1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
54
55#include <linux/types.h>
56#include <linux/kernel.h>
57#include <linux/ip.h>
58#include <linux/ipv6.h>
59#include <linux/net.h>
60#include <linux/inet.h>
61#include <linux/slab.h>
62#include <net/sock.h>
63#include <net/inet_ecn.h>
64#include <linux/skbuff.h>
65#include <net/sctp/sctp.h>
66#include <net/sctp/sm.h>
67#include <net/sctp/structs.h>
68
69static struct sctp_packet *sctp_abort_pkt_new(const struct sctp_endpoint *ep,
70 const struct sctp_association *asoc,
71 struct sctp_chunk *chunk,
72 const void *payload,
73 size_t paylen);
74static int sctp_eat_data(const struct sctp_association *asoc,
75 struct sctp_chunk *chunk,
76 sctp_cmd_seq_t *commands);
77static struct sctp_packet *sctp_ootb_pkt_new(const struct sctp_association *asoc,
78 const struct sctp_chunk *chunk);
79static void sctp_send_stale_cookie_err(const struct sctp_endpoint *ep,
80 const struct sctp_association *asoc,
81 const struct sctp_chunk *chunk,
82 sctp_cmd_seq_t *commands,
83 struct sctp_chunk *err_chunk);
84static sctp_disposition_t sctp_sf_do_5_2_6_stale(const struct sctp_endpoint *ep,
85 const struct sctp_association *asoc,
86 const sctp_subtype_t type,
87 void *arg,
88 sctp_cmd_seq_t *commands);
89static sctp_disposition_t sctp_sf_shut_8_4_5(const struct sctp_endpoint *ep,
90 const struct sctp_association *asoc,
91 const sctp_subtype_t type,
92 void *arg,
93 sctp_cmd_seq_t *commands);
94static sctp_disposition_t sctp_sf_tabort_8_4_8(const struct sctp_endpoint *ep,
95 const struct sctp_association *asoc,
96 const sctp_subtype_t type,
97 void *arg,
98 sctp_cmd_seq_t *commands);
99static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk);
100
101static sctp_disposition_t sctp_stop_t1_and_abort(sctp_cmd_seq_t *commands,
102 __be16 error, int sk_err,
103 const struct sctp_association *asoc,
104 struct sctp_transport *transport);
105
106static sctp_disposition_t sctp_sf_abort_violation(
107 const struct sctp_endpoint *ep,
108 const struct sctp_association *asoc,
109 void *arg,
110 sctp_cmd_seq_t *commands,
111 const __u8 *payload,
112 const size_t paylen);
113
114static sctp_disposition_t sctp_sf_violation_chunklen(
115 const struct sctp_endpoint *ep,
116 const struct sctp_association *asoc,
117 const sctp_subtype_t type,
118 void *arg,
119 sctp_cmd_seq_t *commands);
120
121static sctp_disposition_t sctp_sf_violation_paramlen(
122 const struct sctp_endpoint *ep,
123 const struct sctp_association *asoc,
124 const sctp_subtype_t type,
125 void *arg, void *ext,
126 sctp_cmd_seq_t *commands);
127
128static sctp_disposition_t sctp_sf_violation_ctsn(
129 const struct sctp_endpoint *ep,
130 const struct sctp_association *asoc,
131 const sctp_subtype_t type,
132 void *arg,
133 sctp_cmd_seq_t *commands);
134
135static sctp_disposition_t sctp_sf_violation_chunk(
136 const struct sctp_endpoint *ep,
137 const struct sctp_association *asoc,
138 const sctp_subtype_t type,
139 void *arg,
140 sctp_cmd_seq_t *commands);
141
142static sctp_ierror_t sctp_sf_authenticate(const struct sctp_endpoint *ep,
143 const struct sctp_association *asoc,
144 const sctp_subtype_t type,
145 struct sctp_chunk *chunk);
146
147static sctp_disposition_t __sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep,
148 const struct sctp_association *asoc,
149 const sctp_subtype_t type,
150 void *arg,
151 sctp_cmd_seq_t *commands);
152
153
154
155
156
157
158
159
160static inline int
161sctp_chunk_length_valid(struct sctp_chunk *chunk,
162 __u16 required_length)
163{
164 __u16 chunk_length = ntohs(chunk->chunk_hdr->length);
165
166 if (unlikely(chunk_length < required_length))
167 return 0;
168
169 return 1;
170}
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207sctp_disposition_t sctp_sf_do_4_C(const struct sctp_endpoint *ep,
208 const struct sctp_association *asoc,
209 const sctp_subtype_t type,
210 void *arg,
211 sctp_cmd_seq_t *commands)
212{
213 struct sctp_chunk *chunk = arg;
214 struct sctp_ulpevent *ev;
215
216 if (!sctp_vtag_verify_either(chunk, asoc))
217 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
218
219
220
221
222
223
224 if (!chunk->singleton)
225 return sctp_sf_violation_chunk(ep, asoc, type, arg, commands);
226
227
228 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
229 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
230 commands);
231
232
233
234
235
236
237
238
239 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_SHUTDOWN_COMP,
240 0, 0, 0, NULL, GFP_ATOMIC);
241 if (ev)
242 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
243 SCTP_ULPEVENT(ev));
244
245
246
247
248
249
250
251
252
253 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
254 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
255
256 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
257 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
258
259 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
260 SCTP_STATE(SCTP_STATE_CLOSED));
261
262 SCTP_INC_STATS(SCTP_MIB_SHUTDOWNS);
263 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
264
265 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
266
267 return SCTP_DISPOSITION_DELETE_TCB;
268}
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292sctp_disposition_t sctp_sf_do_5_1B_init(const struct sctp_endpoint *ep,
293 const struct sctp_association *asoc,
294 const sctp_subtype_t type,
295 void *arg,
296 sctp_cmd_seq_t *commands)
297{
298 struct sctp_chunk *chunk = arg;
299 struct sctp_chunk *repl;
300 struct sctp_association *new_asoc;
301 struct sctp_chunk *err_chunk;
302 struct sctp_packet *packet;
303 sctp_unrecognized_param_t *unk_param;
304 int len;
305
306
307
308
309
310
311
312
313
314
315 if (!chunk->singleton)
316 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
317
318
319
320
321 if (ep == sctp_sk((sctp_get_ctl_sock()))->ep) {
322 SCTP_INC_STATS(SCTP_MIB_OUTOFBLUES);
323 return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
324 }
325
326
327
328
329 if (chunk->sctp_hdr->vtag != 0)
330 return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
331
332
333
334
335
336
337 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_init_chunk_t)))
338 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
339
340
341
342
343
344
345
346 if (sctp_sstate(ep->base.sk, CLOSING))
347 return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
348
349
350 err_chunk = NULL;
351 if (!sctp_verify_init(asoc, chunk->chunk_hdr->type,
352 (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
353 &err_chunk)) {
354
355
356
357 if (err_chunk) {
358 packet = sctp_abort_pkt_new(ep, asoc, arg,
359 (__u8 *)(err_chunk->chunk_hdr) +
360 sizeof(sctp_chunkhdr_t),
361 ntohs(err_chunk->chunk_hdr->length) -
362 sizeof(sctp_chunkhdr_t));
363
364 sctp_chunk_free(err_chunk);
365
366 if (packet) {
367 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
368 SCTP_PACKET(packet));
369 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
370 return SCTP_DISPOSITION_CONSUME;
371 } else {
372 return SCTP_DISPOSITION_NOMEM;
373 }
374 } else {
375 return sctp_sf_tabort_8_4_8(ep, asoc, type, arg,
376 commands);
377 }
378 }
379
380
381 chunk->subh.init_hdr = (sctp_inithdr_t *)chunk->skb->data;
382
383
384 chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(sctp_inithdr_t));
385
386 new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC);
387 if (!new_asoc)
388 goto nomem;
389
390 if (sctp_assoc_set_bind_addr_from_ep(new_asoc,
391 sctp_scope(sctp_source(chunk)),
392 GFP_ATOMIC) < 0)
393 goto nomem_init;
394
395
396 if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
397 sctp_source(chunk),
398 (sctp_init_chunk_t *)chunk->chunk_hdr,
399 GFP_ATOMIC))
400 goto nomem_init;
401
402
403
404
405
406
407 len = 0;
408 if (err_chunk)
409 len = ntohs(err_chunk->chunk_hdr->length) -
410 sizeof(sctp_chunkhdr_t);
411
412 repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
413 if (!repl)
414 goto nomem_init;
415
416
417
418
419
420 if (err_chunk) {
421
422
423
424
425
426
427
428 unk_param = (sctp_unrecognized_param_t *)
429 ((__u8 *)(err_chunk->chunk_hdr) +
430 sizeof(sctp_chunkhdr_t));
431
432
433
434 sctp_addto_chunk(repl, len, unk_param);
435 sctp_chunk_free(err_chunk);
436 }
437
438 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
439
440 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
441
442
443
444
445
446
447
448 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
449
450 return SCTP_DISPOSITION_DELETE_TCB;
451
452nomem_init:
453 sctp_association_free(new_asoc);
454nomem:
455 if (err_chunk)
456 sctp_chunk_free(err_chunk);
457 return SCTP_DISPOSITION_NOMEM;
458}
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
489 const struct sctp_association *asoc,
490 const sctp_subtype_t type,
491 void *arg,
492 sctp_cmd_seq_t *commands)
493{
494 struct sctp_chunk *chunk = arg;
495 sctp_init_chunk_t *initchunk;
496 struct sctp_chunk *err_chunk;
497 struct sctp_packet *packet;
498
499 if (!sctp_vtag_verify(chunk, asoc))
500 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
501
502
503
504
505
506 if (!chunk->singleton)
507 return sctp_sf_violation_chunk(ep, asoc, type, arg, commands);
508
509
510 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_initack_chunk_t)))
511 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
512 commands);
513
514 chunk->subh.init_hdr = (sctp_inithdr_t *) chunk->skb->data;
515
516
517 err_chunk = NULL;
518 if (!sctp_verify_init(asoc, chunk->chunk_hdr->type,
519 (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
520 &err_chunk)) {
521
522 sctp_error_t error = SCTP_ERROR_NO_RESOURCE;
523
524
525
526
527
528
529 if (err_chunk) {
530 packet = sctp_abort_pkt_new(ep, asoc, arg,
531 (__u8 *)(err_chunk->chunk_hdr) +
532 sizeof(sctp_chunkhdr_t),
533 ntohs(err_chunk->chunk_hdr->length) -
534 sizeof(sctp_chunkhdr_t));
535
536 sctp_chunk_free(err_chunk);
537
538 if (packet) {
539 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
540 SCTP_PACKET(packet));
541 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
542 error = SCTP_ERROR_INV_PARAM;
543 }
544 }
545
546
547
548
549
550
551
552
553
554
555
556
557 if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
558 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
559
560 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
561 return sctp_stop_t1_and_abort(commands, error, ECONNREFUSED,
562 asoc, chunk->transport);
563 }
564
565
566
567
568 chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(sctp_inithdr_t));
569
570 initchunk = (sctp_init_chunk_t *) chunk->chunk_hdr;
571
572 sctp_add_cmd_sf(commands, SCTP_CMD_PEER_INIT,
573 SCTP_PEER_INIT(initchunk));
574
575
576 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());
577
578
579
580
581
582 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
583 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
584 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
585 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
586 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
587 SCTP_STATE(SCTP_STATE_COOKIE_ECHOED));
588
589
590
591
592 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_SHKEY, SCTP_NULL());
593
594
595
596
597
598
599
600 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_COOKIE_ECHO,
601 SCTP_CHUNK(err_chunk));
602
603 return SCTP_DISPOSITION_CONSUME;
604}
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637sctp_disposition_t sctp_sf_do_5_1D_ce(const struct sctp_endpoint *ep,
638 const struct sctp_association *asoc,
639 const sctp_subtype_t type, void *arg,
640 sctp_cmd_seq_t *commands)
641{
642 struct sctp_chunk *chunk = arg;
643 struct sctp_association *new_asoc;
644 sctp_init_chunk_t *peer_init;
645 struct sctp_chunk *repl;
646 struct sctp_ulpevent *ev, *ai_ev = NULL;
647 int error = 0;
648 struct sctp_chunk *err_chk_p;
649 struct sock *sk;
650
651
652
653
654 if (ep == sctp_sk((sctp_get_ctl_sock()))->ep) {
655 SCTP_INC_STATS(SCTP_MIB_OUTOFBLUES);
656 return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
657 }
658
659
660
661
662
663
664 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
665 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
666
667
668
669
670
671 sk = ep->base.sk;
672 if (!sctp_sstate(sk, LISTENING) ||
673 (sctp_style(sk, TCP) && sk_acceptq_is_full(sk)))
674 return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
675
676
677
678
679 chunk->subh.cookie_hdr =
680 (struct sctp_signed_cookie *)chunk->skb->data;
681 if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
682 sizeof(sctp_chunkhdr_t)))
683 goto nomem;
684
685
686
687
688
689 new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, &error,
690 &err_chk_p);
691
692
693
694
695
696
697
698 if (!new_asoc) {
699
700
701
702 switch (error) {
703 case -SCTP_IERROR_NOMEM:
704 goto nomem;
705
706 case -SCTP_IERROR_STALE_COOKIE:
707 sctp_send_stale_cookie_err(ep, asoc, chunk, commands,
708 err_chk_p);
709 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
710
711 case -SCTP_IERROR_BAD_SIG:
712 default:
713 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
714 }
715 }
716
717
718
719
720
721
722
723
724
725
726 peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
727
728 if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
729 &chunk->subh.cookie_hdr->c.peer_addr,
730 peer_init, GFP_ATOMIC))
731 goto nomem_init;
732
733
734
735
736
737 error = sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC);
738 if (error)
739 goto nomem_init;
740
741
742
743
744
745
746
747 if (chunk->auth_chunk) {
748 struct sctp_chunk auth;
749 sctp_ierror_t ret;
750
751
752 auth.skb = chunk->auth_chunk;
753 auth.asoc = chunk->asoc;
754 auth.sctp_hdr = chunk->sctp_hdr;
755 auth.chunk_hdr = (sctp_chunkhdr_t *)skb_push(chunk->auth_chunk,
756 sizeof(sctp_chunkhdr_t));
757 skb_pull(chunk->auth_chunk, sizeof(sctp_chunkhdr_t));
758 auth.transport = chunk->transport;
759
760 ret = sctp_sf_authenticate(ep, new_asoc, type, &auth);
761
762
763 kfree_skb(chunk->auth_chunk);
764
765 if (ret != SCTP_IERROR_NO_ERROR) {
766 sctp_association_free(new_asoc);
767 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
768 }
769 }
770
771 repl = sctp_make_cookie_ack(new_asoc, chunk);
772 if (!repl)
773 goto nomem_init;
774
775
776
777
778
779
780
781 ev = sctp_ulpevent_make_assoc_change(new_asoc, 0, SCTP_COMM_UP, 0,
782 new_asoc->c.sinit_num_ostreams,
783 new_asoc->c.sinit_max_instreams,
784 NULL, GFP_ATOMIC);
785 if (!ev)
786 goto nomem_ev;
787
788
789
790
791
792
793 if (new_asoc->peer.adaptation_ind) {
794 ai_ev = sctp_ulpevent_make_adaptation_indication(new_asoc,
795 GFP_ATOMIC);
796 if (!ai_ev)
797 goto nomem_aiev;
798 }
799
800
801
802
803
804
805 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
806 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
807 SCTP_STATE(SCTP_STATE_ESTABLISHED));
808 SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
809 SCTP_INC_STATS(SCTP_MIB_PASSIVEESTABS);
810 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
811
812 if (new_asoc->autoclose)
813 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
814 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
815
816
817 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
818
819
820 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
821
822
823 if (ai_ev)
824 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
825 SCTP_ULPEVENT(ai_ev));
826
827 return SCTP_DISPOSITION_CONSUME;
828
829nomem_aiev:
830 sctp_ulpevent_free(ev);
831nomem_ev:
832 sctp_chunk_free(repl);
833nomem_init:
834 sctp_association_free(new_asoc);
835nomem:
836 return SCTP_DISPOSITION_NOMEM;
837}
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860sctp_disposition_t sctp_sf_do_5_1E_ca(const struct sctp_endpoint *ep,
861 const struct sctp_association *asoc,
862 const sctp_subtype_t type, void *arg,
863 sctp_cmd_seq_t *commands)
864{
865 struct sctp_chunk *chunk = arg;
866 struct sctp_ulpevent *ev;
867
868 if (!sctp_vtag_verify(chunk, asoc))
869 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
870
871
872
873
874 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
875 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
876 commands);
877
878
879
880
881
882
883
884 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());
885
886
887
888
889
890
891
892 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
893 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
894 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
895 SCTP_STATE(SCTP_STATE_ESTABLISHED));
896 SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
897 SCTP_INC_STATS(SCTP_MIB_ACTIVEESTABS);
898 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
899 if (asoc->autoclose)
900 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
901 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
902
903
904
905
906
907 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_COMM_UP,
908 0, asoc->c.sinit_num_ostreams,
909 asoc->c.sinit_max_instreams,
910 NULL, GFP_ATOMIC);
911
912 if (!ev)
913 goto nomem;
914
915 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
916
917
918
919
920
921
922 if (asoc->peer.adaptation_ind) {
923 ev = sctp_ulpevent_make_adaptation_indication(asoc, GFP_ATOMIC);
924 if (!ev)
925 goto nomem;
926
927 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
928 SCTP_ULPEVENT(ev));
929 }
930
931 return SCTP_DISPOSITION_CONSUME;
932nomem:
933 return SCTP_DISPOSITION_NOMEM;
934}
935
936
937static sctp_disposition_t sctp_sf_heartbeat(const struct sctp_endpoint *ep,
938 const struct sctp_association *asoc,
939 const sctp_subtype_t type,
940 void *arg,
941 sctp_cmd_seq_t *commands)
942{
943 struct sctp_transport *transport = (struct sctp_transport *) arg;
944 struct sctp_chunk *reply;
945 sctp_sender_hb_info_t hbinfo;
946 size_t paylen = 0;
947
948 hbinfo.param_hdr.type = SCTP_PARAM_HEARTBEAT_INFO;
949 hbinfo.param_hdr.length = htons(sizeof(sctp_sender_hb_info_t));
950 hbinfo.daddr = transport->ipaddr;
951 hbinfo.sent_at = jiffies;
952 hbinfo.hb_nonce = transport->hb_nonce;
953
954
955 paylen = sizeof(sctp_sender_hb_info_t);
956 reply = sctp_make_heartbeat(asoc, transport, &hbinfo, paylen);
957 if (!reply)
958 return SCTP_DISPOSITION_NOMEM;
959
960
961
962
963 sctp_add_cmd_sf(commands, SCTP_CMD_RTO_PENDING,
964 SCTP_TRANSPORT(transport));
965
966 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
967 return SCTP_DISPOSITION_CONSUME;
968}
969
970
971sctp_disposition_t sctp_sf_sendbeat_8_3(const struct sctp_endpoint *ep,
972 const struct sctp_association *asoc,
973 const sctp_subtype_t type,
974 void *arg,
975 sctp_cmd_seq_t *commands)
976{
977 struct sctp_transport *transport = (struct sctp_transport *) arg;
978
979 if (asoc->overall_error_count >= asoc->max_retrans) {
980 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
981 SCTP_ERROR(ETIMEDOUT));
982
983 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
984 SCTP_PERR(SCTP_ERROR_NO_ERROR));
985 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
986 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
987 return SCTP_DISPOSITION_DELETE_TCB;
988 }
989
990
991
992
993
994
995
996
997 if (transport->param_flags & SPP_HB_ENABLE) {
998 if (SCTP_DISPOSITION_NOMEM ==
999 sctp_sf_heartbeat(ep, asoc, type, arg,
1000 commands))
1001 return SCTP_DISPOSITION_NOMEM;
1002
1003
1004
1005
1006 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_HB_SENT,
1007 SCTP_TRANSPORT(transport));
1008 }
1009 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_IDLE,
1010 SCTP_TRANSPORT(transport));
1011 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMER_UPDATE,
1012 SCTP_TRANSPORT(transport));
1013
1014 return SCTP_DISPOSITION_CONSUME;
1015}
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041sctp_disposition_t sctp_sf_beat_8_3(const struct sctp_endpoint *ep,
1042 const struct sctp_association *asoc,
1043 const sctp_subtype_t type,
1044 void *arg,
1045 sctp_cmd_seq_t *commands)
1046{
1047 struct sctp_chunk *chunk = arg;
1048 struct sctp_chunk *reply;
1049 size_t paylen = 0;
1050
1051 if (!sctp_vtag_verify(chunk, asoc))
1052 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
1053
1054
1055 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_heartbeat_chunk_t)))
1056 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
1057 commands);
1058
1059
1060
1061
1062
1063 chunk->subh.hb_hdr = (sctp_heartbeathdr_t *) chunk->skb->data;
1064 paylen = ntohs(chunk->chunk_hdr->length) - sizeof(sctp_chunkhdr_t);
1065 if (!pskb_pull(chunk->skb, paylen))
1066 goto nomem;
1067
1068 reply = sctp_make_heartbeat_ack(asoc, chunk,
1069 chunk->subh.hb_hdr, paylen);
1070 if (!reply)
1071 goto nomem;
1072
1073 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
1074 return SCTP_DISPOSITION_CONSUME;
1075
1076nomem:
1077 return SCTP_DISPOSITION_NOMEM;
1078}
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108sctp_disposition_t sctp_sf_backbeat_8_3(const struct sctp_endpoint *ep,
1109 const struct sctp_association *asoc,
1110 const sctp_subtype_t type,
1111 void *arg,
1112 sctp_cmd_seq_t *commands)
1113{
1114 struct sctp_chunk *chunk = arg;
1115 union sctp_addr from_addr;
1116 struct sctp_transport *link;
1117 sctp_sender_hb_info_t *hbinfo;
1118 unsigned long max_interval;
1119
1120 if (!sctp_vtag_verify(chunk, asoc))
1121 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
1122
1123
1124 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t) +
1125 sizeof(sctp_sender_hb_info_t)))
1126 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
1127 commands);
1128
1129 hbinfo = (sctp_sender_hb_info_t *) chunk->skb->data;
1130
1131 if (ntohs(hbinfo->param_hdr.length) !=
1132 sizeof(sctp_sender_hb_info_t)) {
1133 return SCTP_DISPOSITION_DISCARD;
1134 }
1135
1136 from_addr = hbinfo->daddr;
1137 link = sctp_assoc_lookup_paddr(asoc, &from_addr);
1138
1139
1140 if (unlikely(!link)) {
1141 if (from_addr.sa.sa_family == AF_INET6) {
1142 if (net_ratelimit())
1143 pr_warn("%s association %p could not find address %pI6\n",
1144 __func__,
1145 asoc,
1146 &from_addr.v6.sin6_addr);
1147 } else {
1148 if (net_ratelimit())
1149 pr_warn("%s association %p could not find address %pI4\n",
1150 __func__,
1151 asoc,
1152 &from_addr.v4.sin_addr.s_addr);
1153 }
1154 return SCTP_DISPOSITION_DISCARD;
1155 }
1156
1157
1158 if (hbinfo->hb_nonce != link->hb_nonce)
1159 return SCTP_DISPOSITION_DISCARD;
1160
1161 max_interval = link->hbinterval + link->rto;
1162
1163
1164 if (time_after(hbinfo->sent_at, jiffies) ||
1165 time_after(jiffies, hbinfo->sent_at + max_interval)) {
1166 SCTP_DEBUG_PRINTK("%s: HEARTBEAT ACK with invalid timestamp "
1167 "received for transport: %p\n",
1168 __func__, link);
1169 return SCTP_DISPOSITION_DISCARD;
1170 }
1171
1172
1173
1174
1175
1176
1177
1178 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_ON, SCTP_TRANSPORT(link));
1179
1180 return SCTP_DISPOSITION_CONSUME;
1181}
1182
1183
1184
1185
1186static int sctp_sf_send_restart_abort(union sctp_addr *ssa,
1187 struct sctp_chunk *init,
1188 sctp_cmd_seq_t *commands)
1189{
1190 int len;
1191 struct sctp_packet *pkt;
1192 union sctp_addr_param *addrparm;
1193 struct sctp_errhdr *errhdr;
1194 struct sctp_endpoint *ep;
1195 char buffer[sizeof(struct sctp_errhdr)+sizeof(union sctp_addr_param)];
1196 struct sctp_af *af = sctp_get_af_specific(ssa->v4.sin_family);
1197
1198
1199
1200
1201 errhdr = (struct sctp_errhdr *)buffer;
1202 addrparm = (union sctp_addr_param *)errhdr->variable;
1203
1204
1205 len = af->to_addr_param(ssa, addrparm);
1206 len += sizeof(sctp_errhdr_t);
1207
1208 errhdr->cause = SCTP_ERROR_RESTART;
1209 errhdr->length = htons(len);
1210
1211
1212 ep = sctp_sk((sctp_get_ctl_sock()))->ep;
1213
1214
1215
1216
1217 pkt = sctp_abort_pkt_new(ep, NULL, init, errhdr, len);
1218
1219 if (!pkt)
1220 goto out;
1221 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT, SCTP_PACKET(pkt));
1222
1223 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
1224
1225
1226 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
1227
1228out:
1229
1230
1231
1232 return 0;
1233}
1234
1235static bool list_has_sctp_addr(const struct list_head *list,
1236 union sctp_addr *ipaddr)
1237{
1238 struct sctp_transport *addr;
1239
1240 list_for_each_entry(addr, list, transports) {
1241 if (sctp_cmp_addr_exact(ipaddr, &addr->ipaddr))
1242 return true;
1243 }
1244
1245 return false;
1246}
1247
1248
1249
1250static int sctp_sf_check_restart_addrs(const struct sctp_association *new_asoc,
1251 const struct sctp_association *asoc,
1252 struct sctp_chunk *init,
1253 sctp_cmd_seq_t *commands)
1254{
1255 struct sctp_transport *new_addr;
1256 int ret = 1;
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269 list_for_each_entry(new_addr, &new_asoc->peer.transport_addr_list,
1270 transports) {
1271 if (!list_has_sctp_addr(&asoc->peer.transport_addr_list,
1272 &new_addr->ipaddr)) {
1273 sctp_sf_send_restart_abort(&new_addr->ipaddr, init,
1274 commands);
1275 ret = 0;
1276 break;
1277 }
1278 }
1279
1280
1281 return ret;
1282}
1283
1284
1285
1286
1287
1288
1289static void sctp_tietags_populate(struct sctp_association *new_asoc,
1290 const struct sctp_association *asoc)
1291{
1292 switch (asoc->state) {
1293
1294
1295
1296 case SCTP_STATE_COOKIE_WAIT:
1297 new_asoc->c.my_vtag = asoc->c.my_vtag;
1298 new_asoc->c.my_ttag = asoc->c.my_vtag;
1299 new_asoc->c.peer_ttag = 0;
1300 break;
1301
1302 case SCTP_STATE_COOKIE_ECHOED:
1303 new_asoc->c.my_vtag = asoc->c.my_vtag;
1304 new_asoc->c.my_ttag = asoc->c.my_vtag;
1305 new_asoc->c.peer_ttag = asoc->c.peer_vtag;
1306 break;
1307
1308
1309
1310
1311 default:
1312 new_asoc->c.my_ttag = asoc->c.my_vtag;
1313 new_asoc->c.peer_ttag = asoc->c.peer_vtag;
1314 break;
1315 }
1316
1317
1318
1319
1320
1321 new_asoc->rwnd = asoc->rwnd;
1322 new_asoc->c.sinit_num_ostreams = asoc->c.sinit_num_ostreams;
1323 new_asoc->c.sinit_max_instreams = asoc->c.sinit_max_instreams;
1324 new_asoc->c.initial_tsn = asoc->c.initial_tsn;
1325}
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336static char sctp_tietags_compare(struct sctp_association *new_asoc,
1337 const struct sctp_association *asoc)
1338{
1339
1340 if ((asoc->c.my_vtag != new_asoc->c.my_vtag) &&
1341 (asoc->c.peer_vtag != new_asoc->c.peer_vtag) &&
1342 (asoc->c.my_vtag == new_asoc->c.my_ttag) &&
1343 (asoc->c.peer_vtag == new_asoc->c.peer_ttag))
1344 return 'A';
1345
1346
1347 if ((asoc->c.my_vtag == new_asoc->c.my_vtag) &&
1348 ((asoc->c.peer_vtag != new_asoc->c.peer_vtag) ||
1349 (0 == asoc->c.peer_vtag))) {
1350 return 'B';
1351 }
1352
1353
1354 if ((asoc->c.my_vtag == new_asoc->c.my_vtag) &&
1355 (asoc->c.peer_vtag == new_asoc->c.peer_vtag))
1356 return 'D';
1357
1358
1359 if ((asoc->c.my_vtag != new_asoc->c.my_vtag) &&
1360 (asoc->c.peer_vtag == new_asoc->c.peer_vtag) &&
1361 (0 == new_asoc->c.my_ttag) &&
1362 (0 == new_asoc->c.peer_ttag))
1363 return 'C';
1364
1365
1366 return 'E';
1367}
1368
1369
1370
1371
1372static sctp_disposition_t sctp_sf_do_unexpected_init(
1373 const struct sctp_endpoint *ep,
1374 const struct sctp_association *asoc,
1375 const sctp_subtype_t type,
1376 void *arg, sctp_cmd_seq_t *commands)
1377{
1378 sctp_disposition_t retval;
1379 struct sctp_chunk *chunk = arg;
1380 struct sctp_chunk *repl;
1381 struct sctp_association *new_asoc;
1382 struct sctp_chunk *err_chunk;
1383 struct sctp_packet *packet;
1384 sctp_unrecognized_param_t *unk_param;
1385 int len;
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396 if (!chunk->singleton)
1397 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
1398
1399
1400
1401
1402 if (chunk->sctp_hdr->vtag != 0)
1403 return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
1404
1405
1406
1407
1408
1409 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_init_chunk_t)))
1410 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
1411 commands);
1412
1413 chunk->subh.init_hdr = (sctp_inithdr_t *) chunk->skb->data;
1414
1415
1416 chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(sctp_inithdr_t));
1417
1418
1419 err_chunk = NULL;
1420 if (!sctp_verify_init(asoc, chunk->chunk_hdr->type,
1421 (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
1422 &err_chunk)) {
1423
1424
1425
1426 if (err_chunk) {
1427 packet = sctp_abort_pkt_new(ep, asoc, arg,
1428 (__u8 *)(err_chunk->chunk_hdr) +
1429 sizeof(sctp_chunkhdr_t),
1430 ntohs(err_chunk->chunk_hdr->length) -
1431 sizeof(sctp_chunkhdr_t));
1432
1433 if (packet) {
1434 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
1435 SCTP_PACKET(packet));
1436 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
1437 retval = SCTP_DISPOSITION_CONSUME;
1438 } else {
1439 retval = SCTP_DISPOSITION_NOMEM;
1440 }
1441 goto cleanup;
1442 } else {
1443 return sctp_sf_tabort_8_4_8(ep, asoc, type, arg,
1444 commands);
1445 }
1446 }
1447
1448
1449
1450
1451
1452
1453
1454
1455 new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC);
1456 if (!new_asoc)
1457 goto nomem;
1458
1459 if (sctp_assoc_set_bind_addr_from_ep(new_asoc,
1460 sctp_scope(sctp_source(chunk)), GFP_ATOMIC) < 0)
1461 goto nomem;
1462
1463
1464
1465
1466
1467 if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
1468 sctp_source(chunk),
1469 (sctp_init_chunk_t *)chunk->chunk_hdr,
1470 GFP_ATOMIC))
1471 goto nomem;
1472
1473
1474
1475
1476
1477
1478 if (!sctp_state(asoc, COOKIE_WAIT)) {
1479 if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk,
1480 commands)) {
1481 retval = SCTP_DISPOSITION_CONSUME;
1482 goto nomem_retval;
1483 }
1484 }
1485
1486 sctp_tietags_populate(new_asoc, asoc);
1487
1488
1489
1490
1491
1492
1493 len = 0;
1494 if (err_chunk) {
1495 len = ntohs(err_chunk->chunk_hdr->length) -
1496 sizeof(sctp_chunkhdr_t);
1497 }
1498
1499 repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
1500 if (!repl)
1501 goto nomem;
1502
1503
1504
1505
1506
1507 if (err_chunk) {
1508
1509
1510
1511
1512
1513
1514
1515 unk_param = (sctp_unrecognized_param_t *)
1516 ((__u8 *)(err_chunk->chunk_hdr) +
1517 sizeof(sctp_chunkhdr_t));
1518
1519
1520
1521 sctp_addto_chunk(repl, len, unk_param);
1522 }
1523
1524 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
1525 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1526
1527
1528
1529
1530
1531
1532 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
1533 retval = SCTP_DISPOSITION_CONSUME;
1534
1535 return retval;
1536
1537nomem:
1538 retval = SCTP_DISPOSITION_NOMEM;
1539nomem_retval:
1540 if (new_asoc)
1541 sctp_association_free(new_asoc);
1542cleanup:
1543 if (err_chunk)
1544 sctp_chunk_free(err_chunk);
1545 return retval;
1546}
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586sctp_disposition_t sctp_sf_do_5_2_1_siminit(const struct sctp_endpoint *ep,
1587 const struct sctp_association *asoc,
1588 const sctp_subtype_t type,
1589 void *arg,
1590 sctp_cmd_seq_t *commands)
1591{
1592
1593
1594
1595 return sctp_sf_do_unexpected_init(ep, asoc, type, arg, commands);
1596}
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639sctp_disposition_t sctp_sf_do_5_2_2_dupinit(const struct sctp_endpoint *ep,
1640 const struct sctp_association *asoc,
1641 const sctp_subtype_t type,
1642 void *arg,
1643 sctp_cmd_seq_t *commands)
1644{
1645
1646
1647
1648 return sctp_sf_do_unexpected_init(ep, asoc, type, arg, commands);
1649}
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661sctp_disposition_t sctp_sf_do_5_2_3_initack(const struct sctp_endpoint *ep,
1662 const struct sctp_association *asoc,
1663 const sctp_subtype_t type,
1664 void *arg, sctp_cmd_seq_t *commands)
1665{
1666
1667
1668
1669 if (ep == sctp_sk((sctp_get_ctl_sock()))->ep)
1670 return sctp_sf_ootb(ep, asoc, type, arg, commands);
1671 else
1672 return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
1673}
1674
1675
1676
1677
1678
1679
1680static sctp_disposition_t sctp_sf_do_dupcook_a(const struct sctp_endpoint *ep,
1681 const struct sctp_association *asoc,
1682 struct sctp_chunk *chunk,
1683 sctp_cmd_seq_t *commands,
1684 struct sctp_association *new_asoc)
1685{
1686 sctp_init_chunk_t *peer_init;
1687 struct sctp_ulpevent *ev;
1688 struct sctp_chunk *repl;
1689 struct sctp_chunk *err;
1690 sctp_disposition_t disposition;
1691
1692
1693
1694
1695 peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
1696
1697 if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
1698 sctp_source(chunk), peer_init,
1699 GFP_ATOMIC))
1700 goto nomem;
1701
1702
1703
1704
1705
1706 if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk, commands)) {
1707 return SCTP_DISPOSITION_CONSUME;
1708 }
1709
1710
1711
1712
1713
1714
1715
1716 if (sctp_state(asoc, SHUTDOWN_ACK_SENT)) {
1717 disposition = sctp_sf_do_9_2_reshutack(ep, asoc,
1718 SCTP_ST_CHUNK(chunk->chunk_hdr->type),
1719 chunk, commands);
1720 if (SCTP_DISPOSITION_NOMEM == disposition)
1721 goto nomem;
1722
1723 err = sctp_make_op_error(asoc, chunk,
1724 SCTP_ERROR_COOKIE_IN_SHUTDOWN,
1725 NULL, 0, 0);
1726 if (err)
1727 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
1728 SCTP_CHUNK(err));
1729
1730 return SCTP_DISPOSITION_CONSUME;
1731 }
1732
1733
1734
1735
1736 sctp_add_cmd_sf(commands, SCTP_CMD_PURGE_OUTQUEUE, SCTP_NULL());
1737
1738 repl = sctp_make_cookie_ack(new_asoc, chunk);
1739 if (!repl)
1740 goto nomem;
1741
1742
1743 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_RESTART, 0,
1744 new_asoc->c.sinit_num_ostreams,
1745 new_asoc->c.sinit_max_instreams,
1746 NULL, GFP_ATOMIC);
1747 if (!ev)
1748 goto nomem_ev;
1749
1750
1751 sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
1752 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1753 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
1754 return SCTP_DISPOSITION_CONSUME;
1755
1756nomem_ev:
1757 sctp_chunk_free(repl);
1758nomem:
1759 return SCTP_DISPOSITION_NOMEM;
1760}
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770static sctp_disposition_t sctp_sf_do_dupcook_b(const struct sctp_endpoint *ep,
1771 const struct sctp_association *asoc,
1772 struct sctp_chunk *chunk,
1773 sctp_cmd_seq_t *commands,
1774 struct sctp_association *new_asoc)
1775{
1776 sctp_init_chunk_t *peer_init;
1777 struct sctp_chunk *repl;
1778
1779
1780
1781
1782 peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
1783 if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
1784 sctp_source(chunk), peer_init,
1785 GFP_ATOMIC))
1786 goto nomem;
1787
1788
1789 sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
1790 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
1791 SCTP_STATE(SCTP_STATE_ESTABLISHED));
1792 SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
1793 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
1794
1795 repl = sctp_make_cookie_ack(new_asoc, chunk);
1796 if (!repl)
1797 goto nomem;
1798
1799 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_CHANGE, SCTP_U8(SCTP_COMM_UP));
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823 if (asoc->peer.adaptation_ind)
1824 sctp_add_cmd_sf(commands, SCTP_CMD_ADAPTATION_IND, SCTP_NULL());
1825
1826 return SCTP_DISPOSITION_CONSUME;
1827
1828nomem:
1829 return SCTP_DISPOSITION_NOMEM;
1830}
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841static sctp_disposition_t sctp_sf_do_dupcook_c(const struct sctp_endpoint *ep,
1842 const struct sctp_association *asoc,
1843 struct sctp_chunk *chunk,
1844 sctp_cmd_seq_t *commands,
1845 struct sctp_association *new_asoc)
1846{
1847
1848
1849
1850
1851 return SCTP_DISPOSITION_DISCARD;
1852}
1853
1854
1855
1856
1857
1858
1859
1860
1861
1862static sctp_disposition_t sctp_sf_do_dupcook_d(const struct sctp_endpoint *ep,
1863 const struct sctp_association *asoc,
1864 struct sctp_chunk *chunk,
1865 sctp_cmd_seq_t *commands,
1866 struct sctp_association *new_asoc)
1867{
1868 struct sctp_ulpevent *ev = NULL, *ai_ev = NULL;
1869 struct sctp_chunk *repl;
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879 if (asoc->state < SCTP_STATE_ESTABLISHED) {
1880 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
1881 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
1882 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
1883 SCTP_STATE(SCTP_STATE_ESTABLISHED));
1884 SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
1885 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START,
1886 SCTP_NULL());
1887
1888
1889
1890
1891
1892
1893
1894
1895 ev = sctp_ulpevent_make_assoc_change(asoc, 0,
1896 SCTP_COMM_UP, 0,
1897 asoc->c.sinit_num_ostreams,
1898 asoc->c.sinit_max_instreams,
1899 NULL, GFP_ATOMIC);
1900 if (!ev)
1901 goto nomem;
1902
1903
1904
1905
1906
1907
1908 if (asoc->peer.adaptation_ind) {
1909 ai_ev = sctp_ulpevent_make_adaptation_indication(asoc,
1910 GFP_ATOMIC);
1911 if (!ai_ev)
1912 goto nomem;
1913
1914 }
1915 }
1916
1917 repl = sctp_make_cookie_ack(new_asoc, chunk);
1918 if (!repl)
1919 goto nomem;
1920
1921 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1922
1923 if (ev)
1924 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
1925 SCTP_ULPEVENT(ev));
1926 if (ai_ev)
1927 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
1928 SCTP_ULPEVENT(ai_ev));
1929
1930 return SCTP_DISPOSITION_CONSUME;
1931
1932nomem:
1933 if (ai_ev)
1934 sctp_ulpevent_free(ai_ev);
1935 if (ev)
1936 sctp_ulpevent_free(ev);
1937 return SCTP_DISPOSITION_NOMEM;
1938}
1939
1940
1941
1942
1943
1944
1945
1946
1947
1948
1949
1950
1951
1952
1953
1954
1955
1956sctp_disposition_t sctp_sf_do_5_2_4_dupcook(const struct sctp_endpoint *ep,
1957 const struct sctp_association *asoc,
1958 const sctp_subtype_t type,
1959 void *arg,
1960 sctp_cmd_seq_t *commands)
1961{
1962 sctp_disposition_t retval;
1963 struct sctp_chunk *chunk = arg;
1964 struct sctp_association *new_asoc;
1965 int error = 0;
1966 char action;
1967 struct sctp_chunk *err_chk_p;
1968
1969
1970
1971
1972
1973
1974 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
1975 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
1976 commands);
1977
1978
1979
1980
1981 chunk->subh.cookie_hdr = (struct sctp_signed_cookie *)chunk->skb->data;
1982 if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
1983 sizeof(sctp_chunkhdr_t)))
1984 goto nomem;
1985
1986
1987
1988
1989
1990
1991 new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, &error,
1992 &err_chk_p);
1993
1994
1995
1996
1997
1998
1999
2000 if (!new_asoc) {
2001
2002
2003
2004 switch (error) {
2005 case -SCTP_IERROR_NOMEM:
2006 goto nomem;
2007
2008 case -SCTP_IERROR_STALE_COOKIE:
2009 sctp_send_stale_cookie_err(ep, asoc, chunk, commands,
2010 err_chk_p);
2011 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2012 case -SCTP_IERROR_BAD_SIG:
2013 default:
2014 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2015 }
2016 }
2017
2018
2019
2020
2021 action = sctp_tietags_compare(new_asoc, asoc);
2022
2023 switch (action) {
2024 case 'A':
2025 retval = sctp_sf_do_dupcook_a(ep, asoc, chunk, commands,
2026 new_asoc);
2027 break;
2028
2029 case 'B':
2030 retval = sctp_sf_do_dupcook_b(ep, asoc, chunk, commands,
2031 new_asoc);
2032 break;
2033
2034 case 'C':
2035 retval = sctp_sf_do_dupcook_c(ep, asoc, chunk, commands,
2036 new_asoc);
2037 break;
2038
2039 case 'D':
2040 retval = sctp_sf_do_dupcook_d(ep, asoc, chunk, commands,
2041 new_asoc);
2042 break;
2043
2044 default:
2045 retval = sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2046 break;
2047 }
2048
2049
2050 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
2051 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
2052
2053 return retval;
2054
2055nomem:
2056 return SCTP_DISPOSITION_NOMEM;
2057}
2058
2059
2060
2061
2062
2063
2064sctp_disposition_t sctp_sf_shutdown_pending_abort(
2065 const struct sctp_endpoint *ep,
2066 const struct sctp_association *asoc,
2067 const sctp_subtype_t type,
2068 void *arg,
2069 sctp_cmd_seq_t *commands)
2070{
2071 struct sctp_chunk *chunk = arg;
2072
2073 if (!sctp_vtag_verify_either(chunk, asoc))
2074 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2075
2076
2077
2078
2079
2080
2081
2082
2083
2084
2085
2086 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
2087 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2088
2089
2090
2091
2092
2093
2094 if (SCTP_ADDR_DEL ==
2095 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2096 return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
2097
2098 return __sctp_sf_do_9_1_abort(ep, asoc, type, arg, commands);
2099}
2100
2101
2102
2103
2104
2105
2106sctp_disposition_t sctp_sf_shutdown_sent_abort(const struct sctp_endpoint *ep,
2107 const struct sctp_association *asoc,
2108 const sctp_subtype_t type,
2109 void *arg,
2110 sctp_cmd_seq_t *commands)
2111{
2112 struct sctp_chunk *chunk = arg;
2113
2114 if (!sctp_vtag_verify_either(chunk, asoc))
2115 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2116
2117
2118
2119
2120
2121
2122
2123
2124
2125
2126
2127 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
2128 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2129
2130
2131
2132
2133
2134
2135 if (SCTP_ADDR_DEL ==
2136 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2137 return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
2138
2139
2140 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2141 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
2142
2143
2144 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2145 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
2146
2147 return __sctp_sf_do_9_1_abort(ep, asoc, type, arg, commands);
2148}
2149
2150
2151
2152
2153
2154
2155sctp_disposition_t sctp_sf_shutdown_ack_sent_abort(
2156 const struct sctp_endpoint *ep,
2157 const struct sctp_association *asoc,
2158 const sctp_subtype_t type,
2159 void *arg,
2160 sctp_cmd_seq_t *commands)
2161{
2162
2163
2164
2165 return sctp_sf_shutdown_sent_abort(ep, asoc, type, arg, commands);
2166}
2167
2168
2169
2170
2171
2172
2173
2174
2175
2176
2177
2178
2179
2180
2181
2182sctp_disposition_t sctp_sf_cookie_echoed_err(const struct sctp_endpoint *ep,
2183 const struct sctp_association *asoc,
2184 const sctp_subtype_t type,
2185 void *arg,
2186 sctp_cmd_seq_t *commands)
2187{
2188 struct sctp_chunk *chunk = arg;
2189 sctp_errhdr_t *err;
2190
2191 if (!sctp_vtag_verify(chunk, asoc))
2192 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2193
2194
2195
2196
2197 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_operr_chunk_t)))
2198 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
2199 commands);
2200
2201
2202
2203
2204
2205
2206 sctp_walk_errors(err, chunk->chunk_hdr) {
2207 if (SCTP_ERROR_STALE_COOKIE == err->cause)
2208 return sctp_sf_do_5_2_6_stale(ep, asoc, type,
2209 arg, commands);
2210 }
2211
2212
2213
2214
2215
2216
2217 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2218}
2219
2220
2221
2222
2223
2224
2225
2226
2227
2228
2229
2230
2231
2232
2233
2234
2235
2236
2237
2238
2239
2240
2241
2242
2243
2244
2245static sctp_disposition_t sctp_sf_do_5_2_6_stale(const struct sctp_endpoint *ep,
2246 const struct sctp_association *asoc,
2247 const sctp_subtype_t type,
2248 void *arg,
2249 sctp_cmd_seq_t *commands)
2250{
2251 struct sctp_chunk *chunk = arg;
2252 time_t stale;
2253 sctp_cookie_preserve_param_t bht;
2254 sctp_errhdr_t *err;
2255 struct sctp_chunk *reply;
2256 struct sctp_bind_addr *bp;
2257 int attempts = asoc->init_err_counter + 1;
2258
2259 if (attempts > asoc->max_init_attempts) {
2260 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
2261 SCTP_ERROR(ETIMEDOUT));
2262 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
2263 SCTP_PERR(SCTP_ERROR_STALE_COOKIE));
2264 return SCTP_DISPOSITION_DELETE_TCB;
2265 }
2266
2267 err = (sctp_errhdr_t *)(chunk->skb->data);
2268
2269
2270
2271
2272
2273
2274
2275
2276
2277
2278
2279
2280
2281
2282
2283 stale = ntohl(*(__be32 *)((u8 *)err + sizeof(sctp_errhdr_t)));
2284 stale = (stale * 2) / 1000;
2285
2286 bht.param_hdr.type = SCTP_PARAM_COOKIE_PRESERVATIVE;
2287 bht.param_hdr.length = htons(sizeof(bht));
2288 bht.lifespan_increment = htonl(stale);
2289
2290
2291 bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
2292 reply = sctp_make_init(asoc, bp, GFP_ATOMIC, sizeof(bht));
2293 if (!reply)
2294 goto nomem;
2295
2296 sctp_addto_chunk(reply, sizeof(bht), &bht);
2297
2298
2299 sctp_add_cmd_sf(commands, SCTP_CMD_CLEAR_INIT_TAG, SCTP_NULL());
2300
2301
2302 sctp_add_cmd_sf(commands, SCTP_CMD_T3_RTX_TIMERS_STOP, SCTP_NULL());
2303 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
2304
2305
2306
2307
2308 sctp_add_cmd_sf(commands, SCTP_CMD_DEL_NON_PRIMARY, SCTP_NULL());
2309
2310
2311
2312
2313 sctp_add_cmd_sf(commands, SCTP_CMD_T1_RETRAN,
2314 SCTP_TRANSPORT(asoc->peer.primary_path));
2315
2316
2317
2318
2319 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_INC, SCTP_NULL());
2320
2321 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2322 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
2323 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2324 SCTP_STATE(SCTP_STATE_COOKIE_WAIT));
2325 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
2326 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
2327
2328 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
2329
2330 return SCTP_DISPOSITION_CONSUME;
2331
2332nomem:
2333 return SCTP_DISPOSITION_NOMEM;
2334}
2335
2336
2337
2338
2339
2340
2341
2342
2343
2344
2345
2346
2347
2348
2349
2350
2351
2352
2353
2354
2355
2356
2357
2358
2359
2360
2361
2362
2363
2364
2365
2366
2367sctp_disposition_t sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep,
2368 const struct sctp_association *asoc,
2369 const sctp_subtype_t type,
2370 void *arg,
2371 sctp_cmd_seq_t *commands)
2372{
2373 struct sctp_chunk *chunk = arg;
2374
2375 if (!sctp_vtag_verify_either(chunk, asoc))
2376 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2377
2378
2379
2380
2381
2382
2383
2384
2385
2386
2387
2388 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
2389 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2390
2391
2392
2393
2394
2395
2396 if (SCTP_ADDR_DEL ==
2397 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2398 return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
2399
2400 return __sctp_sf_do_9_1_abort(ep, asoc, type, arg, commands);
2401}
2402
2403static sctp_disposition_t __sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep,
2404 const struct sctp_association *asoc,
2405 const sctp_subtype_t type,
2406 void *arg,
2407 sctp_cmd_seq_t *commands)
2408{
2409 struct sctp_chunk *chunk = arg;
2410 unsigned len;
2411 __be16 error = SCTP_ERROR_NO_ERROR;
2412
2413
2414 len = ntohs(chunk->chunk_hdr->length);
2415 if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
2416 error = ((sctp_errhdr_t *)chunk->skb->data)->cause;
2417
2418 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(ECONNRESET));
2419
2420 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, SCTP_PERR(error));
2421 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
2422 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
2423
2424 return SCTP_DISPOSITION_ABORT;
2425}
2426
2427
2428
2429
2430
2431
2432sctp_disposition_t sctp_sf_cookie_wait_abort(const struct sctp_endpoint *ep,
2433 const struct sctp_association *asoc,
2434 const sctp_subtype_t type,
2435 void *arg,
2436 sctp_cmd_seq_t *commands)
2437{
2438 struct sctp_chunk *chunk = arg;
2439 unsigned len;
2440 __be16 error = SCTP_ERROR_NO_ERROR;
2441
2442 if (!sctp_vtag_verify_either(chunk, asoc))
2443 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2444
2445
2446
2447
2448
2449
2450
2451
2452
2453
2454
2455 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
2456 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2457
2458
2459 len = ntohs(chunk->chunk_hdr->length);
2460 if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
2461 error = ((sctp_errhdr_t *)chunk->skb->data)->cause;
2462
2463 return sctp_stop_t1_and_abort(commands, error, ECONNREFUSED, asoc,
2464 chunk->transport);
2465}
2466
2467
2468
2469
2470sctp_disposition_t sctp_sf_cookie_wait_icmp_abort(const struct sctp_endpoint *ep,
2471 const struct sctp_association *asoc,
2472 const sctp_subtype_t type,
2473 void *arg,
2474 sctp_cmd_seq_t *commands)
2475{
2476 return sctp_stop_t1_and_abort(commands, SCTP_ERROR_NO_ERROR,
2477 ENOPROTOOPT, asoc,
2478 (struct sctp_transport *)arg);
2479}
2480
2481
2482
2483
2484sctp_disposition_t sctp_sf_cookie_echoed_abort(const struct sctp_endpoint *ep,
2485 const struct sctp_association *asoc,
2486 const sctp_subtype_t type,
2487 void *arg,
2488 sctp_cmd_seq_t *commands)
2489{
2490
2491
2492
2493 return sctp_sf_cookie_wait_abort(ep, asoc, type, arg, commands);
2494}
2495
2496
2497
2498
2499
2500
2501static sctp_disposition_t sctp_stop_t1_and_abort(sctp_cmd_seq_t *commands,
2502 __be16 error, int sk_err,
2503 const struct sctp_association *asoc,
2504 struct sctp_transport *transport)
2505{
2506 SCTP_DEBUG_PRINTK("ABORT received (INIT).\n");
2507 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2508 SCTP_STATE(SCTP_STATE_CLOSED));
2509 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
2510 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2511 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
2512 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(sk_err));
2513
2514 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
2515 SCTP_PERR(error));
2516 return SCTP_DISPOSITION_ABORT;
2517}
2518
2519
2520
2521
2522
2523
2524
2525
2526
2527
2528
2529
2530
2531
2532
2533
2534
2535
2536
2537
2538
2539
2540
2541
2542
2543
2544
2545
2546
2547
2548
2549
2550
2551
2552sctp_disposition_t sctp_sf_do_9_2_shutdown(const struct sctp_endpoint *ep,
2553 const struct sctp_association *asoc,
2554 const sctp_subtype_t type,
2555 void *arg,
2556 sctp_cmd_seq_t *commands)
2557{
2558 struct sctp_chunk *chunk = arg;
2559 sctp_shutdownhdr_t *sdh;
2560 sctp_disposition_t disposition;
2561 struct sctp_ulpevent *ev;
2562 __u32 ctsn;
2563
2564 if (!sctp_vtag_verify(chunk, asoc))
2565 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2566
2567
2568 if (!sctp_chunk_length_valid(chunk,
2569 sizeof(struct sctp_shutdown_chunk_t)))
2570 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
2571 commands);
2572
2573
2574 sdh = (sctp_shutdownhdr_t *)chunk->skb->data;
2575 skb_pull(chunk->skb, sizeof(sctp_shutdownhdr_t));
2576 chunk->subh.shutdown_hdr = sdh;
2577 ctsn = ntohl(sdh->cum_tsn_ack);
2578
2579 if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
2580 SCTP_DEBUG_PRINTK("ctsn %x\n", ctsn);
2581 SCTP_DEBUG_PRINTK("ctsn_ack_point %x\n", asoc->ctsn_ack_point);
2582 return SCTP_DISPOSITION_DISCARD;
2583 }
2584
2585
2586
2587
2588
2589 if (!TSN_lt(ctsn, asoc->next_tsn))
2590 return sctp_sf_violation_ctsn(ep, asoc, type, arg, commands);
2591
2592
2593
2594
2595
2596 ev = sctp_ulpevent_make_shutdown_event(asoc, 0, GFP_ATOMIC);
2597 if (!ev) {
2598 disposition = SCTP_DISPOSITION_NOMEM;
2599 goto out;
2600 }
2601 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
2602
2603
2604
2605
2606
2607
2608
2609 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2610 SCTP_STATE(SCTP_STATE_SHUTDOWN_RECEIVED));
2611 disposition = SCTP_DISPOSITION_CONSUME;
2612
2613 if (sctp_outq_is_empty(&asoc->outqueue)) {
2614 disposition = sctp_sf_do_9_2_shutdown_ack(ep, asoc, type,
2615 arg, commands);
2616 }
2617
2618 if (SCTP_DISPOSITION_NOMEM == disposition)
2619 goto out;
2620
2621
2622
2623
2624
2625 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_CTSN,
2626 SCTP_BE32(chunk->subh.shutdown_hdr->cum_tsn_ack));
2627
2628out:
2629 return disposition;
2630}
2631
2632
2633
2634
2635
2636
2637
2638
2639
2640sctp_disposition_t sctp_sf_do_9_2_shut_ctsn(const struct sctp_endpoint *ep,
2641 const struct sctp_association *asoc,
2642 const sctp_subtype_t type,
2643 void *arg,
2644 sctp_cmd_seq_t *commands)
2645{
2646 struct sctp_chunk *chunk = arg;
2647 sctp_shutdownhdr_t *sdh;
2648 __u32 ctsn;
2649
2650 if (!sctp_vtag_verify(chunk, asoc))
2651 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2652
2653
2654 if (!sctp_chunk_length_valid(chunk,
2655 sizeof(struct sctp_shutdown_chunk_t)))
2656 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
2657 commands);
2658
2659 sdh = (sctp_shutdownhdr_t *)chunk->skb->data;
2660 ctsn = ntohl(sdh->cum_tsn_ack);
2661
2662 if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
2663 SCTP_DEBUG_PRINTK("ctsn %x\n", ctsn);
2664 SCTP_DEBUG_PRINTK("ctsn_ack_point %x\n", asoc->ctsn_ack_point);
2665 return SCTP_DISPOSITION_DISCARD;
2666 }
2667
2668
2669
2670
2671
2672 if (!TSN_lt(ctsn, asoc->next_tsn))
2673 return sctp_sf_violation_ctsn(ep, asoc, type, arg, commands);
2674
2675
2676
2677
2678
2679 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_CTSN,
2680 SCTP_BE32(sdh->cum_tsn_ack));
2681
2682 return SCTP_DISPOSITION_CONSUME;
2683}
2684
2685
2686
2687
2688
2689
2690
2691
2692sctp_disposition_t sctp_sf_do_9_2_reshutack(const struct sctp_endpoint *ep,
2693 const struct sctp_association *asoc,
2694 const sctp_subtype_t type,
2695 void *arg,
2696 sctp_cmd_seq_t *commands)
2697{
2698 struct sctp_chunk *chunk = (struct sctp_chunk *) arg;
2699 struct sctp_chunk *reply;
2700
2701
2702 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
2703 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
2704 commands);
2705
2706
2707
2708
2709
2710 reply = sctp_make_shutdown_ack(asoc, chunk);
2711 if (NULL == reply)
2712 goto nomem;
2713
2714
2715
2716
2717 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
2718
2719
2720 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
2721 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
2722
2723 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
2724
2725 return SCTP_DISPOSITION_CONSUME;
2726nomem:
2727 return SCTP_DISPOSITION_NOMEM;
2728}
2729
2730
2731
2732
2733
2734
2735
2736
2737
2738
2739
2740
2741
2742
2743
2744
2745
2746
2747
2748
2749
2750
2751
2752
2753
2754
2755sctp_disposition_t sctp_sf_do_ecn_cwr(const struct sctp_endpoint *ep,
2756 const struct sctp_association *asoc,
2757 const sctp_subtype_t type,
2758 void *arg,
2759 sctp_cmd_seq_t *commands)
2760{
2761 sctp_cwrhdr_t *cwr;
2762 struct sctp_chunk *chunk = arg;
2763 u32 lowest_tsn;
2764
2765 if (!sctp_vtag_verify(chunk, asoc))
2766 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2767
2768 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_ecne_chunk_t)))
2769 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
2770 commands);
2771
2772 cwr = (sctp_cwrhdr_t *) chunk->skb->data;
2773 skb_pull(chunk->skb, sizeof(sctp_cwrhdr_t));
2774
2775 lowest_tsn = ntohl(cwr->lowest_tsn);
2776
2777
2778 if (TSN_lte(asoc->last_ecne_tsn, lowest_tsn)) {
2779
2780 sctp_add_cmd_sf(commands,
2781 SCTP_CMD_ECN_CWR,
2782 SCTP_U32(lowest_tsn));
2783 }
2784 return SCTP_DISPOSITION_CONSUME;
2785}
2786
2787
2788
2789
2790
2791
2792
2793
2794
2795
2796
2797
2798
2799
2800
2801
2802
2803
2804
2805
2806
2807
2808
2809
2810sctp_disposition_t sctp_sf_do_ecne(const struct sctp_endpoint *ep,
2811 const struct sctp_association *asoc,
2812 const sctp_subtype_t type,
2813 void *arg,
2814 sctp_cmd_seq_t *commands)
2815{
2816 sctp_ecnehdr_t *ecne;
2817 struct sctp_chunk *chunk = arg;
2818
2819 if (!sctp_vtag_verify(chunk, asoc))
2820 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2821
2822 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_ecne_chunk_t)))
2823 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
2824 commands);
2825
2826 ecne = (sctp_ecnehdr_t *) chunk->skb->data;
2827 skb_pull(chunk->skb, sizeof(sctp_ecnehdr_t));
2828
2829
2830 sctp_add_cmd_sf(commands, SCTP_CMD_ECN_ECNE,
2831 SCTP_U32(ntohl(ecne->lowest_tsn)));
2832
2833 return SCTP_DISPOSITION_CONSUME;
2834}
2835
2836
2837
2838
2839
2840
2841
2842
2843
2844
2845
2846
2847
2848
2849
2850
2851
2852
2853
2854
2855
2856
2857
2858
2859
2860
2861
2862
2863
2864
2865
2866sctp_disposition_t sctp_sf_eat_data_6_2(const struct sctp_endpoint *ep,
2867 const struct sctp_association *asoc,
2868 const sctp_subtype_t type,
2869 void *arg,
2870 sctp_cmd_seq_t *commands)
2871{
2872 struct sctp_chunk *chunk = arg;
2873 sctp_arg_t force = SCTP_NOFORCE();
2874 int error;
2875
2876 if (!sctp_vtag_verify(chunk, asoc)) {
2877 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
2878 SCTP_NULL());
2879 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2880 }
2881
2882 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_data_chunk_t)))
2883 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
2884 commands);
2885
2886 error = sctp_eat_data(asoc, chunk, commands );
2887 switch (error) {
2888 case SCTP_IERROR_NO_ERROR:
2889 break;
2890 case SCTP_IERROR_HIGH_TSN:
2891 case SCTP_IERROR_BAD_STREAM:
2892 SCTP_INC_STATS(SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
2893 goto discard_noforce;
2894 case SCTP_IERROR_DUP_TSN:
2895 case SCTP_IERROR_IGNORE_TSN:
2896 SCTP_INC_STATS(SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
2897 goto discard_force;
2898 case SCTP_IERROR_NO_DATA:
2899 goto consume;
2900 case SCTP_IERROR_PROTO_VIOLATION:
2901 return sctp_sf_abort_violation(ep, asoc, chunk, commands,
2902 (u8 *)chunk->subh.data_hdr, sizeof(sctp_datahdr_t));
2903 default:
2904 BUG();
2905 }
2906
2907 if (chunk->chunk_hdr->flags & SCTP_DATA_SACK_IMM)
2908 force = SCTP_FORCE();
2909
2910 if (asoc->autoclose) {
2911 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
2912 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
2913 }
2914
2915
2916
2917
2918
2919
2920
2921
2922
2923
2924
2925
2926
2927
2928
2929
2930
2931
2932
2933
2934
2935
2936
2937 if (chunk->end_of_packet)
2938 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, force);
2939
2940 return SCTP_DISPOSITION_CONSUME;
2941
2942discard_force:
2943
2944
2945
2946
2947
2948
2949
2950
2951
2952
2953
2954
2955
2956
2957 if (chunk->end_of_packet)
2958 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
2959 return SCTP_DISPOSITION_DISCARD;
2960
2961discard_noforce:
2962 if (chunk->end_of_packet)
2963 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, force);
2964
2965 return SCTP_DISPOSITION_DISCARD;
2966consume:
2967 return SCTP_DISPOSITION_CONSUME;
2968
2969}
2970
2971
2972
2973
2974
2975
2976
2977
2978
2979
2980
2981
2982
2983
2984
2985
2986
2987sctp_disposition_t sctp_sf_eat_data_fast_4_4(const struct sctp_endpoint *ep,
2988 const struct sctp_association *asoc,
2989 const sctp_subtype_t type,
2990 void *arg,
2991 sctp_cmd_seq_t *commands)
2992{
2993 struct sctp_chunk *chunk = arg;
2994 int error;
2995
2996 if (!sctp_vtag_verify(chunk, asoc)) {
2997 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
2998 SCTP_NULL());
2999 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3000 }
3001
3002 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_data_chunk_t)))
3003 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3004 commands);
3005
3006 error = sctp_eat_data(asoc, chunk, commands );
3007 switch (error) {
3008 case SCTP_IERROR_NO_ERROR:
3009 case SCTP_IERROR_HIGH_TSN:
3010 case SCTP_IERROR_DUP_TSN:
3011 case SCTP_IERROR_IGNORE_TSN:
3012 case SCTP_IERROR_BAD_STREAM:
3013 break;
3014 case SCTP_IERROR_NO_DATA:
3015 goto consume;
3016 case SCTP_IERROR_PROTO_VIOLATION:
3017 return sctp_sf_abort_violation(ep, asoc, chunk, commands,
3018 (u8 *)chunk->subh.data_hdr, sizeof(sctp_datahdr_t));
3019 default:
3020 BUG();
3021 }
3022
3023
3024
3025
3026
3027
3028
3029
3030
3031 if (chunk->end_of_packet) {
3032
3033
3034
3035 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SHUTDOWN, SCTP_NULL());
3036 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
3037 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
3038 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
3039 }
3040
3041consume:
3042 return SCTP_DISPOSITION_CONSUME;
3043}
3044
3045
3046
3047
3048
3049
3050
3051
3052
3053
3054
3055
3056
3057
3058
3059
3060
3061
3062
3063
3064
3065
3066
3067
3068
3069
3070
3071
3072
3073
3074
3075
3076
3077sctp_disposition_t sctp_sf_eat_sack_6_2(const struct sctp_endpoint *ep,
3078 const struct sctp_association *asoc,
3079 const sctp_subtype_t type,
3080 void *arg,
3081 sctp_cmd_seq_t *commands)
3082{
3083 struct sctp_chunk *chunk = arg;
3084 sctp_sackhdr_t *sackh;
3085 __u32 ctsn;
3086
3087 if (!sctp_vtag_verify(chunk, asoc))
3088 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3089
3090
3091 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_sack_chunk_t)))
3092 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3093 commands);
3094
3095
3096 sackh = sctp_sm_pull_sack(chunk);
3097
3098 if (!sackh)
3099 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3100 chunk->subh.sack_hdr = sackh;
3101 ctsn = ntohl(sackh->cum_tsn_ack);
3102
3103
3104
3105
3106
3107
3108
3109 if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
3110 SCTP_DEBUG_PRINTK("ctsn %x\n", ctsn);
3111 SCTP_DEBUG_PRINTK("ctsn_ack_point %x\n", asoc->ctsn_ack_point);
3112 return SCTP_DISPOSITION_DISCARD;
3113 }
3114
3115
3116
3117
3118
3119 if (!TSN_lt(ctsn, asoc->next_tsn))
3120 return sctp_sf_violation_ctsn(ep, asoc, type, arg, commands);
3121
3122
3123 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_SACK, SCTP_SACKH(sackh));
3124
3125
3126
3127
3128 return SCTP_DISPOSITION_CONSUME;
3129}
3130
3131
3132
3133
3134
3135
3136
3137
3138
3139
3140
3141
3142
3143
3144
3145
3146
3147
3148
3149static sctp_disposition_t sctp_sf_tabort_8_4_8(const struct sctp_endpoint *ep,
3150 const struct sctp_association *asoc,
3151 const sctp_subtype_t type,
3152 void *arg,
3153 sctp_cmd_seq_t *commands)
3154{
3155 struct sctp_packet *packet = NULL;
3156 struct sctp_chunk *chunk = arg;
3157 struct sctp_chunk *abort;
3158
3159 packet = sctp_ootb_pkt_new(asoc, chunk);
3160
3161 if (packet) {
3162
3163
3164
3165 abort = sctp_make_abort(asoc, chunk, 0);
3166 if (!abort) {
3167 sctp_ootb_pkt_free(packet);
3168 return SCTP_DISPOSITION_NOMEM;
3169 }
3170
3171
3172 if (sctp_test_T_bit(abort))
3173 packet->vtag = ntohl(chunk->sctp_hdr->vtag);
3174
3175
3176 abort->skb->sk = ep->base.sk;
3177
3178 sctp_packet_append_chunk(packet, abort);
3179
3180 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
3181 SCTP_PACKET(packet));
3182
3183 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
3184
3185 sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3186 return SCTP_DISPOSITION_CONSUME;
3187 }
3188
3189 return SCTP_DISPOSITION_NOMEM;
3190}
3191
3192
3193
3194
3195
3196
3197
3198
3199
3200sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep,
3201 const struct sctp_association *asoc,
3202 const sctp_subtype_t type,
3203 void *arg,
3204 sctp_cmd_seq_t *commands)
3205{
3206 struct sctp_chunk *chunk = arg;
3207
3208 if (!sctp_vtag_verify(chunk, asoc))
3209 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3210
3211
3212 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_operr_chunk_t)))
3213 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3214 commands);
3215
3216 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,
3217 SCTP_CHUNK(chunk));
3218
3219 return SCTP_DISPOSITION_CONSUME;
3220}
3221
3222
3223
3224
3225
3226
3227
3228
3229
3230
3231
3232sctp_disposition_t sctp_sf_do_9_2_final(const struct sctp_endpoint *ep,
3233 const struct sctp_association *asoc,
3234 const sctp_subtype_t type,
3235 void *arg,
3236 sctp_cmd_seq_t *commands)
3237{
3238 struct sctp_chunk *chunk = arg;
3239 struct sctp_chunk *reply;
3240 struct sctp_ulpevent *ev;
3241
3242 if (!sctp_vtag_verify(chunk, asoc))
3243 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3244
3245
3246 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
3247 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3248 commands);
3249
3250
3251
3252
3253
3254 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_SHUTDOWN_COMP,
3255 0, 0, 0, NULL, GFP_ATOMIC);
3256 if (!ev)
3257 goto nomem;
3258
3259
3260 reply = sctp_make_shutdown_complete(asoc, chunk);
3261 if (!reply)
3262 goto nomem_chunk;
3263
3264
3265
3266
3267 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
3268
3269
3270
3271
3272 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3273 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
3274
3275 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3276 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
3277
3278 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
3279 SCTP_STATE(SCTP_STATE_CLOSED));
3280 SCTP_INC_STATS(SCTP_MIB_SHUTDOWNS);
3281 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
3282 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
3283
3284
3285 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
3286 return SCTP_DISPOSITION_DELETE_TCB;
3287
3288nomem_chunk:
3289 sctp_ulpevent_free(ev);
3290nomem:
3291 return SCTP_DISPOSITION_NOMEM;
3292}
3293
3294
3295
3296
3297
3298
3299
3300
3301
3302
3303
3304
3305
3306
3307
3308
3309
3310
3311
3312
3313
3314sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep,
3315 const struct sctp_association *asoc,
3316 const sctp_subtype_t type,
3317 void *arg,
3318 sctp_cmd_seq_t *commands)
3319{
3320 struct sctp_chunk *chunk = arg;
3321 struct sk_buff *skb = chunk->skb;
3322 sctp_chunkhdr_t *ch;
3323 __u8 *ch_end;
3324 int ootb_shut_ack = 0;
3325
3326 SCTP_INC_STATS(SCTP_MIB_OUTOFBLUES);
3327
3328 ch = (sctp_chunkhdr_t *) chunk->chunk_hdr;
3329 do {
3330
3331 if (ntohs(ch->length) < sizeof(sctp_chunkhdr_t))
3332 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3333 commands);
3334
3335
3336
3337
3338 if (SCTP_CID_SHUTDOWN_ACK == ch->type)
3339 ootb_shut_ack = 1;
3340
3341
3342
3343
3344
3345
3346 if (SCTP_CID_ABORT == ch->type)
3347 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3348
3349
3350 ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length));
3351 if (ch_end > skb_tail_pointer(skb))
3352 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3353 commands);
3354
3355 ch = (sctp_chunkhdr_t *) ch_end;
3356 } while (ch_end < skb_tail_pointer(skb));
3357
3358 if (ootb_shut_ack)
3359 return sctp_sf_shut_8_4_5(ep, asoc, type, arg, commands);
3360 else
3361 return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
3362}
3363
3364
3365
3366
3367
3368
3369
3370
3371
3372
3373
3374
3375
3376
3377
3378
3379
3380
3381
3382
3383
3384
3385static sctp_disposition_t sctp_sf_shut_8_4_5(const struct sctp_endpoint *ep,
3386 const struct sctp_association *asoc,
3387 const sctp_subtype_t type,
3388 void *arg,
3389 sctp_cmd_seq_t *commands)
3390{
3391 struct sctp_packet *packet = NULL;
3392 struct sctp_chunk *chunk = arg;
3393 struct sctp_chunk *shut;
3394
3395 packet = sctp_ootb_pkt_new(asoc, chunk);
3396
3397 if (packet) {
3398
3399
3400
3401 shut = sctp_make_shutdown_complete(asoc, chunk);
3402 if (!shut) {
3403 sctp_ootb_pkt_free(packet);
3404 return SCTP_DISPOSITION_NOMEM;
3405 }
3406
3407
3408 if (sctp_test_T_bit(shut))
3409 packet->vtag = ntohl(chunk->sctp_hdr->vtag);
3410
3411
3412 shut->skb->sk = ep->base.sk;
3413
3414 sctp_packet_append_chunk(packet, shut);
3415
3416 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
3417 SCTP_PACKET(packet));
3418
3419 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
3420
3421
3422
3423
3424 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
3425 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3426
3427
3428
3429
3430
3431 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3432 }
3433
3434 return SCTP_DISPOSITION_NOMEM;
3435}
3436
3437
3438
3439
3440
3441
3442
3443
3444
3445
3446
3447
3448sctp_disposition_t sctp_sf_do_8_5_1_E_sa(const struct sctp_endpoint *ep,
3449 const struct sctp_association *asoc,
3450 const sctp_subtype_t type,
3451 void *arg,
3452 sctp_cmd_seq_t *commands)
3453{
3454 struct sctp_chunk *chunk = arg;
3455
3456
3457 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
3458 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3459 commands);
3460
3461
3462
3463
3464
3465
3466 SCTP_INC_STATS(SCTP_MIB_OUTOFBLUES);
3467
3468 return sctp_sf_shut_8_4_5(ep, NULL, type, arg, commands);
3469}
3470
3471
3472sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep,
3473 const struct sctp_association *asoc,
3474 const sctp_subtype_t type, void *arg,
3475 sctp_cmd_seq_t *commands)
3476{
3477 struct sctp_chunk *chunk = arg;
3478 struct sctp_chunk *asconf_ack = NULL;
3479 struct sctp_paramhdr *err_param = NULL;
3480 sctp_addiphdr_t *hdr;
3481 union sctp_addr_param *addr_param;
3482 __u32 serial;
3483 int length;
3484
3485 if (!sctp_vtag_verify(chunk, asoc)) {
3486 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3487 SCTP_NULL());
3488 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3489 }
3490
3491
3492
3493
3494
3495
3496
3497 if (!sctp_addip_noauth && !chunk->auth)
3498 return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
3499
3500
3501 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_addip_chunk_t)))
3502 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3503 commands);
3504
3505 hdr = (sctp_addiphdr_t *)chunk->skb->data;
3506 serial = ntohl(hdr->serial);
3507
3508 addr_param = (union sctp_addr_param *)hdr->params;
3509 length = ntohs(addr_param->p.length);
3510 if (length < sizeof(sctp_paramhdr_t))
3511 return sctp_sf_violation_paramlen(ep, asoc, type, arg,
3512 (void *)addr_param, commands);
3513
3514
3515 if (!sctp_verify_asconf(asoc,
3516 (sctp_paramhdr_t *)((void *)addr_param + length),
3517 (void *)chunk->chunk_end,
3518 &err_param))
3519 return sctp_sf_violation_paramlen(ep, asoc, type, arg,
3520 (void *)err_param, commands);
3521
3522
3523
3524
3525
3526 if (serial == asoc->peer.addip_serial + 1) {
3527
3528
3529
3530 if (!chunk->has_asconf)
3531 sctp_assoc_clean_asconf_ack_cache(asoc);
3532
3533
3534
3535
3536
3537
3538
3539
3540
3541 asconf_ack = sctp_process_asconf((struct sctp_association *)
3542 asoc, chunk);
3543 if (!asconf_ack)
3544 return SCTP_DISPOSITION_NOMEM;
3545 } else if (serial < asoc->peer.addip_serial + 1) {
3546
3547
3548
3549
3550
3551
3552
3553
3554
3555
3556
3557
3558 asconf_ack = sctp_assoc_lookup_asconf_ack(asoc, hdr->serial);
3559 if (!asconf_ack)
3560 return SCTP_DISPOSITION_DISCARD;
3561
3562
3563
3564
3565
3566 asconf_ack->transport = NULL;
3567 } else {
3568
3569
3570
3571 return SCTP_DISPOSITION_DISCARD;
3572 }
3573
3574
3575
3576
3577
3578
3579
3580
3581
3582
3583 asconf_ack->dest = chunk->source;
3584 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(asconf_ack));
3585
3586 return SCTP_DISPOSITION_CONSUME;
3587}
3588
3589
3590
3591
3592
3593
3594sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
3595 const struct sctp_association *asoc,
3596 const sctp_subtype_t type, void *arg,
3597 sctp_cmd_seq_t *commands)
3598{
3599 struct sctp_chunk *asconf_ack = arg;
3600 struct sctp_chunk *last_asconf = asoc->addip_last_asconf;
3601 struct sctp_chunk *abort;
3602 struct sctp_paramhdr *err_param = NULL;
3603 sctp_addiphdr_t *addip_hdr;
3604 __u32 sent_serial, rcvd_serial;
3605
3606 if (!sctp_vtag_verify(asconf_ack, asoc)) {
3607 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3608 SCTP_NULL());
3609 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3610 }
3611
3612
3613
3614
3615
3616
3617
3618 if (!sctp_addip_noauth && !asconf_ack->auth)
3619 return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
3620
3621
3622 if (!sctp_chunk_length_valid(asconf_ack, sizeof(sctp_addip_chunk_t)))
3623 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3624 commands);
3625
3626 addip_hdr = (sctp_addiphdr_t *)asconf_ack->skb->data;
3627 rcvd_serial = ntohl(addip_hdr->serial);
3628
3629
3630 if (!sctp_verify_asconf(asoc,
3631 (sctp_paramhdr_t *)addip_hdr->params,
3632 (void *)asconf_ack->chunk_end,
3633 &err_param))
3634 return sctp_sf_violation_paramlen(ep, asoc, type, arg,
3635 (void *)err_param, commands);
3636
3637 if (last_asconf) {
3638 addip_hdr = (sctp_addiphdr_t *)last_asconf->subh.addip_hdr;
3639 sent_serial = ntohl(addip_hdr->serial);
3640 } else {
3641 sent_serial = asoc->addip_serial - 1;
3642 }
3643
3644
3645
3646
3647
3648
3649
3650 if (ADDIP_SERIAL_gte(rcvd_serial, sent_serial + 1) &&
3651 !(asoc->addip_last_asconf)) {
3652 abort = sctp_make_abort(asoc, asconf_ack,
3653 sizeof(sctp_errhdr_t));
3654 if (abort) {
3655 sctp_init_cause(abort, SCTP_ERROR_ASCONF_ACK, 0);
3656 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
3657 SCTP_CHUNK(abort));
3658 }
3659
3660
3661
3662 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3663 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
3664 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
3665 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
3666 SCTP_ERROR(ECONNABORTED));
3667 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
3668 SCTP_PERR(SCTP_ERROR_ASCONF_ACK));
3669 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
3670 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
3671 return SCTP_DISPOSITION_ABORT;
3672 }
3673
3674 if ((rcvd_serial == sent_serial) && asoc->addip_last_asconf) {
3675 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3676 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
3677
3678 if (!sctp_process_asconf_ack((struct sctp_association *)asoc,
3679 asconf_ack)) {
3680
3681
3682
3683 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_NEXT_ASCONF,
3684 SCTP_NULL());
3685 return SCTP_DISPOSITION_CONSUME;
3686 }
3687
3688 abort = sctp_make_abort(asoc, asconf_ack,
3689 sizeof(sctp_errhdr_t));
3690 if (abort) {
3691 sctp_init_cause(abort, SCTP_ERROR_RSRC_LOW, 0);
3692 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
3693 SCTP_CHUNK(abort));
3694 }
3695
3696
3697
3698 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
3699 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
3700 SCTP_ERROR(ECONNABORTED));
3701 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
3702 SCTP_PERR(SCTP_ERROR_ASCONF_ACK));
3703 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
3704 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
3705 return SCTP_DISPOSITION_ABORT;
3706 }
3707
3708 return SCTP_DISPOSITION_DISCARD;
3709}
3710
3711
3712
3713
3714
3715
3716
3717
3718
3719
3720
3721
3722
3723
3724
3725sctp_disposition_t sctp_sf_eat_fwd_tsn(const struct sctp_endpoint *ep,
3726 const struct sctp_association *asoc,
3727 const sctp_subtype_t type,
3728 void *arg,
3729 sctp_cmd_seq_t *commands)
3730{
3731 struct sctp_chunk *chunk = arg;
3732 struct sctp_fwdtsn_hdr *fwdtsn_hdr;
3733 struct sctp_fwdtsn_skip *skip;
3734 __u16 len;
3735 __u32 tsn;
3736
3737 if (!sctp_vtag_verify(chunk, asoc)) {
3738 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3739 SCTP_NULL());
3740 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3741 }
3742
3743
3744 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_fwdtsn_chunk)))
3745 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3746 commands);
3747
3748 fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data;
3749 chunk->subh.fwdtsn_hdr = fwdtsn_hdr;
3750 len = ntohs(chunk->chunk_hdr->length);
3751 len -= sizeof(struct sctp_chunkhdr);
3752 skb_pull(chunk->skb, len);
3753
3754 tsn = ntohl(fwdtsn_hdr->new_cum_tsn);
3755 SCTP_DEBUG_PRINTK("%s: TSN 0x%x.\n", __func__, tsn);
3756
3757
3758
3759
3760 if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
3761 goto discard_noforce;
3762
3763
3764 sctp_walk_fwdtsn(skip, chunk) {
3765 if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
3766 goto discard_noforce;
3767 }
3768
3769 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
3770 if (len > sizeof(struct sctp_fwdtsn_hdr))
3771 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
3772 SCTP_CHUNK(chunk));
3773
3774
3775 if (asoc->autoclose) {
3776 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
3777 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
3778 }
3779
3780
3781
3782
3783 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_NOFORCE());
3784
3785 return SCTP_DISPOSITION_CONSUME;
3786
3787discard_noforce:
3788 return SCTP_DISPOSITION_DISCARD;
3789}
3790
3791sctp_disposition_t sctp_sf_eat_fwd_tsn_fast(
3792 const struct sctp_endpoint *ep,
3793 const struct sctp_association *asoc,
3794 const sctp_subtype_t type,
3795 void *arg,
3796 sctp_cmd_seq_t *commands)
3797{
3798 struct sctp_chunk *chunk = arg;
3799 struct sctp_fwdtsn_hdr *fwdtsn_hdr;
3800 struct sctp_fwdtsn_skip *skip;
3801 __u16 len;
3802 __u32 tsn;
3803
3804 if (!sctp_vtag_verify(chunk, asoc)) {
3805 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3806 SCTP_NULL());
3807 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3808 }
3809
3810
3811 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_fwdtsn_chunk)))
3812 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3813 commands);
3814
3815 fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data;
3816 chunk->subh.fwdtsn_hdr = fwdtsn_hdr;
3817 len = ntohs(chunk->chunk_hdr->length);
3818 len -= sizeof(struct sctp_chunkhdr);
3819 skb_pull(chunk->skb, len);
3820
3821 tsn = ntohl(fwdtsn_hdr->new_cum_tsn);
3822 SCTP_DEBUG_PRINTK("%s: TSN 0x%x.\n", __func__, tsn);
3823
3824
3825
3826
3827 if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
3828 goto gen_shutdown;
3829
3830
3831 sctp_walk_fwdtsn(skip, chunk) {
3832 if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
3833 goto gen_shutdown;
3834 }
3835
3836 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
3837 if (len > sizeof(struct sctp_fwdtsn_hdr))
3838 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
3839 SCTP_CHUNK(chunk));
3840
3841
3842gen_shutdown:
3843
3844
3845
3846
3847
3848
3849 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SHUTDOWN, SCTP_NULL());
3850 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
3851 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
3852 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
3853
3854 return SCTP_DISPOSITION_CONSUME;
3855}
3856
3857
3858
3859
3860
3861
3862
3863
3864
3865
3866
3867
3868
3869
3870
3871
3872
3873
3874
3875
3876
3877
3878
3879static sctp_ierror_t sctp_sf_authenticate(const struct sctp_endpoint *ep,
3880 const struct sctp_association *asoc,
3881 const sctp_subtype_t type,
3882 struct sctp_chunk *chunk)
3883{
3884 struct sctp_authhdr *auth_hdr;
3885 struct sctp_hmac *hmac;
3886 unsigned int sig_len;
3887 __u16 key_id;
3888 __u8 *save_digest;
3889 __u8 *digest;
3890
3891
3892 auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
3893 chunk->subh.auth_hdr = auth_hdr;
3894 skb_pull(chunk->skb, sizeof(struct sctp_authhdr));
3895
3896
3897
3898
3899 if (!sctp_auth_asoc_verify_hmac_id(asoc, auth_hdr->hmac_id))
3900 return SCTP_IERROR_AUTH_BAD_HMAC;
3901
3902
3903
3904
3905 key_id = ntohs(auth_hdr->shkey_id);
3906 if (key_id != asoc->active_key_id && !sctp_auth_get_shkey(asoc, key_id))
3907 return SCTP_IERROR_AUTH_BAD_KEYID;
3908
3909
3910
3911
3912
3913 sig_len = ntohs(chunk->chunk_hdr->length) - sizeof(sctp_auth_chunk_t);
3914 hmac = sctp_auth_get_hmac(ntohs(auth_hdr->hmac_id));
3915 if (sig_len != hmac->hmac_len)
3916 return SCTP_IERROR_PROTO_VIOLATION;
3917
3918
3919
3920
3921
3922
3923
3924
3925 digest = auth_hdr->hmac;
3926 skb_pull(chunk->skb, sig_len);
3927
3928 save_digest = kmemdup(digest, sig_len, GFP_ATOMIC);
3929 if (!save_digest)
3930 goto nomem;
3931
3932 memset(digest, 0, sig_len);
3933
3934 sctp_auth_calculate_hmac(asoc, chunk->skb,
3935 (struct sctp_auth_chunk *)chunk->chunk_hdr,
3936 GFP_ATOMIC);
3937
3938
3939 if (memcmp(save_digest, digest, sig_len)) {
3940 kfree(save_digest);
3941 return SCTP_IERROR_BAD_SIG;
3942 }
3943
3944 kfree(save_digest);
3945 chunk->auth = 1;
3946
3947 return SCTP_IERROR_NO_ERROR;
3948nomem:
3949 return SCTP_IERROR_NOMEM;
3950}
3951
3952sctp_disposition_t sctp_sf_eat_auth(const struct sctp_endpoint *ep,
3953 const struct sctp_association *asoc,
3954 const sctp_subtype_t type,
3955 void *arg,
3956 sctp_cmd_seq_t *commands)
3957{
3958 struct sctp_authhdr *auth_hdr;
3959 struct sctp_chunk *chunk = arg;
3960 struct sctp_chunk *err_chunk;
3961 sctp_ierror_t error;
3962
3963
3964 if (!asoc->peer.auth_capable)
3965 return sctp_sf_unk_chunk(ep, asoc, type, arg, commands);
3966
3967 if (!sctp_vtag_verify(chunk, asoc)) {
3968 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3969 SCTP_NULL());
3970 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3971 }
3972
3973
3974 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_auth_chunk)))
3975 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3976 commands);
3977
3978 auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
3979 error = sctp_sf_authenticate(ep, asoc, type, chunk);
3980 switch (error) {
3981 case SCTP_IERROR_AUTH_BAD_HMAC:
3982
3983
3984
3985 err_chunk = sctp_make_op_error(asoc, chunk,
3986 SCTP_ERROR_UNSUP_HMAC,
3987 &auth_hdr->hmac_id,
3988 sizeof(__u16), 0);
3989 if (err_chunk) {
3990 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
3991 SCTP_CHUNK(err_chunk));
3992 }
3993
3994 case SCTP_IERROR_AUTH_BAD_KEYID:
3995 case SCTP_IERROR_BAD_SIG:
3996 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3997 break;
3998 case SCTP_IERROR_PROTO_VIOLATION:
3999 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
4000 commands);
4001 break;
4002 case SCTP_IERROR_NOMEM:
4003 return SCTP_DISPOSITION_NOMEM;
4004 default:
4005 break;
4006 }
4007
4008 if (asoc->active_key_id != ntohs(auth_hdr->shkey_id)) {
4009 struct sctp_ulpevent *ev;
4010
4011 ev = sctp_ulpevent_make_authkey(asoc, ntohs(auth_hdr->shkey_id),
4012 SCTP_AUTH_NEWKEY, GFP_ATOMIC);
4013
4014 if (!ev)
4015 return -ENOMEM;
4016
4017 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
4018 SCTP_ULPEVENT(ev));
4019 }
4020
4021 return SCTP_DISPOSITION_CONSUME;
4022}
4023
4024
4025
4026
4027
4028
4029
4030
4031
4032
4033
4034
4035
4036
4037
4038
4039
4040
4041
4042
4043
4044
4045
4046
4047sctp_disposition_t sctp_sf_unk_chunk(const struct sctp_endpoint *ep,
4048 const struct sctp_association *asoc,
4049 const sctp_subtype_t type,
4050 void *arg,
4051 sctp_cmd_seq_t *commands)
4052{
4053 struct sctp_chunk *unk_chunk = arg;
4054 struct sctp_chunk *err_chunk;
4055 sctp_chunkhdr_t *hdr;
4056
4057 SCTP_DEBUG_PRINTK("Processing the unknown chunk id %d.\n", type.chunk);
4058
4059 if (!sctp_vtag_verify(unk_chunk, asoc))
4060 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
4061
4062
4063
4064
4065
4066 if (!sctp_chunk_length_valid(unk_chunk, sizeof(sctp_chunkhdr_t)))
4067 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
4068 commands);
4069
4070 switch (type.chunk & SCTP_CID_ACTION_MASK) {
4071 case SCTP_CID_ACTION_DISCARD:
4072
4073 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
4074 break;
4075 case SCTP_CID_ACTION_DISCARD_ERR:
4076
4077 hdr = unk_chunk->chunk_hdr;
4078 err_chunk = sctp_make_op_error(asoc, unk_chunk,
4079 SCTP_ERROR_UNKNOWN_CHUNK, hdr,
4080 WORD_ROUND(ntohs(hdr->length)),
4081 0);
4082 if (err_chunk) {
4083 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
4084 SCTP_CHUNK(err_chunk));
4085 }
4086
4087
4088 sctp_sf_pdiscard(ep, asoc, type, arg, commands);
4089 return SCTP_DISPOSITION_CONSUME;
4090 break;
4091 case SCTP_CID_ACTION_SKIP:
4092
4093 return SCTP_DISPOSITION_DISCARD;
4094 break;
4095 case SCTP_CID_ACTION_SKIP_ERR:
4096
4097 hdr = unk_chunk->chunk_hdr;
4098 err_chunk = sctp_make_op_error(asoc, unk_chunk,
4099 SCTP_ERROR_UNKNOWN_CHUNK, hdr,
4100 WORD_ROUND(ntohs(hdr->length)),
4101 0);
4102 if (err_chunk) {
4103 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
4104 SCTP_CHUNK(err_chunk));
4105 }
4106
4107 return SCTP_DISPOSITION_CONSUME;
4108 break;
4109 default:
4110 break;
4111 }
4112
4113 return SCTP_DISPOSITION_DISCARD;
4114}
4115
4116
4117
4118
4119
4120
4121
4122
4123
4124
4125
4126
4127
4128
4129
4130sctp_disposition_t sctp_sf_discard_chunk(const struct sctp_endpoint *ep,
4131 const struct sctp_association *asoc,
4132 const sctp_subtype_t type,
4133 void *arg,
4134 sctp_cmd_seq_t *commands)
4135{
4136 struct sctp_chunk *chunk = arg;
4137
4138
4139
4140
4141
4142 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
4143 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
4144 commands);
4145
4146 SCTP_DEBUG_PRINTK("Chunk %d is discarded\n", type.chunk);
4147 return SCTP_DISPOSITION_DISCARD;
4148}
4149
4150
4151
4152
4153
4154
4155
4156
4157
4158
4159
4160
4161
4162
4163
4164
4165
4166
4167
4168sctp_disposition_t sctp_sf_pdiscard(const struct sctp_endpoint *ep,
4169 const struct sctp_association *asoc,
4170 const sctp_subtype_t type,
4171 void *arg,
4172 sctp_cmd_seq_t *commands)
4173{
4174 SCTP_INC_STATS(SCTP_MIB_IN_PKT_DISCARDS);
4175 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
4176
4177 return SCTP_DISPOSITION_CONSUME;
4178}
4179
4180
4181
4182
4183
4184
4185
4186
4187
4188
4189
4190
4191
4192
4193
4194
4195sctp_disposition_t sctp_sf_violation(const struct sctp_endpoint *ep,
4196 const struct sctp_association *asoc,
4197 const sctp_subtype_t type,
4198 void *arg,
4199 sctp_cmd_seq_t *commands)
4200{
4201 struct sctp_chunk *chunk = arg;
4202
4203
4204 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
4205 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
4206 commands);
4207
4208 return SCTP_DISPOSITION_VIOLATION;
4209}
4210
4211
4212
4213
4214static sctp_disposition_t sctp_sf_abort_violation(
4215 const struct sctp_endpoint *ep,
4216 const struct sctp_association *asoc,
4217 void *arg,
4218 sctp_cmd_seq_t *commands,
4219 const __u8 *payload,
4220 const size_t paylen)
4221{
4222 struct sctp_packet *packet = NULL;
4223 struct sctp_chunk *chunk = arg;
4224 struct sctp_chunk *abort = NULL;
4225
4226
4227
4228
4229
4230
4231
4232
4233
4234
4235
4236
4237 if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
4238 goto discard;
4239
4240
4241 abort = sctp_make_abort_violation(asoc, chunk, payload, paylen);
4242 if (!abort)
4243 goto nomem;
4244
4245 if (asoc) {
4246
4247 if (chunk->chunk_hdr->type == SCTP_CID_INIT_ACK &&
4248 !asoc->peer.i.init_tag) {
4249 sctp_initack_chunk_t *initack;
4250
4251 initack = (sctp_initack_chunk_t *)chunk->chunk_hdr;
4252 if (!sctp_chunk_length_valid(chunk,
4253 sizeof(sctp_initack_chunk_t)))
4254 abort->chunk_hdr->flags |= SCTP_CHUNK_FLAG_T;
4255 else {
4256 unsigned int inittag;
4257
4258 inittag = ntohl(initack->init_hdr.init_tag);
4259 sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_INITTAG,
4260 SCTP_U32(inittag));
4261 }
4262 }
4263
4264 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
4265 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
4266
4267 if (asoc->state <= SCTP_STATE_COOKIE_ECHOED) {
4268 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4269 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
4270 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4271 SCTP_ERROR(ECONNREFUSED));
4272 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
4273 SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
4274 } else {
4275 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4276 SCTP_ERROR(ECONNABORTED));
4277 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
4278 SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
4279 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
4280 }
4281 } else {
4282 packet = sctp_ootb_pkt_new(asoc, chunk);
4283
4284 if (!packet)
4285 goto nomem_pkt;
4286
4287 if (sctp_test_T_bit(abort))
4288 packet->vtag = ntohl(chunk->sctp_hdr->vtag);
4289
4290 abort->skb->sk = ep->base.sk;
4291
4292 sctp_packet_append_chunk(packet, abort);
4293
4294 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
4295 SCTP_PACKET(packet));
4296
4297 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
4298 }
4299
4300 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
4301
4302discard:
4303 sctp_sf_pdiscard(ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
4304 return SCTP_DISPOSITION_ABORT;
4305
4306nomem_pkt:
4307 sctp_chunk_free(abort);
4308nomem:
4309 return SCTP_DISPOSITION_NOMEM;
4310}
4311
4312
4313
4314
4315
4316
4317
4318
4319
4320
4321
4322
4323
4324
4325
4326
4327
4328
4329
4330
4331static sctp_disposition_t sctp_sf_violation_chunklen(
4332 const struct sctp_endpoint *ep,
4333 const struct sctp_association *asoc,
4334 const sctp_subtype_t type,
4335 void *arg,
4336 sctp_cmd_seq_t *commands)
4337{
4338 static const char err_str[]="The following chunk had invalid length:";
4339
4340 return sctp_sf_abort_violation(ep, asoc, arg, commands, err_str,
4341 sizeof(err_str));
4342}
4343
4344
4345
4346
4347
4348
4349static sctp_disposition_t sctp_sf_violation_paramlen(
4350 const struct sctp_endpoint *ep,
4351 const struct sctp_association *asoc,
4352 const sctp_subtype_t type,
4353 void *arg, void *ext,
4354 sctp_cmd_seq_t *commands)
4355{
4356 struct sctp_chunk *chunk = arg;
4357 struct sctp_paramhdr *param = ext;
4358 struct sctp_chunk *abort = NULL;
4359
4360 if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
4361 goto discard;
4362
4363
4364 abort = sctp_make_violation_paramlen(asoc, chunk, param);
4365 if (!abort)
4366 goto nomem;
4367
4368 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
4369 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
4370
4371 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4372 SCTP_ERROR(ECONNABORTED));
4373 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
4374 SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
4375 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
4376 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
4377
4378discard:
4379 sctp_sf_pdiscard(ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
4380 return SCTP_DISPOSITION_ABORT;
4381nomem:
4382 return SCTP_DISPOSITION_NOMEM;
4383}
4384
4385
4386
4387
4388
4389
4390
4391static sctp_disposition_t sctp_sf_violation_ctsn(
4392 const struct sctp_endpoint *ep,
4393 const struct sctp_association *asoc,
4394 const sctp_subtype_t type,
4395 void *arg,
4396 sctp_cmd_seq_t *commands)
4397{
4398 static const char err_str[]="The cumulative tsn ack beyond the max tsn currently sent:";
4399
4400 return sctp_sf_abort_violation(ep, asoc, arg, commands, err_str,
4401 sizeof(err_str));
4402}
4403
4404
4405
4406
4407
4408
4409
4410static sctp_disposition_t sctp_sf_violation_chunk(
4411 const struct sctp_endpoint *ep,
4412 const struct sctp_association *asoc,
4413 const sctp_subtype_t type,
4414 void *arg,
4415 sctp_cmd_seq_t *commands)
4416{
4417 static const char err_str[]="The following chunk violates protocol:";
4418
4419 if (!asoc)
4420 return sctp_sf_violation(ep, asoc, type, arg, commands);
4421
4422 return sctp_sf_abort_violation(ep, asoc, arg, commands, err_str,
4423 sizeof(err_str));
4424}
4425
4426
4427
4428
4429
4430
4431
4432
4433
4434
4435
4436
4437
4438
4439
4440
4441
4442
4443
4444
4445
4446
4447
4448
4449
4450
4451
4452
4453
4454
4455
4456
4457
4458
4459
4460
4461
4462
4463
4464
4465
4466
4467
4468
4469
4470
4471
4472
4473
4474
4475
4476
4477
4478
4479
4480
4481
4482
4483
4484
4485sctp_disposition_t sctp_sf_do_prm_asoc(const struct sctp_endpoint *ep,
4486 const struct sctp_association *asoc,
4487 const sctp_subtype_t type,
4488 void *arg,
4489 sctp_cmd_seq_t *commands)
4490{
4491 struct sctp_chunk *repl;
4492 struct sctp_association* my_asoc;
4493
4494
4495
4496
4497
4498 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
4499 SCTP_STATE(SCTP_STATE_COOKIE_WAIT));
4500
4501
4502
4503
4504
4505
4506
4507
4508
4509 repl = sctp_make_init(asoc, &asoc->base.bind_addr, GFP_ATOMIC, 0);
4510 if (!repl)
4511 goto nomem;
4512
4513
4514
4515
4516 my_asoc = (struct sctp_association *)asoc;
4517 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(my_asoc));
4518
4519
4520 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
4521 SCTP_CHUNK(repl));
4522
4523
4524
4525
4526 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
4527 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
4528 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
4529 return SCTP_DISPOSITION_CONSUME;
4530
4531nomem:
4532 return SCTP_DISPOSITION_NOMEM;
4533}
4534
4535
4536
4537
4538
4539
4540
4541
4542
4543
4544
4545
4546
4547
4548
4549
4550
4551
4552
4553
4554
4555
4556
4557
4558
4559
4560
4561
4562
4563
4564
4565
4566
4567
4568
4569
4570
4571
4572
4573
4574
4575
4576
4577
4578
4579
4580
4581
4582
4583
4584
4585
4586
4587
4588
4589
4590
4591
4592
4593
4594
4595
4596sctp_disposition_t sctp_sf_do_prm_send(const struct sctp_endpoint *ep,
4597 const struct sctp_association *asoc,
4598 const sctp_subtype_t type,
4599 void *arg,
4600 sctp_cmd_seq_t *commands)
4601{
4602 struct sctp_datamsg *msg = arg;
4603
4604 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_MSG, SCTP_DATAMSG(msg));
4605 return SCTP_DISPOSITION_CONSUME;
4606}
4607
4608
4609
4610
4611
4612
4613
4614
4615
4616
4617
4618
4619
4620
4621
4622
4623
4624
4625
4626
4627
4628
4629
4630
4631
4632
4633
4634sctp_disposition_t sctp_sf_do_9_2_prm_shutdown(
4635 const struct sctp_endpoint *ep,
4636 const struct sctp_association *asoc,
4637 const sctp_subtype_t type,
4638 void *arg,
4639 sctp_cmd_seq_t *commands)
4640{
4641 int disposition;
4642
4643
4644
4645
4646
4647
4648
4649
4650
4651 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
4652 SCTP_STATE(SCTP_STATE_SHUTDOWN_PENDING));
4653
4654 disposition = SCTP_DISPOSITION_CONSUME;
4655 if (sctp_outq_is_empty(&asoc->outqueue)) {
4656 disposition = sctp_sf_do_9_2_start_shutdown(ep, asoc, type,
4657 arg, commands);
4658 }
4659 return disposition;
4660}
4661
4662
4663
4664
4665
4666
4667
4668
4669
4670
4671
4672
4673
4674
4675
4676
4677
4678
4679
4680
4681
4682
4683
4684
4685
4686
4687
4688
4689sctp_disposition_t sctp_sf_do_9_1_prm_abort(
4690 const struct sctp_endpoint *ep,
4691 const struct sctp_association *asoc,
4692 const sctp_subtype_t type,
4693 void *arg,
4694 sctp_cmd_seq_t *commands)
4695{
4696
4697
4698
4699
4700
4701
4702
4703
4704 struct sctp_chunk *abort = arg;
4705 sctp_disposition_t retval;
4706
4707 retval = SCTP_DISPOSITION_CONSUME;
4708
4709 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
4710
4711
4712
4713
4714
4715 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4716 SCTP_ERROR(ECONNABORTED));
4717
4718 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
4719 SCTP_PERR(SCTP_ERROR_USER_ABORT));
4720
4721 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
4722 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
4723
4724 return retval;
4725}
4726
4727
4728sctp_disposition_t sctp_sf_error_closed(const struct sctp_endpoint *ep,
4729 const struct sctp_association *asoc,
4730 const sctp_subtype_t type,
4731 void *arg,
4732 sctp_cmd_seq_t *commands)
4733{
4734 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_ERROR, SCTP_ERROR(-EINVAL));
4735 return SCTP_DISPOSITION_CONSUME;
4736}
4737
4738
4739
4740
4741sctp_disposition_t sctp_sf_error_shutdown(const struct sctp_endpoint *ep,
4742 const struct sctp_association *asoc,
4743 const sctp_subtype_t type,
4744 void *arg,
4745 sctp_cmd_seq_t *commands)
4746{
4747 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_ERROR,
4748 SCTP_ERROR(-ESHUTDOWN));
4749 return SCTP_DISPOSITION_CONSUME;
4750}
4751
4752
4753
4754
4755
4756
4757
4758
4759
4760
4761
4762
4763
4764
4765
4766sctp_disposition_t sctp_sf_cookie_wait_prm_shutdown(
4767 const struct sctp_endpoint *ep,
4768 const struct sctp_association *asoc,
4769 const sctp_subtype_t type,
4770 void *arg,
4771 sctp_cmd_seq_t *commands)
4772{
4773 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4774 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
4775
4776 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
4777 SCTP_STATE(SCTP_STATE_CLOSED));
4778
4779 SCTP_INC_STATS(SCTP_MIB_SHUTDOWNS);
4780
4781 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
4782
4783 return SCTP_DISPOSITION_DELETE_TCB;
4784}
4785
4786
4787
4788
4789
4790
4791
4792
4793
4794
4795
4796
4797
4798
4799
4800sctp_disposition_t sctp_sf_cookie_echoed_prm_shutdown(
4801 const struct sctp_endpoint *ep,
4802 const struct sctp_association *asoc,
4803 const sctp_subtype_t type,
4804 void *arg, sctp_cmd_seq_t *commands)
4805{
4806
4807
4808
4809 return sctp_sf_cookie_wait_prm_shutdown(ep, asoc, type, arg, commands);
4810}
4811
4812
4813
4814
4815
4816
4817
4818
4819
4820
4821
4822
4823
4824
4825
4826sctp_disposition_t sctp_sf_cookie_wait_prm_abort(
4827 const struct sctp_endpoint *ep,
4828 const struct sctp_association *asoc,
4829 const sctp_subtype_t type,
4830 void *arg,
4831 sctp_cmd_seq_t *commands)
4832{
4833 struct sctp_chunk *abort = arg;
4834 sctp_disposition_t retval;
4835
4836
4837 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4838 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
4839 retval = SCTP_DISPOSITION_CONSUME;
4840
4841 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
4842
4843 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
4844 SCTP_STATE(SCTP_STATE_CLOSED));
4845
4846 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
4847
4848
4849
4850
4851
4852 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4853 SCTP_ERROR(ECONNREFUSED));
4854
4855 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
4856 SCTP_PERR(SCTP_ERROR_USER_ABORT));
4857
4858 return retval;
4859}
4860
4861
4862
4863
4864
4865
4866
4867
4868
4869
4870
4871
4872
4873
4874
4875sctp_disposition_t sctp_sf_cookie_echoed_prm_abort(
4876 const struct sctp_endpoint *ep,
4877 const struct sctp_association *asoc,
4878 const sctp_subtype_t type,
4879 void *arg,
4880 sctp_cmd_seq_t *commands)
4881{
4882
4883
4884
4885 return sctp_sf_cookie_wait_prm_abort(ep, asoc, type, arg, commands);
4886}
4887
4888
4889
4890
4891
4892
4893
4894
4895
4896
4897
4898
4899
4900sctp_disposition_t sctp_sf_shutdown_pending_prm_abort(
4901 const struct sctp_endpoint *ep,
4902 const struct sctp_association *asoc,
4903 const sctp_subtype_t type,
4904 void *arg,
4905 sctp_cmd_seq_t *commands)
4906{
4907
4908 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4909 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
4910
4911 return sctp_sf_do_9_1_prm_abort(ep, asoc, type, arg, commands);
4912}
4913
4914
4915
4916
4917
4918
4919
4920
4921
4922
4923
4924
4925
4926sctp_disposition_t sctp_sf_shutdown_sent_prm_abort(
4927 const struct sctp_endpoint *ep,
4928 const struct sctp_association *asoc,
4929 const sctp_subtype_t type,
4930 void *arg,
4931 sctp_cmd_seq_t *commands)
4932{
4933
4934 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4935 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
4936
4937
4938 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4939 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
4940
4941 return sctp_sf_do_9_1_prm_abort(ep, asoc, type, arg, commands);
4942}
4943
4944
4945
4946
4947
4948
4949
4950
4951
4952
4953
4954
4955
4956sctp_disposition_t sctp_sf_shutdown_ack_sent_prm_abort(
4957 const struct sctp_endpoint *ep,
4958 const struct sctp_association *asoc,
4959 const sctp_subtype_t type,
4960 void *arg,
4961 sctp_cmd_seq_t *commands)
4962{
4963
4964
4965
4966 return sctp_sf_shutdown_sent_prm_abort(ep, asoc, type, arg, commands);
4967}
4968
4969
4970
4971
4972
4973
4974
4975
4976
4977
4978
4979
4980
4981
4982
4983
4984
4985
4986
4987
4988
4989
4990
4991sctp_disposition_t sctp_sf_do_prm_requestheartbeat(
4992 const struct sctp_endpoint *ep,
4993 const struct sctp_association *asoc,
4994 const sctp_subtype_t type,
4995 void *arg,
4996 sctp_cmd_seq_t *commands)
4997{
4998 if (SCTP_DISPOSITION_NOMEM == sctp_sf_heartbeat(ep, asoc, type,
4999 (struct sctp_transport *)arg, commands))
5000 return SCTP_DISPOSITION_NOMEM;
5001
5002
5003
5004
5005
5006
5007
5008
5009
5010
5011
5012
5013 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_HB_SENT,
5014 SCTP_TRANSPORT(arg));
5015 return SCTP_DISPOSITION_CONSUME;
5016}
5017
5018
5019
5020
5021
5022
5023sctp_disposition_t sctp_sf_do_prm_asconf(const struct sctp_endpoint *ep,
5024 const struct sctp_association *asoc,
5025 const sctp_subtype_t type,
5026 void *arg,
5027 sctp_cmd_seq_t *commands)
5028{
5029 struct sctp_chunk *chunk = arg;
5030
5031 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T4, SCTP_CHUNK(chunk));
5032 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
5033 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
5034 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(chunk));
5035 return SCTP_DISPOSITION_CONSUME;
5036}
5037
5038
5039
5040
5041
5042
5043sctp_disposition_t sctp_sf_ignore_primitive(
5044 const struct sctp_endpoint *ep,
5045 const struct sctp_association *asoc,
5046 const sctp_subtype_t type,
5047 void *arg,
5048 sctp_cmd_seq_t *commands)
5049{
5050 SCTP_DEBUG_PRINTK("Primitive type %d is ignored.\n", type.primitive);
5051 return SCTP_DISPOSITION_DISCARD;
5052}
5053
5054
5055
5056
5057
5058
5059
5060
5061
5062
5063
5064
5065
5066
5067
5068
5069
5070
5071sctp_disposition_t sctp_sf_do_9_2_start_shutdown(
5072 const struct sctp_endpoint *ep,
5073 const struct sctp_association *asoc,
5074 const sctp_subtype_t type,
5075 void *arg,
5076 sctp_cmd_seq_t *commands)
5077{
5078 struct sctp_chunk *reply;
5079
5080
5081
5082
5083
5084
5085 reply = sctp_make_shutdown(asoc, NULL);
5086 if (!reply)
5087 goto nomem;
5088
5089
5090
5091
5092 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
5093
5094
5095 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
5096 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5097
5098
5099
5100
5101
5102 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
5103 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5104
5105 if (asoc->autoclose)
5106 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5107 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
5108
5109
5110 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
5111 SCTP_STATE(SCTP_STATE_SHUTDOWN_SENT));
5112
5113
5114
5115
5116
5117
5118 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
5119
5120 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
5121
5122 return SCTP_DISPOSITION_CONSUME;
5123
5124nomem:
5125 return SCTP_DISPOSITION_NOMEM;
5126}
5127
5128
5129
5130
5131
5132
5133
5134
5135
5136
5137
5138
5139
5140sctp_disposition_t sctp_sf_do_9_2_shutdown_ack(
5141 const struct sctp_endpoint *ep,
5142 const struct sctp_association *asoc,
5143 const sctp_subtype_t type,
5144 void *arg,
5145 sctp_cmd_seq_t *commands)
5146{
5147 struct sctp_chunk *chunk = (struct sctp_chunk *) arg;
5148 struct sctp_chunk *reply;
5149
5150
5151
5152
5153
5154
5155
5156
5157 if (chunk) {
5158 if (!sctp_vtag_verify(chunk, asoc))
5159 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
5160
5161
5162 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_shutdown_chunk_t)))
5163 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
5164 commands);
5165 }
5166
5167
5168
5169
5170 reply = sctp_make_shutdown_ack(asoc, chunk);
5171 if (!reply)
5172 goto nomem;
5173
5174
5175
5176
5177 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
5178
5179
5180 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
5181 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5182
5183 if (asoc->autoclose)
5184 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5185 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
5186
5187
5188 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
5189 SCTP_STATE(SCTP_STATE_SHUTDOWN_ACK_SENT));
5190
5191
5192
5193
5194
5195
5196 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
5197
5198 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
5199
5200 return SCTP_DISPOSITION_CONSUME;
5201
5202nomem:
5203 return SCTP_DISPOSITION_NOMEM;
5204}
5205
5206
5207
5208
5209
5210
5211sctp_disposition_t sctp_sf_ignore_other(const struct sctp_endpoint *ep,
5212 const struct sctp_association *asoc,
5213 const sctp_subtype_t type,
5214 void *arg,
5215 sctp_cmd_seq_t *commands)
5216{
5217 SCTP_DEBUG_PRINTK("The event other type %d is ignored\n", type.other);
5218 return SCTP_DISPOSITION_DISCARD;
5219}
5220
5221
5222
5223
5224
5225
5226
5227
5228
5229
5230
5231
5232
5233
5234
5235
5236sctp_disposition_t sctp_sf_do_6_3_3_rtx(const struct sctp_endpoint *ep,
5237 const struct sctp_association *asoc,
5238 const sctp_subtype_t type,
5239 void *arg,
5240 sctp_cmd_seq_t *commands)
5241{
5242 struct sctp_transport *transport = arg;
5243
5244 SCTP_INC_STATS(SCTP_MIB_T3_RTX_EXPIREDS);
5245
5246 if (asoc->overall_error_count >= asoc->max_retrans) {
5247 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5248 SCTP_ERROR(ETIMEDOUT));
5249
5250 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5251 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5252 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
5253 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
5254 return SCTP_DISPOSITION_DELETE_TCB;
5255 }
5256
5257
5258
5259
5260
5261
5262
5263
5264
5265
5266
5267
5268
5269
5270
5271
5272
5273
5274
5275
5276
5277
5278
5279
5280
5281
5282
5283
5284
5285 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE, SCTP_TRANSPORT(transport));
5286
5287
5288 sctp_add_cmd_sf(commands, SCTP_CMD_RETRAN, SCTP_TRANSPORT(transport));
5289
5290 return SCTP_DISPOSITION_CONSUME;
5291}
5292
5293
5294
5295
5296
5297
5298
5299
5300
5301
5302
5303
5304
5305
5306
5307
5308sctp_disposition_t sctp_sf_do_6_2_sack(const struct sctp_endpoint *ep,
5309 const struct sctp_association *asoc,
5310 const sctp_subtype_t type,
5311 void *arg,
5312 sctp_cmd_seq_t *commands)
5313{
5314 SCTP_INC_STATS(SCTP_MIB_DELAY_SACK_EXPIREDS);
5315 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
5316 return SCTP_DISPOSITION_CONSUME;
5317}
5318
5319
5320
5321
5322
5323
5324
5325
5326
5327
5328
5329
5330
5331
5332
5333
5334
5335
5336
5337
5338sctp_disposition_t sctp_sf_t1_init_timer_expire(const struct sctp_endpoint *ep,
5339 const struct sctp_association *asoc,
5340 const sctp_subtype_t type,
5341 void *arg,
5342 sctp_cmd_seq_t *commands)
5343{
5344 struct sctp_chunk *repl = NULL;
5345 struct sctp_bind_addr *bp;
5346 int attempts = asoc->init_err_counter + 1;
5347
5348 SCTP_DEBUG_PRINTK("Timer T1 expired (INIT).\n");
5349 SCTP_INC_STATS(SCTP_MIB_T1_INIT_EXPIREDS);
5350
5351 if (attempts <= asoc->max_init_attempts) {
5352 bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
5353 repl = sctp_make_init(asoc, bp, GFP_ATOMIC, 0);
5354 if (!repl)
5355 return SCTP_DISPOSITION_NOMEM;
5356
5357
5358 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
5359 SCTP_CHUNK(repl));
5360
5361
5362 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_RESTART,
5363 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
5364
5365 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
5366 } else {
5367 SCTP_DEBUG_PRINTK("Giving up on INIT, attempts: %d"
5368 " max_init_attempts: %d\n",
5369 attempts, asoc->max_init_attempts);
5370 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5371 SCTP_ERROR(ETIMEDOUT));
5372 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
5373 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5374 return SCTP_DISPOSITION_DELETE_TCB;
5375 }
5376
5377 return SCTP_DISPOSITION_CONSUME;
5378}
5379
5380
5381
5382
5383
5384
5385
5386
5387
5388
5389
5390
5391
5392
5393
5394
5395
5396
5397
5398
5399sctp_disposition_t sctp_sf_t1_cookie_timer_expire(const struct sctp_endpoint *ep,
5400 const struct sctp_association *asoc,
5401 const sctp_subtype_t type,
5402 void *arg,
5403 sctp_cmd_seq_t *commands)
5404{
5405 struct sctp_chunk *repl = NULL;
5406 int attempts = asoc->init_err_counter + 1;
5407
5408 SCTP_DEBUG_PRINTK("Timer T1 expired (COOKIE-ECHO).\n");
5409 SCTP_INC_STATS(SCTP_MIB_T1_COOKIE_EXPIREDS);
5410
5411 if (attempts <= asoc->max_init_attempts) {
5412 repl = sctp_make_cookie_echo(asoc, NULL);
5413 if (!repl)
5414 return SCTP_DISPOSITION_NOMEM;
5415
5416 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
5417 SCTP_CHUNK(repl));
5418
5419 sctp_add_cmd_sf(commands, SCTP_CMD_COOKIEECHO_RESTART,
5420 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
5421
5422 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
5423 } else {
5424 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5425 SCTP_ERROR(ETIMEDOUT));
5426 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
5427 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5428 return SCTP_DISPOSITION_DELETE_TCB;
5429 }
5430
5431 return SCTP_DISPOSITION_CONSUME;
5432}
5433
5434
5435
5436
5437
5438
5439
5440
5441
5442
5443
5444
5445
5446
5447sctp_disposition_t sctp_sf_t2_timer_expire(const struct sctp_endpoint *ep,
5448 const struct sctp_association *asoc,
5449 const sctp_subtype_t type,
5450 void *arg,
5451 sctp_cmd_seq_t *commands)
5452{
5453 struct sctp_chunk *reply = NULL;
5454
5455 SCTP_DEBUG_PRINTK("Timer T2 expired.\n");
5456 SCTP_INC_STATS(SCTP_MIB_T2_SHUTDOWN_EXPIREDS);
5457
5458 ((struct sctp_association *)asoc)->shutdown_retries++;
5459
5460 if (asoc->overall_error_count >= asoc->max_retrans) {
5461 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5462 SCTP_ERROR(ETIMEDOUT));
5463
5464 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5465 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5466 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
5467 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
5468 return SCTP_DISPOSITION_DELETE_TCB;
5469 }
5470
5471 switch (asoc->state) {
5472 case SCTP_STATE_SHUTDOWN_SENT:
5473 reply = sctp_make_shutdown(asoc, NULL);
5474 break;
5475
5476 case SCTP_STATE_SHUTDOWN_ACK_SENT:
5477 reply = sctp_make_shutdown_ack(asoc, NULL);
5478 break;
5479
5480 default:
5481 BUG();
5482 break;
5483 }
5484
5485 if (!reply)
5486 goto nomem;
5487
5488
5489
5490
5491
5492 if (asoc->shutdown_last_sent_to)
5493 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE,
5494 SCTP_TRANSPORT(asoc->shutdown_last_sent_to));
5495
5496
5497
5498
5499 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
5500
5501
5502 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
5503 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5504 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
5505 return SCTP_DISPOSITION_CONSUME;
5506
5507nomem:
5508 return SCTP_DISPOSITION_NOMEM;
5509}
5510
5511
5512
5513
5514
5515sctp_disposition_t sctp_sf_t4_timer_expire(
5516 const struct sctp_endpoint *ep,
5517 const struct sctp_association *asoc,
5518 const sctp_subtype_t type,
5519 void *arg,
5520 sctp_cmd_seq_t *commands)
5521{
5522 struct sctp_chunk *chunk = asoc->addip_last_asconf;
5523 struct sctp_transport *transport = chunk->transport;
5524
5525 SCTP_INC_STATS(SCTP_MIB_T4_RTO_EXPIREDS);
5526
5527
5528
5529
5530
5531 if (transport)
5532 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE,
5533 SCTP_TRANSPORT(transport));
5534
5535
5536 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T4, SCTP_CHUNK(chunk));
5537
5538
5539
5540
5541
5542
5543 if (asoc->overall_error_count >= asoc->max_retrans) {
5544 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5545 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
5546 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5547 SCTP_ERROR(ETIMEDOUT));
5548 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5549 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5550 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
5551 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
5552 return SCTP_DISPOSITION_ABORT;
5553 }
5554
5555
5556
5557
5558
5559
5560
5561
5562
5563
5564
5565
5566 sctp_chunk_hold(asoc->addip_last_asconf);
5567 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
5568 SCTP_CHUNK(asoc->addip_last_asconf));
5569
5570
5571
5572
5573
5574 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
5575 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
5576
5577 return SCTP_DISPOSITION_CONSUME;
5578}
5579
5580
5581
5582
5583
5584
5585
5586sctp_disposition_t sctp_sf_t5_timer_expire(const struct sctp_endpoint *ep,
5587 const struct sctp_association *asoc,
5588 const sctp_subtype_t type,
5589 void *arg,
5590 sctp_cmd_seq_t *commands)
5591{
5592 struct sctp_chunk *reply = NULL;
5593
5594 SCTP_DEBUG_PRINTK("Timer T5 expired.\n");
5595 SCTP_INC_STATS(SCTP_MIB_T5_SHUTDOWN_GUARD_EXPIREDS);
5596
5597 reply = sctp_make_abort(asoc, NULL, 0);
5598 if (!reply)
5599 goto nomem;
5600
5601 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
5602 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5603 SCTP_ERROR(ETIMEDOUT));
5604 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5605 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5606
5607 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
5608 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
5609
5610 return SCTP_DISPOSITION_DELETE_TCB;
5611nomem:
5612 return SCTP_DISPOSITION_NOMEM;
5613}
5614
5615
5616
5617
5618
5619
5620sctp_disposition_t sctp_sf_autoclose_timer_expire(
5621 const struct sctp_endpoint *ep,
5622 const struct sctp_association *asoc,
5623 const sctp_subtype_t type,
5624 void *arg,
5625 sctp_cmd_seq_t *commands)
5626{
5627 int disposition;
5628
5629 SCTP_INC_STATS(SCTP_MIB_AUTOCLOSE_EXPIREDS);
5630
5631
5632
5633
5634
5635
5636
5637
5638
5639 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
5640 SCTP_STATE(SCTP_STATE_SHUTDOWN_PENDING));
5641
5642 disposition = SCTP_DISPOSITION_CONSUME;
5643 if (sctp_outq_is_empty(&asoc->outqueue)) {
5644 disposition = sctp_sf_do_9_2_start_shutdown(ep, asoc, type,
5645 arg, commands);
5646 }
5647 return disposition;
5648}
5649
5650
5651
5652
5653
5654
5655
5656
5657
5658
5659
5660
5661
5662sctp_disposition_t sctp_sf_not_impl(const struct sctp_endpoint *ep,
5663 const struct sctp_association *asoc,
5664 const sctp_subtype_t type,
5665 void *arg,
5666 sctp_cmd_seq_t *commands)
5667{
5668 return SCTP_DISPOSITION_NOT_IMPL;
5669}
5670
5671
5672
5673
5674
5675
5676
5677
5678
5679sctp_disposition_t sctp_sf_bug(const struct sctp_endpoint *ep,
5680 const struct sctp_association *asoc,
5681 const sctp_subtype_t type,
5682 void *arg,
5683 sctp_cmd_seq_t *commands)
5684{
5685 return SCTP_DISPOSITION_BUG;
5686}
5687
5688
5689
5690
5691
5692
5693
5694
5695
5696
5697
5698
5699sctp_disposition_t sctp_sf_timer_ignore(const struct sctp_endpoint *ep,
5700 const struct sctp_association *asoc,
5701 const sctp_subtype_t type,
5702 void *arg,
5703 sctp_cmd_seq_t *commands)
5704{
5705 SCTP_DEBUG_PRINTK("Timer %d ignored.\n", type.chunk);
5706 return SCTP_DISPOSITION_CONSUME;
5707}
5708
5709
5710
5711
5712
5713
5714static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk)
5715{
5716 struct sctp_sackhdr *sack;
5717 unsigned int len;
5718 __u16 num_blocks;
5719 __u16 num_dup_tsns;
5720
5721
5722
5723
5724 sack = (struct sctp_sackhdr *) chunk->skb->data;
5725
5726 num_blocks = ntohs(sack->num_gap_ack_blocks);
5727 num_dup_tsns = ntohs(sack->num_dup_tsns);
5728 len = sizeof(struct sctp_sackhdr);
5729 len += (num_blocks + num_dup_tsns) * sizeof(__u32);
5730 if (len > chunk->skb->len)
5731 return NULL;
5732
5733 skb_pull(chunk->skb, len);
5734
5735 return sack;
5736}
5737
5738
5739
5740
5741static struct sctp_packet *sctp_abort_pkt_new(const struct sctp_endpoint *ep,
5742 const struct sctp_association *asoc,
5743 struct sctp_chunk *chunk,
5744 const void *payload,
5745 size_t paylen)
5746{
5747 struct sctp_packet *packet;
5748 struct sctp_chunk *abort;
5749
5750 packet = sctp_ootb_pkt_new(asoc, chunk);
5751
5752 if (packet) {
5753
5754
5755
5756 abort = sctp_make_abort(asoc, chunk, paylen);
5757 if (!abort) {
5758 sctp_ootb_pkt_free(packet);
5759 return NULL;
5760 }
5761
5762
5763 if (sctp_test_T_bit(abort))
5764 packet->vtag = ntohl(chunk->sctp_hdr->vtag);
5765
5766
5767
5768
5769 sctp_addto_chunk(abort, paylen, payload);
5770
5771
5772 abort->skb->sk = ep->base.sk;
5773
5774 sctp_packet_append_chunk(packet, abort);
5775
5776 }
5777
5778 return packet;
5779}
5780
5781
5782static struct sctp_packet *sctp_ootb_pkt_new(const struct sctp_association *asoc,
5783 const struct sctp_chunk *chunk)
5784{
5785 struct sctp_packet *packet;
5786 struct sctp_transport *transport;
5787 __u16 sport;
5788 __u16 dport;
5789 __u32 vtag;
5790
5791
5792 sport = ntohs(chunk->sctp_hdr->dest);
5793 dport = ntohs(chunk->sctp_hdr->source);
5794
5795
5796
5797
5798 if (asoc) {
5799
5800
5801
5802 switch(chunk->chunk_hdr->type) {
5803 case SCTP_CID_INIT_ACK:
5804 {
5805 sctp_initack_chunk_t *initack;
5806
5807 initack = (sctp_initack_chunk_t *)chunk->chunk_hdr;
5808 vtag = ntohl(initack->init_hdr.init_tag);
5809 break;
5810 }
5811 default:
5812 vtag = asoc->peer.i.init_tag;
5813 break;
5814 }
5815 } else {
5816
5817
5818
5819 switch(chunk->chunk_hdr->type) {
5820 case SCTP_CID_INIT:
5821 {
5822 sctp_init_chunk_t *init;
5823
5824 init = (sctp_init_chunk_t *)chunk->chunk_hdr;
5825 vtag = ntohl(init->init_hdr.init_tag);
5826 break;
5827 }
5828 default:
5829 vtag = ntohl(chunk->sctp_hdr->vtag);
5830 break;
5831 }
5832 }
5833
5834
5835 transport = sctp_transport_new(sctp_source(chunk), GFP_ATOMIC);
5836 if (!transport)
5837 goto nomem;
5838
5839
5840
5841
5842 sctp_transport_route(transport, (union sctp_addr *)&chunk->dest,
5843 sctp_sk(sctp_get_ctl_sock()));
5844
5845 packet = sctp_packet_init(&transport->packet, transport, sport, dport);
5846 packet = sctp_packet_config(packet, vtag, 0);
5847
5848 return packet;
5849
5850nomem:
5851 return NULL;
5852}
5853
5854
5855void sctp_ootb_pkt_free(struct sctp_packet *packet)
5856{
5857 sctp_transport_free(packet->transport);
5858}
5859
5860
5861static void sctp_send_stale_cookie_err(const struct sctp_endpoint *ep,
5862 const struct sctp_association *asoc,
5863 const struct sctp_chunk *chunk,
5864 sctp_cmd_seq_t *commands,
5865 struct sctp_chunk *err_chunk)
5866{
5867 struct sctp_packet *packet;
5868
5869 if (err_chunk) {
5870 packet = sctp_ootb_pkt_new(asoc, chunk);
5871 if (packet) {
5872 struct sctp_signed_cookie *cookie;
5873
5874
5875 cookie = chunk->subh.cookie_hdr;
5876 packet->vtag = cookie->c.peer_vtag;
5877
5878
5879 err_chunk->skb->sk = ep->base.sk;
5880 sctp_packet_append_chunk(packet, err_chunk);
5881 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
5882 SCTP_PACKET(packet));
5883 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
5884 } else
5885 sctp_chunk_free (err_chunk);
5886 }
5887}
5888
5889
5890
5891static int sctp_eat_data(const struct sctp_association *asoc,
5892 struct sctp_chunk *chunk,
5893 sctp_cmd_seq_t *commands)
5894{
5895 sctp_datahdr_t *data_hdr;
5896 struct sctp_chunk *err;
5897 size_t datalen;
5898 sctp_verb_t deliver;
5899 int tmp;
5900 __u32 tsn;
5901 struct sctp_tsnmap *map = (struct sctp_tsnmap *)&asoc->peer.tsn_map;
5902 struct sock *sk = asoc->base.sk;
5903 u16 ssn;
5904 u16 sid;
5905 u8 ordered = 0;
5906
5907 data_hdr = chunk->subh.data_hdr = (sctp_datahdr_t *)chunk->skb->data;
5908 skb_pull(chunk->skb, sizeof(sctp_datahdr_t));
5909
5910 tsn = ntohl(data_hdr->tsn);
5911 SCTP_DEBUG_PRINTK("eat_data: TSN 0x%x.\n", tsn);
5912
5913
5914
5915
5916
5917
5918
5919
5920
5921
5922
5923
5924
5925 if (!chunk->ecn_ce_done) {
5926 struct sctp_af *af;
5927 chunk->ecn_ce_done = 1;
5928
5929 af = sctp_get_af_specific(
5930 ipver2af(ip_hdr(chunk->skb)->version));
5931
5932 if (af && af->is_ce(chunk->skb) && asoc->peer.ecn_capable) {
5933
5934 sctp_add_cmd_sf(commands, SCTP_CMD_ECN_CE,
5935 SCTP_U32(tsn));
5936 }
5937 }
5938
5939 tmp = sctp_tsnmap_check(&asoc->peer.tsn_map, tsn);
5940 if (tmp < 0) {
5941
5942
5943
5944 return SCTP_IERROR_HIGH_TSN;
5945 } else if (tmp > 0) {
5946
5947 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_DUP, SCTP_U32(tsn));
5948 return SCTP_IERROR_DUP_TSN;
5949 }
5950
5951
5952
5953
5954
5955
5956 datalen = ntohs(chunk->chunk_hdr->length);
5957 datalen -= sizeof(sctp_data_chunk_t);
5958
5959 deliver = SCTP_CMD_CHUNK_ULP;
5960
5961
5962 if ((datalen >= asoc->rwnd) && (!asoc->ulpq.pd_mode)) {
5963
5964
5965
5966
5967 sctp_add_cmd_sf(commands, SCTP_CMD_PART_DELIVER, SCTP_NULL());
5968 }
5969
5970
5971
5972
5973
5974
5975 if ((!chunk->data_accepted) && (!asoc->rwnd || asoc->rwnd_over ||
5976 (datalen > asoc->rwnd + asoc->frag_point))) {
5977
5978
5979
5980
5981
5982
5983
5984 if (sctp_tsnmap_has_gap(map) &&
5985 (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
5986 SCTP_DEBUG_PRINTK("Reneging for tsn:%u\n", tsn);
5987 deliver = SCTP_CMD_RENEGE;
5988 } else {
5989 SCTP_DEBUG_PRINTK("Discard tsn: %u len: %Zd, "
5990 "rwnd: %d\n", tsn, datalen,
5991 asoc->rwnd);
5992 return SCTP_IERROR_IGNORE_TSN;
5993 }
5994 }
5995
5996
5997
5998
5999
6000
6001
6002
6003 if (*sk->sk_prot_creator->memory_pressure) {
6004 if (sctp_tsnmap_has_gap(map) &&
6005 (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
6006 SCTP_DEBUG_PRINTK("Under Pressure! Reneging for tsn:%u\n", tsn);
6007 deliver = SCTP_CMD_RENEGE;
6008 }
6009 }
6010
6011
6012
6013
6014
6015
6016
6017
6018
6019 if (unlikely(0 == datalen)) {
6020 err = sctp_make_abort_no_data(asoc, chunk, tsn);
6021 if (err) {
6022 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
6023 SCTP_CHUNK(err));
6024 }
6025
6026
6027
6028 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
6029 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
6030 SCTP_ERROR(ECONNABORTED));
6031 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
6032 SCTP_PERR(SCTP_ERROR_NO_DATA));
6033 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
6034 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
6035 return SCTP_IERROR_NO_DATA;
6036 }
6037
6038 chunk->data_accepted = 1;
6039
6040
6041
6042
6043 if (chunk->chunk_hdr->flags & SCTP_DATA_UNORDERED)
6044 SCTP_INC_STATS(SCTP_MIB_INUNORDERCHUNKS);
6045 else {
6046 SCTP_INC_STATS(SCTP_MIB_INORDERCHUNKS);
6047 ordered = 1;
6048 }
6049
6050
6051
6052
6053
6054
6055
6056
6057
6058 sid = ntohs(data_hdr->stream);
6059 if (sid >= asoc->c.sinit_max_instreams) {
6060
6061 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_TSN, SCTP_U32(tsn));
6062
6063 err = sctp_make_op_error(asoc, chunk, SCTP_ERROR_INV_STRM,
6064 &data_hdr->stream,
6065 sizeof(data_hdr->stream),
6066 sizeof(u16));
6067 if (err)
6068 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
6069 SCTP_CHUNK(err));
6070 return SCTP_IERROR_BAD_STREAM;
6071 }
6072
6073
6074
6075
6076
6077
6078
6079
6080 ssn = ntohs(data_hdr->ssn);
6081 if (ordered && SSN_lt(ssn, sctp_ssn_peek(&asoc->ssnmap->in, sid))) {
6082 return SCTP_IERROR_PROTO_VIOLATION;
6083 }
6084
6085
6086
6087
6088
6089 sctp_add_cmd_sf(commands, deliver, SCTP_CHUNK(chunk));
6090
6091 return SCTP_IERROR_NO_ERROR;
6092}
6093