1 /* SCTP kernel implementation
2 * Copyright (c) 1999-2000 Cisco, Inc.
3 * Copyright (c) 1999-2001 Motorola, Inc.
4 * Copyright (c) 2001-2003 International Business Machines Corp.
5 * Copyright (c) 2001 Intel Corp.
6 * Copyright (c) 2001 La Monte H.P. Yarroll
8 * This file is part of the SCTP kernel implementation
10 * This module provides the abstraction for an SCTP tranport representing
11 * a remote transport address. For local transport addresses, we just use
14 * This SCTP implementation is free software;
15 * you can redistribute it and/or modify it under the terms of
16 * the GNU General Public License as published by
17 * the Free Software Foundation; either version 2, or (at your option)
20 * This SCTP implementation is distributed in the hope that it
21 * will be useful, but WITHOUT ANY WARRANTY; without even the implied
22 * ************************
23 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
24 * See the GNU General Public License for more details.
26 * You should have received a copy of the GNU General Public License
27 * along with GNU CC; see the file COPYING. If not, see
28 * <http://www.gnu.org/licenses/>.
30 * Please send any bug reports or fixes you make to the
32 * lksctp developers <linux-sctp@vger.kernel.org>
34 * Written or modified by:
35 * La Monte H.P. Yarroll <piggy@acm.org>
36 * Karl Knutson <karl@athena.chicago.il.us>
37 * Jon Grimm <jgrimm@us.ibm.com>
38 * Xingang Guo <xingang.guo@intel.com>
39 * Hui Huang <hui.huang@nokia.com>
40 * Sridhar Samudrala <sri@us.ibm.com>
41 * Ardelle Fan <ardelle.fan@intel.com>
44 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
46 #include <linux/slab.h>
47 #include <linux/types.h>
48 #include <linux/random.h>
49 #include <net/sctp/sctp.h>
50 #include <net/sctp/sm.h>
52 /* 1st Level Abstractions. */
54 /* Initialize a new transport from provided memory. */
55 static struct sctp_transport
*sctp_transport_init(struct net
*net
,
56 struct sctp_transport
*peer
,
57 const union sctp_addr
*addr
,
60 /* Copy in the address. */
62 peer
->af_specific
= sctp_get_af_specific(addr
->sa
.sa_family
);
63 memset(&peer
->saddr
, 0, sizeof(union sctp_addr
));
65 peer
->sack_generation
= 0;
67 /* From 6.3.1 RTO Calculation:
69 * C1) Until an RTT measurement has been made for a packet sent to the
70 * given destination transport address, set RTO to the protocol
71 * parameter 'RTO.Initial'.
73 peer
->rto
= msecs_to_jiffies(net
->sctp
.rto_initial
);
75 peer
->last_time_heard
= 0;
76 peer
->last_time_ecne_reduced
= jiffies
;
78 peer
->param_flags
= SPP_HB_DISABLE
|
82 /* Initialize the default path max_retrans. */
83 peer
->pathmaxrxt
= net
->sctp
.max_retrans_path
;
84 peer
->pf_retrans
= net
->sctp
.pf_retrans
;
86 INIT_LIST_HEAD(&peer
->transmitted
);
87 INIT_LIST_HEAD(&peer
->send_ready
);
88 INIT_LIST_HEAD(&peer
->transports
);
90 timer_setup(&peer
->T3_rtx_timer
, sctp_generate_t3_rtx_event
, 0);
91 timer_setup(&peer
->hb_timer
, sctp_generate_heartbeat_event
, 0);
92 timer_setup(&peer
->reconf_timer
, sctp_generate_reconf_event
, 0);
93 timer_setup(&peer
->proto_unreach_timer
,
94 sctp_generate_proto_unreach_event
, 0);
96 /* Initialize the 64-bit random nonce sent with heartbeat. */
97 get_random_bytes(&peer
->hb_nonce
, sizeof(peer
->hb_nonce
));
99 refcount_set(&peer
->refcnt
, 1);
104 /* Allocate and initialize a new transport. */
105 struct sctp_transport
*sctp_transport_new(struct net
*net
,
106 const union sctp_addr
*addr
,
109 struct sctp_transport
*transport
;
111 transport
= kzalloc(sizeof(*transport
), gfp
);
115 if (!sctp_transport_init(net
, transport
, addr
, gfp
))
118 SCTP_DBG_OBJCNT_INC(transport
);
129 /* This transport is no longer needed. Free up if possible, or
130 * delay until it last reference count.
132 void sctp_transport_free(struct sctp_transport
*transport
)
134 /* Try to delete the heartbeat timer. */
135 if (del_timer(&transport
->hb_timer
))
136 sctp_transport_put(transport
);
138 /* Delete the T3_rtx timer if it's active.
139 * There is no point in not doing this now and letting
140 * structure hang around in memory since we know
141 * the tranport is going away.
143 if (del_timer(&transport
->T3_rtx_timer
))
144 sctp_transport_put(transport
);
146 if (del_timer(&transport
->reconf_timer
))
147 sctp_transport_put(transport
);
149 /* Delete the ICMP proto unreachable timer if it's active. */
150 if (del_timer(&transport
->proto_unreach_timer
))
151 sctp_association_put(transport
->asoc
);
153 sctp_transport_put(transport
);
156 static void sctp_transport_destroy_rcu(struct rcu_head
*head
)
158 struct sctp_transport
*transport
;
160 transport
= container_of(head
, struct sctp_transport
, rcu
);
162 dst_release(transport
->dst
);
164 SCTP_DBG_OBJCNT_DEC(transport
);
167 /* Destroy the transport data structure.
168 * Assumes there are no more users of this structure.
170 static void sctp_transport_destroy(struct sctp_transport
*transport
)
172 if (unlikely(refcount_read(&transport
->refcnt
))) {
173 WARN(1, "Attempt to destroy undead transport %p!\n", transport
);
177 sctp_packet_free(&transport
->packet
);
180 sctp_association_put(transport
->asoc
);
182 call_rcu(&transport
->rcu
, sctp_transport_destroy_rcu
);
185 /* Start T3_rtx timer if it is not already running and update the heartbeat
186 * timer. This routine is called every time a DATA chunk is sent.
188 void sctp_transport_reset_t3_rtx(struct sctp_transport
*transport
)
190 /* RFC 2960 6.3.2 Retransmission Timer Rules
192 * R1) Every time a DATA chunk is sent to any address(including a
193 * retransmission), if the T3-rtx timer of that address is not running
194 * start it running so that it will expire after the RTO of that
198 if (!timer_pending(&transport
->T3_rtx_timer
))
199 if (!mod_timer(&transport
->T3_rtx_timer
,
200 jiffies
+ transport
->rto
))
201 sctp_transport_hold(transport
);
204 void sctp_transport_reset_hb_timer(struct sctp_transport
*transport
)
206 unsigned long expires
;
208 /* When a data chunk is sent, reset the heartbeat interval. */
209 expires
= jiffies
+ sctp_transport_timeout(transport
);
210 if (time_before(transport
->hb_timer
.expires
, expires
) &&
211 !mod_timer(&transport
->hb_timer
,
212 expires
+ prandom_u32_max(transport
->rto
)))
213 sctp_transport_hold(transport
);
216 void sctp_transport_reset_reconf_timer(struct sctp_transport
*transport
)
218 if (!timer_pending(&transport
->reconf_timer
))
219 if (!mod_timer(&transport
->reconf_timer
,
220 jiffies
+ transport
->rto
))
221 sctp_transport_hold(transport
);
224 /* This transport has been assigned to an association.
225 * Initialize fields from the association or from the sock itself.
226 * Register the reference count in the association.
228 void sctp_transport_set_owner(struct sctp_transport
*transport
,
229 struct sctp_association
*asoc
)
231 transport
->asoc
= asoc
;
232 sctp_association_hold(asoc
);
235 /* Initialize the pmtu of a transport. */
236 void sctp_transport_pmtu(struct sctp_transport
*transport
, struct sock
*sk
)
238 /* If we don't have a fresh route, look one up */
239 if (!transport
->dst
|| transport
->dst
->obsolete
) {
240 sctp_transport_dst_release(transport
);
241 transport
->af_specific
->get_dst(transport
, &transport
->saddr
,
245 if (transport
->dst
) {
246 transport
->pathmtu
= SCTP_TRUNC4(dst_mtu(transport
->dst
));
248 transport
->pathmtu
= SCTP_DEFAULT_MAXSEGMENT
;
251 void sctp_transport_update_pmtu(struct sctp_transport
*t
, u32 pmtu
)
253 struct dst_entry
*dst
= sctp_transport_dst_check(t
);
255 if (unlikely(pmtu
< SCTP_DEFAULT_MINSEGMENT
)) {
256 pr_warn("%s: Reported pmtu %d too low, using default minimum of %d\n",
257 __func__
, pmtu
, SCTP_DEFAULT_MINSEGMENT
);
258 /* Use default minimum segment size and disable
259 * pmtu discovery on this transport.
261 t
->pathmtu
= SCTP_DEFAULT_MINSEGMENT
;
267 dst
->ops
->update_pmtu(dst
, t
->asoc
->base
.sk
, NULL
, pmtu
);
268 dst
= sctp_transport_dst_check(t
);
272 t
->af_specific
->get_dst(t
, &t
->saddr
, &t
->fl
, t
->asoc
->base
.sk
);
275 /* Caches the dst entry and source address for a transport's destination
278 void sctp_transport_route(struct sctp_transport
*transport
,
279 union sctp_addr
*saddr
, struct sctp_sock
*opt
)
281 struct sctp_association
*asoc
= transport
->asoc
;
282 struct sctp_af
*af
= transport
->af_specific
;
284 af
->get_dst(transport
, saddr
, &transport
->fl
, sctp_opt2sk(opt
));
287 memcpy(&transport
->saddr
, saddr
, sizeof(union sctp_addr
));
289 af
->get_saddr(opt
, transport
, &transport
->fl
);
291 if ((transport
->param_flags
& SPP_PMTUD_DISABLE
) && transport
->pathmtu
) {
294 if (transport
->dst
) {
295 transport
->pathmtu
= SCTP_TRUNC4(dst_mtu(transport
->dst
));
297 /* Initialize sk->sk_rcv_saddr, if the transport is the
298 * association's active path for getsockname().
300 if (asoc
&& (!asoc
->peer
.primary_path
||
301 (transport
== asoc
->peer
.active_path
)))
302 opt
->pf
->to_sk_saddr(&transport
->saddr
,
305 transport
->pathmtu
= SCTP_DEFAULT_MAXSEGMENT
;
308 /* Hold a reference to a transport. */
309 int sctp_transport_hold(struct sctp_transport
*transport
)
311 return refcount_inc_not_zero(&transport
->refcnt
);
314 /* Release a reference to a transport and clean up
315 * if there are no more references.
317 void sctp_transport_put(struct sctp_transport
*transport
)
319 if (refcount_dec_and_test(&transport
->refcnt
))
320 sctp_transport_destroy(transport
);
323 /* Update transport's RTO based on the newly calculated RTT. */
324 void sctp_transport_update_rto(struct sctp_transport
*tp
, __u32 rtt
)
326 if (unlikely(!tp
->rto_pending
))
327 /* We should not be doing any RTO updates unless rto_pending is set. */
328 pr_debug("%s: rto_pending not set on transport %p!\n", __func__
, tp
);
330 if (tp
->rttvar
|| tp
->srtt
) {
331 struct net
*net
= sock_net(tp
->asoc
->base
.sk
);
332 /* 6.3.1 C3) When a new RTT measurement R' is made, set
333 * RTTVAR <- (1 - RTO.Beta) * RTTVAR + RTO.Beta * |SRTT - R'|
334 * SRTT <- (1 - RTO.Alpha) * SRTT + RTO.Alpha * R'
337 /* Note: The above algorithm has been rewritten to
338 * express rto_beta and rto_alpha as inverse powers
340 * For example, assuming the default value of RTO.Alpha of
341 * 1/8, rto_alpha would be expressed as 3.
343 tp
->rttvar
= tp
->rttvar
- (tp
->rttvar
>> net
->sctp
.rto_beta
)
344 + (((__u32
)abs((__s64
)tp
->srtt
- (__s64
)rtt
)) >> net
->sctp
.rto_beta
);
345 tp
->srtt
= tp
->srtt
- (tp
->srtt
>> net
->sctp
.rto_alpha
)
346 + (rtt
>> net
->sctp
.rto_alpha
);
348 /* 6.3.1 C2) When the first RTT measurement R is made, set
349 * SRTT <- R, RTTVAR <- R/2.
352 tp
->rttvar
= rtt
>> 1;
355 /* 6.3.1 G1) Whenever RTTVAR is computed, if RTTVAR = 0, then
356 * adjust RTTVAR <- G, where G is the CLOCK GRANULARITY.
359 tp
->rttvar
= SCTP_CLOCK_GRANULARITY
;
361 /* 6.3.1 C3) After the computation, update RTO <- SRTT + 4 * RTTVAR. */
362 tp
->rto
= tp
->srtt
+ (tp
->rttvar
<< 2);
364 /* 6.3.1 C6) Whenever RTO is computed, if it is less than RTO.Min
365 * seconds then it is rounded up to RTO.Min seconds.
367 if (tp
->rto
< tp
->asoc
->rto_min
)
368 tp
->rto
= tp
->asoc
->rto_min
;
370 /* 6.3.1 C7) A maximum value may be placed on RTO provided it is
371 * at least RTO.max seconds.
373 if (tp
->rto
> tp
->asoc
->rto_max
)
374 tp
->rto
= tp
->asoc
->rto_max
;
376 sctp_max_rto(tp
->asoc
, tp
);
379 /* Reset rto_pending so that a new RTT measurement is started when a
380 * new data chunk is sent.
384 pr_debug("%s: transport:%p, rtt:%d, srtt:%d rttvar:%d, rto:%ld\n",
385 __func__
, tp
, rtt
, tp
->srtt
, tp
->rttvar
, tp
->rto
);
388 /* This routine updates the transport's cwnd and partial_bytes_acked
389 * parameters based on the bytes acked in the received SACK.
391 void sctp_transport_raise_cwnd(struct sctp_transport
*transport
,
392 __u32 sack_ctsn
, __u32 bytes_acked
)
394 struct sctp_association
*asoc
= transport
->asoc
;
395 __u32 cwnd
, ssthresh
, flight_size
, pba
, pmtu
;
397 cwnd
= transport
->cwnd
;
398 flight_size
= transport
->flight_size
;
400 /* See if we need to exit Fast Recovery first */
401 if (asoc
->fast_recovery
&&
402 TSN_lte(asoc
->fast_recovery_exit
, sack_ctsn
))
403 asoc
->fast_recovery
= 0;
405 ssthresh
= transport
->ssthresh
;
406 pba
= transport
->partial_bytes_acked
;
407 pmtu
= transport
->asoc
->pathmtu
;
409 if (cwnd
<= ssthresh
) {
411 * o When cwnd is less than or equal to ssthresh, an SCTP
412 * endpoint MUST use the slow-start algorithm to increase
413 * cwnd only if the current congestion window is being fully
414 * utilized, an incoming SACK advances the Cumulative TSN
415 * Ack Point, and the data sender is not in Fast Recovery.
416 * Only when these three conditions are met can the cwnd be
417 * increased; otherwise, the cwnd MUST not be increased.
418 * If these conditions are met, then cwnd MUST be increased
419 * by, at most, the lesser of 1) the total size of the
420 * previously outstanding DATA chunk(s) acknowledged, and
421 * 2) the destination's path MTU. This upper bound protects
422 * against the ACK-Splitting attack outlined in [SAVAGE99].
424 if (asoc
->fast_recovery
)
427 /* The appropriate cwnd increase algorithm is performed
428 * if, and only if the congestion window is being fully
429 * utilized. Note that RFC4960 Errata 3.22 removed the
430 * other condition on ctsn moving.
432 if (flight_size
< cwnd
)
435 if (bytes_acked
> pmtu
)
440 pr_debug("%s: slow start: transport:%p, bytes_acked:%d, "
441 "cwnd:%d, ssthresh:%d, flight_size:%d, pba:%d\n",
442 __func__
, transport
, bytes_acked
, cwnd
, ssthresh
,
445 /* RFC 2960 7.2.2 Whenever cwnd is greater than ssthresh,
446 * upon each SACK arrival, increase partial_bytes_acked
447 * by the total number of bytes of all new chunks
448 * acknowledged in that SACK including chunks
449 * acknowledged by the new Cumulative TSN Ack and by Gap
450 * Ack Blocks. (updated by RFC4960 Errata 3.22)
452 * When partial_bytes_acked is greater than cwnd and
453 * before the arrival of the SACK the sender had less
454 * bytes of data outstanding than cwnd (i.e., before
455 * arrival of the SACK, flightsize was less than cwnd),
456 * reset partial_bytes_acked to cwnd. (RFC 4960 Errata
459 * When partial_bytes_acked is equal to or greater than
460 * cwnd and before the arrival of the SACK the sender
461 * had cwnd or more bytes of data outstanding (i.e.,
462 * before arrival of the SACK, flightsize was greater
463 * than or equal to cwnd), partial_bytes_acked is reset
464 * to (partial_bytes_acked - cwnd). Next, cwnd is
465 * increased by MTU. (RFC 4960 Errata 3.12)
468 if (pba
> cwnd
&& flight_size
< cwnd
)
470 if (pba
>= cwnd
&& flight_size
>= cwnd
) {
475 pr_debug("%s: congestion avoidance: transport:%p, "
476 "bytes_acked:%d, cwnd:%d, ssthresh:%d, "
477 "flight_size:%d, pba:%d\n", __func__
,
478 transport
, bytes_acked
, cwnd
, ssthresh
,
482 transport
->cwnd
= cwnd
;
483 transport
->partial_bytes_acked
= pba
;
486 /* This routine is used to lower the transport's cwnd when congestion is
489 void sctp_transport_lower_cwnd(struct sctp_transport
*transport
,
490 enum sctp_lower_cwnd reason
)
492 struct sctp_association
*asoc
= transport
->asoc
;
495 case SCTP_LOWER_CWND_T3_RTX
:
496 /* RFC 2960 Section 7.2.3, sctpimpguide
497 * When the T3-rtx timer expires on an address, SCTP should
498 * perform slow start by:
499 * ssthresh = max(cwnd/2, 4*MTU)
501 * partial_bytes_acked = 0
503 transport
->ssthresh
= max(transport
->cwnd
/2,
505 transport
->cwnd
= asoc
->pathmtu
;
507 /* T3-rtx also clears fast recovery */
508 asoc
->fast_recovery
= 0;
511 case SCTP_LOWER_CWND_FAST_RTX
:
512 /* RFC 2960 7.2.4 Adjust the ssthresh and cwnd of the
513 * destination address(es) to which the missing DATA chunks
514 * were last sent, according to the formula described in
517 * RFC 2960 7.2.3, sctpimpguide Upon detection of packet
518 * losses from SACK (see Section 7.2.4), An endpoint
519 * should do the following:
520 * ssthresh = max(cwnd/2, 4*MTU)
522 * partial_bytes_acked = 0
524 if (asoc
->fast_recovery
)
527 /* Mark Fast recovery */
528 asoc
->fast_recovery
= 1;
529 asoc
->fast_recovery_exit
= asoc
->next_tsn
- 1;
531 transport
->ssthresh
= max(transport
->cwnd
/2,
533 transport
->cwnd
= transport
->ssthresh
;
536 case SCTP_LOWER_CWND_ECNE
:
537 /* RFC 2481 Section 6.1.2.
538 * If the sender receives an ECN-Echo ACK packet
539 * then the sender knows that congestion was encountered in the
540 * network on the path from the sender to the receiver. The
541 * indication of congestion should be treated just as a
542 * congestion loss in non-ECN Capable TCP. That is, the TCP
543 * source halves the congestion window "cwnd" and reduces the
544 * slow start threshold "ssthresh".
545 * A critical condition is that TCP does not react to
546 * congestion indications more than once every window of
547 * data (or more loosely more than once every round-trip time).
549 if (time_after(jiffies
, transport
->last_time_ecne_reduced
+
551 transport
->ssthresh
= max(transport
->cwnd
/2,
553 transport
->cwnd
= transport
->ssthresh
;
554 transport
->last_time_ecne_reduced
= jiffies
;
558 case SCTP_LOWER_CWND_INACTIVE
:
559 /* RFC 2960 Section 7.2.1, sctpimpguide
560 * When the endpoint does not transmit data on a given
561 * transport address, the cwnd of the transport address
562 * should be adjusted to max(cwnd/2, 4*MTU) per RTO.
563 * NOTE: Although the draft recommends that this check needs
564 * to be done every RTO interval, we do it every hearbeat
567 transport
->cwnd
= max(transport
->cwnd
/2,
569 /* RFC 4960 Errata 3.27.2: also adjust sshthresh */
570 transport
->ssthresh
= transport
->cwnd
;
574 transport
->partial_bytes_acked
= 0;
576 pr_debug("%s: transport:%p, reason:%d, cwnd:%d, ssthresh:%d\n",
577 __func__
, transport
, reason
, transport
->cwnd
,
578 transport
->ssthresh
);
581 /* Apply Max.Burst limit to the congestion window:
582 * sctpimpguide-05 2.14.2
583 * D) When the time comes for the sender to
584 * transmit new DATA chunks, the protocol parameter Max.Burst MUST
585 * first be applied to limit how many new DATA chunks may be sent.
586 * The limit is applied by adjusting cwnd as follows:
587 * if ((flightsize+ Max.Burst * MTU) < cwnd)
588 * cwnd = flightsize + Max.Burst * MTU
591 void sctp_transport_burst_limited(struct sctp_transport
*t
)
593 struct sctp_association
*asoc
= t
->asoc
;
594 u32 old_cwnd
= t
->cwnd
;
597 if (t
->burst_limited
|| asoc
->max_burst
== 0)
600 max_burst_bytes
= t
->flight_size
+ (asoc
->max_burst
* asoc
->pathmtu
);
601 if (max_burst_bytes
< old_cwnd
) {
602 t
->cwnd
= max_burst_bytes
;
603 t
->burst_limited
= old_cwnd
;
607 /* Restore the old cwnd congestion window, after the burst had it's
610 void sctp_transport_burst_reset(struct sctp_transport
*t
)
612 if (t
->burst_limited
) {
613 t
->cwnd
= t
->burst_limited
;
614 t
->burst_limited
= 0;
618 /* What is the next timeout value for this transport? */
619 unsigned long sctp_transport_timeout(struct sctp_transport
*trans
)
621 /* RTO + timer slack +/- 50% of RTO */
622 unsigned long timeout
= trans
->rto
>> 1;
624 if (trans
->state
!= SCTP_UNCONFIRMED
&&
625 trans
->state
!= SCTP_PF
)
626 timeout
+= trans
->hbinterval
;
631 /* Reset transport variables to their initial values */
632 void sctp_transport_reset(struct sctp_transport
*t
)
634 struct sctp_association
*asoc
= t
->asoc
;
636 /* RFC 2960 (bis), Section 5.2.4
637 * All the congestion control parameters (e.g., cwnd, ssthresh)
638 * related to this peer MUST be reset to their initial values
639 * (see Section 6.2.1)
641 t
->cwnd
= min(4*asoc
->pathmtu
, max_t(__u32
, 2*asoc
->pathmtu
, 4380));
642 t
->burst_limited
= 0;
643 t
->ssthresh
= asoc
->peer
.i
.a_rwnd
;
644 t
->rto
= asoc
->rto_initial
;
645 sctp_max_rto(asoc
, t
);
650 /* Reset these additional variables so that we have a clean slate. */
651 t
->partial_bytes_acked
= 0;
657 /* Initialize the state information for SFR-CACC */
658 t
->cacc
.changeover_active
= 0;
659 t
->cacc
.cycling_changeover
= 0;
660 t
->cacc
.next_tsn_at_change
= 0;
661 t
->cacc
.cacc_saw_newack
= 0;
664 /* Schedule retransmission on the given transport */
665 void sctp_transport_immediate_rtx(struct sctp_transport
*t
)
667 /* Stop pending T3_rtx_timer */
668 if (del_timer(&t
->T3_rtx_timer
))
669 sctp_transport_put(t
);
671 sctp_retransmit(&t
->asoc
->outqueue
, t
, SCTP_RTXR_T3_RTX
);
672 if (!timer_pending(&t
->T3_rtx_timer
)) {
673 if (!mod_timer(&t
->T3_rtx_timer
, jiffies
+ t
->rto
))
674 sctp_transport_hold(t
);
679 void sctp_transport_dst_release(struct sctp_transport
*t
)
683 t
->dst_pending_confirm
= 0;
686 /* Schedule neighbour confirm */
687 void sctp_transport_dst_confirm(struct sctp_transport
*t
)
689 t
->dst_pending_confirm
= 1;