1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
54
55#include <linux/types.h>
56#include <linux/kernel.h>
57#include <linux/ip.h>
58#include <linux/ipv6.h>
59#include <linux/net.h>
60#include <linux/inet.h>
61#include <linux/slab.h>
62#include <net/sock.h>
63#include <net/inet_ecn.h>
64#include <linux/skbuff.h>
65#include <net/sctp/sctp.h>
66#include <net/sctp/sm.h>
67#include <net/sctp/structs.h>
68
69static struct sctp_packet *sctp_abort_pkt_new(struct net *net,
70 const struct sctp_endpoint *ep,
71 const struct sctp_association *asoc,
72 struct sctp_chunk *chunk,
73 const void *payload,
74 size_t paylen);
75static int sctp_eat_data(const struct sctp_association *asoc,
76 struct sctp_chunk *chunk,
77 sctp_cmd_seq_t *commands);
78static struct sctp_packet *sctp_ootb_pkt_new(struct net *net,
79 const struct sctp_association *asoc,
80 const struct sctp_chunk *chunk);
81static void sctp_send_stale_cookie_err(struct net *net,
82 const struct sctp_endpoint *ep,
83 const struct sctp_association *asoc,
84 const struct sctp_chunk *chunk,
85 sctp_cmd_seq_t *commands,
86 struct sctp_chunk *err_chunk);
87static sctp_disposition_t sctp_sf_do_5_2_6_stale(struct net *net,
88 const struct sctp_endpoint *ep,
89 const struct sctp_association *asoc,
90 const sctp_subtype_t type,
91 void *arg,
92 sctp_cmd_seq_t *commands);
93static sctp_disposition_t sctp_sf_shut_8_4_5(struct net *net,
94 const struct sctp_endpoint *ep,
95 const struct sctp_association *asoc,
96 const sctp_subtype_t type,
97 void *arg,
98 sctp_cmd_seq_t *commands);
99static sctp_disposition_t sctp_sf_tabort_8_4_8(struct net *net,
100 const struct sctp_endpoint *ep,
101 const struct sctp_association *asoc,
102 const sctp_subtype_t type,
103 void *arg,
104 sctp_cmd_seq_t *commands);
105static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk);
106
107static sctp_disposition_t sctp_stop_t1_and_abort(struct net *net,
108 sctp_cmd_seq_t *commands,
109 __be16 error, int sk_err,
110 const struct sctp_association *asoc,
111 struct sctp_transport *transport);
112
113static sctp_disposition_t sctp_sf_abort_violation(
114 struct net *net,
115 const struct sctp_endpoint *ep,
116 const struct sctp_association *asoc,
117 void *arg,
118 sctp_cmd_seq_t *commands,
119 const __u8 *payload,
120 const size_t paylen);
121
122static sctp_disposition_t sctp_sf_violation_chunklen(
123 struct net *net,
124 const struct sctp_endpoint *ep,
125 const struct sctp_association *asoc,
126 const sctp_subtype_t type,
127 void *arg,
128 sctp_cmd_seq_t *commands);
129
130static sctp_disposition_t sctp_sf_violation_paramlen(
131 struct net *net,
132 const struct sctp_endpoint *ep,
133 const struct sctp_association *asoc,
134 const sctp_subtype_t type,
135 void *arg, void *ext,
136 sctp_cmd_seq_t *commands);
137
138static sctp_disposition_t sctp_sf_violation_ctsn(
139 struct net *net,
140 const struct sctp_endpoint *ep,
141 const struct sctp_association *asoc,
142 const sctp_subtype_t type,
143 void *arg,
144 sctp_cmd_seq_t *commands);
145
146static sctp_disposition_t sctp_sf_violation_chunk(
147 struct net *net,
148 const struct sctp_endpoint *ep,
149 const struct sctp_association *asoc,
150 const sctp_subtype_t type,
151 void *arg,
152 sctp_cmd_seq_t *commands);
153
154static sctp_ierror_t sctp_sf_authenticate(struct net *net,
155 const struct sctp_endpoint *ep,
156 const struct sctp_association *asoc,
157 const sctp_subtype_t type,
158 struct sctp_chunk *chunk);
159
160static sctp_disposition_t __sctp_sf_do_9_1_abort(struct net *net,
161 const struct sctp_endpoint *ep,
162 const struct sctp_association *asoc,
163 const sctp_subtype_t type,
164 void *arg,
165 sctp_cmd_seq_t *commands);
166
167
168
169
170
171
172
173
174static inline int
175sctp_chunk_length_valid(struct sctp_chunk *chunk,
176 __u16 required_length)
177{
178 __u16 chunk_length = ntohs(chunk->chunk_hdr->length);
179
180 if (unlikely(chunk_length < required_length))
181 return 0;
182
183 return 1;
184}
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221sctp_disposition_t sctp_sf_do_4_C(struct net *net,
222 const struct sctp_endpoint *ep,
223 const struct sctp_association *asoc,
224 const sctp_subtype_t type,
225 void *arg,
226 sctp_cmd_seq_t *commands)
227{
228 struct sctp_chunk *chunk = arg;
229 struct sctp_ulpevent *ev;
230
231 if (!sctp_vtag_verify_either(chunk, asoc))
232 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
233
234
235
236
237
238
239 if (!chunk->singleton)
240 return sctp_sf_violation_chunk(net, ep, asoc, type, arg, commands);
241
242
243 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
244 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
245 commands);
246
247
248
249
250
251
252
253
254 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_SHUTDOWN_COMP,
255 0, 0, 0, NULL, GFP_ATOMIC);
256 if (ev)
257 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
258 SCTP_ULPEVENT(ev));
259
260
261
262
263
264
265
266
267
268 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
269 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
270
271 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
272 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
273
274 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
275 SCTP_STATE(SCTP_STATE_CLOSED));
276
277 SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS);
278 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
279
280 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
281
282 return SCTP_DISPOSITION_DELETE_TCB;
283}
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307sctp_disposition_t sctp_sf_do_5_1B_init(struct net *net,
308 const struct sctp_endpoint *ep,
309 const struct sctp_association *asoc,
310 const sctp_subtype_t type,
311 void *arg,
312 sctp_cmd_seq_t *commands)
313{
314 struct sctp_chunk *chunk = arg;
315 struct sctp_chunk *repl;
316 struct sctp_association *new_asoc;
317 struct sctp_chunk *err_chunk;
318 struct sctp_packet *packet;
319 sctp_unrecognized_param_t *unk_param;
320 int len;
321
322
323
324
325
326
327
328
329
330
331 if (!chunk->singleton)
332 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
333
334
335
336
337 if (ep == sctp_sk(net->sctp.ctl_sock)->ep) {
338 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
339 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
340 }
341
342
343
344
345 if (chunk->sctp_hdr->vtag != 0)
346 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
347
348
349
350
351
352
353 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_init_chunk_t)))
354 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
355
356
357
358
359
360
361
362 if (sctp_sstate(ep->base.sk, CLOSING))
363 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
364
365
366 err_chunk = NULL;
367 if (!sctp_verify_init(net, asoc, chunk->chunk_hdr->type,
368 (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
369 &err_chunk)) {
370
371
372
373 if (err_chunk) {
374 packet = sctp_abort_pkt_new(net, ep, asoc, arg,
375 (__u8 *)(err_chunk->chunk_hdr) +
376 sizeof(sctp_chunkhdr_t),
377 ntohs(err_chunk->chunk_hdr->length) -
378 sizeof(sctp_chunkhdr_t));
379
380 sctp_chunk_free(err_chunk);
381
382 if (packet) {
383 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
384 SCTP_PACKET(packet));
385 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
386 return SCTP_DISPOSITION_CONSUME;
387 } else {
388 return SCTP_DISPOSITION_NOMEM;
389 }
390 } else {
391 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg,
392 commands);
393 }
394 }
395
396
397 chunk->subh.init_hdr = (sctp_inithdr_t *)chunk->skb->data;
398
399
400 chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(sctp_inithdr_t));
401
402 new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC);
403 if (!new_asoc)
404 goto nomem;
405
406 if (sctp_assoc_set_bind_addr_from_ep(new_asoc,
407 sctp_scope(sctp_source(chunk)),
408 GFP_ATOMIC) < 0)
409 goto nomem_init;
410
411
412 if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk),
413 (sctp_init_chunk_t *)chunk->chunk_hdr,
414 GFP_ATOMIC))
415 goto nomem_init;
416
417
418
419
420
421
422 len = 0;
423 if (err_chunk)
424 len = ntohs(err_chunk->chunk_hdr->length) -
425 sizeof(sctp_chunkhdr_t);
426
427 repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
428 if (!repl)
429 goto nomem_init;
430
431
432
433
434
435 if (err_chunk) {
436
437
438
439
440
441
442
443 unk_param = (sctp_unrecognized_param_t *)
444 ((__u8 *)(err_chunk->chunk_hdr) +
445 sizeof(sctp_chunkhdr_t));
446
447
448
449 sctp_addto_chunk(repl, len, unk_param);
450 sctp_chunk_free(err_chunk);
451 }
452
453 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
454
455 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
456
457
458
459
460
461
462
463 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
464
465 return SCTP_DISPOSITION_DELETE_TCB;
466
467nomem_init:
468 sctp_association_free(new_asoc);
469nomem:
470 if (err_chunk)
471 sctp_chunk_free(err_chunk);
472 return SCTP_DISPOSITION_NOMEM;
473}
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503sctp_disposition_t sctp_sf_do_5_1C_ack(struct net *net,
504 const struct sctp_endpoint *ep,
505 const struct sctp_association *asoc,
506 const sctp_subtype_t type,
507 void *arg,
508 sctp_cmd_seq_t *commands)
509{
510 struct sctp_chunk *chunk = arg;
511 sctp_init_chunk_t *initchunk;
512 struct sctp_chunk *err_chunk;
513 struct sctp_packet *packet;
514
515 if (!sctp_vtag_verify(chunk, asoc))
516 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
517
518
519
520
521
522 if (!chunk->singleton)
523 return sctp_sf_violation_chunk(net, ep, asoc, type, arg, commands);
524
525
526 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_initack_chunk_t)))
527 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
528 commands);
529
530 chunk->subh.init_hdr = (sctp_inithdr_t *) chunk->skb->data;
531
532
533 err_chunk = NULL;
534 if (!sctp_verify_init(net, asoc, chunk->chunk_hdr->type,
535 (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
536 &err_chunk)) {
537
538 sctp_error_t error = SCTP_ERROR_NO_RESOURCE;
539
540
541
542
543
544
545 if (err_chunk) {
546 packet = sctp_abort_pkt_new(net, ep, asoc, arg,
547 (__u8 *)(err_chunk->chunk_hdr) +
548 sizeof(sctp_chunkhdr_t),
549 ntohs(err_chunk->chunk_hdr->length) -
550 sizeof(sctp_chunkhdr_t));
551
552 sctp_chunk_free(err_chunk);
553
554 if (packet) {
555 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
556 SCTP_PACKET(packet));
557 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
558 error = SCTP_ERROR_INV_PARAM;
559 }
560 }
561
562
563
564
565
566
567
568
569
570
571
572
573 if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
574 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
575
576 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
577 return sctp_stop_t1_and_abort(net, commands, error, ECONNREFUSED,
578 asoc, chunk->transport);
579 }
580
581
582
583
584 chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(sctp_inithdr_t));
585
586 initchunk = (sctp_init_chunk_t *) chunk->chunk_hdr;
587
588 sctp_add_cmd_sf(commands, SCTP_CMD_PEER_INIT,
589 SCTP_PEER_INIT(initchunk));
590
591
592 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());
593
594
595
596
597
598 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
599 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
600 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
601 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
602 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
603 SCTP_STATE(SCTP_STATE_COOKIE_ECHOED));
604
605
606
607
608 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_SHKEY, SCTP_NULL());
609
610
611
612
613
614
615
616 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_COOKIE_ECHO,
617 SCTP_CHUNK(err_chunk));
618
619 return SCTP_DISPOSITION_CONSUME;
620}
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net,
654 const struct sctp_endpoint *ep,
655 const struct sctp_association *asoc,
656 const sctp_subtype_t type, void *arg,
657 sctp_cmd_seq_t *commands)
658{
659 struct sctp_chunk *chunk = arg;
660 struct sctp_association *new_asoc;
661 sctp_init_chunk_t *peer_init;
662 struct sctp_chunk *repl;
663 struct sctp_ulpevent *ev, *ai_ev = NULL;
664 int error = 0;
665 struct sctp_chunk *err_chk_p;
666 struct sock *sk;
667
668
669
670
671 if (ep == sctp_sk(net->sctp.ctl_sock)->ep) {
672 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
673 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
674 }
675
676
677
678
679
680
681 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
682 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
683
684
685
686
687
688 sk = ep->base.sk;
689 if (!sctp_sstate(sk, LISTENING) ||
690 (sctp_style(sk, TCP) && sk_acceptq_is_full(sk)))
691 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
692
693
694
695
696 chunk->subh.cookie_hdr =
697 (struct sctp_signed_cookie *)chunk->skb->data;
698 if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
699 sizeof(sctp_chunkhdr_t)))
700 goto nomem;
701
702
703
704
705
706 new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, &error,
707 &err_chk_p);
708
709
710
711
712
713
714
715 if (!new_asoc) {
716
717
718
719 switch (error) {
720 case -SCTP_IERROR_NOMEM:
721 goto nomem;
722
723 case -SCTP_IERROR_STALE_COOKIE:
724 sctp_send_stale_cookie_err(net, ep, asoc, chunk, commands,
725 err_chk_p);
726 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
727
728 case -SCTP_IERROR_BAD_SIG:
729 default:
730 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
731 }
732 }
733
734
735
736
737
738
739
740
741
742
743 peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
744
745 if (!sctp_process_init(new_asoc, chunk,
746 &chunk->subh.cookie_hdr->c.peer_addr,
747 peer_init, GFP_ATOMIC))
748 goto nomem_init;
749
750
751
752
753
754 error = sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC);
755 if (error)
756 goto nomem_init;
757
758
759
760
761
762
763
764 if (chunk->auth_chunk) {
765 struct sctp_chunk auth;
766 sctp_ierror_t ret;
767
768
769 auth.skb = chunk->auth_chunk;
770 auth.asoc = chunk->asoc;
771 auth.sctp_hdr = chunk->sctp_hdr;
772 auth.chunk_hdr = (sctp_chunkhdr_t *)skb_push(chunk->auth_chunk,
773 sizeof(sctp_chunkhdr_t));
774 skb_pull(chunk->auth_chunk, sizeof(sctp_chunkhdr_t));
775 auth.transport = chunk->transport;
776
777 ret = sctp_sf_authenticate(net, ep, new_asoc, type, &auth);
778
779
780 kfree_skb(chunk->auth_chunk);
781
782 if (ret != SCTP_IERROR_NO_ERROR) {
783 sctp_association_free(new_asoc);
784 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
785 }
786 }
787
788 repl = sctp_make_cookie_ack(new_asoc, chunk);
789 if (!repl)
790 goto nomem_init;
791
792
793
794
795
796
797
798 ev = sctp_ulpevent_make_assoc_change(new_asoc, 0, SCTP_COMM_UP, 0,
799 new_asoc->c.sinit_num_ostreams,
800 new_asoc->c.sinit_max_instreams,
801 NULL, GFP_ATOMIC);
802 if (!ev)
803 goto nomem_ev;
804
805
806
807
808
809
810 if (new_asoc->peer.adaptation_ind) {
811 ai_ev = sctp_ulpevent_make_adaptation_indication(new_asoc,
812 GFP_ATOMIC);
813 if (!ai_ev)
814 goto nomem_aiev;
815 }
816
817
818
819
820
821
822 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
823 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
824 SCTP_STATE(SCTP_STATE_ESTABLISHED));
825 SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
826 SCTP_INC_STATS(net, SCTP_MIB_PASSIVEESTABS);
827 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
828
829 if (new_asoc->autoclose)
830 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
831 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
832
833
834 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
835
836
837 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
838
839
840 if (ai_ev)
841 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
842 SCTP_ULPEVENT(ai_ev));
843
844 return SCTP_DISPOSITION_CONSUME;
845
846nomem_aiev:
847 sctp_ulpevent_free(ev);
848nomem_ev:
849 sctp_chunk_free(repl);
850nomem_init:
851 sctp_association_free(new_asoc);
852nomem:
853 return SCTP_DISPOSITION_NOMEM;
854}
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877sctp_disposition_t sctp_sf_do_5_1E_ca(struct net *net,
878 const struct sctp_endpoint *ep,
879 const struct sctp_association *asoc,
880 const sctp_subtype_t type, void *arg,
881 sctp_cmd_seq_t *commands)
882{
883 struct sctp_chunk *chunk = arg;
884 struct sctp_ulpevent *ev;
885
886 if (!sctp_vtag_verify(chunk, asoc))
887 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
888
889
890
891
892 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
893 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
894 commands);
895
896
897
898
899
900
901
902 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());
903
904
905
906
907
908
909
910 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
911 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
912 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
913 SCTP_STATE(SCTP_STATE_ESTABLISHED));
914 SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
915 SCTP_INC_STATS(net, SCTP_MIB_ACTIVEESTABS);
916 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
917 if (asoc->autoclose)
918 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
919 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
920
921
922
923
924
925 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_COMM_UP,
926 0, asoc->c.sinit_num_ostreams,
927 asoc->c.sinit_max_instreams,
928 NULL, GFP_ATOMIC);
929
930 if (!ev)
931 goto nomem;
932
933 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
934
935
936
937
938
939
940 if (asoc->peer.adaptation_ind) {
941 ev = sctp_ulpevent_make_adaptation_indication(asoc, GFP_ATOMIC);
942 if (!ev)
943 goto nomem;
944
945 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
946 SCTP_ULPEVENT(ev));
947 }
948
949 return SCTP_DISPOSITION_CONSUME;
950nomem:
951 return SCTP_DISPOSITION_NOMEM;
952}
953
954
955static sctp_disposition_t sctp_sf_heartbeat(const struct sctp_endpoint *ep,
956 const struct sctp_association *asoc,
957 const sctp_subtype_t type,
958 void *arg,
959 sctp_cmd_seq_t *commands)
960{
961 struct sctp_transport *transport = (struct sctp_transport *) arg;
962 struct sctp_chunk *reply;
963
964
965 reply = sctp_make_heartbeat(asoc, transport);
966 if (!reply)
967 return SCTP_DISPOSITION_NOMEM;
968
969
970
971
972 sctp_add_cmd_sf(commands, SCTP_CMD_RTO_PENDING,
973 SCTP_TRANSPORT(transport));
974
975 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
976 return SCTP_DISPOSITION_CONSUME;
977}
978
979
980sctp_disposition_t sctp_sf_sendbeat_8_3(struct net *net,
981 const struct sctp_endpoint *ep,
982 const struct sctp_association *asoc,
983 const sctp_subtype_t type,
984 void *arg,
985 sctp_cmd_seq_t *commands)
986{
987 struct sctp_transport *transport = (struct sctp_transport *) arg;
988
989 if (asoc->overall_error_count >= asoc->max_retrans) {
990 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
991 SCTP_ERROR(ETIMEDOUT));
992
993 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
994 SCTP_PERR(SCTP_ERROR_NO_ERROR));
995 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
996 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
997 return SCTP_DISPOSITION_DELETE_TCB;
998 }
999
1000
1001
1002
1003
1004
1005
1006
1007 if (transport->param_flags & SPP_HB_ENABLE) {
1008 if (SCTP_DISPOSITION_NOMEM ==
1009 sctp_sf_heartbeat(ep, asoc, type, arg,
1010 commands))
1011 return SCTP_DISPOSITION_NOMEM;
1012
1013
1014
1015
1016 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_HB_SENT,
1017 SCTP_TRANSPORT(transport));
1018 }
1019 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_IDLE,
1020 SCTP_TRANSPORT(transport));
1021 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMER_UPDATE,
1022 SCTP_TRANSPORT(transport));
1023
1024 return SCTP_DISPOSITION_CONSUME;
1025}
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051sctp_disposition_t sctp_sf_beat_8_3(struct net *net,
1052 const struct sctp_endpoint *ep,
1053 const struct sctp_association *asoc,
1054 const sctp_subtype_t type,
1055 void *arg,
1056 sctp_cmd_seq_t *commands)
1057{
1058 sctp_paramhdr_t *param_hdr;
1059 struct sctp_chunk *chunk = arg;
1060 struct sctp_chunk *reply;
1061 size_t paylen = 0;
1062
1063 if (!sctp_vtag_verify(chunk, asoc))
1064 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1065
1066
1067 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_heartbeat_chunk_t)))
1068 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1069 commands);
1070
1071
1072
1073
1074
1075 chunk->subh.hb_hdr = (sctp_heartbeathdr_t *) chunk->skb->data;
1076 param_hdr = (sctp_paramhdr_t *) chunk->subh.hb_hdr;
1077 paylen = ntohs(chunk->chunk_hdr->length) - sizeof(sctp_chunkhdr_t);
1078
1079 if (ntohs(param_hdr->length) > paylen)
1080 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
1081 param_hdr, commands);
1082
1083 if (!pskb_pull(chunk->skb, paylen))
1084 goto nomem;
1085
1086 reply = sctp_make_heartbeat_ack(asoc, chunk, param_hdr, paylen);
1087 if (!reply)
1088 goto nomem;
1089
1090 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
1091 return SCTP_DISPOSITION_CONSUME;
1092
1093nomem:
1094 return SCTP_DISPOSITION_NOMEM;
1095}
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125sctp_disposition_t sctp_sf_backbeat_8_3(struct net *net,
1126 const struct sctp_endpoint *ep,
1127 const struct sctp_association *asoc,
1128 const sctp_subtype_t type,
1129 void *arg,
1130 sctp_cmd_seq_t *commands)
1131{
1132 struct sctp_chunk *chunk = arg;
1133 union sctp_addr from_addr;
1134 struct sctp_transport *link;
1135 sctp_sender_hb_info_t *hbinfo;
1136 unsigned long max_interval;
1137
1138 if (!sctp_vtag_verify(chunk, asoc))
1139 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1140
1141
1142 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t) +
1143 sizeof(sctp_sender_hb_info_t)))
1144 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1145 commands);
1146
1147 hbinfo = (sctp_sender_hb_info_t *) chunk->skb->data;
1148
1149 if (ntohs(hbinfo->param_hdr.length) !=
1150 sizeof(sctp_sender_hb_info_t)) {
1151 return SCTP_DISPOSITION_DISCARD;
1152 }
1153
1154 from_addr = hbinfo->daddr;
1155 link = sctp_assoc_lookup_paddr(asoc, &from_addr);
1156
1157
1158 if (unlikely(!link)) {
1159 if (from_addr.sa.sa_family == AF_INET6) {
1160 net_warn_ratelimited("%s association %p could not find address %pI6\n",
1161 __func__,
1162 asoc,
1163 &from_addr.v6.sin6_addr);
1164 } else {
1165 net_warn_ratelimited("%s association %p could not find address %pI4\n",
1166 __func__,
1167 asoc,
1168 &from_addr.v4.sin_addr.s_addr);
1169 }
1170 return SCTP_DISPOSITION_DISCARD;
1171 }
1172
1173
1174 if (hbinfo->hb_nonce != link->hb_nonce)
1175 return SCTP_DISPOSITION_DISCARD;
1176
1177 max_interval = link->hbinterval + link->rto;
1178
1179
1180 if (time_after(hbinfo->sent_at, jiffies) ||
1181 time_after(jiffies, hbinfo->sent_at + max_interval)) {
1182 pr_debug("%s: HEARTBEAT ACK with invalid timestamp received "
1183 "for transport:%p\n", __func__, link);
1184
1185 return SCTP_DISPOSITION_DISCARD;
1186 }
1187
1188
1189
1190
1191
1192
1193
1194 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_ON, SCTP_TRANSPORT(link));
1195
1196 return SCTP_DISPOSITION_CONSUME;
1197}
1198
1199
1200
1201
1202static int sctp_sf_send_restart_abort(struct net *net, union sctp_addr *ssa,
1203 struct sctp_chunk *init,
1204 sctp_cmd_seq_t *commands)
1205{
1206 int len;
1207 struct sctp_packet *pkt;
1208 union sctp_addr_param *addrparm;
1209 struct sctp_errhdr *errhdr;
1210 struct sctp_endpoint *ep;
1211 char buffer[sizeof(struct sctp_errhdr)+sizeof(union sctp_addr_param)];
1212 struct sctp_af *af = sctp_get_af_specific(ssa->v4.sin_family);
1213
1214
1215
1216
1217 errhdr = (struct sctp_errhdr *)buffer;
1218 addrparm = (union sctp_addr_param *)errhdr->variable;
1219
1220
1221 len = af->to_addr_param(ssa, addrparm);
1222 len += sizeof(sctp_errhdr_t);
1223
1224 errhdr->cause = SCTP_ERROR_RESTART;
1225 errhdr->length = htons(len);
1226
1227
1228 ep = sctp_sk(net->sctp.ctl_sock)->ep;
1229
1230
1231
1232
1233 pkt = sctp_abort_pkt_new(net, ep, NULL, init, errhdr, len);
1234
1235 if (!pkt)
1236 goto out;
1237 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT, SCTP_PACKET(pkt));
1238
1239 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
1240
1241
1242 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
1243
1244out:
1245
1246
1247
1248 return 0;
1249}
1250
1251static bool list_has_sctp_addr(const struct list_head *list,
1252 union sctp_addr *ipaddr)
1253{
1254 struct sctp_transport *addr;
1255
1256 list_for_each_entry(addr, list, transports) {
1257 if (sctp_cmp_addr_exact(ipaddr, &addr->ipaddr))
1258 return true;
1259 }
1260
1261 return false;
1262}
1263
1264
1265
1266static int sctp_sf_check_restart_addrs(const struct sctp_association *new_asoc,
1267 const struct sctp_association *asoc,
1268 struct sctp_chunk *init,
1269 sctp_cmd_seq_t *commands)
1270{
1271 struct net *net = sock_net(new_asoc->base.sk);
1272 struct sctp_transport *new_addr;
1273 int ret = 1;
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286 list_for_each_entry(new_addr, &new_asoc->peer.transport_addr_list,
1287 transports) {
1288 if (!list_has_sctp_addr(&asoc->peer.transport_addr_list,
1289 &new_addr->ipaddr)) {
1290 sctp_sf_send_restart_abort(net, &new_addr->ipaddr, init,
1291 commands);
1292 ret = 0;
1293 break;
1294 }
1295 }
1296
1297
1298 return ret;
1299}
1300
1301
1302
1303
1304
1305
1306static void sctp_tietags_populate(struct sctp_association *new_asoc,
1307 const struct sctp_association *asoc)
1308{
1309 switch (asoc->state) {
1310
1311
1312
1313 case SCTP_STATE_COOKIE_WAIT:
1314 new_asoc->c.my_vtag = asoc->c.my_vtag;
1315 new_asoc->c.my_ttag = asoc->c.my_vtag;
1316 new_asoc->c.peer_ttag = 0;
1317 break;
1318
1319 case SCTP_STATE_COOKIE_ECHOED:
1320 new_asoc->c.my_vtag = asoc->c.my_vtag;
1321 new_asoc->c.my_ttag = asoc->c.my_vtag;
1322 new_asoc->c.peer_ttag = asoc->c.peer_vtag;
1323 break;
1324
1325
1326
1327
1328 default:
1329 new_asoc->c.my_ttag = asoc->c.my_vtag;
1330 new_asoc->c.peer_ttag = asoc->c.peer_vtag;
1331 break;
1332 }
1333
1334
1335
1336
1337
1338 new_asoc->rwnd = asoc->rwnd;
1339 new_asoc->c.sinit_num_ostreams = asoc->c.sinit_num_ostreams;
1340 new_asoc->c.sinit_max_instreams = asoc->c.sinit_max_instreams;
1341 new_asoc->c.initial_tsn = asoc->c.initial_tsn;
1342}
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353static char sctp_tietags_compare(struct sctp_association *new_asoc,
1354 const struct sctp_association *asoc)
1355{
1356
1357 if ((asoc->c.my_vtag != new_asoc->c.my_vtag) &&
1358 (asoc->c.peer_vtag != new_asoc->c.peer_vtag) &&
1359 (asoc->c.my_vtag == new_asoc->c.my_ttag) &&
1360 (asoc->c.peer_vtag == new_asoc->c.peer_ttag))
1361 return 'A';
1362
1363
1364 if ((asoc->c.my_vtag == new_asoc->c.my_vtag) &&
1365 ((asoc->c.peer_vtag != new_asoc->c.peer_vtag) ||
1366 (0 == asoc->c.peer_vtag))) {
1367 return 'B';
1368 }
1369
1370
1371 if ((asoc->c.my_vtag == new_asoc->c.my_vtag) &&
1372 (asoc->c.peer_vtag == new_asoc->c.peer_vtag))
1373 return 'D';
1374
1375
1376 if ((asoc->c.my_vtag != new_asoc->c.my_vtag) &&
1377 (asoc->c.peer_vtag == new_asoc->c.peer_vtag) &&
1378 (0 == new_asoc->c.my_ttag) &&
1379 (0 == new_asoc->c.peer_ttag))
1380 return 'C';
1381
1382
1383 return 'E';
1384}
1385
1386
1387
1388
1389static sctp_disposition_t sctp_sf_do_unexpected_init(
1390 struct net *net,
1391 const struct sctp_endpoint *ep,
1392 const struct sctp_association *asoc,
1393 const sctp_subtype_t type,
1394 void *arg, sctp_cmd_seq_t *commands)
1395{
1396 sctp_disposition_t retval;
1397 struct sctp_chunk *chunk = arg;
1398 struct sctp_chunk *repl;
1399 struct sctp_association *new_asoc;
1400 struct sctp_chunk *err_chunk;
1401 struct sctp_packet *packet;
1402 sctp_unrecognized_param_t *unk_param;
1403 int len;
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414 if (!chunk->singleton)
1415 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1416
1417
1418
1419
1420 if (chunk->sctp_hdr->vtag != 0)
1421 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
1422
1423
1424
1425
1426
1427 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_init_chunk_t)))
1428 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1429 commands);
1430
1431 chunk->subh.init_hdr = (sctp_inithdr_t *) chunk->skb->data;
1432
1433
1434 chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(sctp_inithdr_t));
1435
1436
1437 err_chunk = NULL;
1438 if (!sctp_verify_init(net, asoc, chunk->chunk_hdr->type,
1439 (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
1440 &err_chunk)) {
1441
1442
1443
1444 if (err_chunk) {
1445 packet = sctp_abort_pkt_new(net, ep, asoc, arg,
1446 (__u8 *)(err_chunk->chunk_hdr) +
1447 sizeof(sctp_chunkhdr_t),
1448 ntohs(err_chunk->chunk_hdr->length) -
1449 sizeof(sctp_chunkhdr_t));
1450
1451 if (packet) {
1452 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
1453 SCTP_PACKET(packet));
1454 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
1455 retval = SCTP_DISPOSITION_CONSUME;
1456 } else {
1457 retval = SCTP_DISPOSITION_NOMEM;
1458 }
1459 goto cleanup;
1460 } else {
1461 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg,
1462 commands);
1463 }
1464 }
1465
1466
1467
1468
1469
1470
1471
1472
1473 new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC);
1474 if (!new_asoc)
1475 goto nomem;
1476
1477 if (sctp_assoc_set_bind_addr_from_ep(new_asoc,
1478 sctp_scope(sctp_source(chunk)), GFP_ATOMIC) < 0)
1479 goto nomem;
1480
1481
1482
1483
1484
1485 if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk),
1486 (sctp_init_chunk_t *)chunk->chunk_hdr,
1487 GFP_ATOMIC))
1488 goto nomem;
1489
1490
1491
1492
1493
1494
1495 if (!sctp_state(asoc, COOKIE_WAIT)) {
1496 if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk,
1497 commands)) {
1498 retval = SCTP_DISPOSITION_CONSUME;
1499 goto nomem_retval;
1500 }
1501 }
1502
1503 sctp_tietags_populate(new_asoc, asoc);
1504
1505
1506
1507
1508
1509
1510 len = 0;
1511 if (err_chunk) {
1512 len = ntohs(err_chunk->chunk_hdr->length) -
1513 sizeof(sctp_chunkhdr_t);
1514 }
1515
1516 repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
1517 if (!repl)
1518 goto nomem;
1519
1520
1521
1522
1523
1524 if (err_chunk) {
1525
1526
1527
1528
1529
1530
1531
1532 unk_param = (sctp_unrecognized_param_t *)
1533 ((__u8 *)(err_chunk->chunk_hdr) +
1534 sizeof(sctp_chunkhdr_t));
1535
1536
1537
1538 sctp_addto_chunk(repl, len, unk_param);
1539 }
1540
1541 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
1542 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1543
1544
1545
1546
1547
1548
1549 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
1550 retval = SCTP_DISPOSITION_CONSUME;
1551
1552 return retval;
1553
1554nomem:
1555 retval = SCTP_DISPOSITION_NOMEM;
1556nomem_retval:
1557 if (new_asoc)
1558 sctp_association_free(new_asoc);
1559cleanup:
1560 if (err_chunk)
1561 sctp_chunk_free(err_chunk);
1562 return retval;
1563}
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603sctp_disposition_t sctp_sf_do_5_2_1_siminit(struct net *net,
1604 const struct sctp_endpoint *ep,
1605 const struct sctp_association *asoc,
1606 const sctp_subtype_t type,
1607 void *arg,
1608 sctp_cmd_seq_t *commands)
1609{
1610
1611
1612
1613 return sctp_sf_do_unexpected_init(net, ep, asoc, type, arg, commands);
1614}
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657sctp_disposition_t sctp_sf_do_5_2_2_dupinit(struct net *net,
1658 const struct sctp_endpoint *ep,
1659 const struct sctp_association *asoc,
1660 const sctp_subtype_t type,
1661 void *arg,
1662 sctp_cmd_seq_t *commands)
1663{
1664
1665
1666
1667 return sctp_sf_do_unexpected_init(net, ep, asoc, type, arg, commands);
1668}
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680sctp_disposition_t sctp_sf_do_5_2_3_initack(struct net *net,
1681 const struct sctp_endpoint *ep,
1682 const struct sctp_association *asoc,
1683 const sctp_subtype_t type,
1684 void *arg, sctp_cmd_seq_t *commands)
1685{
1686
1687
1688
1689 if (ep == sctp_sk(net->sctp.ctl_sock)->ep)
1690 return sctp_sf_ootb(net, ep, asoc, type, arg, commands);
1691 else
1692 return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
1693}
1694
1695
1696
1697
1698
1699
1700static sctp_disposition_t sctp_sf_do_dupcook_a(struct net *net,
1701 const struct sctp_endpoint *ep,
1702 const struct sctp_association *asoc,
1703 struct sctp_chunk *chunk,
1704 sctp_cmd_seq_t *commands,
1705 struct sctp_association *new_asoc)
1706{
1707 sctp_init_chunk_t *peer_init;
1708 struct sctp_ulpevent *ev;
1709 struct sctp_chunk *repl;
1710 struct sctp_chunk *err;
1711 sctp_disposition_t disposition;
1712
1713
1714
1715
1716 peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
1717
1718 if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk), peer_init,
1719 GFP_ATOMIC))
1720 goto nomem;
1721
1722
1723
1724
1725
1726 if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk, commands)) {
1727 return SCTP_DISPOSITION_CONSUME;
1728 }
1729
1730
1731
1732
1733
1734
1735
1736 if (sctp_state(asoc, SHUTDOWN_ACK_SENT)) {
1737 disposition = sctp_sf_do_9_2_reshutack(net, ep, asoc,
1738 SCTP_ST_CHUNK(chunk->chunk_hdr->type),
1739 chunk, commands);
1740 if (SCTP_DISPOSITION_NOMEM == disposition)
1741 goto nomem;
1742
1743 err = sctp_make_op_error(asoc, chunk,
1744 SCTP_ERROR_COOKIE_IN_SHUTDOWN,
1745 NULL, 0, 0);
1746 if (err)
1747 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
1748 SCTP_CHUNK(err));
1749
1750 return SCTP_DISPOSITION_CONSUME;
1751 }
1752
1753
1754
1755
1756 sctp_add_cmd_sf(commands, SCTP_CMD_T3_RTX_TIMERS_STOP, SCTP_NULL());
1757 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
1758 SCTP_TO(SCTP_EVENT_TIMEOUT_SACK));
1759 sctp_add_cmd_sf(commands, SCTP_CMD_PURGE_OUTQUEUE, SCTP_NULL());
1760
1761
1762
1763
1764 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
1765 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
1766 sctp_add_cmd_sf(commands, SCTP_CMD_PURGE_ASCONF_QUEUE, SCTP_NULL());
1767
1768 repl = sctp_make_cookie_ack(new_asoc, chunk);
1769 if (!repl)
1770 goto nomem;
1771
1772
1773 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_RESTART, 0,
1774 new_asoc->c.sinit_num_ostreams,
1775 new_asoc->c.sinit_max_instreams,
1776 NULL, GFP_ATOMIC);
1777 if (!ev)
1778 goto nomem_ev;
1779
1780
1781 sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
1782 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
1783 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
1784 SCTP_STATE(SCTP_STATE_ESTABLISHED));
1785 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1786 return SCTP_DISPOSITION_CONSUME;
1787
1788nomem_ev:
1789 sctp_chunk_free(repl);
1790nomem:
1791 return SCTP_DISPOSITION_NOMEM;
1792}
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802static sctp_disposition_t sctp_sf_do_dupcook_b(struct net *net,
1803 const struct sctp_endpoint *ep,
1804 const struct sctp_association *asoc,
1805 struct sctp_chunk *chunk,
1806 sctp_cmd_seq_t *commands,
1807 struct sctp_association *new_asoc)
1808{
1809 sctp_init_chunk_t *peer_init;
1810 struct sctp_chunk *repl;
1811
1812
1813
1814
1815 peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
1816 if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk), peer_init,
1817 GFP_ATOMIC))
1818 goto nomem;
1819
1820
1821 sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
1822 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
1823 SCTP_STATE(SCTP_STATE_ESTABLISHED));
1824 SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
1825 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
1826
1827 repl = sctp_make_cookie_ack(new_asoc, chunk);
1828 if (!repl)
1829 goto nomem;
1830
1831 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_CHANGE, SCTP_U8(SCTP_COMM_UP));
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855 if (asoc->peer.adaptation_ind)
1856 sctp_add_cmd_sf(commands, SCTP_CMD_ADAPTATION_IND, SCTP_NULL());
1857
1858 return SCTP_DISPOSITION_CONSUME;
1859
1860nomem:
1861 return SCTP_DISPOSITION_NOMEM;
1862}
1863
1864
1865
1866
1867
1868
1869
1870
1871
1872
1873static sctp_disposition_t sctp_sf_do_dupcook_c(struct net *net,
1874 const struct sctp_endpoint *ep,
1875 const struct sctp_association *asoc,
1876 struct sctp_chunk *chunk,
1877 sctp_cmd_seq_t *commands,
1878 struct sctp_association *new_asoc)
1879{
1880
1881
1882
1883
1884 return SCTP_DISPOSITION_DISCARD;
1885}
1886
1887
1888
1889
1890
1891
1892
1893
1894
1895static sctp_disposition_t sctp_sf_do_dupcook_d(struct net *net,
1896 const struct sctp_endpoint *ep,
1897 const struct sctp_association *asoc,
1898 struct sctp_chunk *chunk,
1899 sctp_cmd_seq_t *commands,
1900 struct sctp_association *new_asoc)
1901{
1902 struct sctp_ulpevent *ev = NULL, *ai_ev = NULL;
1903 struct sctp_chunk *repl;
1904
1905
1906
1907
1908
1909
1910
1911
1912
1913 if (asoc->state < SCTP_STATE_ESTABLISHED) {
1914 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
1915 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
1916 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
1917 SCTP_STATE(SCTP_STATE_ESTABLISHED));
1918 SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
1919 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START,
1920 SCTP_NULL());
1921
1922
1923
1924
1925
1926
1927
1928
1929 ev = sctp_ulpevent_make_assoc_change(asoc, 0,
1930 SCTP_COMM_UP, 0,
1931 asoc->c.sinit_num_ostreams,
1932 asoc->c.sinit_max_instreams,
1933 NULL, GFP_ATOMIC);
1934 if (!ev)
1935 goto nomem;
1936
1937
1938
1939
1940
1941
1942 if (asoc->peer.adaptation_ind) {
1943 ai_ev = sctp_ulpevent_make_adaptation_indication(asoc,
1944 GFP_ATOMIC);
1945 if (!ai_ev)
1946 goto nomem;
1947
1948 }
1949 }
1950
1951 repl = sctp_make_cookie_ack(new_asoc, chunk);
1952 if (!repl)
1953 goto nomem;
1954
1955 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1956
1957 if (ev)
1958 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
1959 SCTP_ULPEVENT(ev));
1960 if (ai_ev)
1961 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
1962 SCTP_ULPEVENT(ai_ev));
1963
1964 return SCTP_DISPOSITION_CONSUME;
1965
1966nomem:
1967 if (ai_ev)
1968 sctp_ulpevent_free(ai_ev);
1969 if (ev)
1970 sctp_ulpevent_free(ev);
1971 return SCTP_DISPOSITION_NOMEM;
1972}
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990sctp_disposition_t sctp_sf_do_5_2_4_dupcook(struct net *net,
1991 const struct sctp_endpoint *ep,
1992 const struct sctp_association *asoc,
1993 const sctp_subtype_t type,
1994 void *arg,
1995 sctp_cmd_seq_t *commands)
1996{
1997 sctp_disposition_t retval;
1998 struct sctp_chunk *chunk = arg;
1999 struct sctp_association *new_asoc;
2000 int error = 0;
2001 char action;
2002 struct sctp_chunk *err_chk_p;
2003
2004
2005
2006
2007
2008
2009 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
2010 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2011 commands);
2012
2013
2014
2015
2016 chunk->subh.cookie_hdr = (struct sctp_signed_cookie *)chunk->skb->data;
2017 if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
2018 sizeof(sctp_chunkhdr_t)))
2019 goto nomem;
2020
2021
2022
2023
2024
2025
2026 new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, &error,
2027 &err_chk_p);
2028
2029
2030
2031
2032
2033
2034
2035 if (!new_asoc) {
2036
2037
2038
2039 switch (error) {
2040 case -SCTP_IERROR_NOMEM:
2041 goto nomem;
2042
2043 case -SCTP_IERROR_STALE_COOKIE:
2044 sctp_send_stale_cookie_err(net, ep, asoc, chunk, commands,
2045 err_chk_p);
2046 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2047 case -SCTP_IERROR_BAD_SIG:
2048 default:
2049 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2050 }
2051 }
2052
2053
2054
2055
2056 action = sctp_tietags_compare(new_asoc, asoc);
2057
2058 switch (action) {
2059 case 'A':
2060 retval = sctp_sf_do_dupcook_a(net, ep, asoc, chunk, commands,
2061 new_asoc);
2062 break;
2063
2064 case 'B':
2065 retval = sctp_sf_do_dupcook_b(net, ep, asoc, chunk, commands,
2066 new_asoc);
2067 break;
2068
2069 case 'C':
2070 retval = sctp_sf_do_dupcook_c(net, ep, asoc, chunk, commands,
2071 new_asoc);
2072 break;
2073
2074 case 'D':
2075 retval = sctp_sf_do_dupcook_d(net, ep, asoc, chunk, commands,
2076 new_asoc);
2077 break;
2078
2079 default:
2080 retval = sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2081 break;
2082 }
2083
2084
2085 sctp_add_cmd_sf(commands, SCTP_CMD_SET_ASOC, SCTP_ASOC(new_asoc));
2086 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
2087
2088
2089
2090
2091 sctp_add_cmd_sf(commands, SCTP_CMD_SET_ASOC,
2092 SCTP_ASOC((struct sctp_association *)asoc));
2093
2094 return retval;
2095
2096nomem:
2097 return SCTP_DISPOSITION_NOMEM;
2098}
2099
2100
2101
2102
2103
2104
2105sctp_disposition_t sctp_sf_shutdown_pending_abort(
2106 struct net *net,
2107 const struct sctp_endpoint *ep,
2108 const struct sctp_association *asoc,
2109 const sctp_subtype_t type,
2110 void *arg,
2111 sctp_cmd_seq_t *commands)
2112{
2113 struct sctp_chunk *chunk = arg;
2114
2115 if (!sctp_vtag_verify_either(chunk, asoc))
2116 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2117
2118
2119
2120
2121
2122
2123
2124
2125
2126
2127
2128 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
2129 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2130
2131
2132
2133
2134
2135
2136 if (SCTP_ADDR_DEL ==
2137 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2138 return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
2139
2140 return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
2141}
2142
2143
2144
2145
2146
2147
2148sctp_disposition_t sctp_sf_shutdown_sent_abort(struct net *net,
2149 const struct sctp_endpoint *ep,
2150 const struct sctp_association *asoc,
2151 const sctp_subtype_t type,
2152 void *arg,
2153 sctp_cmd_seq_t *commands)
2154{
2155 struct sctp_chunk *chunk = arg;
2156
2157 if (!sctp_vtag_verify_either(chunk, asoc))
2158 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2159
2160
2161
2162
2163
2164
2165
2166
2167
2168
2169
2170 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
2171 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2172
2173
2174
2175
2176
2177
2178 if (SCTP_ADDR_DEL ==
2179 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2180 return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
2181
2182
2183 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2184 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
2185
2186
2187 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2188 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
2189
2190 return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
2191}
2192
2193
2194
2195
2196
2197
2198sctp_disposition_t sctp_sf_shutdown_ack_sent_abort(
2199 struct net *net,
2200 const struct sctp_endpoint *ep,
2201 const struct sctp_association *asoc,
2202 const sctp_subtype_t type,
2203 void *arg,
2204 sctp_cmd_seq_t *commands)
2205{
2206
2207
2208
2209 return sctp_sf_shutdown_sent_abort(net, ep, asoc, type, arg, commands);
2210}
2211
2212
2213
2214
2215
2216
2217
2218
2219
2220
2221
2222
2223
2224
2225
2226sctp_disposition_t sctp_sf_cookie_echoed_err(struct net *net,
2227 const struct sctp_endpoint *ep,
2228 const struct sctp_association *asoc,
2229 const sctp_subtype_t type,
2230 void *arg,
2231 sctp_cmd_seq_t *commands)
2232{
2233 struct sctp_chunk *chunk = arg;
2234 sctp_errhdr_t *err;
2235
2236 if (!sctp_vtag_verify(chunk, asoc))
2237 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2238
2239
2240
2241
2242 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_operr_chunk_t)))
2243 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2244 commands);
2245
2246
2247
2248
2249
2250
2251 sctp_walk_errors(err, chunk->chunk_hdr) {
2252 if (SCTP_ERROR_STALE_COOKIE == err->cause)
2253 return sctp_sf_do_5_2_6_stale(net, ep, asoc, type,
2254 arg, commands);
2255 }
2256
2257
2258
2259
2260
2261
2262 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2263}
2264
2265
2266
2267
2268
2269
2270
2271
2272
2273
2274
2275
2276
2277
2278
2279
2280
2281
2282
2283
2284
2285
2286
2287
2288
2289
2290static sctp_disposition_t sctp_sf_do_5_2_6_stale(struct net *net,
2291 const struct sctp_endpoint *ep,
2292 const struct sctp_association *asoc,
2293 const sctp_subtype_t type,
2294 void *arg,
2295 sctp_cmd_seq_t *commands)
2296{
2297 struct sctp_chunk *chunk = arg;
2298 time_t stale;
2299 sctp_cookie_preserve_param_t bht;
2300 sctp_errhdr_t *err;
2301 struct sctp_chunk *reply;
2302 struct sctp_bind_addr *bp;
2303 int attempts = asoc->init_err_counter + 1;
2304
2305 if (attempts > asoc->max_init_attempts) {
2306 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
2307 SCTP_ERROR(ETIMEDOUT));
2308 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
2309 SCTP_PERR(SCTP_ERROR_STALE_COOKIE));
2310 return SCTP_DISPOSITION_DELETE_TCB;
2311 }
2312
2313 err = (sctp_errhdr_t *)(chunk->skb->data);
2314
2315
2316
2317
2318
2319
2320
2321
2322
2323
2324
2325
2326
2327
2328
2329 stale = ntohl(*(__be32 *)((u8 *)err + sizeof(sctp_errhdr_t)));
2330 stale = (stale * 2) / 1000;
2331
2332 bht.param_hdr.type = SCTP_PARAM_COOKIE_PRESERVATIVE;
2333 bht.param_hdr.length = htons(sizeof(bht));
2334 bht.lifespan_increment = htonl(stale);
2335
2336
2337 bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
2338 reply = sctp_make_init(asoc, bp, GFP_ATOMIC, sizeof(bht));
2339 if (!reply)
2340 goto nomem;
2341
2342 sctp_addto_chunk(reply, sizeof(bht), &bht);
2343
2344
2345 sctp_add_cmd_sf(commands, SCTP_CMD_CLEAR_INIT_TAG, SCTP_NULL());
2346
2347
2348 sctp_add_cmd_sf(commands, SCTP_CMD_T3_RTX_TIMERS_STOP, SCTP_NULL());
2349 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
2350
2351
2352
2353
2354 sctp_add_cmd_sf(commands, SCTP_CMD_DEL_NON_PRIMARY, SCTP_NULL());
2355
2356
2357
2358
2359 sctp_add_cmd_sf(commands, SCTP_CMD_T1_RETRAN,
2360 SCTP_TRANSPORT(asoc->peer.primary_path));
2361
2362
2363
2364
2365 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_INC, SCTP_NULL());
2366
2367 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2368 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
2369 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2370 SCTP_STATE(SCTP_STATE_COOKIE_WAIT));
2371 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
2372 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
2373
2374 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
2375
2376 return SCTP_DISPOSITION_CONSUME;
2377
2378nomem:
2379 return SCTP_DISPOSITION_NOMEM;
2380}
2381
2382
2383
2384
2385
2386
2387
2388
2389
2390
2391
2392
2393
2394
2395
2396
2397
2398
2399
2400
2401
2402
2403
2404
2405
2406
2407
2408
2409
2410
2411
2412
2413sctp_disposition_t sctp_sf_do_9_1_abort(struct net *net,
2414 const struct sctp_endpoint *ep,
2415 const struct sctp_association *asoc,
2416 const sctp_subtype_t type,
2417 void *arg,
2418 sctp_cmd_seq_t *commands)
2419{
2420 struct sctp_chunk *chunk = arg;
2421
2422 if (!sctp_vtag_verify_either(chunk, asoc))
2423 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2424
2425
2426
2427
2428
2429
2430
2431
2432
2433
2434
2435 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
2436 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2437
2438
2439
2440
2441
2442
2443 if (SCTP_ADDR_DEL ==
2444 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2445 return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
2446
2447 return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
2448}
2449
2450static sctp_disposition_t __sctp_sf_do_9_1_abort(struct net *net,
2451 const struct sctp_endpoint *ep,
2452 const struct sctp_association *asoc,
2453 const sctp_subtype_t type,
2454 void *arg,
2455 sctp_cmd_seq_t *commands)
2456{
2457 struct sctp_chunk *chunk = arg;
2458 unsigned int len;
2459 __be16 error = SCTP_ERROR_NO_ERROR;
2460
2461
2462 len = ntohs(chunk->chunk_hdr->length);
2463 if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr)) {
2464
2465 sctp_errhdr_t *err;
2466 sctp_walk_errors(err, chunk->chunk_hdr);
2467 if ((void *)err != (void *)chunk->chunk_end)
2468 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2469
2470 error = ((sctp_errhdr_t *)chunk->skb->data)->cause;
2471 }
2472
2473 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(ECONNRESET));
2474
2475 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, SCTP_PERR(error));
2476 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
2477 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
2478
2479 return SCTP_DISPOSITION_ABORT;
2480}
2481
2482
2483
2484
2485
2486
2487sctp_disposition_t sctp_sf_cookie_wait_abort(struct net *net,
2488 const struct sctp_endpoint *ep,
2489 const struct sctp_association *asoc,
2490 const sctp_subtype_t type,
2491 void *arg,
2492 sctp_cmd_seq_t *commands)
2493{
2494 struct sctp_chunk *chunk = arg;
2495 unsigned int len;
2496 __be16 error = SCTP_ERROR_NO_ERROR;
2497
2498 if (!sctp_vtag_verify_either(chunk, asoc))
2499 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2500
2501
2502
2503
2504
2505
2506
2507
2508
2509
2510
2511 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
2512 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2513
2514
2515 len = ntohs(chunk->chunk_hdr->length);
2516 if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
2517 error = ((sctp_errhdr_t *)chunk->skb->data)->cause;
2518
2519 return sctp_stop_t1_and_abort(net, commands, error, ECONNREFUSED, asoc,
2520 chunk->transport);
2521}
2522
2523
2524
2525
2526sctp_disposition_t sctp_sf_cookie_wait_icmp_abort(struct net *net,
2527 const struct sctp_endpoint *ep,
2528 const struct sctp_association *asoc,
2529 const sctp_subtype_t type,
2530 void *arg,
2531 sctp_cmd_seq_t *commands)
2532{
2533 return sctp_stop_t1_and_abort(net, commands, SCTP_ERROR_NO_ERROR,
2534 ENOPROTOOPT, asoc,
2535 (struct sctp_transport *)arg);
2536}
2537
2538
2539
2540
2541sctp_disposition_t sctp_sf_cookie_echoed_abort(struct net *net,
2542 const struct sctp_endpoint *ep,
2543 const struct sctp_association *asoc,
2544 const sctp_subtype_t type,
2545 void *arg,
2546 sctp_cmd_seq_t *commands)
2547{
2548
2549
2550
2551 return sctp_sf_cookie_wait_abort(net, ep, asoc, type, arg, commands);
2552}
2553
2554
2555
2556
2557
2558
2559static sctp_disposition_t sctp_stop_t1_and_abort(struct net *net,
2560 sctp_cmd_seq_t *commands,
2561 __be16 error, int sk_err,
2562 const struct sctp_association *asoc,
2563 struct sctp_transport *transport)
2564{
2565 pr_debug("%s: ABORT received (INIT)\n", __func__);
2566
2567 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2568 SCTP_STATE(SCTP_STATE_CLOSED));
2569 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
2570 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2571 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
2572 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(sk_err));
2573
2574 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
2575 SCTP_PERR(error));
2576
2577 return SCTP_DISPOSITION_ABORT;
2578}
2579
2580
2581
2582
2583
2584
2585
2586
2587
2588
2589
2590
2591
2592
2593
2594
2595
2596
2597
2598
2599
2600
2601
2602
2603
2604
2605
2606
2607
2608
2609
2610
2611
2612
2613sctp_disposition_t sctp_sf_do_9_2_shutdown(struct net *net,
2614 const struct sctp_endpoint *ep,
2615 const struct sctp_association *asoc,
2616 const sctp_subtype_t type,
2617 void *arg,
2618 sctp_cmd_seq_t *commands)
2619{
2620 struct sctp_chunk *chunk = arg;
2621 sctp_shutdownhdr_t *sdh;
2622 sctp_disposition_t disposition;
2623 struct sctp_ulpevent *ev;
2624 __u32 ctsn;
2625
2626 if (!sctp_vtag_verify(chunk, asoc))
2627 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2628
2629
2630 if (!sctp_chunk_length_valid(chunk,
2631 sizeof(struct sctp_shutdown_chunk_t)))
2632 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2633 commands);
2634
2635
2636 sdh = (sctp_shutdownhdr_t *)chunk->skb->data;
2637 skb_pull(chunk->skb, sizeof(sctp_shutdownhdr_t));
2638 chunk->subh.shutdown_hdr = sdh;
2639 ctsn = ntohl(sdh->cum_tsn_ack);
2640
2641 if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
2642 pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn,
2643 asoc->ctsn_ack_point);
2644
2645 return SCTP_DISPOSITION_DISCARD;
2646 }
2647
2648
2649
2650
2651
2652 if (!TSN_lt(ctsn, asoc->next_tsn))
2653 return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands);
2654
2655
2656
2657
2658
2659 ev = sctp_ulpevent_make_shutdown_event(asoc, 0, GFP_ATOMIC);
2660 if (!ev) {
2661 disposition = SCTP_DISPOSITION_NOMEM;
2662 goto out;
2663 }
2664 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
2665
2666
2667
2668
2669
2670
2671
2672 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2673 SCTP_STATE(SCTP_STATE_SHUTDOWN_RECEIVED));
2674 disposition = SCTP_DISPOSITION_CONSUME;
2675
2676 if (sctp_outq_is_empty(&asoc->outqueue)) {
2677 disposition = sctp_sf_do_9_2_shutdown_ack(net, ep, asoc, type,
2678 arg, commands);
2679 }
2680
2681 if (SCTP_DISPOSITION_NOMEM == disposition)
2682 goto out;
2683
2684
2685
2686
2687
2688 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_CTSN,
2689 SCTP_BE32(chunk->subh.shutdown_hdr->cum_tsn_ack));
2690
2691out:
2692 return disposition;
2693}
2694
2695
2696
2697
2698
2699
2700
2701
2702
2703sctp_disposition_t sctp_sf_do_9_2_shut_ctsn(struct net *net,
2704 const struct sctp_endpoint *ep,
2705 const struct sctp_association *asoc,
2706 const sctp_subtype_t type,
2707 void *arg,
2708 sctp_cmd_seq_t *commands)
2709{
2710 struct sctp_chunk *chunk = arg;
2711 sctp_shutdownhdr_t *sdh;
2712 __u32 ctsn;
2713
2714 if (!sctp_vtag_verify(chunk, asoc))
2715 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2716
2717
2718 if (!sctp_chunk_length_valid(chunk,
2719 sizeof(struct sctp_shutdown_chunk_t)))
2720 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2721 commands);
2722
2723 sdh = (sctp_shutdownhdr_t *)chunk->skb->data;
2724 ctsn = ntohl(sdh->cum_tsn_ack);
2725
2726 if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
2727 pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn,
2728 asoc->ctsn_ack_point);
2729
2730 return SCTP_DISPOSITION_DISCARD;
2731 }
2732
2733
2734
2735
2736
2737 if (!TSN_lt(ctsn, asoc->next_tsn))
2738 return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands);
2739
2740
2741
2742
2743
2744 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_CTSN,
2745 SCTP_BE32(sdh->cum_tsn_ack));
2746
2747 return SCTP_DISPOSITION_CONSUME;
2748}
2749
2750
2751
2752
2753
2754
2755
2756
2757sctp_disposition_t sctp_sf_do_9_2_reshutack(struct net *net,
2758 const struct sctp_endpoint *ep,
2759 const struct sctp_association *asoc,
2760 const sctp_subtype_t type,
2761 void *arg,
2762 sctp_cmd_seq_t *commands)
2763{
2764 struct sctp_chunk *chunk = (struct sctp_chunk *) arg;
2765 struct sctp_chunk *reply;
2766
2767
2768 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
2769 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2770 commands);
2771
2772
2773
2774
2775
2776 reply = sctp_make_shutdown_ack(asoc, chunk);
2777 if (NULL == reply)
2778 goto nomem;
2779
2780
2781
2782
2783 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
2784
2785
2786 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
2787 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
2788
2789 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
2790
2791 return SCTP_DISPOSITION_CONSUME;
2792nomem:
2793 return SCTP_DISPOSITION_NOMEM;
2794}
2795
2796
2797
2798
2799
2800
2801
2802
2803
2804
2805
2806
2807
2808
2809
2810
2811
2812
2813
2814
2815
2816
2817
2818
2819
2820
2821sctp_disposition_t sctp_sf_do_ecn_cwr(struct net *net,
2822 const struct sctp_endpoint *ep,
2823 const struct sctp_association *asoc,
2824 const sctp_subtype_t type,
2825 void *arg,
2826 sctp_cmd_seq_t *commands)
2827{
2828 sctp_cwrhdr_t *cwr;
2829 struct sctp_chunk *chunk = arg;
2830 u32 lowest_tsn;
2831
2832 if (!sctp_vtag_verify(chunk, asoc))
2833 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2834
2835 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_ecne_chunk_t)))
2836 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2837 commands);
2838
2839 cwr = (sctp_cwrhdr_t *) chunk->skb->data;
2840 skb_pull(chunk->skb, sizeof(sctp_cwrhdr_t));
2841
2842 lowest_tsn = ntohl(cwr->lowest_tsn);
2843
2844
2845 if (TSN_lte(asoc->last_ecne_tsn, lowest_tsn)) {
2846
2847 sctp_add_cmd_sf(commands,
2848 SCTP_CMD_ECN_CWR,
2849 SCTP_U32(lowest_tsn));
2850 }
2851 return SCTP_DISPOSITION_CONSUME;
2852}
2853
2854
2855
2856
2857
2858
2859
2860
2861
2862
2863
2864
2865
2866
2867
2868
2869
2870
2871
2872
2873
2874
2875
2876
2877sctp_disposition_t sctp_sf_do_ecne(struct net *net,
2878 const struct sctp_endpoint *ep,
2879 const struct sctp_association *asoc,
2880 const sctp_subtype_t type,
2881 void *arg,
2882 sctp_cmd_seq_t *commands)
2883{
2884 sctp_ecnehdr_t *ecne;
2885 struct sctp_chunk *chunk = arg;
2886
2887 if (!sctp_vtag_verify(chunk, asoc))
2888 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2889
2890 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_ecne_chunk_t)))
2891 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2892 commands);
2893
2894 ecne = (sctp_ecnehdr_t *) chunk->skb->data;
2895 skb_pull(chunk->skb, sizeof(sctp_ecnehdr_t));
2896
2897
2898 sctp_add_cmd_sf(commands, SCTP_CMD_ECN_ECNE,
2899 SCTP_U32(ntohl(ecne->lowest_tsn)));
2900
2901 return SCTP_DISPOSITION_CONSUME;
2902}
2903
2904
2905
2906
2907
2908
2909
2910
2911
2912
2913
2914
2915
2916
2917
2918
2919
2920
2921
2922
2923
2924
2925
2926
2927
2928
2929
2930
2931
2932
2933
2934sctp_disposition_t sctp_sf_eat_data_6_2(struct net *net,
2935 const struct sctp_endpoint *ep,
2936 const struct sctp_association *asoc,
2937 const sctp_subtype_t type,
2938 void *arg,
2939 sctp_cmd_seq_t *commands)
2940{
2941 struct sctp_chunk *chunk = arg;
2942 sctp_arg_t force = SCTP_NOFORCE();
2943 int error;
2944
2945 if (!sctp_vtag_verify(chunk, asoc)) {
2946 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
2947 SCTP_NULL());
2948 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2949 }
2950
2951 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_data_chunk_t)))
2952 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2953 commands);
2954
2955 error = sctp_eat_data(asoc, chunk, commands );
2956 switch (error) {
2957 case SCTP_IERROR_NO_ERROR:
2958 break;
2959 case SCTP_IERROR_HIGH_TSN:
2960 case SCTP_IERROR_BAD_STREAM:
2961 SCTP_INC_STATS(net, SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
2962 goto discard_noforce;
2963 case SCTP_IERROR_DUP_TSN:
2964 case SCTP_IERROR_IGNORE_TSN:
2965 SCTP_INC_STATS(net, SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
2966 goto discard_force;
2967 case SCTP_IERROR_NO_DATA:
2968 goto consume;
2969 case SCTP_IERROR_PROTO_VIOLATION:
2970 return sctp_sf_abort_violation(net, ep, asoc, chunk, commands,
2971 (u8 *)chunk->subh.data_hdr, sizeof(sctp_datahdr_t));
2972 default:
2973 BUG();
2974 }
2975
2976 if (chunk->chunk_hdr->flags & SCTP_DATA_SACK_IMM)
2977 force = SCTP_FORCE();
2978
2979 if (asoc->autoclose) {
2980 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
2981 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
2982 }
2983
2984
2985
2986
2987
2988
2989
2990
2991
2992
2993
2994
2995
2996
2997
2998
2999
3000
3001
3002
3003
3004
3005
3006 if (chunk->end_of_packet)
3007 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, force);
3008
3009 return SCTP_DISPOSITION_CONSUME;
3010
3011discard_force:
3012
3013
3014
3015
3016
3017
3018
3019
3020
3021
3022
3023
3024
3025
3026 if (chunk->end_of_packet)
3027 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
3028 return SCTP_DISPOSITION_DISCARD;
3029
3030discard_noforce:
3031 if (chunk->end_of_packet)
3032 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, force);
3033
3034 return SCTP_DISPOSITION_DISCARD;
3035consume:
3036 return SCTP_DISPOSITION_CONSUME;
3037
3038}
3039
3040
3041
3042
3043
3044
3045
3046
3047
3048
3049
3050
3051
3052
3053
3054
3055
3056sctp_disposition_t sctp_sf_eat_data_fast_4_4(struct net *net,
3057 const struct sctp_endpoint *ep,
3058 const struct sctp_association *asoc,
3059 const sctp_subtype_t type,
3060 void *arg,
3061 sctp_cmd_seq_t *commands)
3062{
3063 struct sctp_chunk *chunk = arg;
3064 int error;
3065
3066 if (!sctp_vtag_verify(chunk, asoc)) {
3067 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3068 SCTP_NULL());
3069 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3070 }
3071
3072 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_data_chunk_t)))
3073 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3074 commands);
3075
3076 error = sctp_eat_data(asoc, chunk, commands );
3077 switch (error) {
3078 case SCTP_IERROR_NO_ERROR:
3079 case SCTP_IERROR_HIGH_TSN:
3080 case SCTP_IERROR_DUP_TSN:
3081 case SCTP_IERROR_IGNORE_TSN:
3082 case SCTP_IERROR_BAD_STREAM:
3083 break;
3084 case SCTP_IERROR_NO_DATA:
3085 goto consume;
3086 case SCTP_IERROR_PROTO_VIOLATION:
3087 return sctp_sf_abort_violation(net, ep, asoc, chunk, commands,
3088 (u8 *)chunk->subh.data_hdr, sizeof(sctp_datahdr_t));
3089 default:
3090 BUG();
3091 }
3092
3093
3094
3095
3096
3097
3098
3099
3100
3101 if (chunk->end_of_packet) {
3102
3103
3104
3105 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SHUTDOWN, SCTP_NULL());
3106 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
3107 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
3108 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
3109 }
3110
3111consume:
3112 return SCTP_DISPOSITION_CONSUME;
3113}
3114
3115
3116
3117
3118
3119
3120
3121
3122
3123
3124
3125
3126
3127
3128
3129
3130
3131
3132
3133
3134
3135
3136
3137
3138
3139
3140
3141
3142
3143
3144
3145
3146
3147sctp_disposition_t sctp_sf_eat_sack_6_2(struct net *net,
3148 const struct sctp_endpoint *ep,
3149 const struct sctp_association *asoc,
3150 const sctp_subtype_t type,
3151 void *arg,
3152 sctp_cmd_seq_t *commands)
3153{
3154 struct sctp_chunk *chunk = arg;
3155 sctp_sackhdr_t *sackh;
3156 __u32 ctsn;
3157
3158 if (!sctp_vtag_verify(chunk, asoc))
3159 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3160
3161
3162 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_sack_chunk_t)))
3163 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3164 commands);
3165
3166
3167 sackh = sctp_sm_pull_sack(chunk);
3168
3169 if (!sackh)
3170 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3171 chunk->subh.sack_hdr = sackh;
3172 ctsn = ntohl(sackh->cum_tsn_ack);
3173
3174
3175
3176
3177
3178
3179
3180 if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
3181 pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn,
3182 asoc->ctsn_ack_point);
3183
3184 return SCTP_DISPOSITION_DISCARD;
3185 }
3186
3187
3188
3189
3190
3191 if (!TSN_lt(ctsn, asoc->next_tsn))
3192 return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands);
3193
3194
3195 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_SACK, SCTP_CHUNK(chunk));
3196
3197
3198
3199
3200 return SCTP_DISPOSITION_CONSUME;
3201}
3202
3203
3204
3205
3206
3207
3208
3209
3210
3211
3212
3213
3214
3215
3216
3217
3218
3219
3220
3221static sctp_disposition_t sctp_sf_tabort_8_4_8(struct net *net,
3222 const struct sctp_endpoint *ep,
3223 const struct sctp_association *asoc,
3224 const sctp_subtype_t type,
3225 void *arg,
3226 sctp_cmd_seq_t *commands)
3227{
3228 struct sctp_packet *packet = NULL;
3229 struct sctp_chunk *chunk = arg;
3230 struct sctp_chunk *abort;
3231
3232 packet = sctp_ootb_pkt_new(net, asoc, chunk);
3233
3234 if (packet) {
3235
3236
3237
3238 abort = sctp_make_abort(asoc, chunk, 0);
3239 if (!abort) {
3240 sctp_ootb_pkt_free(packet);
3241 return SCTP_DISPOSITION_NOMEM;
3242 }
3243
3244
3245 if (sctp_test_T_bit(abort))
3246 packet->vtag = ntohl(chunk->sctp_hdr->vtag);
3247
3248
3249 abort->skb->sk = ep->base.sk;
3250
3251 sctp_packet_append_chunk(packet, abort);
3252
3253 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
3254 SCTP_PACKET(packet));
3255
3256 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
3257
3258 sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3259 return SCTP_DISPOSITION_CONSUME;
3260 }
3261
3262 return SCTP_DISPOSITION_NOMEM;
3263}
3264
3265
3266
3267
3268
3269
3270
3271
3272
3273sctp_disposition_t sctp_sf_operr_notify(struct net *net,
3274 const struct sctp_endpoint *ep,
3275 const struct sctp_association *asoc,
3276 const sctp_subtype_t type,
3277 void *arg,
3278 sctp_cmd_seq_t *commands)
3279{
3280 struct sctp_chunk *chunk = arg;
3281 sctp_errhdr_t *err;
3282
3283 if (!sctp_vtag_verify(chunk, asoc))
3284 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3285
3286
3287 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_operr_chunk_t)))
3288 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3289 commands);
3290 sctp_walk_errors(err, chunk->chunk_hdr);
3291 if ((void *)err != (void *)chunk->chunk_end)
3292 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
3293 (void *)err, commands);
3294
3295 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,
3296 SCTP_CHUNK(chunk));
3297
3298 return SCTP_DISPOSITION_CONSUME;
3299}
3300
3301
3302
3303
3304
3305
3306
3307
3308
3309
3310
3311sctp_disposition_t sctp_sf_do_9_2_final(struct net *net,
3312 const struct sctp_endpoint *ep,
3313 const struct sctp_association *asoc,
3314 const sctp_subtype_t type,
3315 void *arg,
3316 sctp_cmd_seq_t *commands)
3317{
3318 struct sctp_chunk *chunk = arg;
3319 struct sctp_chunk *reply;
3320 struct sctp_ulpevent *ev;
3321
3322 if (!sctp_vtag_verify(chunk, asoc))
3323 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3324
3325
3326 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
3327 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3328 commands);
3329
3330
3331
3332
3333
3334 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_SHUTDOWN_COMP,
3335 0, 0, 0, NULL, GFP_ATOMIC);
3336 if (!ev)
3337 goto nomem;
3338
3339
3340 reply = sctp_make_shutdown_complete(asoc, chunk);
3341 if (!reply)
3342 goto nomem_chunk;
3343
3344
3345
3346
3347 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
3348
3349
3350
3351
3352 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3353 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
3354
3355 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3356 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
3357
3358 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
3359 SCTP_STATE(SCTP_STATE_CLOSED));
3360 SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS);
3361 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
3362 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
3363
3364
3365 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
3366 return SCTP_DISPOSITION_DELETE_TCB;
3367
3368nomem_chunk:
3369 sctp_ulpevent_free(ev);
3370nomem:
3371 return SCTP_DISPOSITION_NOMEM;
3372}
3373
3374
3375
3376
3377
3378
3379
3380
3381
3382
3383
3384
3385
3386
3387
3388
3389
3390
3391
3392
3393
3394sctp_disposition_t sctp_sf_ootb(struct net *net,
3395 const struct sctp_endpoint *ep,
3396 const struct sctp_association *asoc,
3397 const sctp_subtype_t type,
3398 void *arg,
3399 sctp_cmd_seq_t *commands)
3400{
3401 struct sctp_chunk *chunk = arg;
3402 struct sk_buff *skb = chunk->skb;
3403 sctp_chunkhdr_t *ch;
3404 sctp_errhdr_t *err;
3405 __u8 *ch_end;
3406 int ootb_shut_ack = 0;
3407 int ootb_cookie_ack = 0;
3408
3409 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
3410
3411 ch = (sctp_chunkhdr_t *) chunk->chunk_hdr;
3412 do {
3413
3414 if (ntohs(ch->length) < sizeof(sctp_chunkhdr_t))
3415 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3416 commands);
3417
3418
3419
3420
3421 if (SCTP_CID_SHUTDOWN_ACK == ch->type)
3422 ootb_shut_ack = 1;
3423
3424
3425
3426
3427
3428
3429 if (SCTP_CID_ABORT == ch->type)
3430 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3431
3432
3433
3434
3435
3436
3437 if (SCTP_CID_COOKIE_ACK == ch->type)
3438 ootb_cookie_ack = 1;
3439
3440 if (SCTP_CID_ERROR == ch->type) {
3441 sctp_walk_errors(err, ch) {
3442 if (SCTP_ERROR_STALE_COOKIE == err->cause) {
3443 ootb_cookie_ack = 1;
3444 break;
3445 }
3446 }
3447 }
3448
3449
3450 ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length));
3451 if (ch_end > skb_tail_pointer(skb))
3452 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3453 commands);
3454
3455 ch = (sctp_chunkhdr_t *) ch_end;
3456 } while (ch_end < skb_tail_pointer(skb));
3457
3458 if (ootb_shut_ack)
3459 return sctp_sf_shut_8_4_5(net, ep, asoc, type, arg, commands);
3460 else if (ootb_cookie_ack)
3461 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3462 else
3463 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
3464}
3465
3466
3467
3468
3469
3470
3471
3472
3473
3474
3475
3476
3477
3478
3479
3480
3481
3482
3483
3484
3485
3486
3487static sctp_disposition_t sctp_sf_shut_8_4_5(struct net *net,
3488 const struct sctp_endpoint *ep,
3489 const struct sctp_association *asoc,
3490 const sctp_subtype_t type,
3491 void *arg,
3492 sctp_cmd_seq_t *commands)
3493{
3494 struct sctp_packet *packet = NULL;
3495 struct sctp_chunk *chunk = arg;
3496 struct sctp_chunk *shut;
3497
3498 packet = sctp_ootb_pkt_new(net, asoc, chunk);
3499
3500 if (packet) {
3501
3502
3503
3504 shut = sctp_make_shutdown_complete(asoc, chunk);
3505 if (!shut) {
3506 sctp_ootb_pkt_free(packet);
3507 return SCTP_DISPOSITION_NOMEM;
3508 }
3509
3510
3511 if (sctp_test_T_bit(shut))
3512 packet->vtag = ntohl(chunk->sctp_hdr->vtag);
3513
3514
3515 shut->skb->sk = ep->base.sk;
3516
3517 sctp_packet_append_chunk(packet, shut);
3518
3519 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
3520 SCTP_PACKET(packet));
3521
3522 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
3523
3524
3525
3526
3527 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
3528 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3529
3530
3531
3532
3533
3534 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3535 }
3536
3537 return SCTP_DISPOSITION_NOMEM;
3538}
3539
3540
3541
3542
3543
3544
3545
3546
3547
3548
3549
3550
3551sctp_disposition_t sctp_sf_do_8_5_1_E_sa(struct net *net,
3552 const struct sctp_endpoint *ep,
3553 const struct sctp_association *asoc,
3554 const sctp_subtype_t type,
3555 void *arg,
3556 sctp_cmd_seq_t *commands)
3557{
3558 struct sctp_chunk *chunk = arg;
3559
3560
3561 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
3562 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3563 commands);
3564
3565
3566
3567
3568
3569
3570 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
3571
3572 return sctp_sf_shut_8_4_5(net, ep, NULL, type, arg, commands);
3573}
3574
3575
3576sctp_disposition_t sctp_sf_do_asconf(struct net *net,
3577 const struct sctp_endpoint *ep,
3578 const struct sctp_association *asoc,
3579 const sctp_subtype_t type, void *arg,
3580 sctp_cmd_seq_t *commands)
3581{
3582 struct sctp_chunk *chunk = arg;
3583 struct sctp_chunk *asconf_ack = NULL;
3584 struct sctp_paramhdr *err_param = NULL;
3585 sctp_addiphdr_t *hdr;
3586 union sctp_addr_param *addr_param;
3587 __u32 serial;
3588 int length;
3589
3590 if (!sctp_vtag_verify(chunk, asoc)) {
3591 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3592 SCTP_NULL());
3593 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3594 }
3595
3596
3597
3598
3599
3600
3601
3602 if (!net->sctp.addip_noauth && !chunk->auth)
3603 return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
3604
3605
3606 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_addip_chunk_t)))
3607 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3608 commands);
3609
3610 hdr = (sctp_addiphdr_t *)chunk->skb->data;
3611 serial = ntohl(hdr->serial);
3612
3613 addr_param = (union sctp_addr_param *)hdr->params;
3614 length = ntohs(addr_param->p.length);
3615 if (length < sizeof(sctp_paramhdr_t))
3616 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
3617 (void *)addr_param, commands);
3618
3619
3620 if (!sctp_verify_asconf(asoc,
3621 (sctp_paramhdr_t *)((void *)addr_param + length),
3622 (void *)chunk->chunk_end,
3623 &err_param))
3624 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
3625 (void *)err_param, commands);
3626
3627
3628
3629
3630
3631 if (serial == asoc->peer.addip_serial + 1) {
3632
3633
3634
3635 if (!chunk->has_asconf)
3636 sctp_assoc_clean_asconf_ack_cache(asoc);
3637
3638
3639
3640
3641
3642
3643
3644
3645
3646 asconf_ack = sctp_process_asconf((struct sctp_association *)
3647 asoc, chunk);
3648 if (!asconf_ack)
3649 return SCTP_DISPOSITION_NOMEM;
3650 } else if (serial < asoc->peer.addip_serial + 1) {
3651
3652
3653
3654
3655
3656
3657
3658
3659
3660
3661
3662
3663 asconf_ack = sctp_assoc_lookup_asconf_ack(asoc, hdr->serial);
3664 if (!asconf_ack)
3665 return SCTP_DISPOSITION_DISCARD;
3666
3667
3668
3669
3670
3671 asconf_ack->transport = NULL;
3672 } else {
3673
3674
3675
3676 return SCTP_DISPOSITION_DISCARD;
3677 }
3678
3679
3680
3681
3682
3683
3684
3685
3686
3687
3688 asconf_ack->dest = chunk->source;
3689 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(asconf_ack));
3690 if (asoc->new_transport) {
3691 sctp_sf_heartbeat(ep, asoc, type, asoc->new_transport,
3692 commands);
3693 ((struct sctp_association *)asoc)->new_transport = NULL;
3694 }
3695
3696 return SCTP_DISPOSITION_CONSUME;
3697}
3698
3699
3700
3701
3702
3703
3704sctp_disposition_t sctp_sf_do_asconf_ack(struct net *net,
3705 const struct sctp_endpoint *ep,
3706 const struct sctp_association *asoc,
3707 const sctp_subtype_t type, void *arg,
3708 sctp_cmd_seq_t *commands)
3709{
3710 struct sctp_chunk *asconf_ack = arg;
3711 struct sctp_chunk *last_asconf = asoc->addip_last_asconf;
3712 struct sctp_chunk *abort;
3713 struct sctp_paramhdr *err_param = NULL;
3714 sctp_addiphdr_t *addip_hdr;
3715 __u32 sent_serial, rcvd_serial;
3716
3717 if (!sctp_vtag_verify(asconf_ack, asoc)) {
3718 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3719 SCTP_NULL());
3720 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3721 }
3722
3723
3724
3725
3726
3727
3728
3729 if (!net->sctp.addip_noauth && !asconf_ack->auth)
3730 return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
3731
3732
3733 if (!sctp_chunk_length_valid(asconf_ack, sizeof(sctp_addip_chunk_t)))
3734 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3735 commands);
3736
3737 addip_hdr = (sctp_addiphdr_t *)asconf_ack->skb->data;
3738 rcvd_serial = ntohl(addip_hdr->serial);
3739
3740
3741 if (!sctp_verify_asconf(asoc,
3742 (sctp_paramhdr_t *)addip_hdr->params,
3743 (void *)asconf_ack->chunk_end,
3744 &err_param))
3745 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
3746 (void *)err_param, commands);
3747
3748 if (last_asconf) {
3749 addip_hdr = (sctp_addiphdr_t *)last_asconf->subh.addip_hdr;
3750 sent_serial = ntohl(addip_hdr->serial);
3751 } else {
3752 sent_serial = asoc->addip_serial - 1;
3753 }
3754
3755
3756
3757
3758
3759
3760
3761 if (ADDIP_SERIAL_gte(rcvd_serial, sent_serial + 1) &&
3762 !(asoc->addip_last_asconf)) {
3763 abort = sctp_make_abort(asoc, asconf_ack,
3764 sizeof(sctp_errhdr_t));
3765 if (abort) {
3766 sctp_init_cause(abort, SCTP_ERROR_ASCONF_ACK, 0);
3767 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
3768 SCTP_CHUNK(abort));
3769 }
3770
3771
3772
3773 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3774 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
3775 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
3776 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
3777 SCTP_ERROR(ECONNABORTED));
3778 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
3779 SCTP_PERR(SCTP_ERROR_ASCONF_ACK));
3780 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
3781 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
3782 return SCTP_DISPOSITION_ABORT;
3783 }
3784
3785 if ((rcvd_serial == sent_serial) && asoc->addip_last_asconf) {
3786 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3787 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
3788
3789 if (!sctp_process_asconf_ack((struct sctp_association *)asoc,
3790 asconf_ack)) {
3791
3792
3793
3794 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_NEXT_ASCONF,
3795 SCTP_NULL());
3796 return SCTP_DISPOSITION_CONSUME;
3797 }
3798
3799 abort = sctp_make_abort(asoc, asconf_ack,
3800 sizeof(sctp_errhdr_t));
3801 if (abort) {
3802 sctp_init_cause(abort, SCTP_ERROR_RSRC_LOW, 0);
3803 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
3804 SCTP_CHUNK(abort));
3805 }
3806
3807
3808
3809 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
3810 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
3811 SCTP_ERROR(ECONNABORTED));
3812 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
3813 SCTP_PERR(SCTP_ERROR_ASCONF_ACK));
3814 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
3815 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
3816 return SCTP_DISPOSITION_ABORT;
3817 }
3818
3819 return SCTP_DISPOSITION_DISCARD;
3820}
3821
3822
3823
3824
3825
3826
3827
3828
3829
3830
3831
3832
3833
3834
3835
3836sctp_disposition_t sctp_sf_eat_fwd_tsn(struct net *net,
3837 const struct sctp_endpoint *ep,
3838 const struct sctp_association *asoc,
3839 const sctp_subtype_t type,
3840 void *arg,
3841 sctp_cmd_seq_t *commands)
3842{
3843 struct sctp_chunk *chunk = arg;
3844 struct sctp_fwdtsn_hdr *fwdtsn_hdr;
3845 struct sctp_fwdtsn_skip *skip;
3846 __u16 len;
3847 __u32 tsn;
3848
3849 if (!sctp_vtag_verify(chunk, asoc)) {
3850 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3851 SCTP_NULL());
3852 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3853 }
3854
3855
3856 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_fwdtsn_chunk)))
3857 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3858 commands);
3859
3860 fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data;
3861 chunk->subh.fwdtsn_hdr = fwdtsn_hdr;
3862 len = ntohs(chunk->chunk_hdr->length);
3863 len -= sizeof(struct sctp_chunkhdr);
3864 skb_pull(chunk->skb, len);
3865
3866 tsn = ntohl(fwdtsn_hdr->new_cum_tsn);
3867 pr_debug("%s: TSN 0x%x\n", __func__, tsn);
3868
3869
3870
3871
3872 if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
3873 goto discard_noforce;
3874
3875
3876 sctp_walk_fwdtsn(skip, chunk) {
3877 if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
3878 goto discard_noforce;
3879 }
3880
3881 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
3882 if (len > sizeof(struct sctp_fwdtsn_hdr))
3883 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
3884 SCTP_CHUNK(chunk));
3885
3886
3887 if (asoc->autoclose) {
3888 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
3889 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
3890 }
3891
3892
3893
3894
3895 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_NOFORCE());
3896
3897 return SCTP_DISPOSITION_CONSUME;
3898
3899discard_noforce:
3900 return SCTP_DISPOSITION_DISCARD;
3901}
3902
3903sctp_disposition_t sctp_sf_eat_fwd_tsn_fast(
3904 struct net *net,
3905 const struct sctp_endpoint *ep,
3906 const struct sctp_association *asoc,
3907 const sctp_subtype_t type,
3908 void *arg,
3909 sctp_cmd_seq_t *commands)
3910{
3911 struct sctp_chunk *chunk = arg;
3912 struct sctp_fwdtsn_hdr *fwdtsn_hdr;
3913 struct sctp_fwdtsn_skip *skip;
3914 __u16 len;
3915 __u32 tsn;
3916
3917 if (!sctp_vtag_verify(chunk, asoc)) {
3918 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3919 SCTP_NULL());
3920 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3921 }
3922
3923
3924 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_fwdtsn_chunk)))
3925 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3926 commands);
3927
3928 fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data;
3929 chunk->subh.fwdtsn_hdr = fwdtsn_hdr;
3930 len = ntohs(chunk->chunk_hdr->length);
3931 len -= sizeof(struct sctp_chunkhdr);
3932 skb_pull(chunk->skb, len);
3933
3934 tsn = ntohl(fwdtsn_hdr->new_cum_tsn);
3935 pr_debug("%s: TSN 0x%x\n", __func__, tsn);
3936
3937
3938
3939
3940 if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
3941 goto gen_shutdown;
3942
3943
3944 sctp_walk_fwdtsn(skip, chunk) {
3945 if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
3946 goto gen_shutdown;
3947 }
3948
3949 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
3950 if (len > sizeof(struct sctp_fwdtsn_hdr))
3951 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
3952 SCTP_CHUNK(chunk));
3953
3954
3955gen_shutdown:
3956
3957
3958
3959
3960
3961
3962 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SHUTDOWN, SCTP_NULL());
3963 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
3964 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
3965 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
3966
3967 return SCTP_DISPOSITION_CONSUME;
3968}
3969
3970
3971
3972
3973
3974
3975
3976
3977
3978
3979
3980
3981
3982
3983
3984
3985
3986
3987
3988
3989
3990
3991
3992static sctp_ierror_t sctp_sf_authenticate(struct net *net,
3993 const struct sctp_endpoint *ep,
3994 const struct sctp_association *asoc,
3995 const sctp_subtype_t type,
3996 struct sctp_chunk *chunk)
3997{
3998 struct sctp_authhdr *auth_hdr;
3999 struct sctp_hmac *hmac;
4000 unsigned int sig_len;
4001 __u16 key_id;
4002 __u8 *save_digest;
4003 __u8 *digest;
4004
4005
4006 auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
4007 chunk->subh.auth_hdr = auth_hdr;
4008 skb_pull(chunk->skb, sizeof(struct sctp_authhdr));
4009
4010
4011
4012
4013 if (!sctp_auth_asoc_verify_hmac_id(asoc, auth_hdr->hmac_id))
4014 return SCTP_IERROR_AUTH_BAD_HMAC;
4015
4016
4017
4018
4019 key_id = ntohs(auth_hdr->shkey_id);
4020 if (key_id != asoc->active_key_id && !sctp_auth_get_shkey(asoc, key_id))
4021 return SCTP_IERROR_AUTH_BAD_KEYID;
4022
4023
4024
4025
4026
4027 sig_len = ntohs(chunk->chunk_hdr->length) - sizeof(sctp_auth_chunk_t);
4028 hmac = sctp_auth_get_hmac(ntohs(auth_hdr->hmac_id));
4029 if (sig_len != hmac->hmac_len)
4030 return SCTP_IERROR_PROTO_VIOLATION;
4031
4032
4033
4034
4035
4036
4037
4038
4039 digest = auth_hdr->hmac;
4040 skb_pull(chunk->skb, sig_len);
4041
4042 save_digest = kmemdup(digest, sig_len, GFP_ATOMIC);
4043 if (!save_digest)
4044 goto nomem;
4045
4046 memset(digest, 0, sig_len);
4047
4048 sctp_auth_calculate_hmac(asoc, chunk->skb,
4049 (struct sctp_auth_chunk *)chunk->chunk_hdr,
4050 GFP_ATOMIC);
4051
4052
4053 if (memcmp(save_digest, digest, sig_len)) {
4054 kfree(save_digest);
4055 return SCTP_IERROR_BAD_SIG;
4056 }
4057
4058 kfree(save_digest);
4059 chunk->auth = 1;
4060
4061 return SCTP_IERROR_NO_ERROR;
4062nomem:
4063 return SCTP_IERROR_NOMEM;
4064}
4065
4066sctp_disposition_t sctp_sf_eat_auth(struct net *net,
4067 const struct sctp_endpoint *ep,
4068 const struct sctp_association *asoc,
4069 const sctp_subtype_t type,
4070 void *arg,
4071 sctp_cmd_seq_t *commands)
4072{
4073 struct sctp_authhdr *auth_hdr;
4074 struct sctp_chunk *chunk = arg;
4075 struct sctp_chunk *err_chunk;
4076 sctp_ierror_t error;
4077
4078
4079 if (!asoc->peer.auth_capable)
4080 return sctp_sf_unk_chunk(net, ep, asoc, type, arg, commands);
4081
4082 if (!sctp_vtag_verify(chunk, asoc)) {
4083 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
4084 SCTP_NULL());
4085 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4086 }
4087
4088
4089 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_auth_chunk)))
4090 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4091 commands);
4092
4093 auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
4094 error = sctp_sf_authenticate(net, ep, asoc, type, chunk);
4095 switch (error) {
4096 case SCTP_IERROR_AUTH_BAD_HMAC:
4097
4098
4099
4100 err_chunk = sctp_make_op_error(asoc, chunk,
4101 SCTP_ERROR_UNSUP_HMAC,
4102 &auth_hdr->hmac_id,
4103 sizeof(__u16), 0);
4104 if (err_chunk) {
4105 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
4106 SCTP_CHUNK(err_chunk));
4107 }
4108
4109 case SCTP_IERROR_AUTH_BAD_KEYID:
4110 case SCTP_IERROR_BAD_SIG:
4111 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4112
4113 case SCTP_IERROR_PROTO_VIOLATION:
4114 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4115 commands);
4116
4117 case SCTP_IERROR_NOMEM:
4118 return SCTP_DISPOSITION_NOMEM;
4119
4120 default:
4121 break;
4122 }
4123
4124 if (asoc->active_key_id != ntohs(auth_hdr->shkey_id)) {
4125 struct sctp_ulpevent *ev;
4126
4127 ev = sctp_ulpevent_make_authkey(asoc, ntohs(auth_hdr->shkey_id),
4128 SCTP_AUTH_NEWKEY, GFP_ATOMIC);
4129
4130 if (!ev)
4131 return -ENOMEM;
4132
4133 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
4134 SCTP_ULPEVENT(ev));
4135 }
4136
4137 return SCTP_DISPOSITION_CONSUME;
4138}
4139
4140
4141
4142
4143
4144
4145
4146
4147
4148
4149
4150
4151
4152
4153
4154
4155
4156
4157
4158
4159
4160
4161
4162
4163sctp_disposition_t sctp_sf_unk_chunk(struct net *net,
4164 const struct sctp_endpoint *ep,
4165 const struct sctp_association *asoc,
4166 const sctp_subtype_t type,
4167 void *arg,
4168 sctp_cmd_seq_t *commands)
4169{
4170 struct sctp_chunk *unk_chunk = arg;
4171 struct sctp_chunk *err_chunk;
4172 sctp_chunkhdr_t *hdr;
4173
4174 pr_debug("%s: processing unknown chunk id:%d\n", __func__, type.chunk);
4175
4176 if (!sctp_vtag_verify(unk_chunk, asoc))
4177 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4178
4179
4180
4181
4182
4183 if (!sctp_chunk_length_valid(unk_chunk, sizeof(sctp_chunkhdr_t)))
4184 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4185 commands);
4186
4187 switch (type.chunk & SCTP_CID_ACTION_MASK) {
4188 case SCTP_CID_ACTION_DISCARD:
4189
4190 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4191 break;
4192 case SCTP_CID_ACTION_DISCARD_ERR:
4193
4194 hdr = unk_chunk->chunk_hdr;
4195 err_chunk = sctp_make_op_error(asoc, unk_chunk,
4196 SCTP_ERROR_UNKNOWN_CHUNK, hdr,
4197 WORD_ROUND(ntohs(hdr->length)),
4198 0);
4199 if (err_chunk) {
4200 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
4201 SCTP_CHUNK(err_chunk));
4202 }
4203
4204
4205 sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4206 return SCTP_DISPOSITION_CONSUME;
4207 break;
4208 case SCTP_CID_ACTION_SKIP:
4209
4210 return SCTP_DISPOSITION_DISCARD;
4211 break;
4212 case SCTP_CID_ACTION_SKIP_ERR:
4213
4214 hdr = unk_chunk->chunk_hdr;
4215 err_chunk = sctp_make_op_error(asoc, unk_chunk,
4216 SCTP_ERROR_UNKNOWN_CHUNK, hdr,
4217 WORD_ROUND(ntohs(hdr->length)),
4218 0);
4219 if (err_chunk) {
4220 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
4221 SCTP_CHUNK(err_chunk));
4222 }
4223
4224 return SCTP_DISPOSITION_CONSUME;
4225 break;
4226 default:
4227 break;
4228 }
4229
4230 return SCTP_DISPOSITION_DISCARD;
4231}
4232
4233
4234
4235
4236
4237
4238
4239
4240
4241
4242
4243
4244
4245
4246
4247sctp_disposition_t sctp_sf_discard_chunk(struct net *net,
4248 const struct sctp_endpoint *ep,
4249 const struct sctp_association *asoc,
4250 const sctp_subtype_t type,
4251 void *arg,
4252 sctp_cmd_seq_t *commands)
4253{
4254 struct sctp_chunk *chunk = arg;
4255
4256
4257
4258
4259
4260 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
4261 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4262 commands);
4263
4264 pr_debug("%s: chunk:%d is discarded\n", __func__, type.chunk);
4265
4266 return SCTP_DISPOSITION_DISCARD;
4267}
4268
4269
4270
4271
4272
4273
4274
4275
4276
4277
4278
4279
4280
4281
4282
4283
4284
4285
4286
4287sctp_disposition_t sctp_sf_pdiscard(struct net *net,
4288 const struct sctp_endpoint *ep,
4289 const struct sctp_association *asoc,
4290 const sctp_subtype_t type,
4291 void *arg,
4292 sctp_cmd_seq_t *commands)
4293{
4294 SCTP_INC_STATS(net, SCTP_MIB_IN_PKT_DISCARDS);
4295 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
4296
4297 return SCTP_DISPOSITION_CONSUME;
4298}
4299
4300
4301
4302
4303
4304
4305
4306
4307
4308
4309
4310
4311
4312
4313
4314
4315sctp_disposition_t sctp_sf_violation(struct net *net,
4316 const struct sctp_endpoint *ep,
4317 const struct sctp_association *asoc,
4318 const sctp_subtype_t type,
4319 void *arg,
4320 sctp_cmd_seq_t *commands)
4321{
4322 struct sctp_chunk *chunk = arg;
4323
4324
4325 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
4326 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4327 commands);
4328
4329 return SCTP_DISPOSITION_VIOLATION;
4330}
4331
4332
4333
4334
4335static sctp_disposition_t sctp_sf_abort_violation(
4336 struct net *net,
4337 const struct sctp_endpoint *ep,
4338 const struct sctp_association *asoc,
4339 void *arg,
4340 sctp_cmd_seq_t *commands,
4341 const __u8 *payload,
4342 const size_t paylen)
4343{
4344 struct sctp_packet *packet = NULL;
4345 struct sctp_chunk *chunk = arg;
4346 struct sctp_chunk *abort = NULL;
4347
4348
4349
4350
4351
4352
4353
4354
4355
4356
4357
4358
4359 if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
4360 goto discard;
4361
4362
4363 abort = sctp_make_abort_violation(asoc, chunk, payload, paylen);
4364 if (!abort)
4365 goto nomem;
4366
4367 if (asoc) {
4368
4369 if (chunk->chunk_hdr->type == SCTP_CID_INIT_ACK &&
4370 !asoc->peer.i.init_tag) {
4371 sctp_initack_chunk_t *initack;
4372
4373 initack = (sctp_initack_chunk_t *)chunk->chunk_hdr;
4374 if (!sctp_chunk_length_valid(chunk,
4375 sizeof(sctp_initack_chunk_t)))
4376 abort->chunk_hdr->flags |= SCTP_CHUNK_FLAG_T;
4377 else {
4378 unsigned int inittag;
4379
4380 inittag = ntohl(initack->init_hdr.init_tag);
4381 sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_INITTAG,
4382 SCTP_U32(inittag));
4383 }
4384 }
4385
4386 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
4387 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
4388
4389 if (asoc->state <= SCTP_STATE_COOKIE_ECHOED) {
4390 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4391 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
4392 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4393 SCTP_ERROR(ECONNREFUSED));
4394 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
4395 SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
4396 } else {
4397 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4398 SCTP_ERROR(ECONNABORTED));
4399 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
4400 SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
4401 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
4402 }
4403 } else {
4404 packet = sctp_ootb_pkt_new(net, asoc, chunk);
4405
4406 if (!packet)
4407 goto nomem_pkt;
4408
4409 if (sctp_test_T_bit(abort))
4410 packet->vtag = ntohl(chunk->sctp_hdr->vtag);
4411
4412 abort->skb->sk = ep->base.sk;
4413
4414 sctp_packet_append_chunk(packet, abort);
4415
4416 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
4417 SCTP_PACKET(packet));
4418
4419 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
4420 }
4421
4422 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
4423
4424discard:
4425 sctp_sf_pdiscard(net, ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
4426 return SCTP_DISPOSITION_ABORT;
4427
4428nomem_pkt:
4429 sctp_chunk_free(abort);
4430nomem:
4431 return SCTP_DISPOSITION_NOMEM;
4432}
4433
4434
4435
4436
4437
4438
4439
4440
4441
4442
4443
4444
4445
4446
4447
4448
4449
4450
4451
4452
4453static sctp_disposition_t sctp_sf_violation_chunklen(
4454 struct net *net,
4455 const struct sctp_endpoint *ep,
4456 const struct sctp_association *asoc,
4457 const sctp_subtype_t type,
4458 void *arg,
4459 sctp_cmd_seq_t *commands)
4460{
4461 static const char err_str[]="The following chunk had invalid length:";
4462
4463 return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str,
4464 sizeof(err_str));
4465}
4466
4467
4468
4469
4470
4471
4472
4473static sctp_disposition_t sctp_sf_violation_paramlen(
4474 struct net *net,
4475 const struct sctp_endpoint *ep,
4476 const struct sctp_association *asoc,
4477 const sctp_subtype_t type,
4478 void *arg, void *ext,
4479 sctp_cmd_seq_t *commands)
4480{
4481 struct sctp_chunk *chunk = arg;
4482 struct sctp_paramhdr *param = ext;
4483 struct sctp_chunk *abort = NULL;
4484
4485 if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
4486 goto discard;
4487
4488
4489 abort = sctp_make_violation_paramlen(asoc, chunk, param);
4490 if (!abort)
4491 goto nomem;
4492
4493 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
4494 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
4495
4496 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4497 SCTP_ERROR(ECONNABORTED));
4498 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
4499 SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
4500 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
4501 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
4502
4503discard:
4504 sctp_sf_pdiscard(net, ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
4505 return SCTP_DISPOSITION_ABORT;
4506nomem:
4507 return SCTP_DISPOSITION_NOMEM;
4508}
4509
4510
4511
4512
4513
4514
4515
4516static sctp_disposition_t sctp_sf_violation_ctsn(
4517 struct net *net,
4518 const struct sctp_endpoint *ep,
4519 const struct sctp_association *asoc,
4520 const sctp_subtype_t type,
4521 void *arg,
4522 sctp_cmd_seq_t *commands)
4523{
4524 static const char err_str[]="The cumulative tsn ack beyond the max tsn currently sent:";
4525
4526 return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str,
4527 sizeof(err_str));
4528}
4529
4530
4531
4532
4533
4534
4535
4536static sctp_disposition_t sctp_sf_violation_chunk(
4537 struct net *net,
4538 const struct sctp_endpoint *ep,
4539 const struct sctp_association *asoc,
4540 const sctp_subtype_t type,
4541 void *arg,
4542 sctp_cmd_seq_t *commands)
4543{
4544 static const char err_str[]="The following chunk violates protocol:";
4545
4546 if (!asoc)
4547 return sctp_sf_violation(net, ep, asoc, type, arg, commands);
4548
4549 return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str,
4550 sizeof(err_str));
4551}
4552
4553
4554
4555
4556
4557
4558
4559
4560
4561
4562
4563
4564
4565
4566
4567
4568
4569
4570
4571
4572
4573
4574
4575
4576
4577
4578
4579
4580
4581
4582
4583
4584
4585
4586
4587
4588
4589
4590
4591
4592
4593
4594
4595
4596
4597
4598
4599
4600
4601
4602
4603
4604
4605
4606
4607
4608
4609
4610
4611
4612sctp_disposition_t sctp_sf_do_prm_asoc(struct net *net,
4613 const struct sctp_endpoint *ep,
4614 const struct sctp_association *asoc,
4615 const sctp_subtype_t type,
4616 void *arg,
4617 sctp_cmd_seq_t *commands)
4618{
4619 struct sctp_chunk *repl;
4620 struct sctp_association* my_asoc;
4621
4622
4623
4624
4625
4626 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
4627 SCTP_STATE(SCTP_STATE_COOKIE_WAIT));
4628
4629
4630
4631
4632
4633
4634
4635
4636
4637 repl = sctp_make_init(asoc, &asoc->base.bind_addr, GFP_ATOMIC, 0);
4638 if (!repl)
4639 goto nomem;
4640
4641
4642 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
4643 SCTP_CHUNK(repl));
4644
4645
4646
4647
4648 my_asoc = (struct sctp_association *)asoc;
4649 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(my_asoc));
4650
4651
4652
4653
4654 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
4655 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
4656 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
4657 return SCTP_DISPOSITION_CONSUME;
4658
4659nomem:
4660 return SCTP_DISPOSITION_NOMEM;
4661}
4662
4663
4664
4665
4666
4667
4668
4669
4670
4671
4672
4673
4674
4675
4676
4677
4678
4679
4680
4681
4682
4683
4684
4685
4686
4687
4688
4689
4690
4691
4692
4693
4694
4695
4696
4697
4698
4699
4700
4701
4702
4703
4704
4705
4706
4707
4708
4709
4710
4711
4712
4713
4714
4715
4716
4717
4718
4719
4720
4721
4722
4723
4724sctp_disposition_t sctp_sf_do_prm_send(struct net *net,
4725 const struct sctp_endpoint *ep,
4726 const struct sctp_association *asoc,
4727 const sctp_subtype_t type,
4728 void *arg,
4729 sctp_cmd_seq_t *commands)
4730{
4731 struct sctp_datamsg *msg = arg;
4732
4733 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_MSG, SCTP_DATAMSG(msg));
4734 return SCTP_DISPOSITION_CONSUME;
4735}
4736
4737
4738
4739
4740
4741
4742
4743
4744
4745
4746
4747
4748
4749
4750
4751
4752
4753
4754
4755
4756
4757
4758
4759
4760
4761
4762
4763sctp_disposition_t sctp_sf_do_9_2_prm_shutdown(
4764 struct net *net,
4765 const struct sctp_endpoint *ep,
4766 const struct sctp_association *asoc,
4767 const sctp_subtype_t type,
4768 void *arg,
4769 sctp_cmd_seq_t *commands)
4770{
4771 int disposition;
4772
4773
4774
4775
4776
4777
4778
4779
4780
4781 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
4782 SCTP_STATE(SCTP_STATE_SHUTDOWN_PENDING));
4783
4784 disposition = SCTP_DISPOSITION_CONSUME;
4785 if (sctp_outq_is_empty(&asoc->outqueue)) {
4786 disposition = sctp_sf_do_9_2_start_shutdown(net, ep, asoc, type,
4787 arg, commands);
4788 }
4789 return disposition;
4790}
4791
4792
4793
4794
4795
4796
4797
4798
4799
4800
4801
4802
4803
4804
4805
4806
4807
4808
4809
4810
4811
4812
4813
4814
4815
4816
4817
4818
4819sctp_disposition_t sctp_sf_do_9_1_prm_abort(
4820 struct net *net,
4821 const struct sctp_endpoint *ep,
4822 const struct sctp_association *asoc,
4823 const sctp_subtype_t type,
4824 void *arg,
4825 sctp_cmd_seq_t *commands)
4826{
4827
4828
4829
4830
4831
4832
4833
4834
4835 struct sctp_chunk *abort = arg;
4836 sctp_disposition_t retval;
4837
4838 retval = SCTP_DISPOSITION_CONSUME;
4839
4840 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
4841
4842
4843
4844
4845
4846 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4847 SCTP_ERROR(ECONNABORTED));
4848
4849 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
4850 SCTP_PERR(SCTP_ERROR_USER_ABORT));
4851
4852 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
4853 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
4854
4855 return retval;
4856}
4857
4858
4859sctp_disposition_t sctp_sf_error_closed(struct net *net,
4860 const struct sctp_endpoint *ep,
4861 const struct sctp_association *asoc,
4862 const sctp_subtype_t type,
4863 void *arg,
4864 sctp_cmd_seq_t *commands)
4865{
4866 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_ERROR, SCTP_ERROR(-EINVAL));
4867 return SCTP_DISPOSITION_CONSUME;
4868}
4869
4870
4871
4872
4873sctp_disposition_t sctp_sf_error_shutdown(struct net *net,
4874 const struct sctp_endpoint *ep,
4875 const struct sctp_association *asoc,
4876 const sctp_subtype_t type,
4877 void *arg,
4878 sctp_cmd_seq_t *commands)
4879{
4880 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_ERROR,
4881 SCTP_ERROR(-ESHUTDOWN));
4882 return SCTP_DISPOSITION_CONSUME;
4883}
4884
4885
4886
4887
4888
4889
4890
4891
4892
4893
4894
4895
4896
4897
4898
4899sctp_disposition_t sctp_sf_cookie_wait_prm_shutdown(
4900 struct net *net,
4901 const struct sctp_endpoint *ep,
4902 const struct sctp_association *asoc,
4903 const sctp_subtype_t type,
4904 void *arg,
4905 sctp_cmd_seq_t *commands)
4906{
4907 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4908 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
4909
4910 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
4911 SCTP_STATE(SCTP_STATE_CLOSED));
4912
4913 SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS);
4914
4915 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
4916
4917 return SCTP_DISPOSITION_DELETE_TCB;
4918}
4919
4920
4921
4922
4923
4924
4925
4926
4927
4928
4929
4930
4931
4932
4933
4934sctp_disposition_t sctp_sf_cookie_echoed_prm_shutdown(
4935 struct net *net,
4936 const struct sctp_endpoint *ep,
4937 const struct sctp_association *asoc,
4938 const sctp_subtype_t type,
4939 void *arg, sctp_cmd_seq_t *commands)
4940{
4941
4942
4943
4944 return sctp_sf_cookie_wait_prm_shutdown(net, ep, asoc, type, arg, commands);
4945}
4946
4947
4948
4949
4950
4951
4952
4953
4954
4955
4956
4957
4958
4959
4960
4961sctp_disposition_t sctp_sf_cookie_wait_prm_abort(
4962 struct net *net,
4963 const struct sctp_endpoint *ep,
4964 const struct sctp_association *asoc,
4965 const sctp_subtype_t type,
4966 void *arg,
4967 sctp_cmd_seq_t *commands)
4968{
4969 struct sctp_chunk *abort = arg;
4970 sctp_disposition_t retval;
4971
4972
4973 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4974 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
4975 retval = SCTP_DISPOSITION_CONSUME;
4976
4977 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
4978
4979 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
4980 SCTP_STATE(SCTP_STATE_CLOSED));
4981
4982 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
4983
4984
4985
4986
4987
4988 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4989 SCTP_ERROR(ECONNREFUSED));
4990
4991 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
4992 SCTP_PERR(SCTP_ERROR_USER_ABORT));
4993
4994 return retval;
4995}
4996
4997
4998
4999
5000
5001
5002
5003
5004
5005
5006
5007
5008
5009
5010
5011sctp_disposition_t sctp_sf_cookie_echoed_prm_abort(
5012 struct net *net,
5013 const struct sctp_endpoint *ep,
5014 const struct sctp_association *asoc,
5015 const sctp_subtype_t type,
5016 void *arg,
5017 sctp_cmd_seq_t *commands)
5018{
5019
5020
5021
5022 return sctp_sf_cookie_wait_prm_abort(net, ep, asoc, type, arg, commands);
5023}
5024
5025
5026
5027
5028
5029
5030
5031
5032
5033
5034
5035
5036
5037sctp_disposition_t sctp_sf_shutdown_pending_prm_abort(
5038 struct net *net,
5039 const struct sctp_endpoint *ep,
5040 const struct sctp_association *asoc,
5041 const sctp_subtype_t type,
5042 void *arg,
5043 sctp_cmd_seq_t *commands)
5044{
5045
5046 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5047 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5048
5049 return sctp_sf_do_9_1_prm_abort(net, ep, asoc, type, arg, commands);
5050}
5051
5052
5053
5054
5055
5056
5057
5058
5059
5060
5061
5062
5063
5064sctp_disposition_t sctp_sf_shutdown_sent_prm_abort(
5065 struct net *net,
5066 const struct sctp_endpoint *ep,
5067 const struct sctp_association *asoc,
5068 const sctp_subtype_t type,
5069 void *arg,
5070 sctp_cmd_seq_t *commands)
5071{
5072
5073 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5074 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5075
5076
5077 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5078 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5079
5080 return sctp_sf_do_9_1_prm_abort(net, ep, asoc, type, arg, commands);
5081}
5082
5083
5084
5085
5086
5087
5088
5089
5090
5091
5092
5093
5094
5095sctp_disposition_t sctp_sf_shutdown_ack_sent_prm_abort(
5096 struct net *net,
5097 const struct sctp_endpoint *ep,
5098 const struct sctp_association *asoc,
5099 const sctp_subtype_t type,
5100 void *arg,
5101 sctp_cmd_seq_t *commands)
5102{
5103
5104
5105
5106 return sctp_sf_shutdown_sent_prm_abort(net, ep, asoc, type, arg, commands);
5107}
5108
5109
5110
5111
5112
5113
5114
5115
5116
5117
5118
5119
5120
5121
5122
5123
5124
5125
5126
5127
5128
5129
5130
5131sctp_disposition_t sctp_sf_do_prm_requestheartbeat(
5132 struct net *net,
5133 const struct sctp_endpoint *ep,
5134 const struct sctp_association *asoc,
5135 const sctp_subtype_t type,
5136 void *arg,
5137 sctp_cmd_seq_t *commands)
5138{
5139 if (SCTP_DISPOSITION_NOMEM == sctp_sf_heartbeat(ep, asoc, type,
5140 (struct sctp_transport *)arg, commands))
5141 return SCTP_DISPOSITION_NOMEM;
5142
5143
5144
5145
5146
5147
5148
5149
5150
5151
5152
5153
5154 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_HB_SENT,
5155 SCTP_TRANSPORT(arg));
5156 return SCTP_DISPOSITION_CONSUME;
5157}
5158
5159
5160
5161
5162
5163
5164sctp_disposition_t sctp_sf_do_prm_asconf(struct net *net,
5165 const struct sctp_endpoint *ep,
5166 const struct sctp_association *asoc,
5167 const sctp_subtype_t type,
5168 void *arg,
5169 sctp_cmd_seq_t *commands)
5170{
5171 struct sctp_chunk *chunk = arg;
5172
5173 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T4, SCTP_CHUNK(chunk));
5174 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
5175 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
5176 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(chunk));
5177 return SCTP_DISPOSITION_CONSUME;
5178}
5179
5180
5181
5182
5183
5184
5185sctp_disposition_t sctp_sf_ignore_primitive(
5186 struct net *net,
5187 const struct sctp_endpoint *ep,
5188 const struct sctp_association *asoc,
5189 const sctp_subtype_t type,
5190 void *arg,
5191 sctp_cmd_seq_t *commands)
5192{
5193 pr_debug("%s: primitive type:%d is ignored\n", __func__,
5194 type.primitive);
5195
5196 return SCTP_DISPOSITION_DISCARD;
5197}
5198
5199
5200
5201
5202
5203
5204
5205
5206
5207
5208
5209sctp_disposition_t sctp_sf_do_no_pending_tsn(
5210 struct net *net,
5211 const struct sctp_endpoint *ep,
5212 const struct sctp_association *asoc,
5213 const sctp_subtype_t type,
5214 void *arg,
5215 sctp_cmd_seq_t *commands)
5216{
5217 struct sctp_ulpevent *event;
5218
5219 event = sctp_ulpevent_make_sender_dry_event(asoc, GFP_ATOMIC);
5220 if (!event)
5221 return SCTP_DISPOSITION_NOMEM;
5222
5223 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(event));
5224
5225 return SCTP_DISPOSITION_CONSUME;
5226}
5227
5228
5229
5230
5231
5232
5233
5234
5235
5236
5237
5238
5239
5240
5241sctp_disposition_t sctp_sf_do_9_2_start_shutdown(
5242 struct net *net,
5243 const struct sctp_endpoint *ep,
5244 const struct sctp_association *asoc,
5245 const sctp_subtype_t type,
5246 void *arg,
5247 sctp_cmd_seq_t *commands)
5248{
5249 struct sctp_chunk *reply;
5250
5251
5252
5253
5254
5255
5256 reply = sctp_make_shutdown(asoc, NULL);
5257 if (!reply)
5258 goto nomem;
5259
5260
5261
5262
5263 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
5264
5265
5266 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
5267 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5268
5269
5270
5271
5272
5273 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
5274 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5275
5276 if (asoc->autoclose)
5277 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5278 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
5279
5280
5281 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
5282 SCTP_STATE(SCTP_STATE_SHUTDOWN_SENT));
5283
5284
5285
5286
5287
5288
5289 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
5290
5291 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
5292
5293 return SCTP_DISPOSITION_CONSUME;
5294
5295nomem:
5296 return SCTP_DISPOSITION_NOMEM;
5297}
5298
5299
5300
5301
5302
5303
5304
5305
5306
5307
5308
5309
5310
5311sctp_disposition_t sctp_sf_do_9_2_shutdown_ack(
5312 struct net *net,
5313 const struct sctp_endpoint *ep,
5314 const struct sctp_association *asoc,
5315 const sctp_subtype_t type,
5316 void *arg,
5317 sctp_cmd_seq_t *commands)
5318{
5319 struct sctp_chunk *chunk = (struct sctp_chunk *) arg;
5320 struct sctp_chunk *reply;
5321
5322
5323
5324
5325
5326
5327
5328
5329 if (chunk) {
5330 if (!sctp_vtag_verify(chunk, asoc))
5331 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
5332
5333
5334 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_shutdown_chunk_t)))
5335 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
5336 commands);
5337 }
5338
5339
5340
5341
5342 reply = sctp_make_shutdown_ack(asoc, chunk);
5343 if (!reply)
5344 goto nomem;
5345
5346
5347
5348
5349 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
5350
5351
5352 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
5353 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5354
5355 if (asoc->autoclose)
5356 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5357 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
5358
5359
5360 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
5361 SCTP_STATE(SCTP_STATE_SHUTDOWN_ACK_SENT));
5362
5363
5364
5365
5366
5367
5368 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
5369
5370 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
5371
5372 return SCTP_DISPOSITION_CONSUME;
5373
5374nomem:
5375 return SCTP_DISPOSITION_NOMEM;
5376}
5377
5378
5379
5380
5381
5382
5383sctp_disposition_t sctp_sf_ignore_other(struct net *net,
5384 const struct sctp_endpoint *ep,
5385 const struct sctp_association *asoc,
5386 const sctp_subtype_t type,
5387 void *arg,
5388 sctp_cmd_seq_t *commands)
5389{
5390 pr_debug("%s: the event other type:%d is ignored\n",
5391 __func__, type.other);
5392
5393 return SCTP_DISPOSITION_DISCARD;
5394}
5395
5396
5397
5398
5399
5400
5401
5402
5403
5404
5405
5406
5407
5408
5409
5410
5411sctp_disposition_t sctp_sf_do_6_3_3_rtx(struct net *net,
5412 const struct sctp_endpoint *ep,
5413 const struct sctp_association *asoc,
5414 const sctp_subtype_t type,
5415 void *arg,
5416 sctp_cmd_seq_t *commands)
5417{
5418 struct sctp_transport *transport = arg;
5419
5420 SCTP_INC_STATS(net, SCTP_MIB_T3_RTX_EXPIREDS);
5421
5422 if (asoc->overall_error_count >= asoc->max_retrans) {
5423 if (asoc->state == SCTP_STATE_SHUTDOWN_PENDING) {
5424
5425
5426
5427
5428
5429
5430
5431
5432
5433 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START_ONCE,
5434 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5435 } else {
5436 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5437 SCTP_ERROR(ETIMEDOUT));
5438
5439 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5440 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5441 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
5442 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
5443 return SCTP_DISPOSITION_DELETE_TCB;
5444 }
5445 }
5446
5447
5448
5449
5450
5451
5452
5453
5454
5455
5456
5457
5458
5459
5460
5461
5462
5463
5464
5465
5466
5467
5468
5469
5470
5471
5472
5473
5474
5475 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE, SCTP_TRANSPORT(transport));
5476
5477
5478 sctp_add_cmd_sf(commands, SCTP_CMD_RETRAN, SCTP_TRANSPORT(transport));
5479
5480 return SCTP_DISPOSITION_CONSUME;
5481}
5482
5483
5484
5485
5486
5487
5488
5489
5490
5491
5492
5493
5494
5495
5496
5497
5498sctp_disposition_t sctp_sf_do_6_2_sack(struct net *net,
5499 const struct sctp_endpoint *ep,
5500 const struct sctp_association *asoc,
5501 const sctp_subtype_t type,
5502 void *arg,
5503 sctp_cmd_seq_t *commands)
5504{
5505 SCTP_INC_STATS(net, SCTP_MIB_DELAY_SACK_EXPIREDS);
5506 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
5507 return SCTP_DISPOSITION_CONSUME;
5508}
5509
5510
5511
5512
5513
5514
5515
5516
5517
5518
5519
5520
5521
5522
5523
5524
5525
5526
5527
5528
5529sctp_disposition_t sctp_sf_t1_init_timer_expire(struct net *net,
5530 const struct sctp_endpoint *ep,
5531 const struct sctp_association *asoc,
5532 const sctp_subtype_t type,
5533 void *arg,
5534 sctp_cmd_seq_t *commands)
5535{
5536 struct sctp_chunk *repl = NULL;
5537 struct sctp_bind_addr *bp;
5538 int attempts = asoc->init_err_counter + 1;
5539
5540 pr_debug("%s: timer T1 expired (INIT)\n", __func__);
5541
5542 SCTP_INC_STATS(net, SCTP_MIB_T1_INIT_EXPIREDS);
5543
5544 if (attempts <= asoc->max_init_attempts) {
5545 bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
5546 repl = sctp_make_init(asoc, bp, GFP_ATOMIC, 0);
5547 if (!repl)
5548 return SCTP_DISPOSITION_NOMEM;
5549
5550
5551 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
5552 SCTP_CHUNK(repl));
5553
5554
5555 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_RESTART,
5556 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
5557
5558 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
5559 } else {
5560 pr_debug("%s: giving up on INIT, attempts:%d "
5561 "max_init_attempts:%d\n", __func__, attempts,
5562 asoc->max_init_attempts);
5563
5564 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5565 SCTP_ERROR(ETIMEDOUT));
5566 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
5567 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5568 return SCTP_DISPOSITION_DELETE_TCB;
5569 }
5570
5571 return SCTP_DISPOSITION_CONSUME;
5572}
5573
5574
5575
5576
5577
5578
5579
5580
5581
5582
5583
5584
5585
5586
5587
5588
5589
5590
5591
5592
5593sctp_disposition_t sctp_sf_t1_cookie_timer_expire(struct net *net,
5594 const struct sctp_endpoint *ep,
5595 const struct sctp_association *asoc,
5596 const sctp_subtype_t type,
5597 void *arg,
5598 sctp_cmd_seq_t *commands)
5599{
5600 struct sctp_chunk *repl = NULL;
5601 int attempts = asoc->init_err_counter + 1;
5602
5603 pr_debug("%s: timer T1 expired (COOKIE-ECHO)\n", __func__);
5604
5605 SCTP_INC_STATS(net, SCTP_MIB_T1_COOKIE_EXPIREDS);
5606
5607 if (attempts <= asoc->max_init_attempts) {
5608 repl = sctp_make_cookie_echo(asoc, NULL);
5609 if (!repl)
5610 return SCTP_DISPOSITION_NOMEM;
5611
5612 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
5613 SCTP_CHUNK(repl));
5614
5615 sctp_add_cmd_sf(commands, SCTP_CMD_COOKIEECHO_RESTART,
5616 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
5617
5618 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
5619 } else {
5620 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5621 SCTP_ERROR(ETIMEDOUT));
5622 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
5623 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5624 return SCTP_DISPOSITION_DELETE_TCB;
5625 }
5626
5627 return SCTP_DISPOSITION_CONSUME;
5628}
5629
5630
5631
5632
5633
5634
5635
5636
5637
5638
5639
5640
5641
5642
5643sctp_disposition_t sctp_sf_t2_timer_expire(struct net *net,
5644 const struct sctp_endpoint *ep,
5645 const struct sctp_association *asoc,
5646 const sctp_subtype_t type,
5647 void *arg,
5648 sctp_cmd_seq_t *commands)
5649{
5650 struct sctp_chunk *reply = NULL;
5651
5652 pr_debug("%s: timer T2 expired\n", __func__);
5653
5654 SCTP_INC_STATS(net, SCTP_MIB_T2_SHUTDOWN_EXPIREDS);
5655
5656 ((struct sctp_association *)asoc)->shutdown_retries++;
5657
5658 if (asoc->overall_error_count >= asoc->max_retrans) {
5659 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5660 SCTP_ERROR(ETIMEDOUT));
5661
5662 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5663 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5664 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
5665 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
5666 return SCTP_DISPOSITION_DELETE_TCB;
5667 }
5668
5669 switch (asoc->state) {
5670 case SCTP_STATE_SHUTDOWN_SENT:
5671 reply = sctp_make_shutdown(asoc, NULL);
5672 break;
5673
5674 case SCTP_STATE_SHUTDOWN_ACK_SENT:
5675 reply = sctp_make_shutdown_ack(asoc, NULL);
5676 break;
5677
5678 default:
5679 BUG();
5680 break;
5681 }
5682
5683 if (!reply)
5684 goto nomem;
5685
5686
5687
5688
5689
5690 if (asoc->shutdown_last_sent_to)
5691 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE,
5692 SCTP_TRANSPORT(asoc->shutdown_last_sent_to));
5693
5694
5695
5696
5697 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
5698
5699
5700 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
5701 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5702 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
5703 return SCTP_DISPOSITION_CONSUME;
5704
5705nomem:
5706 return SCTP_DISPOSITION_NOMEM;
5707}
5708
5709
5710
5711
5712
5713sctp_disposition_t sctp_sf_t4_timer_expire(
5714 struct net *net,
5715 const struct sctp_endpoint *ep,
5716 const struct sctp_association *asoc,
5717 const sctp_subtype_t type,
5718 void *arg,
5719 sctp_cmd_seq_t *commands)
5720{
5721 struct sctp_chunk *chunk = asoc->addip_last_asconf;
5722 struct sctp_transport *transport = chunk->transport;
5723
5724 SCTP_INC_STATS(net, SCTP_MIB_T4_RTO_EXPIREDS);
5725
5726
5727
5728
5729
5730 if (transport)
5731 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE,
5732 SCTP_TRANSPORT(transport));
5733
5734
5735 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T4, SCTP_CHUNK(chunk));
5736
5737
5738
5739
5740
5741
5742 if (asoc->overall_error_count >= asoc->max_retrans) {
5743 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5744 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
5745 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5746 SCTP_ERROR(ETIMEDOUT));
5747 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5748 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5749 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
5750 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
5751 return SCTP_DISPOSITION_ABORT;
5752 }
5753
5754
5755
5756
5757
5758
5759
5760
5761
5762
5763
5764
5765 sctp_chunk_hold(asoc->addip_last_asconf);
5766 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
5767 SCTP_CHUNK(asoc->addip_last_asconf));
5768
5769
5770
5771
5772
5773 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
5774 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
5775
5776 return SCTP_DISPOSITION_CONSUME;
5777}
5778
5779
5780
5781
5782
5783
5784
5785sctp_disposition_t sctp_sf_t5_timer_expire(struct net *net,
5786 const struct sctp_endpoint *ep,
5787 const struct sctp_association *asoc,
5788 const sctp_subtype_t type,
5789 void *arg,
5790 sctp_cmd_seq_t *commands)
5791{
5792 struct sctp_chunk *reply = NULL;
5793
5794 pr_debug("%s: timer T5 expired\n", __func__);
5795
5796 SCTP_INC_STATS(net, SCTP_MIB_T5_SHUTDOWN_GUARD_EXPIREDS);
5797
5798 reply = sctp_make_abort(asoc, NULL, 0);
5799 if (!reply)
5800 goto nomem;
5801
5802 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
5803 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5804 SCTP_ERROR(ETIMEDOUT));
5805 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5806 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5807
5808 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
5809 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
5810
5811 return SCTP_DISPOSITION_DELETE_TCB;
5812nomem:
5813 return SCTP_DISPOSITION_NOMEM;
5814}
5815
5816
5817
5818
5819
5820
5821sctp_disposition_t sctp_sf_autoclose_timer_expire(
5822 struct net *net,
5823 const struct sctp_endpoint *ep,
5824 const struct sctp_association *asoc,
5825 const sctp_subtype_t type,
5826 void *arg,
5827 sctp_cmd_seq_t *commands)
5828{
5829 int disposition;
5830
5831 SCTP_INC_STATS(net, SCTP_MIB_AUTOCLOSE_EXPIREDS);
5832
5833
5834
5835
5836
5837
5838
5839
5840
5841 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
5842 SCTP_STATE(SCTP_STATE_SHUTDOWN_PENDING));
5843
5844 disposition = SCTP_DISPOSITION_CONSUME;
5845 if (sctp_outq_is_empty(&asoc->outqueue)) {
5846 disposition = sctp_sf_do_9_2_start_shutdown(net, ep, asoc, type,
5847 arg, commands);
5848 }
5849 return disposition;
5850}
5851
5852
5853
5854
5855
5856
5857
5858
5859
5860
5861
5862
5863
5864sctp_disposition_t sctp_sf_not_impl(struct net *net,
5865 const struct sctp_endpoint *ep,
5866 const struct sctp_association *asoc,
5867 const sctp_subtype_t type,
5868 void *arg,
5869 sctp_cmd_seq_t *commands)
5870{
5871 return SCTP_DISPOSITION_NOT_IMPL;
5872}
5873
5874
5875
5876
5877
5878
5879
5880
5881
5882sctp_disposition_t sctp_sf_bug(struct net *net,
5883 const struct sctp_endpoint *ep,
5884 const struct sctp_association *asoc,
5885 const sctp_subtype_t type,
5886 void *arg,
5887 sctp_cmd_seq_t *commands)
5888{
5889 return SCTP_DISPOSITION_BUG;
5890}
5891
5892
5893
5894
5895
5896
5897
5898
5899
5900
5901
5902
5903sctp_disposition_t sctp_sf_timer_ignore(struct net *net,
5904 const struct sctp_endpoint *ep,
5905 const struct sctp_association *asoc,
5906 const sctp_subtype_t type,
5907 void *arg,
5908 sctp_cmd_seq_t *commands)
5909{
5910 pr_debug("%s: timer %d ignored\n", __func__, type.chunk);
5911
5912 return SCTP_DISPOSITION_CONSUME;
5913}
5914
5915
5916
5917
5918
5919
5920static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk)
5921{
5922 struct sctp_sackhdr *sack;
5923 unsigned int len;
5924 __u16 num_blocks;
5925 __u16 num_dup_tsns;
5926
5927
5928
5929
5930 sack = (struct sctp_sackhdr *) chunk->skb->data;
5931
5932 num_blocks = ntohs(sack->num_gap_ack_blocks);
5933 num_dup_tsns = ntohs(sack->num_dup_tsns);
5934 len = sizeof(struct sctp_sackhdr);
5935 len += (num_blocks + num_dup_tsns) * sizeof(__u32);
5936 if (len > chunk->skb->len)
5937 return NULL;
5938
5939 skb_pull(chunk->skb, len);
5940
5941 return sack;
5942}
5943
5944
5945
5946
5947static struct sctp_packet *sctp_abort_pkt_new(struct net *net,
5948 const struct sctp_endpoint *ep,
5949 const struct sctp_association *asoc,
5950 struct sctp_chunk *chunk,
5951 const void *payload,
5952 size_t paylen)
5953{
5954 struct sctp_packet *packet;
5955 struct sctp_chunk *abort;
5956
5957 packet = sctp_ootb_pkt_new(net, asoc, chunk);
5958
5959 if (packet) {
5960
5961
5962
5963 abort = sctp_make_abort(asoc, chunk, paylen);
5964 if (!abort) {
5965 sctp_ootb_pkt_free(packet);
5966 return NULL;
5967 }
5968
5969
5970 if (sctp_test_T_bit(abort))
5971 packet->vtag = ntohl(chunk->sctp_hdr->vtag);
5972
5973
5974
5975
5976 sctp_addto_chunk(abort, paylen, payload);
5977
5978
5979 abort->skb->sk = ep->base.sk;
5980
5981 sctp_packet_append_chunk(packet, abort);
5982
5983 }
5984
5985 return packet;
5986}
5987
5988
5989static struct sctp_packet *sctp_ootb_pkt_new(struct net *net,
5990 const struct sctp_association *asoc,
5991 const struct sctp_chunk *chunk)
5992{
5993 struct sctp_packet *packet;
5994 struct sctp_transport *transport;
5995 __u16 sport;
5996 __u16 dport;
5997 __u32 vtag;
5998
5999
6000 sport = ntohs(chunk->sctp_hdr->dest);
6001 dport = ntohs(chunk->sctp_hdr->source);
6002
6003
6004
6005
6006 if (asoc) {
6007
6008
6009
6010 switch(chunk->chunk_hdr->type) {
6011 case SCTP_CID_INIT_ACK:
6012 {
6013 sctp_initack_chunk_t *initack;
6014
6015 initack = (sctp_initack_chunk_t *)chunk->chunk_hdr;
6016 vtag = ntohl(initack->init_hdr.init_tag);
6017 break;
6018 }
6019 default:
6020 vtag = asoc->peer.i.init_tag;
6021 break;
6022 }
6023 } else {
6024
6025
6026
6027 switch(chunk->chunk_hdr->type) {
6028 case SCTP_CID_INIT:
6029 {
6030 sctp_init_chunk_t *init;
6031
6032 init = (sctp_init_chunk_t *)chunk->chunk_hdr;
6033 vtag = ntohl(init->init_hdr.init_tag);
6034 break;
6035 }
6036 default:
6037 vtag = ntohl(chunk->sctp_hdr->vtag);
6038 break;
6039 }
6040 }
6041
6042
6043 transport = sctp_transport_new(net, sctp_source(chunk), GFP_ATOMIC);
6044 if (!transport)
6045 goto nomem;
6046
6047
6048
6049
6050 sctp_transport_route(transport, (union sctp_addr *)&chunk->dest,
6051 sctp_sk(net->sctp.ctl_sock));
6052
6053 packet = sctp_packet_init(&transport->packet, transport, sport, dport);
6054 packet = sctp_packet_config(packet, vtag, 0);
6055
6056 return packet;
6057
6058nomem:
6059 return NULL;
6060}
6061
6062
6063void sctp_ootb_pkt_free(struct sctp_packet *packet)
6064{
6065 sctp_transport_free(packet->transport);
6066}
6067
6068
6069static void sctp_send_stale_cookie_err(struct net *net,
6070 const struct sctp_endpoint *ep,
6071 const struct sctp_association *asoc,
6072 const struct sctp_chunk *chunk,
6073 sctp_cmd_seq_t *commands,
6074 struct sctp_chunk *err_chunk)
6075{
6076 struct sctp_packet *packet;
6077
6078 if (err_chunk) {
6079 packet = sctp_ootb_pkt_new(net, asoc, chunk);
6080 if (packet) {
6081 struct sctp_signed_cookie *cookie;
6082
6083
6084 cookie = chunk->subh.cookie_hdr;
6085 packet->vtag = cookie->c.peer_vtag;
6086
6087
6088 err_chunk->skb->sk = ep->base.sk;
6089 sctp_packet_append_chunk(packet, err_chunk);
6090 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
6091 SCTP_PACKET(packet));
6092 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
6093 } else
6094 sctp_chunk_free (err_chunk);
6095 }
6096}
6097
6098
6099
6100static int sctp_eat_data(const struct sctp_association *asoc,
6101 struct sctp_chunk *chunk,
6102 sctp_cmd_seq_t *commands)
6103{
6104 sctp_datahdr_t *data_hdr;
6105 struct sctp_chunk *err;
6106 size_t datalen;
6107 sctp_verb_t deliver;
6108 int tmp;
6109 __u32 tsn;
6110 struct sctp_tsnmap *map = (struct sctp_tsnmap *)&asoc->peer.tsn_map;
6111 struct sock *sk = asoc->base.sk;
6112 struct net *net = sock_net(sk);
6113 u16 ssn;
6114 u16 sid;
6115 u8 ordered = 0;
6116
6117 data_hdr = chunk->subh.data_hdr = (sctp_datahdr_t *)chunk->skb->data;
6118 skb_pull(chunk->skb, sizeof(sctp_datahdr_t));
6119
6120 tsn = ntohl(data_hdr->tsn);
6121 pr_debug("%s: TSN 0x%x\n", __func__, tsn);
6122
6123
6124
6125
6126
6127
6128
6129
6130
6131
6132
6133
6134
6135 if (!chunk->ecn_ce_done) {
6136 struct sctp_af *af;
6137 chunk->ecn_ce_done = 1;
6138
6139 af = sctp_get_af_specific(
6140 ipver2af(ip_hdr(chunk->skb)->version));
6141
6142 if (af && af->is_ce(chunk->skb) && asoc->peer.ecn_capable) {
6143
6144 sctp_add_cmd_sf(commands, SCTP_CMD_ECN_CE,
6145 SCTP_U32(tsn));
6146 }
6147 }
6148
6149 tmp = sctp_tsnmap_check(&asoc->peer.tsn_map, tsn);
6150 if (tmp < 0) {
6151
6152
6153
6154 if (chunk->asoc)
6155 chunk->asoc->stats.outofseqtsns++;
6156 return SCTP_IERROR_HIGH_TSN;
6157 } else if (tmp > 0) {
6158
6159 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_DUP, SCTP_U32(tsn));
6160 return SCTP_IERROR_DUP_TSN;
6161 }
6162
6163
6164
6165
6166
6167
6168 datalen = ntohs(chunk->chunk_hdr->length);
6169 datalen -= sizeof(sctp_data_chunk_t);
6170
6171 deliver = SCTP_CMD_CHUNK_ULP;
6172
6173
6174 if ((datalen >= asoc->rwnd) && (!asoc->ulpq.pd_mode)) {
6175
6176
6177
6178
6179 sctp_add_cmd_sf(commands, SCTP_CMD_PART_DELIVER, SCTP_NULL());
6180 }
6181
6182
6183
6184
6185
6186
6187 if ((!chunk->data_accepted) && (!asoc->rwnd || asoc->rwnd_over ||
6188 (datalen > asoc->rwnd + asoc->frag_point))) {
6189
6190
6191
6192
6193
6194
6195
6196 if (sctp_tsnmap_has_gap(map) &&
6197 (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
6198 pr_debug("%s: reneging for tsn:%u\n", __func__, tsn);
6199 deliver = SCTP_CMD_RENEGE;
6200 } else {
6201 pr_debug("%s: discard tsn:%u len:%zu, rwnd:%d\n",
6202 __func__, tsn, datalen, asoc->rwnd);
6203
6204 return SCTP_IERROR_IGNORE_TSN;
6205 }
6206 }
6207
6208
6209
6210
6211
6212
6213
6214
6215 if (*sk->sk_prot_creator->memory_pressure) {
6216 if (sctp_tsnmap_has_gap(map) &&
6217 (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
6218 pr_debug("%s: under pressure, reneging for tsn:%u\n",
6219 __func__, tsn);
6220 deliver = SCTP_CMD_RENEGE;
6221 }
6222 }
6223
6224
6225
6226
6227
6228
6229
6230
6231
6232 if (unlikely(0 == datalen)) {
6233 err = sctp_make_abort_no_data(asoc, chunk, tsn);
6234 if (err) {
6235 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
6236 SCTP_CHUNK(err));
6237 }
6238
6239
6240
6241 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
6242 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
6243 SCTP_ERROR(ECONNABORTED));
6244 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
6245 SCTP_PERR(SCTP_ERROR_NO_DATA));
6246 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
6247 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
6248 return SCTP_IERROR_NO_DATA;
6249 }
6250
6251 chunk->data_accepted = 1;
6252
6253
6254
6255
6256 if (chunk->chunk_hdr->flags & SCTP_DATA_UNORDERED) {
6257 SCTP_INC_STATS(net, SCTP_MIB_INUNORDERCHUNKS);
6258 if (chunk->asoc)
6259 chunk->asoc->stats.iuodchunks++;
6260 } else {
6261 SCTP_INC_STATS(net, SCTP_MIB_INORDERCHUNKS);
6262 if (chunk->asoc)
6263 chunk->asoc->stats.iodchunks++;
6264 ordered = 1;
6265 }
6266
6267
6268
6269
6270
6271
6272
6273
6274
6275 sid = ntohs(data_hdr->stream);
6276 if (sid >= asoc->c.sinit_max_instreams) {
6277
6278 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_TSN, SCTP_U32(tsn));
6279
6280 err = sctp_make_op_error(asoc, chunk, SCTP_ERROR_INV_STRM,
6281 &data_hdr->stream,
6282 sizeof(data_hdr->stream),
6283 sizeof(u16));
6284 if (err)
6285 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
6286 SCTP_CHUNK(err));
6287 return SCTP_IERROR_BAD_STREAM;
6288 }
6289
6290
6291
6292
6293
6294
6295
6296
6297 ssn = ntohs(data_hdr->ssn);
6298 if (ordered && SSN_lt(ssn, sctp_ssn_peek(&asoc->ssnmap->in, sid))) {
6299 return SCTP_IERROR_PROTO_VIOLATION;
6300 }
6301
6302
6303
6304
6305
6306 sctp_add_cmd_sf(commands, deliver, SCTP_CHUNK(chunk));
6307
6308 return SCTP_IERROR_NO_ERROR;
6309}
6310