1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
24  */
25 
26 #include <sys/types.h>
27 #include <sys/systm.h>
28 #include <sys/stream.h>
29 #include <sys/ddi.h>
30 #include <sys/sunddi.h>
31 #include <sys/strsubr.h>
32 #include <sys/strsun.h>
33 
34 #include <netinet/in.h>
35 #include <netinet/ip6.h>
36 
37 #include <inet/ipsec_impl.h>
38 #include <inet/common.h>
39 #include <inet/ip.h>
40 #include <inet/ip6.h>
41 #include <inet/mib2.h>
42 #include <inet/nd.h>
43 #include <inet/optcom.h>
44 #include <inet/sctp_ip.h>
45 #include <inet/ipclassifier.h>
46 #include "sctp_impl.h"
47 
48 void
49 sctp_send_shutdown(sctp_t *sctp, int rexmit)
50 {
51 	mblk_t *smp;
52 	mblk_t *sendmp;
53 	sctp_chunk_hdr_t *sch;
54 	uint32_t *ctsn;
55 	sctp_faddr_t *fp;
56 	sctp_stack_t	*sctps = sctp->sctp_sctps;
57 
58 	if (sctp->sctp_state != SCTPS_ESTABLISHED &&
59 	    sctp->sctp_state != SCTPS_SHUTDOWN_PENDING &&
60 	    sctp->sctp_state != SCTPS_SHUTDOWN_SENT) {
61 		return;
62 	}
63 
64 	if (sctp->sctp_state == SCTPS_ESTABLISHED) {
65 		sctp->sctp_state = SCTPS_SHUTDOWN_PENDING;
66 		/*
67 		 * We set an upper bound on how long we will
68 		 * wait for a shutdown-ack from the peer. This
69 		 * is to prevent the receiver from attempting
70 		 * to create a half-closed state indefinately.
71 		 * See archive from IETF TSVWG mailing list
72 		 * for June 2001 for more information.
73 		 * Since we will not be calculating RTTs after
74 		 * sending the shutdown, we can overload out_time
75 		 * to track how long we have waited.
76 		 */
77 		sctp->sctp_out_time = ddi_get_lbolt64();
78 	}
79 
80 	/*
81 	 * If there is unsent (or unacked) data, wait for it to get ack'd
82 	 */
83 	if (sctp->sctp_xmit_head != NULL || sctp->sctp_xmit_unsent != NULL) {
84 		return;
85 	}
86 
87 	/* rotate faddrs if we are retransmitting */
88 	if (!rexmit) {
89 		fp = sctp->sctp_current;
90 	} else {
91 		fp = sctp_rotate_faddr(sctp, sctp->sctp_shutdown_faddr);
92 	}
93 
94 	sctp->sctp_shutdown_faddr = fp;
95 
96 	/* Link in a SACK if resending the shutdown */
97 	if (sctp->sctp_state > SCTPS_SHUTDOWN_PENDING &&
98 	    (sendmp = sctp_make_sack(sctp, fp, NULL)) != NULL) {
99 
100 		smp = allocb(sizeof (*sch) + sizeof (*ctsn), BPRI_MED);
101 		if (smp == NULL) {
102 			freemsg(sendmp);
103 			goto done;
104 		}
105 		linkb(sendmp, smp);
106 
107 		sch = (sctp_chunk_hdr_t *)smp->b_rptr;
108 		smp->b_wptr = smp->b_rptr + sizeof (*sch) + sizeof (*ctsn);
109 	} else {
110 		sendmp = sctp_make_mp(sctp, fp,
111 		    sizeof (*sch) + sizeof (*ctsn));
112 		if (sendmp == NULL) {
113 			SCTP_KSTAT(sctps, sctp_send_shutdown_failed);
114 			goto done;
115 		}
116 		sch = (sctp_chunk_hdr_t *)sendmp->b_wptr;
117 		sendmp->b_wptr += sizeof (*sch) + sizeof (*ctsn);
118 
119 		/* shutdown w/o sack, update lastacked */
120 		sctp->sctp_lastacked = sctp->sctp_ftsn - 1;
121 	}
122 
123 	sch->sch_id = CHUNK_SHUTDOWN;
124 	sch->sch_flags = 0;
125 	sch->sch_len = htons(sizeof (*sch) + sizeof (*ctsn));
126 
127 	ctsn = (uint32_t *)(sch + 1);
128 	*ctsn = htonl(sctp->sctp_lastacked);
129 
130 	/* Link the shutdown chunk in after the IP/SCTP header */
131 
132 	BUMP_LOCAL(sctp->sctp_obchunks);
133 
134 	/* Send the shutdown and restart the timer */
135 	sctp_set_iplen(sctp, sendmp, fp->ixa);
136 	(void) conn_ip_output(sendmp, fp->ixa);
137 	BUMP_LOCAL(sctp->sctp_opkts);
138 
139 done:
140 	sctp->sctp_state = SCTPS_SHUTDOWN_SENT;
141 	SCTP_FADDR_TIMER_RESTART(sctp, sctp->sctp_current,
142 	    sctp->sctp_current->rto);
143 }
144 
145 int
146 sctp_shutdown_received(sctp_t *sctp, sctp_chunk_hdr_t *sch, boolean_t crwsd,
147     boolean_t rexmit, sctp_faddr_t *fp)
148 {
149 	mblk_t *samp;
150 	sctp_chunk_hdr_t *sach;
151 	uint32_t *tsn;
152 	int trysend = 0;
153 	sctp_stack_t	*sctps = sctp->sctp_sctps;
154 
155 	if (sctp->sctp_state != SCTPS_SHUTDOWN_ACK_SENT)
156 		sctp->sctp_state = SCTPS_SHUTDOWN_RECEIVED;
157 
158 	/* Extract and process the TSN in the shutdown chunk */
159 	if (sch != NULL) {
160 		tsn = (uint32_t *)(sch + 1);
161 		/* not already acked */
162 		if (!SEQ_LT(ntohl(*tsn), sctp->sctp_lastack_rxd))
163 			trysend = sctp_cumack(sctp, ntohl(*tsn), &samp);
164 	}
165 
166 	/* Don't allow sending new data */
167 	if (!SCTP_IS_DETACHED(sctp) && !sctp->sctp_ulp_discon_done) {
168 		sctp->sctp_ulp_opctl(sctp->sctp_ulpd, SOCK_OPCTL_SHUT_SEND, 0);
169 		sctp->sctp_ulp_discon_done = B_TRUE;
170 	}
171 
172 	/*
173 	 * If there is unsent or unacked data, try sending them out now.
174 	 * The other side should acknowledge them.  After we have flushed
175 	 * the transmit queue, we can complete the shutdown sequence.
176 	 */
177 	if (sctp->sctp_xmit_head != NULL || sctp->sctp_xmit_unsent != NULL)
178 		return (1);
179 
180 	if (fp == NULL) {
181 		/* rotate faddrs if we are retransmitting */
182 		if (!rexmit)
183 			fp = sctp->sctp_current;
184 		else
185 			fp = sctp_rotate_faddr(sctp, sctp->sctp_shutdown_faddr);
186 	}
187 	sctp->sctp_shutdown_faddr = fp;
188 
189 	samp = sctp_make_mp(sctp, fp, sizeof (*sach));
190 	if (samp == NULL) {
191 		SCTP_KSTAT(sctps, sctp_send_shutdown_ack_failed);
192 		goto dotimer;
193 	}
194 
195 	sach = (sctp_chunk_hdr_t *)samp->b_wptr;
196 	sach->sch_id = CHUNK_SHUTDOWN_ACK;
197 	sach->sch_flags = 0;
198 	sach->sch_len = htons(sizeof (*sach));
199 
200 	samp->b_wptr += sizeof (*sach);
201 
202 	/*
203 	 * bundle a "cookie received while shutting down" error if
204 	 * the caller asks for it.
205 	 */
206 	if (crwsd) {
207 		mblk_t *errmp;
208 
209 		errmp = sctp_make_err(sctp, SCTP_ERR_COOKIE_SHUT, NULL, 0);
210 		if (errmp != NULL) {
211 			linkb(samp, errmp);
212 			BUMP_LOCAL(sctp->sctp_obchunks);
213 		}
214 	}
215 
216 	BUMP_LOCAL(sctp->sctp_obchunks);
217 
218 	sctp_set_iplen(sctp, samp, fp->ixa);
219 	(void) conn_ip_output(samp, fp->ixa);
220 	BUMP_LOCAL(sctp->sctp_opkts);
221 
222 dotimer:
223 	sctp->sctp_state = SCTPS_SHUTDOWN_ACK_SENT;
224 	SCTP_FADDR_TIMER_RESTART(sctp, sctp->sctp_current,
225 	    sctp->sctp_current->rto);
226 
227 	return (trysend);
228 }
229 
230 void
231 sctp_shutdown_complete(sctp_t *sctp)
232 {
233 	mblk_t *scmp;
234 	sctp_chunk_hdr_t *scch;
235 	sctp_stack_t	*sctps = sctp->sctp_sctps;
236 
237 	scmp = sctp_make_mp(sctp, sctp->sctp_current, sizeof (*scch));
238 	if (scmp == NULL) {
239 		/* XXX use timer approach */
240 		SCTP_KSTAT(sctps, sctp_send_shutdown_comp_failed);
241 		return;
242 	}
243 
244 	scch = (sctp_chunk_hdr_t *)scmp->b_wptr;
245 	scch->sch_id = CHUNK_SHUTDOWN_COMPLETE;
246 	scch->sch_flags = 0;
247 	scch->sch_len = htons(sizeof (*scch));
248 
249 	scmp->b_wptr += sizeof (*scch);
250 
251 	BUMP_LOCAL(sctp->sctp_obchunks);
252 
253 	sctp_set_iplen(sctp, scmp, sctp->sctp_current->ixa);
254 	(void) conn_ip_output(scmp, sctp->sctp_current->ixa);
255 	BUMP_LOCAL(sctp->sctp_opkts);
256 }
257 
258 /*
259  * Similar to sctp_shutdown_complete(), except that since this
260  * is out-of-the-blue, we can't use an sctp's association information,
261  * and instead must draw all necessary info from the incoming packet.
262  */
263 void
264 sctp_ootb_shutdown_ack(mblk_t *mp, uint_t ip_hdr_len, ip_recv_attr_t *ira,
265     ip_stack_t *ipst)
266 {
267 	boolean_t		isv4;
268 	ipha_t			*ipha = NULL;
269 	ip6_t			*ip6h = NULL;
270 	sctp_hdr_t		*insctph;
271 	sctp_chunk_hdr_t	*scch;
272 	int			i;
273 	uint16_t		port;
274 	mblk_t			*mp1;
275 	netstack_t		*ns = ipst->ips_netstack;
276 	sctp_stack_t		*sctps = ns->netstack_sctp;
277 	ip_xmit_attr_t		ixas;
278 
279 	bzero(&ixas, sizeof (ixas));
280 
281 	isv4 = (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION);
282 
283 	ASSERT(MBLKL(mp) >= sizeof (*insctph) + sizeof (*scch) +
284 	    (isv4 ? sizeof (ipha_t) : sizeof (ip6_t)));
285 
286 	/*
287 	 * Check to see if we can reuse the incoming mblk.  There should
288 	 * not be other reference. Since this packet comes from below,
289 	 * there should be enough header space to fill in what the lower
290 	 * layers want to add.
291 	 */
292 	if (DB_REF(mp) != 1) {
293 		mp1 = allocb(MBLKL(mp) + sctps->sctps_wroff_xtra, BPRI_MED);
294 		if (mp1 == NULL) {
295 			freeb(mp);
296 			return;
297 		}
298 		mp1->b_rptr += sctps->sctps_wroff_xtra;
299 		bcopy(mp->b_rptr, mp1->b_rptr, MBLKL(mp));
300 		freeb(mp);
301 		mp = mp1;
302 	} else {
303 		DB_CKSUMFLAGS(mp) = 0;
304 	}
305 
306 	ixas.ixa_pktlen = ip_hdr_len + sizeof (*insctph) + sizeof (*scch);
307 	ixas.ixa_ip_hdr_length = ip_hdr_len;
308 	mp->b_wptr = (mp->b_rptr + ixas.ixa_pktlen);
309 
310 	/*
311 	 * We follow the logic in tcp_xmit_early_reset() in that we skip
312 	 * reversing source route (i.e. replace all IP options with EOL).
313 	 */
314 	if (isv4) {
315 		ipaddr_t	v4addr;
316 
317 		ipha = (ipha_t *)mp->b_rptr;
318 		for (i = IP_SIMPLE_HDR_LENGTH; i < (int)ip_hdr_len; i++)
319 			mp->b_rptr[i] = IPOPT_EOL;
320 		/* Swap addresses */
321 		ipha->ipha_length = htons(ixas.ixa_pktlen);
322 		v4addr = ipha->ipha_src;
323 		ipha->ipha_src = ipha->ipha_dst;
324 		ipha->ipha_dst = v4addr;
325 		ipha->ipha_ident = 0;
326 		ipha->ipha_ttl = (uchar_t)sctps->sctps_ipv4_ttl;
327 
328 		ixas.ixa_flags = IXAF_BASIC_SIMPLE_V4;
329 	} else {
330 		in6_addr_t	v6addr;
331 
332 		ip6h = (ip6_t *)mp->b_rptr;
333 		/* Remove any extension headers assuming partial overlay */
334 		if (ip_hdr_len > IPV6_HDR_LEN) {
335 			uint8_t	*to;
336 
337 			to = mp->b_rptr + ip_hdr_len - IPV6_HDR_LEN;
338 			ovbcopy(ip6h, to, IPV6_HDR_LEN);
339 			mp->b_rptr += ip_hdr_len - IPV6_HDR_LEN;
340 			ip_hdr_len = IPV6_HDR_LEN;
341 			ip6h = (ip6_t *)mp->b_rptr;
342 			ip6h->ip6_nxt = IPPROTO_SCTP;
343 		}
344 		ip6h->ip6_plen = htons(ixas.ixa_pktlen - IPV6_HDR_LEN);
345 		v6addr = ip6h->ip6_src;
346 		ip6h->ip6_src = ip6h->ip6_dst;
347 		ip6h->ip6_dst = v6addr;
348 		ip6h->ip6_hops = (uchar_t)sctps->sctps_ipv6_hoplimit;
349 
350 		ixas.ixa_flags = IXAF_BASIC_SIMPLE_V6;
351 		if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_dst)) {
352 			ixas.ixa_flags |= IXAF_SCOPEID_SET;
353 			ixas.ixa_scopeid = ira->ira_ruifindex;
354 		}
355 	}
356 
357 	insctph = (sctp_hdr_t *)(mp->b_rptr + ip_hdr_len);
358 
359 	/* Swap ports.  Verification tag is reused. */
360 	port = insctph->sh_sport;
361 	insctph->sh_sport = insctph->sh_dport;
362 	insctph->sh_dport = port;
363 
364 	/* Lay in the shutdown complete chunk */
365 	scch = (sctp_chunk_hdr_t *)(insctph + 1);
366 	scch->sch_id = CHUNK_SHUTDOWN_COMPLETE;
367 	scch->sch_len = htons(sizeof (*scch));
368 	scch->sch_flags = 0;
369 
370 	/* Set the T-bit */
371 	SCTP_SET_TBIT(scch);
372 
373 	ixas.ixa_protocol = IPPROTO_SCTP;
374 	ixas.ixa_zoneid = ira->ira_zoneid;
375 	ixas.ixa_ipst = ipst;
376 	ixas.ixa_ifindex = 0;
377 
378 	if (ira->ira_flags & IRAF_IPSEC_SECURE) {
379 		/*
380 		 * Apply IPsec based on how IPsec was applied to
381 		 * the packet that was out of the blue.
382 		 */
383 		if (!ipsec_in_to_out(ira, &ixas, mp, ipha, ip6h)) {
384 			BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards);
385 			/* Note: mp already consumed and ip_drop_packet done */
386 			return;
387 		}
388 	} else {
389 		/*
390 		 * This is in clear. The message we are building
391 		 * here should go out in clear, independent of our policy.
392 		 */
393 		ixas.ixa_flags |= IXAF_NO_IPSEC;
394 	}
395 
396 	(void) ip_output_simple(mp, &ixas);
397 	ixa_cleanup(&ixas);
398 }
399