_reset_seq_in == seq) {1 ] = asoc->last_reset_action[0 ];if ((asoc->local_strreset_support & SCTP_ENABLE_RESET_STREAM_REQ) == 0 ) {0 ] = SCTP_STREAM_RESET_RESULT_DENIED;else if (trunc) {/* Can't do it, since they exceeded our buffer size */ 0 ] = SCTP_STREAM_RESET_RESULT_DENIED;else if (stcb->asoc.stream_reset_out_is_outstanding == 0 ) {sizeof (struct sctp_stream_reset_in_request)) / sizeof (uint16_t));if (number_entries) {for (i = 0 ; i < number_entries; i++) {if (temp >= stcb->asoc.streamoutcnt) {0 ] = SCTP_STREAM_RESET_RESULT_DENIED;goto bad_boy;for (i = 0 ; i < number_entries; i++) {if (stcb->asoc.strmout[req->list_of_streams[i]].state == SCTP_STREAM_OPEN) {else {/* Its all */ for (i = 0 ; i < stcb->asoc.streamoutcnt; i++) {if (stcb->asoc.strmout[i].state == SCTP_STREAM_OPEN)0 ] = SCTP_STREAM_RESET_RESULT_PERFORMED;else {/* Can't do it, since we have sent one out */ 0 ] = SCTP_STREAM_RESET_RESULT_ERR_IN_PROGRESS;0 ]);else if (asoc->str_reset_seq_in - 1 == seq) {0 ]);else if (asoc->str_reset_seq_in - 2 == seq) {1 ]);else {static int struct sctp_tcb *stcb,struct sctp_tmit_chunk *chk,struct sctp_stream_reset_tsn_request *req)/* reset all in and out and update the tsn */ /* * A ) reset my str - seq ' s on in and out . B ) Select a receive next , * and set cum - ack to it . Also process this selected number as a * fwd - tsn as well . C ) set in the response my next sending seq . struct sctp_forward_tsn_chunk fwdtsn;struct sctp_association *asoc = &stcb->asoc;int abort_flag = 0 ;if (asoc->str_reset_seq_in == seq) {1 ] = stcb->asoc.last_reset_action[0 ];if ((asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ) == 0 ) {0 ] = SCTP_STREAM_RESET_RESULT_DENIED;else {sizeof (struct sctp_forward_tsn_chunk));0 ;1 );0 );if (abort_flag) {return (1 );if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {0 , 10 , asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);1 ;0 , asoc->mapping_array_size);0 , asoc->mapping_array_size);1 );/* save off historical data for retrans */ 1 ] = asoc->last_sending_seq[0 ];0 ] = asoc->sending_seq;1 ] = asoc->last_base_tsnsent[0 ];0 ] = asoc->mapping_array_base_tsn;0 , (uint16_t *) NULL);0 , (uint16_t *) NULL);0 ] = SCTP_STREAM_RESET_RESULT_PERFORMED;0 , NULL, SCTP_SO_NOT_LOCKED);0 ],0 ], asoc->last_base_tsnsent[0 ]);else if (asoc->str_reset_seq_in - 1 == seq) {0 ],0 ], asoc->last_base_tsnsent[0 ]);else if (asoc->str_reset_seq_in - 2 == seq) {1 ],1 ], asoc->last_base_tsnsent[1 ]);else {return (0 );static void struct sctp_tcb *stcb,struct sctp_tmit_chunk *chk,struct sctp_stream_reset_out_request *req, int trunc)int number_entries, len;struct sctp_association *asoc = &stcb->asoc;/* now if its not a duplicate we process it */ if (asoc->str_reset_seq_in == seq) {sizeof (struct sctp_stream_reset_out_request)) / sizeof (uint16_t));/* * the sender is resetting , handle the list issue . . we must * a ) verify if we can do the reset , if so no problem b ) If * we can ' t do the reset we must copy the request . c ) queue * it , and setup the data in processor to trigger it off * when needed and dequeue all the queued data . /* move the reset action back one */ 1 ] = asoc->last_reset_action[0 ];if ((asoc->local_strreset_support & SCTP_ENABLE_RESET_STREAM_REQ) == 0 ) {0 ] = SCTP_STREAM_RESET_RESULT_DENIED;else if (trunc) {0 ] = SCTP_STREAM_RESET_RESULT_DENIED;else if (SCTP_TSN_GE(asoc->cumulative_tsn, tsn)) {/* we can do it now */ 0 ] = SCTP_STREAM_RESET_RESULT_PERFORMED;else {/* * we must queue it up and thus wait for the TSN ' s * to arrive that are at or before tsn struct sctp_stream_reset_list *liste;int siz;sizeof (struct sctp_stream_reset_list) + (number_entries * sizeof (uint16_t));struct sctp_stream_reset_list *,if (liste == NULL) {/* gak out of memory */ 0 ] = SCTP_STREAM_RESET_RESULT_DENIED;0 ]);return ;sizeof (uint16_t));0 ] = SCTP_STREAM_RESET_RESULT_IN_PROGRESS;0 ]);else if ((asoc->str_reset_seq_in - 1 ) == seq) {/* * one seq back , just echo back last action since my * response was lost . 0 ]);else if ((asoc->str_reset_seq_in - 2 ) == seq) {/* * two seq back , just echo back last action since my * response was lost . 1 ]);else {static void struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk,struct sctp_stream_reset_add_strm *str_add)/* * Peer is requesting to add more streams . * If its within our max - streams we will * allow it . struct sctp_association *asoc = &stcb->asoc;struct sctp_queued_to_read *ctl, *nctl;/* Get the number. */ /* Now what would be the new total? */ if (asoc->str_reset_seq_in == seq) {1 ] = stcb->asoc.last_reset_action[0 ];if ((asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ) == 0 ) {0 ] = SCTP_STREAM_RESET_RESULT_DENIED;else if ((num_stream > stcb->asoc.max_inbound_streams) ||0 xffff)) {/* We must reject it they ask for to many */ 0 ] = SCTP_STREAM_RESET_RESULT_DENIED;else {/* Ok, we can do that :-) */ struct sctp_stream_in *oldstrm;/* save off the old */ struct sctp_stream_in *,sizeof (struct sctp_stream_in)),if (stcb->asoc.strmin == NULL) {goto denied;/* copy off the old data */ for (i = 0 ; i < stcb->asoc.streamincnt; i++) {/* now anything on those queues? */ /* Init the new streams */ for (i = stcb->asoc.streamincnt; i < num_stream; i++) {0 xffffffff;0 ;0 ;/* update the size */ 0 ] = SCTP_STREAM_RESET_RESULT_PERFORMED;0 , NULL, SCTP_SO_NOT_LOCKED);0 ]);else if ((asoc->str_reset_seq_in - 1 ) == seq) {/* * one seq back , just echo back last action since my * response was lost . 0 ]);else if ((asoc->str_reset_seq_in - 2 ) == seq) {/* * two seq back , just echo back last action since my * response was lost . 1 ]);else {static void struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk,struct sctp_stream_reset_add_strm *str_add)/* * Peer is requesting to add more streams . * If its within our max - streams we will * allow it . struct sctp_association *asoc = &stcb->asoc;/* Get the number. */ /* Now what would be the new total? */ if (asoc->str_reset_seq_in == seq) {1 ] = stcb->asoc.last_reset_action[0 ];if ((asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ) == 0 ) {0 ] = SCTP_STREAM_RESET_RESULT_DENIED;else if (stcb->asoc.stream_reset_outstanding) {/* We must reject it we have something pending */ 0 ] = SCTP_STREAM_RESET_RESULT_ERR_IN_PROGRESS;else {/* Ok, we can do that :-) */ int mychk;if (mychk < 0 x10000) {0 ] = SCTP_STREAM_RESET_RESULT_PERFORMED;if (sctp_send_str_reset_req(stcb, 0 , NULL, 0 , 0 , 1 , num_stream, 0 , 1 )) {0 ] = SCTP_STREAM_RESET_RESULT_DENIED;else {0 ] = SCTP_STREAM_RESET_RESULT_DENIED;0 ]);else if ((asoc->str_reset_seq_in - 1 ) == seq) {/* * one seq back , just echo back last action since my * response was lost . 0 ]);else if ((asoc->str_reset_seq_in - 2 ) == seq) {/* * two seq back , just echo back last action since my * response was lost . 1 ]);else {#ifdef __GNUC__#endif static int struct sctp_tcb *stcb, struct mbuf *m, int offset,struct sctp_chunkhdr *ch_req)struct sctp_paramhdr pstore;0 ;int num_req = 0 ;int trunc = 0 ;struct sctp_tmit_chunk *chk;struct sctp_chunkhdr *ch;struct sctp_paramhdr *ph;int ret_code = 0 ;int num_param = 0 ;/* now it may be a reset or a reset-response */ sizeof (struct sctp_chunkhdr);/* setup for adding the response */ if (chk == NULL) {return (ret_code);0 ;0 ;0 ;0 ;sizeof (struct sctp_chunkhdr);0 ;0 , M_NOWAIT, 1 , MT_DATA);if (chk->data == NULL) {if (chk->data) {return (ret_code);/* setup chunk parameters */ 0 ;struct sctp_chunkhdr *);0 ;sizeof (struct sctp_chunkhdr);while (remaining_length >= sizeof (struct sctp_paramhdr)) {struct sctp_paramhdr *)sctp_m_getptr(m, offset, sizeof (pstore), (uint8_t *)&pstore);if (ph == NULL) {/* TSNH */ break ;if ((param_len > remaining_length) ||sizeof (struct sctp_paramhdr) + sizeof (uint32_t)))) {/* bad parameter length */ break ;struct sctp_paramhdr *)sctp_m_getptr(m, offset, min(param_len, sizeof (cstore)),if (ph == NULL) {/* TSNH */ break ;if (param_len > sizeof (cstore)) {1 ;else {0 ;if (num_param > SCTP_MAX_RESET_PARAMS) {/* hit the max of parameters already sorry.. */ break ;if (ptype == SCTP_STR_RESET_OUT_REQUEST) {struct sctp_stream_reset_out_request *req_out;if (param_len < sizeof (struct sctp_stream_reset_out_request)) {break ;struct sctp_stream_reset_out_request *)ph;if (stcb->asoc.stream_reset_outstanding) {if (seq == stcb->asoc.str_reset_seq_out) {/* implicit ack */ void )sctp_handle_stream_reset_response(stcb, seq, SCTP_STREAM_RESET_RESULT_PERFORMED, NULL);else if (ptype == SCTP_STR_RESET_ADD_OUT_STREAMS) {struct sctp_stream_reset_add_strm *str_add;if (param_len < sizeof (struct sctp_stream_reset_add_strm)) {break ;struct sctp_stream_reset_add_strm *)ph;else if (ptype == SCTP_STR_RESET_ADD_IN_STREAMS) {struct sctp_stream_reset_add_strm *str_add;if (param_len < sizeof (struct sctp_stream_reset_add_strm)) {break ;struct sctp_stream_reset_add_strm *)ph;else if (ptype == SCTP_STR_RESET_IN_REQUEST) {struct sctp_stream_reset_in_request *req_in;struct sctp_stream_reset_in_request *)ph;else if (ptype == SCTP_STR_RESET_TSN_REQUEST) {struct sctp_stream_reset_tsn_request *req_tsn;struct sctp_stream_reset_tsn_request *)ph;if (sctp_handle_str_reset_request_tsn(stcb, chk, req_tsn)) {1 ;goto strres_nochunk;/* no more */ break ;else if (ptype == SCTP_STR_RESET_RESPONSE) {struct sctp_stream_reset_response *resp;if (param_len < sizeof (struct sctp_stream_reset_response)) {break ;struct sctp_stream_reset_response *)ph;if (sctp_handle_stream_reset_response(stcb, seq, result, resp)) {1 ;goto strres_nochunk;else {break ;if (remaining_length >= SCTP_SIZE32(param_len)) {else {0 ;if (num_req == 0 ) {/* we have no response free the stuff */ goto strres_nochunk;/* ok we have a chunk to link in */ return (ret_code);/* * Handle a router or endpoints report of a packet loss , there are two ways * to handle this , either we get the whole packet and must disect it * ourselves ( possibly with truncation and or corruption ) or it is a summary * from a middle box that did the disecting for us . static void struct sctp_pktdrop_chunk *cp,struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t limit)struct sctp_chunk_desc desc;struct sctp_chunkhdr *chk_hdr;struct sctp_data_chunk *data_chunk;struct sctp_idata_chunk *idata_chunk;sizeof (struct sctp_pktdrop_chunk) <= limit,"PKTDROP chunk too small" ));"Inconsistent limit" ));if (pktdrp_flags & SCTP_PACKET_TRUNCATED) {if (ntohs(cp->trunc_len) <= pktdrp_len - sizeof (struct sctp_pktdrop_chunk)) {/* The peer plays games with us. */ return ;sizeof (struct sctp_pktdrop_chunk);0 ;if (offset == limit) {if (pktdrp_flags & SCTP_FROM_MIDDLE_BOX) {else if (offset + sizeof (struct sctphdr) > limit) {/* Only a partial SCTP common header. */ else {/* XXX: Check embedded SCTP common header. */ sizeof (struct sctphdr);/* Now parse through the chunks themselves. */ while (offset < limit) {if (offset + sizeof (struct sctp_chunkhdr) > limit) {break ;struct sctp_chunkhdr *)(cp->data + offset);/* get amount we need to move */ if (chk_len < sizeof (struct sctp_chunkhdr)) {/* Someone is lying... */ break ;if (desc.chunk_type == SCTP_DATA) {if (stcb->asoc.idata_supported) {/* Some is playing games with us. */ break ;if (chk_len <= sizeof (struct sctp_data_chunk)) {/* Some is playing games with us. */ break ;if (chk_len < sizeof (struct sctp_data_chunk) + SCTP_NUM_DB_TO_VERIFY) {/* Not enough data bytes available in the chunk. */ goto next_chunk;if (offset + sizeof (struct sctp_data_chunk) + SCTP_NUM_DB_TO_VERIFY > limit) {/* Not enough data in buffer. */ break ;struct sctp_data_chunk *)(cp->data + offset);1 , SCTP_NUM_DB_TO_VERIFY);if (pktdrp_flags & SCTP_FROM_MIDDLE_BOX) {else if (desc.chunk_type == SCTP_IDATA) {if (!stcb->asoc.idata_supported) {/* Some is playing games with us. */ break ;if (chk_len <= sizeof (struct sctp_idata_chunk)) {/* Some is playing games with us. */ break ;if (chk_len < sizeof (struct sctp_idata_chunk) + SCTP_NUM_DB_TO_VERIFY) {/* Not enough data bytes available in the chunk. */ goto next_chunk;if (offset + sizeof (struct sctp_idata_chunk) + SCTP_NUM_DB_TO_VERIFY > limit) {/* Not enough data in buffer. */ break ;struct sctp_idata_chunk *)(cp->data + offset);1 , SCTP_NUM_DB_TO_VERIFY);if (pktdrp_flags & SCTP_FROM_MIDDLE_BOX) {else {0 );0 , SCTP_NUM_DB_TO_VERIFY);if (pktdrp_flags & SCTP_FROM_MIDDLE_BOX) {if (process_chunk_drop(stcb, &desc, net, pktdrp_flags)) {break ;/* Now update any rwnd --- possibly */ if ((pktdrp_flags & SCTP_FROM_MIDDLE_BOX) == 0 ) {/* From a peer, we get a rwnd report */ if (bottle_bw && on_queue) {/* a rwnd report is in here */ if (bottle_bw > on_queue)else 0 ;if (a_rwnd == 0 )0 ;else {if (a_rwnd > stcb->asoc.total_flight) {else {0 ;if (stcb->asoc.peers_rwnd </* SWS sender side engages */ 0 ;else {/* now middle boxes in sat networks get a cwnd bump */ if ((pktdrp_flags & SCTP_FROM_MIDDLE_BOX) &&0 ) &&/* * This is debatable but for sat networks it makes sense * Note if a T3 timer has went off , we will prohibit any * changes to cwnd until we exit the t3 loss recovery . /* * handles all control chunks in a packet inputs : - m : mbuf chain , assumed to * still contain IP / SCTP header - stcb : is the tcb found for this packet - * offset : offset into the mbuf chain to first chunkhdr - length : is the * length of the complete packet outputs : - length : modified to remaining * length after control processing - netp : modified to new sctp_nets after * cookie - echo processing - return NULL to discard the packet ( ie . no asoc , * bad packet , . . . ) otherwise return the tcb for this packet #ifdef __GNUC__#endif static struct sctp_tcb *struct mbuf *m, int iphlen, int *offset, int length,struct sockaddr *src, struct sockaddr *dst,struct sctphdr *sh, struct sctp_chunkhdr *ch, struct sctp_inpcb *inp,struct sctp_tcb *stcb, struct sctp_nets **netp, int *fwd_tsn_seen,#if defined (__FreeBSD__) && !defined (__Userspace__)#endif struct sctp_association *asoc;struct mbuf *op_err;char msg[SCTP_DIAG_INFO_LEN];int num_chunks = 0 ; /* number of control chunks processed */ int ret;int abort_no_unlock = 0 ;int ecne_seen = 0 ;int abort_flag;/* * How big should this be , and should it be alloc ' d ? Lets try the * d - mtu - ceiling for now ( 2 k ) and that should hopefully work . . . * until we get into jumbo grams and such . . int got_auth = 0 ;0 , auth_len = 0 ;int auth_skipped = 0 ;int asconf_cnt = 0 ;#if defined (__APPLE__) && !defined (__Userspace__)struct socket *so;#endif "sctp_process_control: iphlen=%u, offset=%u, length=%u stcb:%p\n" ,void *)stcb);if (stcb) {/* validate chunk header length... */ if (ntohs(ch->chunk_length) < sizeof (*ch)) {"Invalid header length %d\n" ,return (stcb);/* * validate the verification tag if (ch->chunk_type == SCTP_INITIATION) {"Its an INIT of len:%d vtag:%x\n" ,if (vtag_in != 0 ) {/* protocol error- silently discard... */ if (stcb != NULL) {return (NULL);else if (ch->chunk_type != SCTP_COOKIE_ECHO) {/* * If there is no stcb , skip the AUTH chunk and process * later after a stcb is found ( to validate the lookup was * valid . if ((ch->chunk_type == SCTP_AUTHENTICATION) &&1 )) {/* save this chunk for later processing */ 1 ;/* (temporarily) move past this chunk */ if (*offset >= length) {/* no more data left in the mbuf chain */ return (NULL);struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,sizeof (struct sctp_chunkhdr), chunk_buf);if (ch == NULL) {/* Help */ return (stcb);if (ch->chunk_type == SCTP_COOKIE_ECHO) {goto process_control_chunks;/* * first check if it ' s an ASCONF with an unknown src addr we * need to look inside to find the association if (ch->chunk_type == SCTP_ASCONF && stcb == NULL) {struct sctp_chunkhdr *asconf_ch = ch;0 , asconf_len = 0 ;/* inp's refcount may be reduced */ do {if (asconf_len < sizeof (struct sctp_asconf_paramhdr))break ;if (stcb != NULL)break ;struct sctp_chunkhdr *)sctp_m_getptr(m, asconf_offset,sizeof (struct sctp_chunkhdr), chunk_buf);while (asconf_ch != NULL && asconf_ch->chunk_type == SCTP_ASCONF);if (stcb == NULL) {/* * reduce inp ' s refcount if not reduced in * sctp_findassociation_ep_asconf ( ) . /* now go back and verify any auth chunk to be sure */ if (auth_skipped && (stcb != NULL)) {struct sctp_auth_chunk *auth;if (auth_len <= SCTP_CHUNK_BUFFER_SIZE) {struct sctp_auth_chunk *)sctp_m_getptr(m, auth_offset, auth_len, chunk_buf);1 ;0 ;else {if ((auth == NULL) || sctp_handle_auth(stcb, auth, m,/* auth HMAC failed so dump it */ return (stcb);else {/* remaining chunks are HMAC checked */ 1 ;if (stcb == NULL) {sizeof (msg), "OOTB, %s:%d at %s" , __FILE__, __LINE__, __func__);/* no association, so it's out of the blue... */ #if defined (__FreeBSD__) && !defined (__Userspace__)#endif return (NULL);/* ABORT and SHUTDOWN can use either v_tag... */ if ((ch->chunk_type == SCTP_ABORT_ASSOCIATION) ||/* Take the T-bit always into account. */ if ((((ch->chunk_flags & SCTP_HAD_NO_TCB) == 0 ) &&0 )) &&/* this is valid */ else {/* drop this packet... */ if (stcb != NULL) {return (NULL);else {/* for all other chunks, vtag must match */ if (vtag_in != asoc->my_vtag) {/* invalid vtag... */ "invalid vtag: %xh, expect %xh\n" ,if (stcb != NULL) {return (NULL);/* end if !SCTP_COOKIE_ECHO */ /* * process all control chunks . . . if (((ch->chunk_type == SCTP_SELECTIVE_ACK) ||/* implied cookie-ack.. we must have lost the ack */ struct sctp_cookie_ack_chunk *)ch, stcb,while (IS_SCTP_CONTROL(ch)) {/* validate chunk length */ "sctp_process_control: processing a chunk type=%u, len=%u\n" ,if (chk_length < sizeof (*ch) ||int )chk_length) > length) {return (stcb);/* * INIT and INIT - ACK only gets the init ack " header " portion * only because we don ' t have to process the peer ' s COOKIE . * All others get a complete chunk . switch (ch->chunk_type) {case SCTP_INITIATION:sizeof (struct sctp_init_chunk);break ;case SCTP_INITIATION_ACK:sizeof (struct sctp_init_ack_chunk);break ;default :sizeof (chunk_buf));break ;struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,if (ch == NULL) {return (stcb);/* Save off the last place we got a control from */ if (stcb != NULL) {if (((netp != NULL) && (*netp != NULL)) || (ch->chunk_type == SCTP_ASCONF)) {/* * allow last_control to be NULL if * ASCONF . . . ASCONF processing will find the * right net later if ((netp != NULL) && (*netp != NULL))#ifdef SCTP_AUDITING_ENABLED0 xB0, ch->chunk_type);#endif /* check to see if this chunk required auth, but isn't */ if ((stcb != NULL) &&/* "silently" ignore */ goto next_chunk;switch (ch->chunk_type) {case SCTP_INITIATION:"SCTP_INIT\n" );/* The INIT chunk must be the only chunk. */ if ((num_chunks > 1 ) ||int )SCTP_SIZE32(chk_length))) {/* * RFC 4960 bis requires stopping the * processing of the packet . return (stcb);/* Honor our resource limit. */ if (chk_length > SCTP_LARGEST_INIT_ACCEPTED) {"" );0 , op_err,#if defined (__FreeBSD__) && !defined (__Userspace__)#endif if (stcb != NULL) {return (NULL);struct sctp_init_chunk *)ch, inp,#if defined (__FreeBSD__) && !defined (__Userspace__)#endif if (stcb != NULL) {return (NULL);break ;case SCTP_PAD_CHUNK:break ;case SCTP_INITIATION_ACK:"SCTP_INIT_ACK\n" );if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {/* We are not interested anymore */ if ((stcb != NULL) && (stcb->asoc.total_output_queue_size)) {else {if (stcb != NULL) {#if defined (__APPLE__) && !defined (__Userspace__)1 );1 );1 );#endif void )sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,#if defined (__APPLE__) && !defined (__Userspace__)1 );#endif return (NULL);/* The INIT-ACK chunk must be the only chunk. */ if ((num_chunks > 1 ) ||int )SCTP_SIZE32(chk_length))) {return (stcb);if ((netp != NULL) && (*netp != NULL)) {struct sctp_init_ack_chunk *)ch,#if defined (__FreeBSD__) && !defined (__Userspace__)#endif else {1 ;if (abort_no_unlock) {return (NULL);/* * Special case , I must call the output routine to * get the cookie echoed if ((stcb != NULL) && (ret == 0 )) {CKED);return (stcb);break ;case SCTP_SELECTIVE_ACK:case SCTP_NR_SELECTIVE_ACK:int abort_now = 0 ;int offset_seg, offset_dup;"%s\n" ,"SCTP_SACK" : "SCTP_NR_SACK" );if (stcb == NULL) {"No stcb when processing %s chunk\n" ,"SCTP_SACK" : "SCTP_NR_SACK" );break ;if (ch->chunk_type == SCTP_SELECTIVE_ACK) {if (chk_length < sizeof (struct sctp_sack_chunk)) {"Bad size on SACK chunk, too small\n" );break ;else {if (stcb->asoc.nrsack_supported == 0 ) {goto unknown_chunk;if (chk_length < sizeof (struct sctp_nr_sack_chunk)) {"Bad size on NR_SACK chunk, too small\n" );break ;if (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) {/*- * If we have sent a shutdown - ack , we will pay no * attention to a sack sent in to us since * we don ' t care anymore . break ;if (ch->chunk_type == SCTP_SELECTIVE_ACK) {struct sctp_sack_chunk *sack;struct sctp_sack_chunk *)ch;0 ;if (sizeof (struct sctp_sack_chunk) +sizeof (struct sctp_gap_ack_block) +sizeof (uint32_t) != chk_length) {"Bad size of SACK chunk\n" );break ;sizeof (struct sctp_sack_chunk);sizeof (struct sctp_gap_ack_block);else {struct sctp_nr_sack_chunk *nr_sack;struct sctp_nr_sack_chunk *)ch;if (sizeof (struct sctp_nr_sack_chunk) +sizeof (struct sctp_gap_ack_block) +sizeof (uint32_t) != chk_length) {"Bad size of NR_SACK chunk\n" );break ;sizeof (struct sctp_nr_sack_chunk);sizeof (struct sctp_gap_ack_block);"%s process cum_ack:%x num_seg:%d a_rwnd:%d\n" ,"SCTP_SACK" : "SCTP_NR_SACK" ,1 ;if ((stcb->asoc.pr_sctp_cnt == 0 ) &&0 ) && (num_nr_seg == 0 ) &&0 ) &&0 ) &&/* * We have a SIMPLE sack having no * prior segments and data on sent * queue to be acked . Use the * faster path sack processing . We * also allow window update sacks * with no missing segments to go * this way too . else {if ((netp != NULL) && (*netp != NULL)) {if (abort_now) {/* ABORT signal from sack processing */ return (NULL);if (TAILQ_EMPTY(&stcb->asoc.send_queue) &&0 )) {0 , NULL, SCTP_SO_NOT_LOCKED);break ;case SCTP_HEARTBEAT_REQUEST:"SCTP_HEARTBEAT\n" );if ((stcb != NULL) && (netp != NULL) && (*netp != NULL)) {break ;case SCTP_HEARTBEAT_ACK:"SCTP_HEARTBEAT_ACK\n" );if ((stcb == NULL) || (chk_length != sizeof (struct sctp_heartbeat_chunk))) {/* Its not ours */ break ;if ((netp != NULL) && (*netp != NULL)) {struct sctp_heartbeat_chunk *)ch,break ;case SCTP_ABORT_ASSOCIATION:"SCTP_ABORT, stcb %p\n" ,void *)stcb);if ((stcb != NULL) && (netp != NULL) && (*netp != NULL)) {if (sctp_handle_abort((struct sctp_abort_chunk *)ch, stcb, *netp)) {return (NULL);else {return (stcb);else {return (NULL);break ;case SCTP_SHUTDOWN:"SCTP_SHUTDOWN, stcb %p\n" ,void *)stcb);if ((stcb == NULL) || (chk_length != sizeof (struct sctp_shutdown_chunk))) {break ;if ((netp != NULL) && (*netp != NULL)) {0 ;struct sctp_shutdown_chunk *)ch,if (abort_flag) {return (NULL);break ;case SCTP_SHUTDOWN_ACK:"SCTP_SHUTDOWN_ACK, stcb %p\n" , (void *)stcb);if ((chk_length == sizeof (struct sctp_shutdown_ack_chunk)) &&struct sctp_shutdown_ack_chunk *)ch, stcb, *netp);return (NULL);break ;case SCTP_OPERATION_ERROR:"SCTP_OP_ERR\n" );if ((stcb != NULL) && (netp != NULL) && (*netp != NULL) &&0 ) {return (NULL);break ;case SCTP_COOKIE_ECHO:"SCTP_COOKIE_ECHO, stcb %p\n" , (void *)stcb);if ((stcb != NULL) && (stcb->asoc.total_output_queue_size > 0 )) {else {if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {/* We are not interested anymore */ if (stcb != NULL) {return (NULL);/*- * First are we accepting ? We do this again here * since it is possible that a previous endpoint WAS * listening responded to a INIT - ACK and then * closed . We opened and bound . . and are now no * longer listening . * * XXXGL : notes on checking listen queue length . * 1 ) SCTP_IS_LISTENING ( ) doesn ' t necessarily mean * SOLISTENING ( ) , because a listening " UDP type " * socket isn ' t listening in terms of the socket * layer . It is a normal data flow socket , that * can fork off new connections . Thus , we should * look into sol_qlen only in case we are ! UDP . * 2 ) Checking sol_qlen in general requires locking * the socket , and this code lacks that . if ((stcb == NULL) &&0 ) &&#if defined (__FreeBSD__) && !defined (__Userspace__)#else #endif if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&"" );#if defined (__FreeBSD__) && !defined (__Userspace__)#endif return (NULL);else {struct mbuf *ret_buf;struct sctp_inpcb *linp;struct sctp_tmit_chunk *chk;if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE |goto abend;if (stcb) {else {if (linp != NULL) {if (netp != NULL) {struct sctp_tcb *locked_stcb;struct sctp_cookie_echo_chunk *)ch,#if defined (__FreeBSD__) && !defined (__Userspace__)#endif if ((locked_stcb != NULL) && (locked_stcb != stcb)) {if (stcb != NULL) {else {if (linp != NULL) {if (ret_buf == NULL) {if (stcb != NULL) {"GAK, null buffer\n" );return (NULL);/* if AUTH skipped, see if it verified... */ if (auth_skipped) {1 ;0 ;/* Restart the timer if we have pending data */ if (chk->whoTo != NULL) {break ;if (chk != NULL) {break ;case SCTP_COOKIE_ACK:"SCTP_COOKIE_ACK, stcb %p\n" , (void *)stcb);if ((stcb == NULL) || chk_length != sizeof (struct sctp_cookie_ack_chunk)) {break ;if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {/* We are not interested anymore */ if ((stcb) && (stcb->asoc.total_output_queue_size)) {else if (stcb) {#if defined (__APPLE__) && !defined (__Userspace__)1 );1 );1 );#endif void )sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,#if defined (__APPLE__) && !defined (__Userspace__)1 );#endif return (NULL);if ((netp != NULL) && (*netp != NULL)) {struct sctp_cookie_ack_chunk *)ch, stcb, *netp);break ;case SCTP_ECN_ECHO:"SCTP_ECN_ECHO\n" );if (stcb == NULL) {break ;if (stcb->asoc.ecn_supported == 0 ) {goto unknown_chunk;if ((chk_length != sizeof (struct sctp_ecne_chunk)) &&sizeof (struct old_sctp_ecne_chunk))) {break ;struct sctp_ecne_chunk *)ch, stcb);1 ;break ;case SCTP_ECN_CWR:"SCTP_ECN_CWR\n" );if (stcb == NULL) {break ;if (stcb->asoc.ecn_supported == 0 ) {goto unknown_chunk;if (chk_length != sizeof (struct sctp_cwr_chunk)) {break ;struct sctp_cwr_chunk *)ch, stcb, *netp);break ;case SCTP_SHUTDOWN_COMPLETE:"SCTP_SHUTDOWN_COMPLETE, stcb %p\n" , (void *)stcb);/* must be first and only chunk */ if ((num_chunks > 1 ) ||int )SCTP_SIZE32(chk_length))) {return (stcb);if ((chk_length == sizeof (struct sctp_shutdown_complete_chunk)) &&struct sctp_shutdown_complete_chunk *)ch,return (NULL);break ;case SCTP_ASCONF:"SCTP_ASCONF\n" );if (stcb != NULL) {if (stcb->asoc.asconf_supported == 0 ) {goto unknown_chunk;struct sctp_asconf_chunk *)ch, stcb, asconf_cnt == 0 );break ;case SCTP_ASCONF_ACK:"SCTP_ASCONF_ACK\n" );if (stcb == NULL) {break ;if (stcb->asoc.asconf_supported == 0 ) {goto unknown_chunk;if (chk_length < sizeof (struct sctp_asconf_ack_chunk)) {break ;if ((netp != NULL) && (*netp != NULL)) {/* He's alive so give him credit */ if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {0 ,0 ;struct sctp_asconf_ack_chunk *)ch, stcb, *netp, &abort_no_unlock);if (abort_no_unlock)return (NULL);break ;case SCTP_FORWARD_CUM_TSN:case SCTP_IFORWARD_CUM_TSN:"%s\n" ,"FORWARD_TSN" : "I_FORWARD_TSN" );if (stcb == NULL) {break ;if (stcb->asoc.prsctp_supported == 0 ) {goto unknown_chunk;if (chk_length < sizeof (struct sctp_forward_tsn_chunk)) {break ;if (((stcb->asoc.idata_supported == 1 ) && (ch->chunk_type == SCTP_FORWARD_CUM_TSN)) ||0 ) && (ch->chunk_type == SCTP_IFORWARD_CUM_TSN))) {if (ch->chunk_type == SCTP_FORWARD_CUM_TSN) {sizeof (msg), "%s" , "FORWARD-TSN chunk received when I-FORWARD-TSN was negotiated" );else {sizeof (msg), "%s" , "I-FORWARD-TSN chunk received when FORWARD-TSN was negotiated" );false , SCTP_SO_NOT_LOCKED);return (NULL);1 ;if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {/* We are not interested anymore */ #if defined (__APPLE__) && !defined (__Userspace__)1 );1 );1 );#endif void )sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,#if defined (__APPLE__) && !defined (__Userspace__)1 );#endif return (NULL);/* * For sending a SACK this looks like DATA * chunks . 0 ;struct sctp_forward_tsn_chunk *)ch, &abort_flag, m, *offset);if (abort_flag) {return (NULL);break ;case SCTP_STREAM_RESET:"SCTP_STREAM_RESET\n" );if (stcb == NULL) {break ;if (stcb->asoc.reconfig_supported == 0 ) {goto unknown_chunk;if (chk_length < sizeof (struct sctp_stream_reset_tsn_req)) {break ;if (sctp_handle_stream_reset(stcb, m, *offset, ch)) {/* stop processing */ return (NULL);break ;case SCTP_PACKET_DROPPED:"SCTP_PACKET_DROPPED\n" );if (stcb == NULL) {break ;if (stcb->asoc.pktdrop_supported == 0 ) {goto unknown_chunk;if (chk_length < sizeof (struct sctp_pktdrop_chunk)) {break ;if ((netp != NULL) && (*netp != NULL)) {struct sctp_pktdrop_chunk *)ch,break ;case SCTP_AUTHENTICATION:"SCTP_AUTHENTICATION\n" );if (stcb == NULL) {/* save the first AUTH for later processing */ if (auth_skipped == 0 ) {1 ;/* skip this chunk (temporarily) */ break ;if (stcb->asoc.auth_supported == 0 ) {goto unknown_chunk;if ((chk_length < (sizeof (struct sctp_auth_chunk))) ||sizeof (struct sctp_auth_chunk) +/* Its not ours */ return (stcb);if (got_auth == 1 ) {/* skip this chunk... it's already auth'd */ break ;1 ;if (sctp_handle_auth(stcb, (struct sctp_auth_chunk *)ch, m, *offset)) {/* auth HMAC failed so dump the packet */ return (stcb);else {/* remaining chunks are HMAC checked */ 1 ;break ;default :/* it's an unknown chunk! */ if ((ch->chunk_type & 0 x40) &&struct sctp_gen_error_cause *cause;int len;sizeof (struct sctp_gen_error_cause),0 , M_NOWAIT, 1 , MT_DATA);if (op_err != NULL) {struct sctp_gen_error_cause *);sizeof (struct sctp_gen_error_cause)));sizeof (struct sctp_gen_error_cause);if (SCTP_BUF_NEXT(op_err) != NULL) {#ifdef SCTP_MBUF_LOGGINGif (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {#endif else {if ((ch->chunk_type & 0 x80) == 0 ) {/* discard this packet */ return (stcb);/* else skip this bad chunk and continue... */ break ;/* switch (ch->chunk_type) */ /* get the next chunk */ if (*offset >= length) {/* no more data left in the mbuf chain */ break ;struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,sizeof (struct sctp_chunkhdr), chunk_buf);if (ch == NULL) {return (stcb);/* while */ if ((asconf_cnt > 0 ) && (stcb != NULL)) {return (stcb);/* * common input chunk processing ( v4 and v6 ) void struct mbuf **mm, int iphlen, int offset, int length,struct sockaddr *src, struct sockaddr *dst,struct sctphdr *sh, struct sctp_chunkhdr *ch,#if defined (__FreeBSD__) && !defined (__Userspace__)#endif char msg[SCTP_DIAG_INFO_LEN];struct mbuf *m = *mm, *op_err;struct sctp_inpcb *inp = NULL, *inp_decr = NULL;struct sctp_tcb *stcb = NULL;struct sctp_nets *net = NULL;#if defined (__Userspace__)struct socket *upcall_socket = NULL;#endif int un_sent;int cnt_ctrl_ready = 0 ;int fwd_tsn_seen = 0 , data_processed = 0 ;bool cksum_validated, stcb_looked_up;#ifdef SCTP_AUDITING_ENABLED0 xE0, 1 );0 , inp, stcb, net);#endif false ;if (compute_crc != 0 ) {false ;if (cksum_in_hdr != htonl(0 )) {0 ;if (cksum_calculated != cksum_in_hdr) {if (stcb_looked_up) {/* * The packet has a zero checksum , which * is not the correct CRC , no stcb has * been found or an stcb has been found * but an incorrect zero checksum is not * acceptable . 0 ),"cksum in header not zero: %x" ,if ((inp == NULL) &&1 )) {/* * This is an OOTB packet , * depending on the sysctl * variable , pretend that the * checksum is acceptable , * to allow an appropriate * response ( ABORT , for examlpe ) * to be sent . "stcb is %p" , stcb));goto cksum_validated;else {"Bad cksum in SCTP packet:%x calculated:%x m:%p mlen:%d iphlen:%d\n" ,void *)m, length, iphlen);#if defined (INET) || defined (INET6)if ((ch->chunk_type != SCTP_INITIATION) &&if (net->port == 0 ) {/* UDP encapsulation turned on. */ sizeof (struct udphdr);if (stcb->asoc.smallest_mtu > net->mtu) {else if (port == 0 ) {/* UDP encapsulation turned off. */ sizeof (struct udphdr);/* XXX Update smallest_mtu */ #endif #if defined (__FreeBSD__) && !defined (__Userspace__)if (net != NULL) {#endif if ((inp != NULL) && (stcb != NULL)) {if (stcb->asoc.pktdrop_supported) {1 );else if ((inp != NULL) && (stcb == NULL)) {goto out;else {0 ),"cksum 0x%08x not zero and not validated" , ntohl(cksum_in_hdr)));if (!cksum_validated) {if (stcb == NULL) {goto validate_cksum;if (stcb->asoc.rcv_edmid == SCTP_EDMID_NONE) {goto validate_cksum;"Unexpected EDMID %u" , stcb->asoc.rcv_edmid));/* Destination port of 0 is illegal, based on RFC4960. */ if (sh->dest_port == htons(0 )) {if ((stcb == NULL) && (inp != NULL)) {goto out;if (!stcb_looked_up) {#if defined (INET) || defined (INET6)if ((ch->chunk_type != SCTP_INITIATION) &&if (net->port == 0 ) {/* UDP encapsulation turned on. */ sizeof (struct udphdr);if (stcb->asoc.smallest_mtu > net->mtu) {else if (port == 0 ) {/* UDP encapsulation turned off. */ sizeof (struct udphdr);/* XXX Update smallest_mtu */ #endif #if defined (__FreeBSD__) && !defined (__Userspace__)if (net != NULL) {#endif if (inp == NULL) {#if defined (__FreeBSD__) && !defined (__Userspace__)if (badport_bandlim(BANDLIM_SCTP_OOTB) < 0 ) {goto out;#endif if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {#if defined (__FreeBSD__) && !defined (__Userspace__)#endif goto out;if (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) {goto out;if (ch->chunk_type != SCTP_ABORT_ASSOCIATION) {if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0 ) ||1 ) &&"Out of the blue" );0 , op_err,#if defined (__FreeBSD__) && !defined (__Userspace__)#endif goto out;else if (stcb == NULL) {"Ok, Common input processing called, m:%p iphlen:%d offset:%d length:%d stcb:%p\n" ,void *)m, iphlen, offset, length, (void *)stcb);if (stcb) {/* always clear this before beginning a packet */ 0 ;0 ;"stcb:%p state:%x\n" ,void *)stcb, stcb->asoc.state);if ((stcb->asoc.state & SCTP_STATE_WAS_ABORTED) ||/*- * If we hit here , we had a ref count * up when the assoc was aborted and the * timer is clearing out the assoc , we should * NOT respond to any packet . . its OOTB . #if defined (__FreeBSD__) && !defined (__Userspace__)#endif sizeof (msg), "OOTB, %s:%d at %s" , __FILE__, __LINE__, __func__);#if defined (__FreeBSD__) && !defined (__Userspace__)#endif goto out;#if defined (__Userspace__)if ((stcb != NULL) &&0 ) &&if (stcb->sctp_socket->so_head != NULL) {else {#endif if (IS_SCTP_CONTROL(ch)) {/* process the control portion of the SCTP packet */ /* sa_ignore NO_NULL_CHK */ #if defined (__FreeBSD__) && !defined (__Userspace__)#endif if (stcb) {/* This covers us if the cookie-echo was there * and it changes our INP . #if defined (INET) || defined (INET6)if ((ch->chunk_type != SCTP_INITIATION) &&if (net->port == 0 ) {/* UDP encapsulation turned on. */ sizeof (struct udphdr);if (stcb->asoc.smallest_mtu > net->mtu) {else if (port == 0 ) {/* UDP encapsulation turned off. */ sizeof (struct udphdr);/* XXX Update smallest_mtu */ #endif else {/* * no control chunks , so pre - process DATA chunks ( these * checks are taken care of by control processing ) /* * if DATA only packet , and auth is required , then punt . . . * can ' t have authenticated without any AUTH ( control ) * chunks if ((stcb != NULL) &&/* "silently" ignore */ #if defined (__FreeBSD__) && !defined (__Userspace__)#endif goto out;if (stcb == NULL) {/* out of the blue DATA chunk */ #if defined (__FreeBSD__) && !defined (__Userspace__)#endif sizeof (msg), "OOTB, %s:%d at %s" , __FILE__, __LINE__, __func__);#if defined (__FreeBSD__) && !defined (__Userspace__)#endif goto out;if (stcb->asoc.my_vtag != ntohl(sh->v_tag)) {/* v_tag mismatch! */ #if defined (__FreeBSD__) && !defined (__Userspace__)#endif goto out;#if defined (__FreeBSD__) && !defined (__Userspace__)#endif if (stcb == NULL) {/* * no valid TCB for this packet , or we found it ' s a bad * packet while processing control , or we ' re done with this * packet ( done or skip rest of data ) , so we drop it . . . goto out;#if defined (__Userspace__)if ((upcall_socket == NULL) &&0 ) &&if (stcb->sctp_socket->so_head != NULL) {else {#endif /* * DATA chunk processing /* plow through the data chunks while length > offset */ /* * Rest should be DATA only . Check authentication state if AUTH for * DATA is required . if ((length > offset) &&/* "silently" ignore */ "Data chunk requires AUTH, skipped\n" );goto trigger_send;if (length > offset) {int retval;/* * First check to make sure our state is correct . We would * not get here unless we really did have a tag , so we don ' t * abort if this happens , just dump the chunk silently . switch (SCTP_GET_STATE(stcb)) {case SCTP_STATE_COOKIE_ECHOED:/* * we consider data with valid tags in this state * shows us the cookie - ack was lost . Imply it was * there . struct sctp_cookie_ack_chunk *)ch, stcb, net);break ;case SCTP_STATE_COOKIE_WAIT:/* * We consider OOTB any data sent during asoc setup . sizeof (msg), "OOTB, %s:%d at %s" , __FILE__, __LINE__, __func__);#if defined (__FreeBSD__) && !defined (__Userspace__)#endif goto out;/*sa_ignore NOTREACHED*/ break ;case SCTP_STATE_EMPTY: /* should not happen */ case SCTP_STATE_INUSE: /* should not happen */ case SCTP_STATE_SHUTDOWN_RECEIVED: /* This is a peer error */ case SCTP_STATE_SHUTDOWN_ACK_SENT:default :goto out;/*sa_ignore NOTREACHED*/ break ;case SCTP_STATE_OPEN:case SCTP_STATE_SHUTDOWN_SENT:break ;/* plow through the data chunks while length > offset */ if (retval == 2 ) {/* * The association aborted , NO UNLOCK needed since * the association is destroyed . goto out;if (retval == 0 ) {1 ;/* * Anything important needs to have been m_copy ' ed in * process_data /* take care of ecn */ if ((data_processed == 1 ) &&1 ) &&/* Yep, we need to add a ECNE */ if ((data_processed == 0 ) && (fwd_tsn_seen)) {int was_a_gap;if (SCTP_TSN_GT(stcb->asoc.highest_tsn_inside_nr_map, stcb->asoc.highest_tsn_inside_map)) {else {1 ;else if (fwd_tsn_seen) {1 ;/* trigger send of any chunks in queue... */ #ifdef SCTP_AUDITING_ENABLED0 xE0, 2 );1 , inp, stcb, net);#endif "Check for chunk output prw:%d tqe:%d tf=%d\n" ,if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {if (!TAILQ_EMPTY(&stcb->asoc.asconf_send_queue) ||0 ) &&0 || stcb->asoc.total_flight == 0 ))) {"Calling chunk OUTPUT\n" );"chunk OUTPUT returns\n" );#ifdef SCTP_AUDITING_ENABLED0 xE0, 3 );2 , inp, stcb, net);#endif if (stcb != NULL) {#if defined (__Userspace__)if (upcall_socket != NULL) {if (upcall_socket->so_upcall != NULL) {if (soreadable(upcall_socket) ||#endif if (inp_decr != NULL) {/* reduce ref-count */ return ;#ifdef INET#if !defined (__Userspace__)void struct mbuf *i_pak, int off, uint16_t port)struct mbuf *m;int iphlen;0 ;struct sockaddr_in src, dst;struct ip *ip;struct sctphdr *sh;struct sctp_chunkhdr *ch;int length, offset;#if defined (__FreeBSD__) && !defined (__Userspace__)#endif #if defined (__Userspace__)0 ;#endif if (SCTP_GET_PKT_VRFID(i_pak, vrf_id)) {return ;#ifdef SCTP_MBUF_LOGGING/* Log in any input mbufs */ if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {#endif #ifdef SCTP_PACKET_LOGGINGif (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) {#endif #if defined (__FreeBSD__) && !defined (__Userspace__)"sctp_input(): Packet of length %d received on %s with csum_flags 0x%b.\n" ,int )m->m_pkthdr.csum_flags, CSUM_BITS);#endif #if defined (__APPLE__) && !defined (__Userspace__)"sctp_input(): Packet of length %d received on %s%d with csum_flags 0x%x.\n" ,#endif #if defined (_WIN32) && !defined (__Userspace__)"sctp_input(): Packet of length %d received on %s with csum_flags 0x%x.\n" ,#endif #if defined (__FreeBSD__) && !defined (__Userspace__)#endif /* Get IP, SCTP, and first chunk header together in the first mbuf. */ sizeof (struct sctphdr) + sizeof (struct sctp_chunkhdr);if (SCTP_BUF_LEN(m) < offset) {if ((m = m_pullup(m, offset)) == NULL) {return ;struct ip *);struct sctphdr *)((caddr_t)ip + iphlen);struct sctp_chunkhdr *)((caddr_t)sh + sizeof (struct sctphdr));sizeof (struct sctp_chunkhdr);0 , sizeof (struct sockaddr_in));#ifdef HAVE_SIN_LENsizeof (struct sockaddr_in);#endif 0 , sizeof (struct sockaddr_in));#ifdef HAVE_SIN_LENsizeof (struct sockaddr_in);#endif #if defined (_WIN32) && !defined (__Userspace__)#endif #if defined (__linux__) || (defined (_WIN32) && defined (__Userspace__))#endif #if defined (__Userspace__)#if defined (__linux__) || defined (_WIN32)#else #endif #elif defined (__FreeBSD__)#elif defined (__APPLE__)#else #endif /* Validate mbuf chain length with IP payload length. */ if (SCTP_HEADER_LEN(m) != length) {"sctp_input() length:%d reported length:%d\n" , length, SCTP_HEADER_LEN(m));goto out;/* SCTP does not allow broadcasts or multicasts */ if (IN_MULTICAST(ntohl(dst.sin_addr.s_addr))) {goto out;if (SCTP_IS_IT_BROADCAST(dst.sin_addr, m)) {goto out;#if defined (__FreeBSD__) && !defined (__Userspace__)if (m->m_pkthdr.csum_flags & CSUM_SCTP_VALID) {0 ;else {#else if (SCTP_BASE_SYSCTL(sctp_no_csum_on_loopback) &&0 ;else {#endif 1 ;struct sockaddr *)&src,struct sockaddr *)&dst,#if defined (__FreeBSD__) && !defined (__Userspace__)#endif if (m) {return ;#if defined (__FreeBSD__) && !defined (__Userspace__)#if defined (SCTP_MCORE_INPUT) && defined (SMP)extern int *sctp_cpuarry;#endif #endif #if defined (__FreeBSD__) && !defined (__Userspace__)int struct mbuf **mp, int *offp, int proto SCTP_UNUSED)struct mbuf *m;int off;#else void struct mbuf *m, int off)#endif #if defined (__FreeBSD__) && !defined (__Userspace__)#if defined (SCTP_MCORE_INPUT) && defined (SMP)if (mp_ncpus > 1 ) {struct ip *ip;struct sctphdr *sh;int offset;int cpu_to_use;if (M_HASHTYPE_GET(m) != M_HASHTYPE_NONE) {else {/* No flow id built by lower layers * fix it so we create one . sizeof (struct sctphdr);if (SCTP_BUF_LEN(m) < offset) {if ((m = m_pullup(m, offset)) == NULL) {return (IPPROTO_DONE);struct ip *);struct sctphdr *)((caddr_t)ip + off);return (IPPROTO_DONE);#endif #endif 0 );#if defined (__FreeBSD__) && !defined (__Userspace__)return (IPPROTO_DONE);#endif #endif #endif
Messung V0.5 in Prozent C=92 H=95 G=93
¤ Die Informationen auf dieser Webseite wurden
nach bestem Wissen sorgfältig zusammengestellt. Es wird jedoch weder Vollständigkeit, noch Richtigkeit,
noch Qualität der bereit gestellten Informationen zugesichert.0.233Bemerkung:
(Wie Sie bei der Firma Beratungs- und Dienstleistungen beauftragen können 2026-08-26)
¤ *Eine klare Vorstellung vom Zielzustand
