1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
47
48#include <linux/types.h>
49#include <linux/kernel.h>
50#include <linux/ip.h>
51#include <linux/ipv6.h>
52#include <linux/net.h>
53#include <linux/inet.h>
54#include <linux/slab.h>
55#include <net/sock.h>
56#include <net/inet_ecn.h>
57#include <linux/skbuff.h>
58#include <net/sctp/sctp.h>
59#include <net/sctp/sm.h>
60#include <net/sctp/structs.h>
61
62static struct sctp_packet *sctp_abort_pkt_new(struct net *net,
63 const struct sctp_endpoint *ep,
64 const struct sctp_association *asoc,
65 struct sctp_chunk *chunk,
66 const void *payload,
67 size_t paylen);
68static int sctp_eat_data(const struct sctp_association *asoc,
69 struct sctp_chunk *chunk,
70 sctp_cmd_seq_t *commands);
71static struct sctp_packet *sctp_ootb_pkt_new(struct net *net,
72 const struct sctp_association *asoc,
73 const struct sctp_chunk *chunk);
74static void sctp_send_stale_cookie_err(struct net *net,
75 const struct sctp_endpoint *ep,
76 const struct sctp_association *asoc,
77 const struct sctp_chunk *chunk,
78 sctp_cmd_seq_t *commands,
79 struct sctp_chunk *err_chunk);
80static sctp_disposition_t sctp_sf_do_5_2_6_stale(struct net *net,
81 const struct sctp_endpoint *ep,
82 const struct sctp_association *asoc,
83 const sctp_subtype_t type,
84 void *arg,
85 sctp_cmd_seq_t *commands);
86static sctp_disposition_t sctp_sf_shut_8_4_5(struct net *net,
87 const struct sctp_endpoint *ep,
88 const struct sctp_association *asoc,
89 const sctp_subtype_t type,
90 void *arg,
91 sctp_cmd_seq_t *commands);
92static sctp_disposition_t sctp_sf_tabort_8_4_8(struct net *net,
93 const struct sctp_endpoint *ep,
94 const struct sctp_association *asoc,
95 const sctp_subtype_t type,
96 void *arg,
97 sctp_cmd_seq_t *commands);
98static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk);
99
100static sctp_disposition_t sctp_stop_t1_and_abort(struct net *net,
101 sctp_cmd_seq_t *commands,
102 __be16 error, int sk_err,
103 const struct sctp_association *asoc,
104 struct sctp_transport *transport);
105
106static sctp_disposition_t sctp_sf_abort_violation(
107 struct net *net,
108 const struct sctp_endpoint *ep,
109 const struct sctp_association *asoc,
110 void *arg,
111 sctp_cmd_seq_t *commands,
112 const __u8 *payload,
113 const size_t paylen);
114
115static sctp_disposition_t sctp_sf_violation_chunklen(
116 struct net *net,
117 const struct sctp_endpoint *ep,
118 const struct sctp_association *asoc,
119 const sctp_subtype_t type,
120 void *arg,
121 sctp_cmd_seq_t *commands);
122
123static sctp_disposition_t sctp_sf_violation_paramlen(
124 struct net *net,
125 const struct sctp_endpoint *ep,
126 const struct sctp_association *asoc,
127 const sctp_subtype_t type,
128 void *arg, void *ext,
129 sctp_cmd_seq_t *commands);
130
131static sctp_disposition_t sctp_sf_violation_ctsn(
132 struct net *net,
133 const struct sctp_endpoint *ep,
134 const struct sctp_association *asoc,
135 const sctp_subtype_t type,
136 void *arg,
137 sctp_cmd_seq_t *commands);
138
139static sctp_disposition_t sctp_sf_violation_chunk(
140 struct net *net,
141 const struct sctp_endpoint *ep,
142 const struct sctp_association *asoc,
143 const sctp_subtype_t type,
144 void *arg,
145 sctp_cmd_seq_t *commands);
146
147static sctp_ierror_t sctp_sf_authenticate(struct net *net,
148 const struct sctp_endpoint *ep,
149 const struct sctp_association *asoc,
150 const sctp_subtype_t type,
151 struct sctp_chunk *chunk);
152
153static sctp_disposition_t __sctp_sf_do_9_1_abort(struct net *net,
154 const struct sctp_endpoint *ep,
155 const struct sctp_association *asoc,
156 const sctp_subtype_t type,
157 void *arg,
158 sctp_cmd_seq_t *commands);
159
160
161
162
163
164
165
166
167static inline int
168sctp_chunk_length_valid(struct sctp_chunk *chunk,
169 __u16 required_length)
170{
171 __u16 chunk_length = ntohs(chunk->chunk_hdr->length);
172
173
174 if (unlikely(chunk->pdiscard))
175 return 0;
176 if (unlikely(chunk_length < required_length))
177 return 0;
178
179 return 1;
180}
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217sctp_disposition_t sctp_sf_do_4_C(struct net *net,
218 const struct sctp_endpoint *ep,
219 const struct sctp_association *asoc,
220 const sctp_subtype_t type,
221 void *arg,
222 sctp_cmd_seq_t *commands)
223{
224 struct sctp_chunk *chunk = arg;
225 struct sctp_ulpevent *ev;
226
227 if (!sctp_vtag_verify_either(chunk, asoc))
228 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
229
230
231
232
233
234
235 if (!chunk->singleton)
236 return sctp_sf_violation_chunk(net, ep, asoc, type, arg, commands);
237
238
239 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
240 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
241 commands);
242
243
244
245
246
247
248
249
250 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_SHUTDOWN_COMP,
251 0, 0, 0, NULL, GFP_ATOMIC);
252 if (ev)
253 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
254 SCTP_ULPEVENT(ev));
255
256
257
258
259
260
261
262
263
264 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
265 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
266
267 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
268 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
269
270 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
271 SCTP_STATE(SCTP_STATE_CLOSED));
272
273 SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS);
274 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
275
276 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
277
278 return SCTP_DISPOSITION_DELETE_TCB;
279}
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303sctp_disposition_t sctp_sf_do_5_1B_init(struct net *net,
304 const struct sctp_endpoint *ep,
305 const struct sctp_association *asoc,
306 const sctp_subtype_t type,
307 void *arg,
308 sctp_cmd_seq_t *commands)
309{
310 struct sctp_chunk *chunk = arg;
311 struct sctp_chunk *repl;
312 struct sctp_association *new_asoc;
313 struct sctp_chunk *err_chunk;
314 struct sctp_packet *packet;
315 sctp_unrecognized_param_t *unk_param;
316 int len;
317
318
319
320
321
322
323
324
325
326
327 if (!chunk->singleton)
328 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
329
330
331
332
333 if (ep == sctp_sk(net->sctp.ctl_sock)->ep) {
334 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
335 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
336 }
337
338
339
340
341 if (chunk->sctp_hdr->vtag != 0)
342 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
343
344
345
346
347
348
349 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_init_chunk_t)))
350 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
351
352
353
354
355
356
357
358 if (sctp_sstate(ep->base.sk, CLOSING))
359 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
360
361
362 err_chunk = NULL;
363 if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type,
364 (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
365 &err_chunk)) {
366
367
368
369 if (err_chunk) {
370 packet = sctp_abort_pkt_new(net, ep, asoc, arg,
371 (__u8 *)(err_chunk->chunk_hdr) +
372 sizeof(sctp_chunkhdr_t),
373 ntohs(err_chunk->chunk_hdr->length) -
374 sizeof(sctp_chunkhdr_t));
375
376 sctp_chunk_free(err_chunk);
377
378 if (packet) {
379 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
380 SCTP_PACKET(packet));
381 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
382 return SCTP_DISPOSITION_CONSUME;
383 } else {
384 return SCTP_DISPOSITION_NOMEM;
385 }
386 } else {
387 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg,
388 commands);
389 }
390 }
391
392
393 chunk->subh.init_hdr = (sctp_inithdr_t *)chunk->skb->data;
394
395
396 chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(sctp_inithdr_t));
397
398 new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC);
399 if (!new_asoc)
400 goto nomem;
401
402 if (sctp_assoc_set_bind_addr_from_ep(new_asoc,
403 sctp_scope(sctp_source(chunk)),
404 GFP_ATOMIC) < 0)
405 goto nomem_init;
406
407
408 if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk),
409 (sctp_init_chunk_t *)chunk->chunk_hdr,
410 GFP_ATOMIC))
411 goto nomem_init;
412
413
414
415
416
417
418 len = 0;
419 if (err_chunk)
420 len = ntohs(err_chunk->chunk_hdr->length) -
421 sizeof(sctp_chunkhdr_t);
422
423 repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
424 if (!repl)
425 goto nomem_init;
426
427
428
429
430
431 if (err_chunk) {
432
433
434
435
436
437
438
439 unk_param = (sctp_unrecognized_param_t *)
440 ((__u8 *)(err_chunk->chunk_hdr) +
441 sizeof(sctp_chunkhdr_t));
442
443
444
445 sctp_addto_chunk(repl, len, unk_param);
446 sctp_chunk_free(err_chunk);
447 }
448
449 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
450
451 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
452
453
454
455
456
457
458
459 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
460
461 return SCTP_DISPOSITION_DELETE_TCB;
462
463nomem_init:
464 sctp_association_free(new_asoc);
465nomem:
466 if (err_chunk)
467 sctp_chunk_free(err_chunk);
468 return SCTP_DISPOSITION_NOMEM;
469}
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499sctp_disposition_t sctp_sf_do_5_1C_ack(struct net *net,
500 const struct sctp_endpoint *ep,
501 const struct sctp_association *asoc,
502 const sctp_subtype_t type,
503 void *arg,
504 sctp_cmd_seq_t *commands)
505{
506 struct sctp_chunk *chunk = arg;
507 sctp_init_chunk_t *initchunk;
508 struct sctp_chunk *err_chunk;
509 struct sctp_packet *packet;
510
511 if (!sctp_vtag_verify(chunk, asoc))
512 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
513
514
515
516
517
518 if (!chunk->singleton)
519 return sctp_sf_violation_chunk(net, ep, asoc, type, arg, commands);
520
521
522 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_initack_chunk_t)))
523 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
524 commands);
525
526 chunk->subh.init_hdr = (sctp_inithdr_t *) chunk->skb->data;
527
528
529 err_chunk = NULL;
530 if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type,
531 (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
532 &err_chunk)) {
533
534 sctp_error_t error = SCTP_ERROR_NO_RESOURCE;
535
536
537
538
539
540
541 if (err_chunk) {
542 packet = sctp_abort_pkt_new(net, ep, asoc, arg,
543 (__u8 *)(err_chunk->chunk_hdr) +
544 sizeof(sctp_chunkhdr_t),
545 ntohs(err_chunk->chunk_hdr->length) -
546 sizeof(sctp_chunkhdr_t));
547
548 sctp_chunk_free(err_chunk);
549
550 if (packet) {
551 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
552 SCTP_PACKET(packet));
553 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
554 error = SCTP_ERROR_INV_PARAM;
555 }
556 }
557
558
559
560
561
562
563
564
565
566
567
568
569 if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
570 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
571
572 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
573 return sctp_stop_t1_and_abort(net, commands, error, ECONNREFUSED,
574 asoc, chunk->transport);
575 }
576
577
578
579
580 chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(sctp_inithdr_t));
581
582 initchunk = (sctp_init_chunk_t *) chunk->chunk_hdr;
583
584 sctp_add_cmd_sf(commands, SCTP_CMD_PEER_INIT,
585 SCTP_PEER_INIT(initchunk));
586
587
588 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());
589
590
591
592
593
594 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
595 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
596 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
597 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
598 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
599 SCTP_STATE(SCTP_STATE_COOKIE_ECHOED));
600
601
602
603
604 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_SHKEY, SCTP_NULL());
605
606
607
608
609
610
611
612 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_COOKIE_ECHO,
613 SCTP_CHUNK(err_chunk));
614
615 return SCTP_DISPOSITION_CONSUME;
616}
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net,
650 const struct sctp_endpoint *ep,
651 const struct sctp_association *asoc,
652 const sctp_subtype_t type, void *arg,
653 sctp_cmd_seq_t *commands)
654{
655 struct sctp_chunk *chunk = arg;
656 struct sctp_association *new_asoc;
657 sctp_init_chunk_t *peer_init;
658 struct sctp_chunk *repl;
659 struct sctp_ulpevent *ev, *ai_ev = NULL;
660 int error = 0;
661 struct sctp_chunk *err_chk_p;
662 struct sock *sk;
663
664
665
666
667 if (ep == sctp_sk(net->sctp.ctl_sock)->ep) {
668 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
669 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
670 }
671
672
673
674
675
676
677 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
678 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
679
680
681
682
683
684 sk = ep->base.sk;
685 if (!sctp_sstate(sk, LISTENING) ||
686 (sctp_style(sk, TCP) && sk_acceptq_is_full(sk)))
687 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
688
689
690
691
692 chunk->subh.cookie_hdr =
693 (struct sctp_signed_cookie *)chunk->skb->data;
694 if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
695 sizeof(sctp_chunkhdr_t)))
696 goto nomem;
697
698
699
700
701
702 new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, &error,
703 &err_chk_p);
704
705
706
707
708
709
710
711 if (!new_asoc) {
712
713
714
715 switch (error) {
716 case -SCTP_IERROR_NOMEM:
717 goto nomem;
718
719 case -SCTP_IERROR_STALE_COOKIE:
720 sctp_send_stale_cookie_err(net, ep, asoc, chunk, commands,
721 err_chk_p);
722 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
723
724 case -SCTP_IERROR_BAD_SIG:
725 default:
726 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
727 }
728 }
729
730
731
732
733
734
735
736
737
738
739 peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
740
741 if (!sctp_process_init(new_asoc, chunk,
742 &chunk->subh.cookie_hdr->c.peer_addr,
743 peer_init, GFP_ATOMIC))
744 goto nomem_init;
745
746
747
748
749
750 error = sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC);
751 if (error)
752 goto nomem_init;
753
754
755
756
757
758
759
760 if (chunk->auth_chunk) {
761 struct sctp_chunk auth;
762 sctp_ierror_t ret;
763
764
765 if (!net->sctp.auth_enable || !new_asoc->peer.auth_capable) {
766 sctp_association_free(new_asoc);
767 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
768 }
769
770
771 auth.skb = chunk->auth_chunk;
772 auth.asoc = chunk->asoc;
773 auth.sctp_hdr = chunk->sctp_hdr;
774 auth.chunk_hdr = (sctp_chunkhdr_t *)skb_push(chunk->auth_chunk,
775 sizeof(sctp_chunkhdr_t));
776 skb_pull(chunk->auth_chunk, sizeof(sctp_chunkhdr_t));
777 auth.transport = chunk->transport;
778
779 ret = sctp_sf_authenticate(net, ep, new_asoc, type, &auth);
780 if (ret != SCTP_IERROR_NO_ERROR) {
781 sctp_association_free(new_asoc);
782 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
783 }
784 }
785
786 repl = sctp_make_cookie_ack(new_asoc, chunk);
787 if (!repl)
788 goto nomem_init;
789
790
791
792
793
794
795
796 ev = sctp_ulpevent_make_assoc_change(new_asoc, 0, SCTP_COMM_UP, 0,
797 new_asoc->c.sinit_num_ostreams,
798 new_asoc->c.sinit_max_instreams,
799 NULL, GFP_ATOMIC);
800 if (!ev)
801 goto nomem_ev;
802
803
804
805
806
807
808 if (new_asoc->peer.adaptation_ind) {
809 ai_ev = sctp_ulpevent_make_adaptation_indication(new_asoc,
810 GFP_ATOMIC);
811 if (!ai_ev)
812 goto nomem_aiev;
813 }
814
815
816
817
818
819
820 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
821 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
822 SCTP_STATE(SCTP_STATE_ESTABLISHED));
823 SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
824 SCTP_INC_STATS(net, SCTP_MIB_PASSIVEESTABS);
825 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
826
827 if (new_asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
828 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
829 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
830
831
832 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
833
834
835 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
836
837
838 if (ai_ev)
839 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
840 SCTP_ULPEVENT(ai_ev));
841
842 return SCTP_DISPOSITION_CONSUME;
843
844nomem_aiev:
845 sctp_ulpevent_free(ev);
846nomem_ev:
847 sctp_chunk_free(repl);
848nomem_init:
849 sctp_association_free(new_asoc);
850nomem:
851 return SCTP_DISPOSITION_NOMEM;
852}
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875sctp_disposition_t sctp_sf_do_5_1E_ca(struct net *net,
876 const struct sctp_endpoint *ep,
877 const struct sctp_association *asoc,
878 const sctp_subtype_t type, void *arg,
879 sctp_cmd_seq_t *commands)
880{
881 struct sctp_chunk *chunk = arg;
882 struct sctp_ulpevent *ev;
883
884 if (!sctp_vtag_verify(chunk, asoc))
885 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
886
887
888
889
890 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
891 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
892 commands);
893
894
895
896
897
898
899
900 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());
901
902
903
904
905
906
907
908 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
909 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
910 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
911 SCTP_STATE(SCTP_STATE_ESTABLISHED));
912 SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
913 SCTP_INC_STATS(net, SCTP_MIB_ACTIVEESTABS);
914 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
915 if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
916 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
917 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
918
919
920
921
922
923 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_COMM_UP,
924 0, asoc->c.sinit_num_ostreams,
925 asoc->c.sinit_max_instreams,
926 NULL, GFP_ATOMIC);
927
928 if (!ev)
929 goto nomem;
930
931 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
932
933
934
935
936
937
938 if (asoc->peer.adaptation_ind) {
939 ev = sctp_ulpevent_make_adaptation_indication(asoc, GFP_ATOMIC);
940 if (!ev)
941 goto nomem;
942
943 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
944 SCTP_ULPEVENT(ev));
945 }
946
947 return SCTP_DISPOSITION_CONSUME;
948nomem:
949 return SCTP_DISPOSITION_NOMEM;
950}
951
952
953static sctp_disposition_t sctp_sf_heartbeat(const struct sctp_endpoint *ep,
954 const struct sctp_association *asoc,
955 const sctp_subtype_t type,
956 void *arg,
957 sctp_cmd_seq_t *commands)
958{
959 struct sctp_transport *transport = (struct sctp_transport *) arg;
960 struct sctp_chunk *reply;
961
962
963 reply = sctp_make_heartbeat(asoc, transport);
964 if (!reply)
965 return SCTP_DISPOSITION_NOMEM;
966
967
968
969
970 sctp_add_cmd_sf(commands, SCTP_CMD_RTO_PENDING,
971 SCTP_TRANSPORT(transport));
972
973 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
974 return SCTP_DISPOSITION_CONSUME;
975}
976
977
978sctp_disposition_t sctp_sf_sendbeat_8_3(struct net *net,
979 const struct sctp_endpoint *ep,
980 const struct sctp_association *asoc,
981 const sctp_subtype_t type,
982 void *arg,
983 sctp_cmd_seq_t *commands)
984{
985 struct sctp_transport *transport = (struct sctp_transport *) arg;
986
987 if (asoc->overall_error_count >= asoc->max_retrans) {
988 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
989 SCTP_ERROR(ETIMEDOUT));
990
991 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
992 SCTP_PERR(SCTP_ERROR_NO_ERROR));
993 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
994 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
995 return SCTP_DISPOSITION_DELETE_TCB;
996 }
997
998
999
1000
1001
1002
1003
1004
1005 if (transport->param_flags & SPP_HB_ENABLE) {
1006 if (SCTP_DISPOSITION_NOMEM ==
1007 sctp_sf_heartbeat(ep, asoc, type, arg,
1008 commands))
1009 return SCTP_DISPOSITION_NOMEM;
1010
1011
1012
1013
1014 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_HB_SENT,
1015 SCTP_TRANSPORT(transport));
1016 }
1017 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_IDLE,
1018 SCTP_TRANSPORT(transport));
1019 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMER_UPDATE,
1020 SCTP_TRANSPORT(transport));
1021
1022 return SCTP_DISPOSITION_CONSUME;
1023}
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049sctp_disposition_t sctp_sf_beat_8_3(struct net *net,
1050 const struct sctp_endpoint *ep,
1051 const struct sctp_association *asoc,
1052 const sctp_subtype_t type,
1053 void *arg,
1054 sctp_cmd_seq_t *commands)
1055{
1056 sctp_paramhdr_t *param_hdr;
1057 struct sctp_chunk *chunk = arg;
1058 struct sctp_chunk *reply;
1059 size_t paylen = 0;
1060
1061 if (!sctp_vtag_verify(chunk, asoc))
1062 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1063
1064
1065 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_heartbeat_chunk_t)))
1066 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1067 commands);
1068
1069
1070
1071
1072
1073 chunk->subh.hb_hdr = (sctp_heartbeathdr_t *) chunk->skb->data;
1074 param_hdr = (sctp_paramhdr_t *) chunk->subh.hb_hdr;
1075 paylen = ntohs(chunk->chunk_hdr->length) - sizeof(sctp_chunkhdr_t);
1076
1077 if (ntohs(param_hdr->length) > paylen)
1078 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
1079 param_hdr, commands);
1080
1081 if (!pskb_pull(chunk->skb, paylen))
1082 goto nomem;
1083
1084 reply = sctp_make_heartbeat_ack(asoc, chunk, param_hdr, paylen);
1085 if (!reply)
1086 goto nomem;
1087
1088 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
1089 return SCTP_DISPOSITION_CONSUME;
1090
1091nomem:
1092 return SCTP_DISPOSITION_NOMEM;
1093}
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123sctp_disposition_t sctp_sf_backbeat_8_3(struct net *net,
1124 const struct sctp_endpoint *ep,
1125 const struct sctp_association *asoc,
1126 const sctp_subtype_t type,
1127 void *arg,
1128 sctp_cmd_seq_t *commands)
1129{
1130 struct sctp_chunk *chunk = arg;
1131 union sctp_addr from_addr;
1132 struct sctp_transport *link;
1133 sctp_sender_hb_info_t *hbinfo;
1134 unsigned long max_interval;
1135
1136 if (!sctp_vtag_verify(chunk, asoc))
1137 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1138
1139
1140 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t) +
1141 sizeof(sctp_sender_hb_info_t)))
1142 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1143 commands);
1144
1145 hbinfo = (sctp_sender_hb_info_t *) chunk->skb->data;
1146
1147 if (ntohs(hbinfo->param_hdr.length) !=
1148 sizeof(sctp_sender_hb_info_t)) {
1149 return SCTP_DISPOSITION_DISCARD;
1150 }
1151
1152 from_addr = hbinfo->daddr;
1153 link = sctp_assoc_lookup_paddr(asoc, &from_addr);
1154
1155
1156 if (unlikely(!link)) {
1157 if (from_addr.sa.sa_family == AF_INET6) {
1158 net_warn_ratelimited("%s association %p could not find address %pI6\n",
1159 __func__,
1160 asoc,
1161 &from_addr.v6.sin6_addr);
1162 } else {
1163 net_warn_ratelimited("%s association %p could not find address %pI4\n",
1164 __func__,
1165 asoc,
1166 &from_addr.v4.sin_addr.s_addr);
1167 }
1168 return SCTP_DISPOSITION_DISCARD;
1169 }
1170
1171
1172 if (hbinfo->hb_nonce != link->hb_nonce)
1173 return SCTP_DISPOSITION_DISCARD;
1174
1175 max_interval = link->hbinterval + link->rto;
1176
1177
1178 if (time_after(hbinfo->sent_at, jiffies) ||
1179 time_after(jiffies, hbinfo->sent_at + max_interval)) {
1180 pr_debug("%s: HEARTBEAT ACK with invalid timestamp received "
1181 "for transport:%p\n", __func__, link);
1182
1183 return SCTP_DISPOSITION_DISCARD;
1184 }
1185
1186
1187
1188
1189
1190
1191
1192 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_ON, SCTP_TRANSPORT(link));
1193
1194 return SCTP_DISPOSITION_CONSUME;
1195}
1196
1197
1198
1199
1200static int sctp_sf_send_restart_abort(struct net *net, union sctp_addr *ssa,
1201 struct sctp_chunk *init,
1202 sctp_cmd_seq_t *commands)
1203{
1204 int len;
1205 struct sctp_packet *pkt;
1206 union sctp_addr_param *addrparm;
1207 struct sctp_errhdr *errhdr;
1208 struct sctp_endpoint *ep;
1209 char buffer[sizeof(struct sctp_errhdr)+sizeof(union sctp_addr_param)];
1210 struct sctp_af *af = sctp_get_af_specific(ssa->v4.sin_family);
1211
1212
1213
1214
1215 errhdr = (struct sctp_errhdr *)buffer;
1216 addrparm = (union sctp_addr_param *)errhdr->variable;
1217
1218
1219 len = af->to_addr_param(ssa, addrparm);
1220 len += sizeof(sctp_errhdr_t);
1221
1222 errhdr->cause = SCTP_ERROR_RESTART;
1223 errhdr->length = htons(len);
1224
1225
1226 ep = sctp_sk(net->sctp.ctl_sock)->ep;
1227
1228
1229
1230
1231 pkt = sctp_abort_pkt_new(net, ep, NULL, init, errhdr, len);
1232
1233 if (!pkt)
1234 goto out;
1235 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT, SCTP_PACKET(pkt));
1236
1237 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
1238
1239
1240 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
1241
1242out:
1243
1244
1245
1246 return 0;
1247}
1248
1249static bool list_has_sctp_addr(const struct list_head *list,
1250 union sctp_addr *ipaddr)
1251{
1252 struct sctp_transport *addr;
1253
1254 list_for_each_entry(addr, list, transports) {
1255 if (sctp_cmp_addr_exact(ipaddr, &addr->ipaddr))
1256 return true;
1257 }
1258
1259 return false;
1260}
1261
1262
1263
1264static int sctp_sf_check_restart_addrs(const struct sctp_association *new_asoc,
1265 const struct sctp_association *asoc,
1266 struct sctp_chunk *init,
1267 sctp_cmd_seq_t *commands)
1268{
1269 struct net *net = sock_net(new_asoc->base.sk);
1270 struct sctp_transport *new_addr;
1271 int ret = 1;
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284 list_for_each_entry(new_addr, &new_asoc->peer.transport_addr_list,
1285 transports) {
1286 if (!list_has_sctp_addr(&asoc->peer.transport_addr_list,
1287 &new_addr->ipaddr)) {
1288 sctp_sf_send_restart_abort(net, &new_addr->ipaddr, init,
1289 commands);
1290 ret = 0;
1291 break;
1292 }
1293 }
1294
1295
1296 return ret;
1297}
1298
1299
1300
1301
1302
1303
1304static void sctp_tietags_populate(struct sctp_association *new_asoc,
1305 const struct sctp_association *asoc)
1306{
1307 switch (asoc->state) {
1308
1309
1310
1311 case SCTP_STATE_COOKIE_WAIT:
1312 new_asoc->c.my_vtag = asoc->c.my_vtag;
1313 new_asoc->c.my_ttag = asoc->c.my_vtag;
1314 new_asoc->c.peer_ttag = 0;
1315 break;
1316
1317 case SCTP_STATE_COOKIE_ECHOED:
1318 new_asoc->c.my_vtag = asoc->c.my_vtag;
1319 new_asoc->c.my_ttag = asoc->c.my_vtag;
1320 new_asoc->c.peer_ttag = asoc->c.peer_vtag;
1321 break;
1322
1323
1324
1325
1326 default:
1327 new_asoc->c.my_ttag = asoc->c.my_vtag;
1328 new_asoc->c.peer_ttag = asoc->c.peer_vtag;
1329 break;
1330 }
1331
1332
1333
1334
1335
1336 new_asoc->rwnd = asoc->rwnd;
1337 new_asoc->c.sinit_num_ostreams = asoc->c.sinit_num_ostreams;
1338 new_asoc->c.sinit_max_instreams = asoc->c.sinit_max_instreams;
1339 new_asoc->c.initial_tsn = asoc->c.initial_tsn;
1340}
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351static char sctp_tietags_compare(struct sctp_association *new_asoc,
1352 const struct sctp_association *asoc)
1353{
1354
1355 if ((asoc->c.my_vtag != new_asoc->c.my_vtag) &&
1356 (asoc->c.peer_vtag != new_asoc->c.peer_vtag) &&
1357 (asoc->c.my_vtag == new_asoc->c.my_ttag) &&
1358 (asoc->c.peer_vtag == new_asoc->c.peer_ttag))
1359 return 'A';
1360
1361
1362 if ((asoc->c.my_vtag == new_asoc->c.my_vtag) &&
1363 ((asoc->c.peer_vtag != new_asoc->c.peer_vtag) ||
1364 (0 == asoc->c.peer_vtag))) {
1365 return 'B';
1366 }
1367
1368
1369 if ((asoc->c.my_vtag == new_asoc->c.my_vtag) &&
1370 (asoc->c.peer_vtag == new_asoc->c.peer_vtag))
1371 return 'D';
1372
1373
1374 if ((asoc->c.my_vtag != new_asoc->c.my_vtag) &&
1375 (asoc->c.peer_vtag == new_asoc->c.peer_vtag) &&
1376 (0 == new_asoc->c.my_ttag) &&
1377 (0 == new_asoc->c.peer_ttag))
1378 return 'C';
1379
1380
1381 return 'E';
1382}
1383
1384
1385
1386
1387static sctp_disposition_t sctp_sf_do_unexpected_init(
1388 struct net *net,
1389 const struct sctp_endpoint *ep,
1390 const struct sctp_association *asoc,
1391 const sctp_subtype_t type,
1392 void *arg, sctp_cmd_seq_t *commands)
1393{
1394 sctp_disposition_t retval;
1395 struct sctp_chunk *chunk = arg;
1396 struct sctp_chunk *repl;
1397 struct sctp_association *new_asoc;
1398 struct sctp_chunk *err_chunk;
1399 struct sctp_packet *packet;
1400 sctp_unrecognized_param_t *unk_param;
1401 int len;
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412 if (!chunk->singleton)
1413 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1414
1415
1416
1417
1418 if (chunk->sctp_hdr->vtag != 0)
1419 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
1420
1421
1422
1423
1424
1425 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_init_chunk_t)))
1426 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1427 commands);
1428
1429 chunk->subh.init_hdr = (sctp_inithdr_t *) chunk->skb->data;
1430
1431
1432 chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(sctp_inithdr_t));
1433
1434
1435 err_chunk = NULL;
1436 if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type,
1437 (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
1438 &err_chunk)) {
1439
1440
1441
1442 if (err_chunk) {
1443 packet = sctp_abort_pkt_new(net, ep, asoc, arg,
1444 (__u8 *)(err_chunk->chunk_hdr) +
1445 sizeof(sctp_chunkhdr_t),
1446 ntohs(err_chunk->chunk_hdr->length) -
1447 sizeof(sctp_chunkhdr_t));
1448
1449 if (packet) {
1450 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
1451 SCTP_PACKET(packet));
1452 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
1453 retval = SCTP_DISPOSITION_CONSUME;
1454 } else {
1455 retval = SCTP_DISPOSITION_NOMEM;
1456 }
1457 goto cleanup;
1458 } else {
1459 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg,
1460 commands);
1461 }
1462 }
1463
1464
1465
1466
1467
1468
1469
1470
1471 new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC);
1472 if (!new_asoc)
1473 goto nomem;
1474
1475 if (sctp_assoc_set_bind_addr_from_ep(new_asoc,
1476 sctp_scope(sctp_source(chunk)), GFP_ATOMIC) < 0)
1477 goto nomem;
1478
1479
1480
1481
1482
1483 if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk),
1484 (sctp_init_chunk_t *)chunk->chunk_hdr,
1485 GFP_ATOMIC))
1486 goto nomem;
1487
1488
1489
1490
1491
1492
1493 if (!sctp_state(asoc, COOKIE_WAIT)) {
1494 if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk,
1495 commands)) {
1496 retval = SCTP_DISPOSITION_CONSUME;
1497 goto nomem_retval;
1498 }
1499 }
1500
1501 sctp_tietags_populate(new_asoc, asoc);
1502
1503
1504
1505
1506
1507
1508 len = 0;
1509 if (err_chunk) {
1510 len = ntohs(err_chunk->chunk_hdr->length) -
1511 sizeof(sctp_chunkhdr_t);
1512 }
1513
1514 repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
1515 if (!repl)
1516 goto nomem;
1517
1518
1519
1520
1521
1522 if (err_chunk) {
1523
1524
1525
1526
1527
1528
1529
1530 unk_param = (sctp_unrecognized_param_t *)
1531 ((__u8 *)(err_chunk->chunk_hdr) +
1532 sizeof(sctp_chunkhdr_t));
1533
1534
1535
1536 sctp_addto_chunk(repl, len, unk_param);
1537 }
1538
1539 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
1540 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1541
1542
1543
1544
1545
1546
1547 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
1548 retval = SCTP_DISPOSITION_CONSUME;
1549
1550 return retval;
1551
1552nomem:
1553 retval = SCTP_DISPOSITION_NOMEM;
1554nomem_retval:
1555 if (new_asoc)
1556 sctp_association_free(new_asoc);
1557cleanup:
1558 if (err_chunk)
1559 sctp_chunk_free(err_chunk);
1560 return retval;
1561}
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601sctp_disposition_t sctp_sf_do_5_2_1_siminit(struct net *net,
1602 const struct sctp_endpoint *ep,
1603 const struct sctp_association *asoc,
1604 const sctp_subtype_t type,
1605 void *arg,
1606 sctp_cmd_seq_t *commands)
1607{
1608
1609
1610
1611 return sctp_sf_do_unexpected_init(net, ep, asoc, type, arg, commands);
1612}
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655sctp_disposition_t sctp_sf_do_5_2_2_dupinit(struct net *net,
1656 const struct sctp_endpoint *ep,
1657 const struct sctp_association *asoc,
1658 const sctp_subtype_t type,
1659 void *arg,
1660 sctp_cmd_seq_t *commands)
1661{
1662
1663
1664
1665 return sctp_sf_do_unexpected_init(net, ep, asoc, type, arg, commands);
1666}
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678sctp_disposition_t sctp_sf_do_5_2_3_initack(struct net *net,
1679 const struct sctp_endpoint *ep,
1680 const struct sctp_association *asoc,
1681 const sctp_subtype_t type,
1682 void *arg, sctp_cmd_seq_t *commands)
1683{
1684
1685
1686
1687 if (ep == sctp_sk(net->sctp.ctl_sock)->ep)
1688 return sctp_sf_ootb(net, ep, asoc, type, arg, commands);
1689 else
1690 return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
1691}
1692
1693
1694
1695
1696
1697
1698static sctp_disposition_t sctp_sf_do_dupcook_a(struct net *net,
1699 const struct sctp_endpoint *ep,
1700 const struct sctp_association *asoc,
1701 struct sctp_chunk *chunk,
1702 sctp_cmd_seq_t *commands,
1703 struct sctp_association *new_asoc)
1704{
1705 sctp_init_chunk_t *peer_init;
1706 struct sctp_ulpevent *ev;
1707 struct sctp_chunk *repl;
1708 struct sctp_chunk *err;
1709 sctp_disposition_t disposition;
1710
1711
1712
1713
1714 peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
1715
1716 if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk), peer_init,
1717 GFP_ATOMIC))
1718 goto nomem;
1719
1720
1721
1722
1723
1724 if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk, commands)) {
1725 return SCTP_DISPOSITION_CONSUME;
1726 }
1727
1728
1729
1730
1731
1732
1733
1734 if (sctp_state(asoc, SHUTDOWN_ACK_SENT)) {
1735 disposition = sctp_sf_do_9_2_reshutack(net, ep, asoc,
1736 SCTP_ST_CHUNK(chunk->chunk_hdr->type),
1737 chunk, commands);
1738 if (SCTP_DISPOSITION_NOMEM == disposition)
1739 goto nomem;
1740
1741 err = sctp_make_op_error(asoc, chunk,
1742 SCTP_ERROR_COOKIE_IN_SHUTDOWN,
1743 NULL, 0, 0);
1744 if (err)
1745 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
1746 SCTP_CHUNK(err));
1747
1748 return SCTP_DISPOSITION_CONSUME;
1749 }
1750
1751
1752
1753
1754 sctp_add_cmd_sf(commands, SCTP_CMD_T3_RTX_TIMERS_STOP, SCTP_NULL());
1755 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
1756 SCTP_TO(SCTP_EVENT_TIMEOUT_SACK));
1757 sctp_add_cmd_sf(commands, SCTP_CMD_PURGE_OUTQUEUE, SCTP_NULL());
1758
1759
1760
1761
1762 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
1763 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
1764 sctp_add_cmd_sf(commands, SCTP_CMD_PURGE_ASCONF_QUEUE, SCTP_NULL());
1765
1766 repl = sctp_make_cookie_ack(new_asoc, chunk);
1767 if (!repl)
1768 goto nomem;
1769
1770
1771 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_RESTART, 0,
1772 new_asoc->c.sinit_num_ostreams,
1773 new_asoc->c.sinit_max_instreams,
1774 NULL, GFP_ATOMIC);
1775 if (!ev)
1776 goto nomem_ev;
1777
1778
1779 sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
1780 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
1781 if (sctp_state(asoc, SHUTDOWN_PENDING) &&
1782 (sctp_sstate(asoc->base.sk, CLOSING) ||
1783 sock_flag(asoc->base.sk, SOCK_DEAD))) {
1784
1785
1786
1787
1788 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1789 return sctp_sf_do_9_2_start_shutdown(net, ep, asoc,
1790 SCTP_ST_CHUNK(0), NULL,
1791 commands);
1792 } else {
1793 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
1794 SCTP_STATE(SCTP_STATE_ESTABLISHED));
1795 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1796 }
1797 return SCTP_DISPOSITION_CONSUME;
1798
1799nomem_ev:
1800 sctp_chunk_free(repl);
1801nomem:
1802 return SCTP_DISPOSITION_NOMEM;
1803}
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813static sctp_disposition_t sctp_sf_do_dupcook_b(struct net *net,
1814 const struct sctp_endpoint *ep,
1815 const struct sctp_association *asoc,
1816 struct sctp_chunk *chunk,
1817 sctp_cmd_seq_t *commands,
1818 struct sctp_association *new_asoc)
1819{
1820 sctp_init_chunk_t *peer_init;
1821 struct sctp_chunk *repl;
1822
1823
1824
1825
1826 peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
1827 if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk), peer_init,
1828 GFP_ATOMIC))
1829 goto nomem;
1830
1831
1832 sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
1833 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
1834 SCTP_STATE(SCTP_STATE_ESTABLISHED));
1835 SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
1836 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
1837
1838 repl = sctp_make_cookie_ack(new_asoc, chunk);
1839 if (!repl)
1840 goto nomem;
1841
1842 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_CHANGE, SCTP_U8(SCTP_COMM_UP));
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866 if (asoc->peer.adaptation_ind)
1867 sctp_add_cmd_sf(commands, SCTP_CMD_ADAPTATION_IND, SCTP_NULL());
1868
1869 return SCTP_DISPOSITION_CONSUME;
1870
1871nomem:
1872 return SCTP_DISPOSITION_NOMEM;
1873}
1874
1875
1876
1877
1878
1879
1880
1881
1882
1883
1884static sctp_disposition_t sctp_sf_do_dupcook_c(struct net *net,
1885 const struct sctp_endpoint *ep,
1886 const struct sctp_association *asoc,
1887 struct sctp_chunk *chunk,
1888 sctp_cmd_seq_t *commands,
1889 struct sctp_association *new_asoc)
1890{
1891
1892
1893
1894
1895 return SCTP_DISPOSITION_DISCARD;
1896}
1897
1898
1899
1900
1901
1902
1903
1904
1905
1906static sctp_disposition_t sctp_sf_do_dupcook_d(struct net *net,
1907 const struct sctp_endpoint *ep,
1908 const struct sctp_association *asoc,
1909 struct sctp_chunk *chunk,
1910 sctp_cmd_seq_t *commands,
1911 struct sctp_association *new_asoc)
1912{
1913 struct sctp_ulpevent *ev = NULL, *ai_ev = NULL;
1914 struct sctp_chunk *repl;
1915
1916
1917
1918
1919
1920
1921
1922
1923
1924 if (asoc->state < SCTP_STATE_ESTABLISHED) {
1925 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
1926 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
1927 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
1928 SCTP_STATE(SCTP_STATE_ESTABLISHED));
1929 SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
1930 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START,
1931 SCTP_NULL());
1932
1933
1934
1935
1936
1937
1938
1939
1940 ev = sctp_ulpevent_make_assoc_change(asoc, 0,
1941 SCTP_COMM_UP, 0,
1942 asoc->c.sinit_num_ostreams,
1943 asoc->c.sinit_max_instreams,
1944 NULL, GFP_ATOMIC);
1945 if (!ev)
1946 goto nomem;
1947
1948
1949
1950
1951
1952
1953 if (asoc->peer.adaptation_ind) {
1954 ai_ev = sctp_ulpevent_make_adaptation_indication(asoc,
1955 GFP_ATOMIC);
1956 if (!ai_ev)
1957 goto nomem;
1958
1959 }
1960 }
1961
1962 repl = sctp_make_cookie_ack(new_asoc, chunk);
1963 if (!repl)
1964 goto nomem;
1965
1966 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1967
1968 if (ev)
1969 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
1970 SCTP_ULPEVENT(ev));
1971 if (ai_ev)
1972 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
1973 SCTP_ULPEVENT(ai_ev));
1974
1975 return SCTP_DISPOSITION_CONSUME;
1976
1977nomem:
1978 if (ai_ev)
1979 sctp_ulpevent_free(ai_ev);
1980 if (ev)
1981 sctp_ulpevent_free(ev);
1982 return SCTP_DISPOSITION_NOMEM;
1983}
1984
1985
1986
1987
1988
1989
1990
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001sctp_disposition_t sctp_sf_do_5_2_4_dupcook(struct net *net,
2002 const struct sctp_endpoint *ep,
2003 const struct sctp_association *asoc,
2004 const sctp_subtype_t type,
2005 void *arg,
2006 sctp_cmd_seq_t *commands)
2007{
2008 sctp_disposition_t retval;
2009 struct sctp_chunk *chunk = arg;
2010 struct sctp_association *new_asoc;
2011 int error = 0;
2012 char action;
2013 struct sctp_chunk *err_chk_p;
2014
2015
2016
2017
2018
2019
2020 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
2021 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2022 commands);
2023
2024
2025
2026
2027 chunk->subh.cookie_hdr = (struct sctp_signed_cookie *)chunk->skb->data;
2028 if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
2029 sizeof(sctp_chunkhdr_t)))
2030 goto nomem;
2031
2032
2033
2034
2035
2036
2037 new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, &error,
2038 &err_chk_p);
2039
2040
2041
2042
2043
2044
2045
2046 if (!new_asoc) {
2047
2048
2049
2050 switch (error) {
2051 case -SCTP_IERROR_NOMEM:
2052 goto nomem;
2053
2054 case -SCTP_IERROR_STALE_COOKIE:
2055 sctp_send_stale_cookie_err(net, ep, asoc, chunk, commands,
2056 err_chk_p);
2057 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2058 case -SCTP_IERROR_BAD_SIG:
2059 default:
2060 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2061 }
2062 }
2063
2064
2065
2066
2067 action = sctp_tietags_compare(new_asoc, asoc);
2068
2069 switch (action) {
2070 case 'A':
2071 retval = sctp_sf_do_dupcook_a(net, ep, asoc, chunk, commands,
2072 new_asoc);
2073 break;
2074
2075 case 'B':
2076 retval = sctp_sf_do_dupcook_b(net, ep, asoc, chunk, commands,
2077 new_asoc);
2078 break;
2079
2080 case 'C':
2081 retval = sctp_sf_do_dupcook_c(net, ep, asoc, chunk, commands,
2082 new_asoc);
2083 break;
2084
2085 case 'D':
2086 retval = sctp_sf_do_dupcook_d(net, ep, asoc, chunk, commands,
2087 new_asoc);
2088 break;
2089
2090 default:
2091 retval = sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2092 break;
2093 }
2094
2095
2096 sctp_add_cmd_sf(commands, SCTP_CMD_SET_ASOC, SCTP_ASOC(new_asoc));
2097 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
2098
2099
2100
2101
2102 sctp_add_cmd_sf(commands, SCTP_CMD_SET_ASOC,
2103 SCTP_ASOC((struct sctp_association *)asoc));
2104
2105 return retval;
2106
2107nomem:
2108 return SCTP_DISPOSITION_NOMEM;
2109}
2110
2111
2112
2113
2114
2115
2116sctp_disposition_t sctp_sf_shutdown_pending_abort(
2117 struct net *net,
2118 const struct sctp_endpoint *ep,
2119 const struct sctp_association *asoc,
2120 const sctp_subtype_t type,
2121 void *arg,
2122 sctp_cmd_seq_t *commands)
2123{
2124 struct sctp_chunk *chunk = arg;
2125
2126 if (!sctp_vtag_verify_either(chunk, asoc))
2127 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2128
2129
2130
2131
2132
2133
2134
2135
2136
2137
2138
2139 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
2140 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2141
2142
2143
2144
2145
2146
2147 if (SCTP_ADDR_DEL ==
2148 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2149 return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
2150
2151 return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
2152}
2153
2154
2155
2156
2157
2158
2159sctp_disposition_t sctp_sf_shutdown_sent_abort(struct net *net,
2160 const struct sctp_endpoint *ep,
2161 const struct sctp_association *asoc,
2162 const sctp_subtype_t type,
2163 void *arg,
2164 sctp_cmd_seq_t *commands)
2165{
2166 struct sctp_chunk *chunk = arg;
2167
2168 if (!sctp_vtag_verify_either(chunk, asoc))
2169 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2170
2171
2172
2173
2174
2175
2176
2177
2178
2179
2180
2181 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
2182 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2183
2184
2185
2186
2187
2188
2189 if (SCTP_ADDR_DEL ==
2190 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2191 return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
2192
2193
2194 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2195 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
2196
2197
2198 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2199 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
2200
2201 return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
2202}
2203
2204
2205
2206
2207
2208
2209sctp_disposition_t sctp_sf_shutdown_ack_sent_abort(
2210 struct net *net,
2211 const struct sctp_endpoint *ep,
2212 const struct sctp_association *asoc,
2213 const sctp_subtype_t type,
2214 void *arg,
2215 sctp_cmd_seq_t *commands)
2216{
2217
2218
2219
2220 return sctp_sf_shutdown_sent_abort(net, ep, asoc, type, arg, commands);
2221}
2222
2223
2224
2225
2226
2227
2228
2229
2230
2231
2232
2233
2234
2235
2236
2237sctp_disposition_t sctp_sf_cookie_echoed_err(struct net *net,
2238 const struct sctp_endpoint *ep,
2239 const struct sctp_association *asoc,
2240 const sctp_subtype_t type,
2241 void *arg,
2242 sctp_cmd_seq_t *commands)
2243{
2244 struct sctp_chunk *chunk = arg;
2245 sctp_errhdr_t *err;
2246
2247 if (!sctp_vtag_verify(chunk, asoc))
2248 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2249
2250
2251
2252
2253 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_operr_chunk_t)))
2254 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2255 commands);
2256
2257
2258
2259
2260
2261
2262 sctp_walk_errors(err, chunk->chunk_hdr) {
2263 if (SCTP_ERROR_STALE_COOKIE == err->cause)
2264 return sctp_sf_do_5_2_6_stale(net, ep, asoc, type,
2265 arg, commands);
2266 }
2267
2268
2269
2270
2271
2272
2273 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2274}
2275
2276
2277
2278
2279
2280
2281
2282
2283
2284
2285
2286
2287
2288
2289
2290
2291
2292
2293
2294
2295
2296
2297
2298
2299
2300
2301static sctp_disposition_t sctp_sf_do_5_2_6_stale(struct net *net,
2302 const struct sctp_endpoint *ep,
2303 const struct sctp_association *asoc,
2304 const sctp_subtype_t type,
2305 void *arg,
2306 sctp_cmd_seq_t *commands)
2307{
2308 struct sctp_chunk *chunk = arg;
2309 u32 stale;
2310 sctp_cookie_preserve_param_t bht;
2311 sctp_errhdr_t *err;
2312 struct sctp_chunk *reply;
2313 struct sctp_bind_addr *bp;
2314 int attempts = asoc->init_err_counter + 1;
2315
2316 if (attempts > asoc->max_init_attempts) {
2317 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
2318 SCTP_ERROR(ETIMEDOUT));
2319 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
2320 SCTP_PERR(SCTP_ERROR_STALE_COOKIE));
2321 return SCTP_DISPOSITION_DELETE_TCB;
2322 }
2323
2324 err = (sctp_errhdr_t *)(chunk->skb->data);
2325
2326
2327
2328
2329
2330
2331
2332
2333
2334
2335
2336
2337
2338
2339
2340 stale = ntohl(*(__be32 *)((u8 *)err + sizeof(sctp_errhdr_t)));
2341 stale = (stale * 2) / 1000;
2342
2343 bht.param_hdr.type = SCTP_PARAM_COOKIE_PRESERVATIVE;
2344 bht.param_hdr.length = htons(sizeof(bht));
2345 bht.lifespan_increment = htonl(stale);
2346
2347
2348 bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
2349 reply = sctp_make_init(asoc, bp, GFP_ATOMIC, sizeof(bht));
2350 if (!reply)
2351 goto nomem;
2352
2353 sctp_addto_chunk(reply, sizeof(bht), &bht);
2354
2355
2356 sctp_add_cmd_sf(commands, SCTP_CMD_CLEAR_INIT_TAG, SCTP_NULL());
2357
2358
2359 sctp_add_cmd_sf(commands, SCTP_CMD_T3_RTX_TIMERS_STOP, SCTP_NULL());
2360 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
2361
2362
2363
2364
2365 sctp_add_cmd_sf(commands, SCTP_CMD_DEL_NON_PRIMARY, SCTP_NULL());
2366
2367
2368
2369
2370 sctp_add_cmd_sf(commands, SCTP_CMD_T1_RETRAN,
2371 SCTP_TRANSPORT(asoc->peer.primary_path));
2372
2373
2374
2375
2376 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_INC, SCTP_NULL());
2377
2378 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2379 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
2380 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2381 SCTP_STATE(SCTP_STATE_COOKIE_WAIT));
2382 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
2383 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
2384
2385 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
2386
2387 return SCTP_DISPOSITION_CONSUME;
2388
2389nomem:
2390 return SCTP_DISPOSITION_NOMEM;
2391}
2392
2393
2394
2395
2396
2397
2398
2399
2400
2401
2402
2403
2404
2405
2406
2407
2408
2409
2410
2411
2412
2413
2414
2415
2416
2417
2418
2419
2420
2421
2422
2423
2424sctp_disposition_t sctp_sf_do_9_1_abort(struct net *net,
2425 const struct sctp_endpoint *ep,
2426 const struct sctp_association *asoc,
2427 const sctp_subtype_t type,
2428 void *arg,
2429 sctp_cmd_seq_t *commands)
2430{
2431 struct sctp_chunk *chunk = arg;
2432
2433 if (!sctp_vtag_verify_either(chunk, asoc))
2434 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2435
2436
2437
2438
2439
2440
2441
2442
2443
2444
2445
2446 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
2447 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2448
2449
2450
2451
2452
2453
2454 if (SCTP_ADDR_DEL ==
2455 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2456 return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
2457
2458 return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
2459}
2460
2461static sctp_disposition_t __sctp_sf_do_9_1_abort(struct net *net,
2462 const struct sctp_endpoint *ep,
2463 const struct sctp_association *asoc,
2464 const sctp_subtype_t type,
2465 void *arg,
2466 sctp_cmd_seq_t *commands)
2467{
2468 struct sctp_chunk *chunk = arg;
2469 unsigned int len;
2470 __be16 error = SCTP_ERROR_NO_ERROR;
2471
2472
2473 len = ntohs(chunk->chunk_hdr->length);
2474 if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr)) {
2475
2476 sctp_errhdr_t *err;
2477 sctp_walk_errors(err, chunk->chunk_hdr);
2478 if ((void *)err != (void *)chunk->chunk_end)
2479 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2480
2481 error = ((sctp_errhdr_t *)chunk->skb->data)->cause;
2482 }
2483
2484 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(ECONNRESET));
2485
2486 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, SCTP_PERR(error));
2487 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
2488 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
2489
2490 return SCTP_DISPOSITION_ABORT;
2491}
2492
2493
2494
2495
2496
2497
2498sctp_disposition_t sctp_sf_cookie_wait_abort(struct net *net,
2499 const struct sctp_endpoint *ep,
2500 const struct sctp_association *asoc,
2501 const sctp_subtype_t type,
2502 void *arg,
2503 sctp_cmd_seq_t *commands)
2504{
2505 struct sctp_chunk *chunk = arg;
2506 unsigned int len;
2507 __be16 error = SCTP_ERROR_NO_ERROR;
2508
2509 if (!sctp_vtag_verify_either(chunk, asoc))
2510 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2511
2512
2513
2514
2515
2516
2517
2518
2519
2520
2521
2522 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
2523 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2524
2525
2526 len = ntohs(chunk->chunk_hdr->length);
2527 if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
2528 error = ((sctp_errhdr_t *)chunk->skb->data)->cause;
2529
2530 return sctp_stop_t1_and_abort(net, commands, error, ECONNREFUSED, asoc,
2531 chunk->transport);
2532}
2533
2534
2535
2536
2537sctp_disposition_t sctp_sf_cookie_wait_icmp_abort(struct net *net,
2538 const struct sctp_endpoint *ep,
2539 const struct sctp_association *asoc,
2540 const sctp_subtype_t type,
2541 void *arg,
2542 sctp_cmd_seq_t *commands)
2543{
2544 return sctp_stop_t1_and_abort(net, commands, SCTP_ERROR_NO_ERROR,
2545 ENOPROTOOPT, asoc,
2546 (struct sctp_transport *)arg);
2547}
2548
2549
2550
2551
2552sctp_disposition_t sctp_sf_cookie_echoed_abort(struct net *net,
2553 const struct sctp_endpoint *ep,
2554 const struct sctp_association *asoc,
2555 const sctp_subtype_t type,
2556 void *arg,
2557 sctp_cmd_seq_t *commands)
2558{
2559
2560
2561
2562 return sctp_sf_cookie_wait_abort(net, ep, asoc, type, arg, commands);
2563}
2564
2565
2566
2567
2568
2569
2570static sctp_disposition_t sctp_stop_t1_and_abort(struct net *net,
2571 sctp_cmd_seq_t *commands,
2572 __be16 error, int sk_err,
2573 const struct sctp_association *asoc,
2574 struct sctp_transport *transport)
2575{
2576 pr_debug("%s: ABORT received (INIT)\n", __func__);
2577
2578 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2579 SCTP_STATE(SCTP_STATE_CLOSED));
2580 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
2581 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2582 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
2583 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(sk_err));
2584
2585 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
2586 SCTP_PERR(error));
2587
2588 return SCTP_DISPOSITION_ABORT;
2589}
2590
2591
2592
2593
2594
2595
2596
2597
2598
2599
2600
2601
2602
2603
2604
2605
2606
2607
2608
2609
2610
2611
2612
2613
2614
2615
2616
2617
2618
2619
2620
2621
2622
2623
2624sctp_disposition_t sctp_sf_do_9_2_shutdown(struct net *net,
2625 const struct sctp_endpoint *ep,
2626 const struct sctp_association *asoc,
2627 const sctp_subtype_t type,
2628 void *arg,
2629 sctp_cmd_seq_t *commands)
2630{
2631 struct sctp_chunk *chunk = arg;
2632 sctp_shutdownhdr_t *sdh;
2633 sctp_disposition_t disposition;
2634 struct sctp_ulpevent *ev;
2635 __u32 ctsn;
2636
2637 if (!sctp_vtag_verify(chunk, asoc))
2638 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2639
2640
2641 if (!sctp_chunk_length_valid(chunk,
2642 sizeof(struct sctp_shutdown_chunk_t)))
2643 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2644 commands);
2645
2646
2647 sdh = (sctp_shutdownhdr_t *)chunk->skb->data;
2648 skb_pull(chunk->skb, sizeof(sctp_shutdownhdr_t));
2649 chunk->subh.shutdown_hdr = sdh;
2650 ctsn = ntohl(sdh->cum_tsn_ack);
2651
2652 if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
2653 pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn,
2654 asoc->ctsn_ack_point);
2655
2656 return SCTP_DISPOSITION_DISCARD;
2657 }
2658
2659
2660
2661
2662
2663 if (!TSN_lt(ctsn, asoc->next_tsn))
2664 return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands);
2665
2666
2667
2668
2669
2670 ev = sctp_ulpevent_make_shutdown_event(asoc, 0, GFP_ATOMIC);
2671 if (!ev) {
2672 disposition = SCTP_DISPOSITION_NOMEM;
2673 goto out;
2674 }
2675 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
2676
2677
2678
2679
2680
2681
2682
2683 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2684 SCTP_STATE(SCTP_STATE_SHUTDOWN_RECEIVED));
2685 disposition = SCTP_DISPOSITION_CONSUME;
2686
2687 if (sctp_outq_is_empty(&asoc->outqueue)) {
2688 disposition = sctp_sf_do_9_2_shutdown_ack(net, ep, asoc, type,
2689 arg, commands);
2690 }
2691
2692 if (SCTP_DISPOSITION_NOMEM == disposition)
2693 goto out;
2694
2695
2696
2697
2698
2699 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_CTSN,
2700 SCTP_BE32(chunk->subh.shutdown_hdr->cum_tsn_ack));
2701
2702out:
2703 return disposition;
2704}
2705
2706
2707
2708
2709
2710
2711
2712
2713
2714sctp_disposition_t sctp_sf_do_9_2_shut_ctsn(struct net *net,
2715 const struct sctp_endpoint *ep,
2716 const struct sctp_association *asoc,
2717 const sctp_subtype_t type,
2718 void *arg,
2719 sctp_cmd_seq_t *commands)
2720{
2721 struct sctp_chunk *chunk = arg;
2722 sctp_shutdownhdr_t *sdh;
2723 __u32 ctsn;
2724
2725 if (!sctp_vtag_verify(chunk, asoc))
2726 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2727
2728
2729 if (!sctp_chunk_length_valid(chunk,
2730 sizeof(struct sctp_shutdown_chunk_t)))
2731 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2732 commands);
2733
2734 sdh = (sctp_shutdownhdr_t *)chunk->skb->data;
2735 ctsn = ntohl(sdh->cum_tsn_ack);
2736
2737 if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
2738 pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn,
2739 asoc->ctsn_ack_point);
2740
2741 return SCTP_DISPOSITION_DISCARD;
2742 }
2743
2744
2745
2746
2747
2748 if (!TSN_lt(ctsn, asoc->next_tsn))
2749 return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands);
2750
2751
2752
2753
2754
2755 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_CTSN,
2756 SCTP_BE32(sdh->cum_tsn_ack));
2757
2758 return SCTP_DISPOSITION_CONSUME;
2759}
2760
2761
2762
2763
2764
2765
2766
2767
2768sctp_disposition_t sctp_sf_do_9_2_reshutack(struct net *net,
2769 const struct sctp_endpoint *ep,
2770 const struct sctp_association *asoc,
2771 const sctp_subtype_t type,
2772 void *arg,
2773 sctp_cmd_seq_t *commands)
2774{
2775 struct sctp_chunk *chunk = (struct sctp_chunk *) arg;
2776 struct sctp_chunk *reply;
2777
2778
2779 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
2780 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2781 commands);
2782
2783
2784
2785
2786
2787 reply = sctp_make_shutdown_ack(asoc, chunk);
2788 if (NULL == reply)
2789 goto nomem;
2790
2791
2792
2793
2794 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
2795
2796
2797 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
2798 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
2799
2800 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
2801
2802 return SCTP_DISPOSITION_CONSUME;
2803nomem:
2804 return SCTP_DISPOSITION_NOMEM;
2805}
2806
2807
2808
2809
2810
2811
2812
2813
2814
2815
2816
2817
2818
2819
2820
2821
2822
2823
2824
2825
2826
2827
2828
2829
2830
2831
2832sctp_disposition_t sctp_sf_do_ecn_cwr(struct net *net,
2833 const struct sctp_endpoint *ep,
2834 const struct sctp_association *asoc,
2835 const sctp_subtype_t type,
2836 void *arg,
2837 sctp_cmd_seq_t *commands)
2838{
2839 sctp_cwrhdr_t *cwr;
2840 struct sctp_chunk *chunk = arg;
2841 u32 lowest_tsn;
2842
2843 if (!sctp_vtag_verify(chunk, asoc))
2844 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2845
2846 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_ecne_chunk_t)))
2847 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2848 commands);
2849
2850 cwr = (sctp_cwrhdr_t *) chunk->skb->data;
2851 skb_pull(chunk->skb, sizeof(sctp_cwrhdr_t));
2852
2853 lowest_tsn = ntohl(cwr->lowest_tsn);
2854
2855
2856 if (TSN_lte(asoc->last_ecne_tsn, lowest_tsn)) {
2857
2858 sctp_add_cmd_sf(commands,
2859 SCTP_CMD_ECN_CWR,
2860 SCTP_U32(lowest_tsn));
2861 }
2862 return SCTP_DISPOSITION_CONSUME;
2863}
2864
2865
2866
2867
2868
2869
2870
2871
2872
2873
2874
2875
2876
2877
2878
2879
2880
2881
2882
2883
2884
2885
2886
2887
2888sctp_disposition_t sctp_sf_do_ecne(struct net *net,
2889 const struct sctp_endpoint *ep,
2890 const struct sctp_association *asoc,
2891 const sctp_subtype_t type,
2892 void *arg,
2893 sctp_cmd_seq_t *commands)
2894{
2895 sctp_ecnehdr_t *ecne;
2896 struct sctp_chunk *chunk = arg;
2897
2898 if (!sctp_vtag_verify(chunk, asoc))
2899 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2900
2901 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_ecne_chunk_t)))
2902 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2903 commands);
2904
2905 ecne = (sctp_ecnehdr_t *) chunk->skb->data;
2906 skb_pull(chunk->skb, sizeof(sctp_ecnehdr_t));
2907
2908
2909 sctp_add_cmd_sf(commands, SCTP_CMD_ECN_ECNE,
2910 SCTP_U32(ntohl(ecne->lowest_tsn)));
2911
2912 return SCTP_DISPOSITION_CONSUME;
2913}
2914
2915
2916
2917
2918
2919
2920
2921
2922
2923
2924
2925
2926
2927
2928
2929
2930
2931
2932
2933
2934
2935
2936
2937
2938
2939
2940
2941
2942
2943
2944
2945sctp_disposition_t sctp_sf_eat_data_6_2(struct net *net,
2946 const struct sctp_endpoint *ep,
2947 const struct sctp_association *asoc,
2948 const sctp_subtype_t type,
2949 void *arg,
2950 sctp_cmd_seq_t *commands)
2951{
2952 struct sctp_chunk *chunk = arg;
2953 sctp_arg_t force = SCTP_NOFORCE();
2954 int error;
2955
2956 if (!sctp_vtag_verify(chunk, asoc)) {
2957 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
2958 SCTP_NULL());
2959 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2960 }
2961
2962 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_data_chunk_t)))
2963 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2964 commands);
2965
2966 error = sctp_eat_data(asoc, chunk, commands);
2967 switch (error) {
2968 case SCTP_IERROR_NO_ERROR:
2969 break;
2970 case SCTP_IERROR_HIGH_TSN:
2971 case SCTP_IERROR_BAD_STREAM:
2972 SCTP_INC_STATS(net, SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
2973 goto discard_noforce;
2974 case SCTP_IERROR_DUP_TSN:
2975 case SCTP_IERROR_IGNORE_TSN:
2976 SCTP_INC_STATS(net, SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
2977 goto discard_force;
2978 case SCTP_IERROR_NO_DATA:
2979 return SCTP_DISPOSITION_ABORT;
2980 case SCTP_IERROR_PROTO_VIOLATION:
2981 return sctp_sf_abort_violation(net, ep, asoc, chunk, commands,
2982 (u8 *)chunk->subh.data_hdr, sizeof(sctp_datahdr_t));
2983 default:
2984 BUG();
2985 }
2986
2987 if (chunk->chunk_hdr->flags & SCTP_DATA_SACK_IMM)
2988 force = SCTP_FORCE();
2989
2990 if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) {
2991 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
2992 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
2993 }
2994
2995
2996
2997
2998
2999
3000
3001
3002
3003
3004
3005
3006
3007
3008
3009
3010
3011
3012
3013
3014
3015
3016
3017 if (chunk->end_of_packet)
3018 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, force);
3019
3020 return SCTP_DISPOSITION_CONSUME;
3021
3022discard_force:
3023
3024
3025
3026
3027
3028
3029
3030
3031
3032
3033
3034
3035
3036
3037 if (chunk->end_of_packet)
3038 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
3039 return SCTP_DISPOSITION_DISCARD;
3040
3041discard_noforce:
3042 if (chunk->end_of_packet)
3043 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, force);
3044
3045 return SCTP_DISPOSITION_DISCARD;
3046}
3047
3048
3049
3050
3051
3052
3053
3054
3055
3056
3057
3058
3059
3060
3061
3062
3063
3064sctp_disposition_t sctp_sf_eat_data_fast_4_4(struct net *net,
3065 const struct sctp_endpoint *ep,
3066 const struct sctp_association *asoc,
3067 const sctp_subtype_t type,
3068 void *arg,
3069 sctp_cmd_seq_t *commands)
3070{
3071 struct sctp_chunk *chunk = arg;
3072 int error;
3073
3074 if (!sctp_vtag_verify(chunk, asoc)) {
3075 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3076 SCTP_NULL());
3077 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3078 }
3079
3080 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_data_chunk_t)))
3081 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3082 commands);
3083
3084 error = sctp_eat_data(asoc, chunk, commands);
3085 switch (error) {
3086 case SCTP_IERROR_NO_ERROR:
3087 case SCTP_IERROR_HIGH_TSN:
3088 case SCTP_IERROR_DUP_TSN:
3089 case SCTP_IERROR_IGNORE_TSN:
3090 case SCTP_IERROR_BAD_STREAM:
3091 break;
3092 case SCTP_IERROR_NO_DATA:
3093 return SCTP_DISPOSITION_ABORT;
3094 case SCTP_IERROR_PROTO_VIOLATION:
3095 return sctp_sf_abort_violation(net, ep, asoc, chunk, commands,
3096 (u8 *)chunk->subh.data_hdr, sizeof(sctp_datahdr_t));
3097 default:
3098 BUG();
3099 }
3100
3101
3102
3103
3104
3105
3106
3107
3108
3109 if (chunk->end_of_packet) {
3110
3111
3112
3113 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SHUTDOWN, SCTP_NULL());
3114 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
3115 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
3116 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
3117 }
3118
3119 return SCTP_DISPOSITION_CONSUME;
3120}
3121
3122
3123
3124
3125
3126
3127
3128
3129
3130
3131
3132
3133
3134
3135
3136
3137
3138
3139
3140
3141
3142
3143
3144
3145
3146
3147
3148
3149
3150
3151
3152
3153
3154sctp_disposition_t sctp_sf_eat_sack_6_2(struct net *net,
3155 const struct sctp_endpoint *ep,
3156 const struct sctp_association *asoc,
3157 const sctp_subtype_t type,
3158 void *arg,
3159 sctp_cmd_seq_t *commands)
3160{
3161 struct sctp_chunk *chunk = arg;
3162 sctp_sackhdr_t *sackh;
3163 __u32 ctsn;
3164
3165 if (!sctp_vtag_verify(chunk, asoc))
3166 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3167
3168
3169 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_sack_chunk_t)))
3170 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3171 commands);
3172
3173
3174 sackh = sctp_sm_pull_sack(chunk);
3175
3176 if (!sackh)
3177 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3178 chunk->subh.sack_hdr = sackh;
3179 ctsn = ntohl(sackh->cum_tsn_ack);
3180
3181
3182
3183
3184
3185
3186
3187 if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
3188 pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn,
3189 asoc->ctsn_ack_point);
3190
3191 return SCTP_DISPOSITION_DISCARD;
3192 }
3193
3194
3195
3196
3197
3198 if (!TSN_lt(ctsn, asoc->next_tsn))
3199 return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands);
3200
3201
3202 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_SACK, SCTP_CHUNK(chunk));
3203
3204
3205
3206
3207 return SCTP_DISPOSITION_CONSUME;
3208}
3209
3210
3211
3212
3213
3214
3215
3216
3217
3218
3219
3220
3221
3222
3223
3224
3225
3226
3227
3228static sctp_disposition_t sctp_sf_tabort_8_4_8(struct net *net,
3229 const struct sctp_endpoint *ep,
3230 const struct sctp_association *asoc,
3231 const sctp_subtype_t type,
3232 void *arg,
3233 sctp_cmd_seq_t *commands)
3234{
3235 struct sctp_packet *packet = NULL;
3236 struct sctp_chunk *chunk = arg;
3237 struct sctp_chunk *abort;
3238
3239 packet = sctp_ootb_pkt_new(net, asoc, chunk);
3240
3241 if (packet) {
3242
3243
3244
3245 abort = sctp_make_abort(asoc, chunk, 0);
3246 if (!abort) {
3247 sctp_ootb_pkt_free(packet);
3248 return SCTP_DISPOSITION_NOMEM;
3249 }
3250
3251
3252 if (sctp_test_T_bit(abort))
3253 packet->vtag = ntohl(chunk->sctp_hdr->vtag);
3254
3255
3256 abort->skb->sk = ep->base.sk;
3257
3258 sctp_packet_append_chunk(packet, abort);
3259
3260 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
3261 SCTP_PACKET(packet));
3262
3263 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
3264
3265 sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3266 return SCTP_DISPOSITION_CONSUME;
3267 }
3268
3269 return SCTP_DISPOSITION_NOMEM;
3270}
3271
3272
3273
3274
3275
3276
3277
3278
3279
3280sctp_disposition_t sctp_sf_operr_notify(struct net *net,
3281 const struct sctp_endpoint *ep,
3282 const struct sctp_association *asoc,
3283 const sctp_subtype_t type,
3284 void *arg,
3285 sctp_cmd_seq_t *commands)
3286{
3287 struct sctp_chunk *chunk = arg;
3288 sctp_errhdr_t *err;
3289
3290 if (!sctp_vtag_verify(chunk, asoc))
3291 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3292
3293
3294 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_operr_chunk_t)))
3295 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3296 commands);
3297 sctp_walk_errors(err, chunk->chunk_hdr);
3298 if ((void *)err != (void *)chunk->chunk_end)
3299 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
3300 (void *)err, commands);
3301
3302 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,
3303 SCTP_CHUNK(chunk));
3304
3305 return SCTP_DISPOSITION_CONSUME;
3306}
3307
3308
3309
3310
3311
3312
3313
3314
3315
3316
3317
3318sctp_disposition_t sctp_sf_do_9_2_final(struct net *net,
3319 const struct sctp_endpoint *ep,
3320 const struct sctp_association *asoc,
3321 const sctp_subtype_t type,
3322 void *arg,
3323 sctp_cmd_seq_t *commands)
3324{
3325 struct sctp_chunk *chunk = arg;
3326 struct sctp_chunk *reply;
3327 struct sctp_ulpevent *ev;
3328
3329 if (!sctp_vtag_verify(chunk, asoc))
3330 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3331
3332
3333 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
3334 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3335 commands);
3336
3337
3338
3339
3340
3341 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_SHUTDOWN_COMP,
3342 0, 0, 0, NULL, GFP_ATOMIC);
3343 if (!ev)
3344 goto nomem;
3345
3346
3347 reply = sctp_make_shutdown_complete(asoc, chunk);
3348 if (!reply)
3349 goto nomem_chunk;
3350
3351
3352
3353
3354 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
3355
3356
3357
3358
3359 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3360 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
3361
3362 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3363 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
3364
3365 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
3366 SCTP_STATE(SCTP_STATE_CLOSED));
3367 SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS);
3368 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
3369 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
3370
3371
3372 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
3373 return SCTP_DISPOSITION_DELETE_TCB;
3374
3375nomem_chunk:
3376 sctp_ulpevent_free(ev);
3377nomem:
3378 return SCTP_DISPOSITION_NOMEM;
3379}
3380
3381
3382
3383
3384
3385
3386
3387
3388
3389
3390
3391
3392
3393
3394
3395
3396
3397
3398
3399
3400
3401sctp_disposition_t sctp_sf_ootb(struct net *net,
3402 const struct sctp_endpoint *ep,
3403 const struct sctp_association *asoc,
3404 const sctp_subtype_t type,
3405 void *arg,
3406 sctp_cmd_seq_t *commands)
3407{
3408 struct sctp_chunk *chunk = arg;
3409 struct sk_buff *skb = chunk->skb;
3410 sctp_chunkhdr_t *ch;
3411 sctp_errhdr_t *err;
3412 __u8 *ch_end;
3413 int ootb_shut_ack = 0;
3414 int ootb_cookie_ack = 0;
3415
3416 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
3417
3418 ch = (sctp_chunkhdr_t *) chunk->chunk_hdr;
3419 do {
3420
3421 if (ntohs(ch->length) < sizeof(sctp_chunkhdr_t))
3422 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3423 commands);
3424
3425
3426
3427
3428 if (SCTP_CID_SHUTDOWN_ACK == ch->type)
3429 ootb_shut_ack = 1;
3430
3431
3432
3433
3434
3435
3436 if (SCTP_CID_ABORT == ch->type)
3437 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3438
3439
3440
3441
3442
3443
3444 if (SCTP_CID_COOKIE_ACK == ch->type)
3445 ootb_cookie_ack = 1;
3446
3447 if (SCTP_CID_ERROR == ch->type) {
3448 sctp_walk_errors(err, ch) {
3449 if (SCTP_ERROR_STALE_COOKIE == err->cause) {
3450 ootb_cookie_ack = 1;
3451 break;
3452 }
3453 }
3454 }
3455
3456
3457 ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length));
3458 if (ch_end > skb_tail_pointer(skb))
3459 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3460 commands);
3461
3462 ch = (sctp_chunkhdr_t *) ch_end;
3463 } while (ch_end < skb_tail_pointer(skb));
3464
3465 if (ootb_shut_ack)
3466 return sctp_sf_shut_8_4_5(net, ep, asoc, type, arg, commands);
3467 else if (ootb_cookie_ack)
3468 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3469 else
3470 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
3471}
3472
3473
3474
3475
3476
3477
3478
3479
3480
3481
3482
3483
3484
3485
3486
3487
3488
3489
3490
3491
3492
3493
3494static sctp_disposition_t sctp_sf_shut_8_4_5(struct net *net,
3495 const struct sctp_endpoint *ep,
3496 const struct sctp_association *asoc,
3497 const sctp_subtype_t type,
3498 void *arg,
3499 sctp_cmd_seq_t *commands)
3500{
3501 struct sctp_packet *packet = NULL;
3502 struct sctp_chunk *chunk = arg;
3503 struct sctp_chunk *shut;
3504
3505 packet = sctp_ootb_pkt_new(net, asoc, chunk);
3506
3507 if (packet) {
3508
3509
3510
3511 shut = sctp_make_shutdown_complete(asoc, chunk);
3512 if (!shut) {
3513 sctp_ootb_pkt_free(packet);
3514 return SCTP_DISPOSITION_NOMEM;
3515 }
3516
3517
3518 if (sctp_test_T_bit(shut))
3519 packet->vtag = ntohl(chunk->sctp_hdr->vtag);
3520
3521
3522 shut->skb->sk = ep->base.sk;
3523
3524 sctp_packet_append_chunk(packet, shut);
3525
3526 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
3527 SCTP_PACKET(packet));
3528
3529 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
3530
3531
3532
3533
3534 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
3535 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3536
3537
3538
3539
3540
3541 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3542 }
3543
3544 return SCTP_DISPOSITION_NOMEM;
3545}
3546
3547
3548
3549
3550
3551
3552
3553
3554
3555
3556
3557
3558sctp_disposition_t sctp_sf_do_8_5_1_E_sa(struct net *net,
3559 const struct sctp_endpoint *ep,
3560 const struct sctp_association *asoc,
3561 const sctp_subtype_t type,
3562 void *arg,
3563 sctp_cmd_seq_t *commands)
3564{
3565 struct sctp_chunk *chunk = arg;
3566
3567
3568 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
3569 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3570 commands);
3571
3572
3573
3574
3575
3576
3577 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
3578
3579 return sctp_sf_shut_8_4_5(net, ep, NULL, type, arg, commands);
3580}
3581
3582
3583sctp_disposition_t sctp_sf_do_asconf(struct net *net,
3584 const struct sctp_endpoint *ep,
3585 const struct sctp_association *asoc,
3586 const sctp_subtype_t type, void *arg,
3587 sctp_cmd_seq_t *commands)
3588{
3589 struct sctp_chunk *chunk = arg;
3590 struct sctp_chunk *asconf_ack = NULL;
3591 struct sctp_paramhdr *err_param = NULL;
3592 sctp_addiphdr_t *hdr;
3593 __u32 serial;
3594
3595 if (!sctp_vtag_verify(chunk, asoc)) {
3596 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3597 SCTP_NULL());
3598 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3599 }
3600
3601
3602
3603
3604
3605
3606
3607 if (!net->sctp.addip_noauth && !chunk->auth)
3608 return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
3609
3610
3611 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_addip_chunk_t)))
3612 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3613 commands);
3614
3615 hdr = (sctp_addiphdr_t *)chunk->skb->data;
3616 serial = ntohl(hdr->serial);
3617
3618
3619 if (!sctp_verify_asconf(asoc, chunk, true, &err_param))
3620 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
3621 (void *)err_param, commands);
3622
3623
3624
3625
3626
3627 if (serial == asoc->peer.addip_serial + 1) {
3628
3629
3630
3631 if (!chunk->has_asconf)
3632 sctp_assoc_clean_asconf_ack_cache(asoc);
3633
3634
3635
3636
3637
3638
3639
3640
3641
3642 asconf_ack = sctp_process_asconf((struct sctp_association *)
3643 asoc, chunk);
3644 if (!asconf_ack)
3645 return SCTP_DISPOSITION_NOMEM;
3646 } else if (serial < asoc->peer.addip_serial + 1) {
3647
3648
3649
3650
3651
3652
3653
3654
3655
3656
3657
3658
3659 asconf_ack = sctp_assoc_lookup_asconf_ack(asoc, hdr->serial);
3660 if (!asconf_ack)
3661 return SCTP_DISPOSITION_DISCARD;
3662
3663
3664
3665
3666
3667 asconf_ack->transport = NULL;
3668 } else {
3669
3670
3671
3672 return SCTP_DISPOSITION_DISCARD;
3673 }
3674
3675
3676
3677
3678
3679
3680
3681
3682
3683
3684 asconf_ack->dest = chunk->source;
3685 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(asconf_ack));
3686 if (asoc->new_transport) {
3687 sctp_sf_heartbeat(ep, asoc, type, asoc->new_transport, commands);
3688 ((struct sctp_association *)asoc)->new_transport = NULL;
3689 }
3690
3691 return SCTP_DISPOSITION_CONSUME;
3692}
3693
3694
3695
3696
3697
3698
3699sctp_disposition_t sctp_sf_do_asconf_ack(struct net *net,
3700 const struct sctp_endpoint *ep,
3701 const struct sctp_association *asoc,
3702 const sctp_subtype_t type, void *arg,
3703 sctp_cmd_seq_t *commands)
3704{
3705 struct sctp_chunk *asconf_ack = arg;
3706 struct sctp_chunk *last_asconf = asoc->addip_last_asconf;
3707 struct sctp_chunk *abort;
3708 struct sctp_paramhdr *err_param = NULL;
3709 sctp_addiphdr_t *addip_hdr;
3710 __u32 sent_serial, rcvd_serial;
3711
3712 if (!sctp_vtag_verify(asconf_ack, asoc)) {
3713 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3714 SCTP_NULL());
3715 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3716 }
3717
3718
3719
3720
3721
3722
3723
3724 if (!net->sctp.addip_noauth && !asconf_ack->auth)
3725 return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
3726
3727
3728 if (!sctp_chunk_length_valid(asconf_ack, sizeof(sctp_addip_chunk_t)))
3729 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3730 commands);
3731
3732 addip_hdr = (sctp_addiphdr_t *)asconf_ack->skb->data;
3733 rcvd_serial = ntohl(addip_hdr->serial);
3734
3735
3736 if (!sctp_verify_asconf(asoc, asconf_ack, false, &err_param))
3737 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
3738 (void *)err_param, commands);
3739
3740 if (last_asconf) {
3741 addip_hdr = (sctp_addiphdr_t *)last_asconf->subh.addip_hdr;
3742 sent_serial = ntohl(addip_hdr->serial);
3743 } else {
3744 sent_serial = asoc->addip_serial - 1;
3745 }
3746
3747
3748
3749
3750
3751
3752
3753 if (ADDIP_SERIAL_gte(rcvd_serial, sent_serial + 1) &&
3754 !(asoc->addip_last_asconf)) {
3755 abort = sctp_make_abort(asoc, asconf_ack,
3756 sizeof(sctp_errhdr_t));
3757 if (abort) {
3758 sctp_init_cause(abort, SCTP_ERROR_ASCONF_ACK, 0);
3759 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
3760 SCTP_CHUNK(abort));
3761 }
3762
3763
3764
3765 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3766 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
3767 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
3768 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
3769 SCTP_ERROR(ECONNABORTED));
3770 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
3771 SCTP_PERR(SCTP_ERROR_ASCONF_ACK));
3772 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
3773 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
3774 return SCTP_DISPOSITION_ABORT;
3775 }
3776
3777 if ((rcvd_serial == sent_serial) && asoc->addip_last_asconf) {
3778 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3779 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
3780
3781 if (!sctp_process_asconf_ack((struct sctp_association *)asoc,
3782 asconf_ack)) {
3783
3784
3785
3786 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_NEXT_ASCONF,
3787 SCTP_NULL());
3788 return SCTP_DISPOSITION_CONSUME;
3789 }
3790
3791 abort = sctp_make_abort(asoc, asconf_ack,
3792 sizeof(sctp_errhdr_t));
3793 if (abort) {
3794 sctp_init_cause(abort, SCTP_ERROR_RSRC_LOW, 0);
3795 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
3796 SCTP_CHUNK(abort));
3797 }
3798
3799
3800
3801 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
3802 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
3803 SCTP_ERROR(ECONNABORTED));
3804 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
3805 SCTP_PERR(SCTP_ERROR_ASCONF_ACK));
3806 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
3807 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
3808 return SCTP_DISPOSITION_ABORT;
3809 }
3810
3811 return SCTP_DISPOSITION_DISCARD;
3812}
3813
3814
3815
3816
3817
3818
3819
3820
3821
3822
3823
3824
3825
3826
3827
3828sctp_disposition_t sctp_sf_eat_fwd_tsn(struct net *net,
3829 const struct sctp_endpoint *ep,
3830 const struct sctp_association *asoc,
3831 const sctp_subtype_t type,
3832 void *arg,
3833 sctp_cmd_seq_t *commands)
3834{
3835 struct sctp_chunk *chunk = arg;
3836 struct sctp_fwdtsn_hdr *fwdtsn_hdr;
3837 struct sctp_fwdtsn_skip *skip;
3838 __u16 len;
3839 __u32 tsn;
3840
3841 if (!sctp_vtag_verify(chunk, asoc)) {
3842 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3843 SCTP_NULL());
3844 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3845 }
3846
3847
3848 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_fwdtsn_chunk)))
3849 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3850 commands);
3851
3852 fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data;
3853 chunk->subh.fwdtsn_hdr = fwdtsn_hdr;
3854 len = ntohs(chunk->chunk_hdr->length);
3855 len -= sizeof(struct sctp_chunkhdr);
3856 skb_pull(chunk->skb, len);
3857
3858 tsn = ntohl(fwdtsn_hdr->new_cum_tsn);
3859 pr_debug("%s: TSN 0x%x\n", __func__, tsn);
3860
3861
3862
3863
3864 if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
3865 goto discard_noforce;
3866
3867
3868 sctp_walk_fwdtsn(skip, chunk) {
3869 if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
3870 goto discard_noforce;
3871 }
3872
3873 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
3874 if (len > sizeof(struct sctp_fwdtsn_hdr))
3875 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
3876 SCTP_CHUNK(chunk));
3877
3878
3879 if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) {
3880 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
3881 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
3882 }
3883
3884
3885
3886
3887 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_NOFORCE());
3888
3889 return SCTP_DISPOSITION_CONSUME;
3890
3891discard_noforce:
3892 return SCTP_DISPOSITION_DISCARD;
3893}
3894
3895sctp_disposition_t sctp_sf_eat_fwd_tsn_fast(
3896 struct net *net,
3897 const struct sctp_endpoint *ep,
3898 const struct sctp_association *asoc,
3899 const sctp_subtype_t type,
3900 void *arg,
3901 sctp_cmd_seq_t *commands)
3902{
3903 struct sctp_chunk *chunk = arg;
3904 struct sctp_fwdtsn_hdr *fwdtsn_hdr;
3905 struct sctp_fwdtsn_skip *skip;
3906 __u16 len;
3907 __u32 tsn;
3908
3909 if (!sctp_vtag_verify(chunk, asoc)) {
3910 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3911 SCTP_NULL());
3912 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3913 }
3914
3915
3916 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_fwdtsn_chunk)))
3917 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3918 commands);
3919
3920 fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data;
3921 chunk->subh.fwdtsn_hdr = fwdtsn_hdr;
3922 len = ntohs(chunk->chunk_hdr->length);
3923 len -= sizeof(struct sctp_chunkhdr);
3924 skb_pull(chunk->skb, len);
3925
3926 tsn = ntohl(fwdtsn_hdr->new_cum_tsn);
3927 pr_debug("%s: TSN 0x%x\n", __func__, tsn);
3928
3929
3930
3931
3932 if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
3933 goto gen_shutdown;
3934
3935
3936 sctp_walk_fwdtsn(skip, chunk) {
3937 if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
3938 goto gen_shutdown;
3939 }
3940
3941 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
3942 if (len > sizeof(struct sctp_fwdtsn_hdr))
3943 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
3944 SCTP_CHUNK(chunk));
3945
3946
3947gen_shutdown:
3948
3949
3950
3951
3952
3953
3954 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SHUTDOWN, SCTP_NULL());
3955 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
3956 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
3957 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
3958
3959 return SCTP_DISPOSITION_CONSUME;
3960}
3961
3962
3963
3964
3965
3966
3967
3968
3969
3970
3971
3972
3973
3974
3975
3976
3977
3978
3979
3980
3981
3982
3983
3984static sctp_ierror_t sctp_sf_authenticate(struct net *net,
3985 const struct sctp_endpoint *ep,
3986 const struct sctp_association *asoc,
3987 const sctp_subtype_t type,
3988 struct sctp_chunk *chunk)
3989{
3990 struct sctp_authhdr *auth_hdr;
3991 struct sctp_hmac *hmac;
3992 unsigned int sig_len;
3993 __u16 key_id;
3994 __u8 *save_digest;
3995 __u8 *digest;
3996
3997
3998 auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
3999 chunk->subh.auth_hdr = auth_hdr;
4000 skb_pull(chunk->skb, sizeof(struct sctp_authhdr));
4001
4002
4003
4004
4005 if (!sctp_auth_asoc_verify_hmac_id(asoc, auth_hdr->hmac_id))
4006 return SCTP_IERROR_AUTH_BAD_HMAC;
4007
4008
4009
4010
4011 key_id = ntohs(auth_hdr->shkey_id);
4012 if (key_id != asoc->active_key_id && !sctp_auth_get_shkey(asoc, key_id))
4013 return SCTP_IERROR_AUTH_BAD_KEYID;
4014
4015
4016
4017
4018
4019 sig_len = ntohs(chunk->chunk_hdr->length) - sizeof(sctp_auth_chunk_t);
4020 hmac = sctp_auth_get_hmac(ntohs(auth_hdr->hmac_id));
4021 if (sig_len != hmac->hmac_len)
4022 return SCTP_IERROR_PROTO_VIOLATION;
4023
4024
4025
4026
4027
4028
4029
4030
4031 digest = auth_hdr->hmac;
4032 skb_pull(chunk->skb, sig_len);
4033
4034 save_digest = kmemdup(digest, sig_len, GFP_ATOMIC);
4035 if (!save_digest)
4036 goto nomem;
4037
4038 memset(digest, 0, sig_len);
4039
4040 sctp_auth_calculate_hmac(asoc, chunk->skb,
4041 (struct sctp_auth_chunk *)chunk->chunk_hdr,
4042 GFP_ATOMIC);
4043
4044
4045 if (memcmp(save_digest, digest, sig_len)) {
4046 kfree(save_digest);
4047 return SCTP_IERROR_BAD_SIG;
4048 }
4049
4050 kfree(save_digest);
4051 chunk->auth = 1;
4052
4053 return SCTP_IERROR_NO_ERROR;
4054nomem:
4055 return SCTP_IERROR_NOMEM;
4056}
4057
4058sctp_disposition_t sctp_sf_eat_auth(struct net *net,
4059 const struct sctp_endpoint *ep,
4060 const struct sctp_association *asoc,
4061 const sctp_subtype_t type,
4062 void *arg,
4063 sctp_cmd_seq_t *commands)
4064{
4065 struct sctp_authhdr *auth_hdr;
4066 struct sctp_chunk *chunk = arg;
4067 struct sctp_chunk *err_chunk;
4068 sctp_ierror_t error;
4069
4070
4071 if (!asoc->peer.auth_capable)
4072 return sctp_sf_unk_chunk(net, ep, asoc, type, arg, commands);
4073
4074 if (!sctp_vtag_verify(chunk, asoc)) {
4075 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
4076 SCTP_NULL());
4077 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4078 }
4079
4080
4081 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_auth_chunk)))
4082 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4083 commands);
4084
4085 auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
4086 error = sctp_sf_authenticate(net, ep, asoc, type, chunk);
4087 switch (error) {
4088 case SCTP_IERROR_AUTH_BAD_HMAC:
4089
4090
4091
4092 err_chunk = sctp_make_op_error(asoc, chunk,
4093 SCTP_ERROR_UNSUP_HMAC,
4094 &auth_hdr->hmac_id,
4095 sizeof(__u16), 0);
4096 if (err_chunk) {
4097 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
4098 SCTP_CHUNK(err_chunk));
4099 }
4100
4101 case SCTP_IERROR_AUTH_BAD_KEYID:
4102 case SCTP_IERROR_BAD_SIG:
4103 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4104
4105 case SCTP_IERROR_PROTO_VIOLATION:
4106 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4107 commands);
4108
4109 case SCTP_IERROR_NOMEM:
4110 return SCTP_DISPOSITION_NOMEM;
4111
4112 default:
4113 break;
4114 }
4115
4116 if (asoc->active_key_id != ntohs(auth_hdr->shkey_id)) {
4117 struct sctp_ulpevent *ev;
4118
4119 ev = sctp_ulpevent_make_authkey(asoc, ntohs(auth_hdr->shkey_id),
4120 SCTP_AUTH_NEWKEY, GFP_ATOMIC);
4121
4122 if (!ev)
4123 return -ENOMEM;
4124
4125 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
4126 SCTP_ULPEVENT(ev));
4127 }
4128
4129 return SCTP_DISPOSITION_CONSUME;
4130}
4131
4132
4133
4134
4135
4136
4137
4138
4139
4140
4141
4142
4143
4144
4145
4146
4147
4148
4149
4150
4151
4152
4153
4154
4155sctp_disposition_t sctp_sf_unk_chunk(struct net *net,
4156 const struct sctp_endpoint *ep,
4157 const struct sctp_association *asoc,
4158 const sctp_subtype_t type,
4159 void *arg,
4160 sctp_cmd_seq_t *commands)
4161{
4162 struct sctp_chunk *unk_chunk = arg;
4163 struct sctp_chunk *err_chunk;
4164 sctp_chunkhdr_t *hdr;
4165
4166 pr_debug("%s: processing unknown chunk id:%d\n", __func__, type.chunk);
4167
4168 if (!sctp_vtag_verify(unk_chunk, asoc))
4169 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4170
4171
4172
4173
4174
4175 if (!sctp_chunk_length_valid(unk_chunk, sizeof(sctp_chunkhdr_t)))
4176 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4177 commands);
4178
4179 switch (type.chunk & SCTP_CID_ACTION_MASK) {
4180 case SCTP_CID_ACTION_DISCARD:
4181
4182 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4183 case SCTP_CID_ACTION_DISCARD_ERR:
4184
4185 hdr = unk_chunk->chunk_hdr;
4186 err_chunk = sctp_make_op_error(asoc, unk_chunk,
4187 SCTP_ERROR_UNKNOWN_CHUNK, hdr,
4188 WORD_ROUND(ntohs(hdr->length)),
4189 0);
4190 if (err_chunk) {
4191 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
4192 SCTP_CHUNK(err_chunk));
4193 }
4194
4195
4196 sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4197 return SCTP_DISPOSITION_CONSUME;
4198 case SCTP_CID_ACTION_SKIP:
4199
4200 return SCTP_DISPOSITION_DISCARD;
4201 case SCTP_CID_ACTION_SKIP_ERR:
4202
4203 hdr = unk_chunk->chunk_hdr;
4204 err_chunk = sctp_make_op_error(asoc, unk_chunk,
4205 SCTP_ERROR_UNKNOWN_CHUNK, hdr,
4206 WORD_ROUND(ntohs(hdr->length)),
4207 0);
4208 if (err_chunk) {
4209 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
4210 SCTP_CHUNK(err_chunk));
4211 }
4212
4213 return SCTP_DISPOSITION_CONSUME;
4214 default:
4215 break;
4216 }
4217
4218 return SCTP_DISPOSITION_DISCARD;
4219}
4220
4221
4222
4223
4224
4225
4226
4227
4228
4229
4230
4231
4232
4233
4234
4235sctp_disposition_t sctp_sf_discard_chunk(struct net *net,
4236 const struct sctp_endpoint *ep,
4237 const struct sctp_association *asoc,
4238 const sctp_subtype_t type,
4239 void *arg,
4240 sctp_cmd_seq_t *commands)
4241{
4242 struct sctp_chunk *chunk = arg;
4243
4244
4245
4246
4247
4248 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
4249 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4250 commands);
4251
4252 pr_debug("%s: chunk:%d is discarded\n", __func__, type.chunk);
4253
4254 return SCTP_DISPOSITION_DISCARD;
4255}
4256
4257
4258
4259
4260
4261
4262
4263
4264
4265
4266
4267
4268
4269
4270
4271
4272
4273
4274
4275sctp_disposition_t sctp_sf_pdiscard(struct net *net,
4276 const struct sctp_endpoint *ep,
4277 const struct sctp_association *asoc,
4278 const sctp_subtype_t type,
4279 void *arg,
4280 sctp_cmd_seq_t *commands)
4281{
4282 SCTP_INC_STATS(net, SCTP_MIB_IN_PKT_DISCARDS);
4283 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
4284
4285 return SCTP_DISPOSITION_CONSUME;
4286}
4287
4288
4289
4290
4291
4292
4293
4294
4295
4296
4297
4298
4299
4300
4301
4302
4303sctp_disposition_t sctp_sf_violation(struct net *net,
4304 const struct sctp_endpoint *ep,
4305 const struct sctp_association *asoc,
4306 const sctp_subtype_t type,
4307 void *arg,
4308 sctp_cmd_seq_t *commands)
4309{
4310 struct sctp_chunk *chunk = arg;
4311
4312
4313 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
4314 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4315 commands);
4316
4317 return SCTP_DISPOSITION_VIOLATION;
4318}
4319
4320
4321
4322
4323static sctp_disposition_t sctp_sf_abort_violation(
4324 struct net *net,
4325 const struct sctp_endpoint *ep,
4326 const struct sctp_association *asoc,
4327 void *arg,
4328 sctp_cmd_seq_t *commands,
4329 const __u8 *payload,
4330 const size_t paylen)
4331{
4332 struct sctp_packet *packet = NULL;
4333 struct sctp_chunk *chunk = arg;
4334 struct sctp_chunk *abort = NULL;
4335
4336
4337
4338
4339
4340
4341
4342
4343
4344
4345
4346
4347 if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
4348 goto discard;
4349
4350
4351 abort = sctp_make_abort_violation(asoc, chunk, payload, paylen);
4352 if (!abort)
4353 goto nomem;
4354
4355 if (asoc) {
4356
4357 if (chunk->chunk_hdr->type == SCTP_CID_INIT_ACK &&
4358 !asoc->peer.i.init_tag) {
4359 sctp_initack_chunk_t *initack;
4360
4361 initack = (sctp_initack_chunk_t *)chunk->chunk_hdr;
4362 if (!sctp_chunk_length_valid(chunk,
4363 sizeof(sctp_initack_chunk_t)))
4364 abort->chunk_hdr->flags |= SCTP_CHUNK_FLAG_T;
4365 else {
4366 unsigned int inittag;
4367
4368 inittag = ntohl(initack->init_hdr.init_tag);
4369 sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_INITTAG,
4370 SCTP_U32(inittag));
4371 }
4372 }
4373
4374 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
4375 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
4376
4377 if (asoc->state <= SCTP_STATE_COOKIE_ECHOED) {
4378 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4379 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
4380 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4381 SCTP_ERROR(ECONNREFUSED));
4382 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
4383 SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
4384 } else {
4385 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4386 SCTP_ERROR(ECONNABORTED));
4387 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
4388 SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
4389 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
4390 }
4391 } else {
4392 packet = sctp_ootb_pkt_new(net, asoc, chunk);
4393
4394 if (!packet)
4395 goto nomem_pkt;
4396
4397 if (sctp_test_T_bit(abort))
4398 packet->vtag = ntohl(chunk->sctp_hdr->vtag);
4399
4400 abort->skb->sk = ep->base.sk;
4401
4402 sctp_packet_append_chunk(packet, abort);
4403
4404 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
4405 SCTP_PACKET(packet));
4406
4407 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
4408 }
4409
4410 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
4411
4412discard:
4413 sctp_sf_pdiscard(net, ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
4414 return SCTP_DISPOSITION_ABORT;
4415
4416nomem_pkt:
4417 sctp_chunk_free(abort);
4418nomem:
4419 return SCTP_DISPOSITION_NOMEM;
4420}
4421
4422
4423
4424
4425
4426
4427
4428
4429
4430
4431
4432
4433
4434
4435
4436
4437
4438
4439
4440
4441static sctp_disposition_t sctp_sf_violation_chunklen(
4442 struct net *net,
4443 const struct sctp_endpoint *ep,
4444 const struct sctp_association *asoc,
4445 const sctp_subtype_t type,
4446 void *arg,
4447 sctp_cmd_seq_t *commands)
4448{
4449 static const char err_str[] = "The following chunk had invalid length:";
4450
4451 return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str,
4452 sizeof(err_str));
4453}
4454
4455
4456
4457
4458
4459
4460
4461static sctp_disposition_t sctp_sf_violation_paramlen(
4462 struct net *net,
4463 const struct sctp_endpoint *ep,
4464 const struct sctp_association *asoc,
4465 const sctp_subtype_t type,
4466 void *arg, void *ext,
4467 sctp_cmd_seq_t *commands)
4468{
4469 struct sctp_chunk *chunk = arg;
4470 struct sctp_paramhdr *param = ext;
4471 struct sctp_chunk *abort = NULL;
4472
4473 if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
4474 goto discard;
4475
4476
4477 abort = sctp_make_violation_paramlen(asoc, chunk, param);
4478 if (!abort)
4479 goto nomem;
4480
4481 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
4482 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
4483
4484 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4485 SCTP_ERROR(ECONNABORTED));
4486 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
4487 SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
4488 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
4489 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
4490
4491discard:
4492 sctp_sf_pdiscard(net, ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
4493 return SCTP_DISPOSITION_ABORT;
4494nomem:
4495 return SCTP_DISPOSITION_NOMEM;
4496}
4497
4498
4499
4500
4501
4502
4503
4504static sctp_disposition_t sctp_sf_violation_ctsn(
4505 struct net *net,
4506 const struct sctp_endpoint *ep,
4507 const struct sctp_association *asoc,
4508 const sctp_subtype_t type,
4509 void *arg,
4510 sctp_cmd_seq_t *commands)
4511{
4512 static const char err_str[] = "The cumulative tsn ack beyond the max tsn currently sent:";
4513
4514 return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str,
4515 sizeof(err_str));
4516}
4517
4518
4519
4520
4521
4522
4523
4524static sctp_disposition_t sctp_sf_violation_chunk(
4525 struct net *net,
4526 const struct sctp_endpoint *ep,
4527 const struct sctp_association *asoc,
4528 const sctp_subtype_t type,
4529 void *arg,
4530 sctp_cmd_seq_t *commands)
4531{
4532 static const char err_str[] = "The following chunk violates protocol:";
4533
4534 if (!asoc)
4535 return sctp_sf_violation(net, ep, asoc, type, arg, commands);
4536
4537 return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str,
4538 sizeof(err_str));
4539}
4540
4541
4542
4543
4544
4545
4546
4547
4548
4549
4550
4551
4552
4553
4554
4555
4556
4557
4558
4559
4560
4561
4562
4563
4564
4565
4566
4567
4568
4569
4570
4571
4572
4573
4574
4575
4576
4577
4578
4579
4580
4581
4582
4583
4584
4585
4586
4587
4588
4589
4590
4591
4592
4593
4594
4595
4596
4597
4598
4599
4600sctp_disposition_t sctp_sf_do_prm_asoc(struct net *net,
4601 const struct sctp_endpoint *ep,
4602 const struct sctp_association *asoc,
4603 const sctp_subtype_t type,
4604 void *arg,
4605 sctp_cmd_seq_t *commands)
4606{
4607 struct sctp_chunk *repl;
4608 struct sctp_association *my_asoc;
4609
4610
4611
4612
4613
4614 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
4615 SCTP_STATE(SCTP_STATE_COOKIE_WAIT));
4616
4617
4618
4619
4620
4621
4622
4623
4624
4625 repl = sctp_make_init(asoc, &asoc->base.bind_addr, GFP_ATOMIC, 0);
4626 if (!repl)
4627 goto nomem;
4628
4629
4630 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
4631 SCTP_CHUNK(repl));
4632
4633
4634
4635
4636 my_asoc = (struct sctp_association *)asoc;
4637 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(my_asoc));
4638
4639
4640
4641
4642 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
4643 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
4644 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
4645 return SCTP_DISPOSITION_CONSUME;
4646
4647nomem:
4648 return SCTP_DISPOSITION_NOMEM;
4649}
4650
4651
4652
4653
4654
4655
4656
4657
4658
4659
4660
4661
4662
4663
4664
4665
4666
4667
4668
4669
4670
4671
4672
4673
4674
4675
4676
4677
4678
4679
4680
4681
4682
4683
4684
4685
4686
4687
4688
4689
4690
4691
4692
4693
4694
4695
4696
4697
4698
4699
4700
4701
4702
4703
4704
4705
4706
4707
4708
4709
4710
4711
4712sctp_disposition_t sctp_sf_do_prm_send(struct net *net,
4713 const struct sctp_endpoint *ep,
4714 const struct sctp_association *asoc,
4715 const sctp_subtype_t type,
4716 void *arg,
4717 sctp_cmd_seq_t *commands)
4718{
4719 struct sctp_datamsg *msg = arg;
4720
4721 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_MSG, SCTP_DATAMSG(msg));
4722 return SCTP_DISPOSITION_CONSUME;
4723}
4724
4725
4726
4727
4728
4729
4730
4731
4732
4733
4734
4735
4736
4737
4738
4739
4740
4741
4742
4743
4744
4745
4746
4747
4748
4749
4750
4751sctp_disposition_t sctp_sf_do_9_2_prm_shutdown(
4752 struct net *net,
4753 const struct sctp_endpoint *ep,
4754 const struct sctp_association *asoc,
4755 const sctp_subtype_t type,
4756 void *arg,
4757 sctp_cmd_seq_t *commands)
4758{
4759 int disposition;
4760
4761
4762
4763
4764
4765
4766
4767
4768
4769 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
4770 SCTP_STATE(SCTP_STATE_SHUTDOWN_PENDING));
4771
4772 disposition = SCTP_DISPOSITION_CONSUME;
4773 if (sctp_outq_is_empty(&asoc->outqueue)) {
4774 disposition = sctp_sf_do_9_2_start_shutdown(net, ep, asoc, type,
4775 arg, commands);
4776 }
4777 return disposition;
4778}
4779
4780
4781
4782
4783
4784
4785
4786
4787
4788
4789
4790
4791
4792
4793
4794
4795
4796
4797
4798
4799
4800
4801
4802
4803
4804
4805
4806
4807sctp_disposition_t sctp_sf_do_9_1_prm_abort(
4808 struct net *net,
4809 const struct sctp_endpoint *ep,
4810 const struct sctp_association *asoc,
4811 const sctp_subtype_t type,
4812 void *arg,
4813 sctp_cmd_seq_t *commands)
4814{
4815
4816
4817
4818
4819
4820
4821
4822
4823 struct sctp_chunk *abort = arg;
4824
4825 if (abort)
4826 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
4827
4828
4829
4830
4831
4832 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4833 SCTP_ERROR(ECONNABORTED));
4834
4835 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
4836 SCTP_PERR(SCTP_ERROR_USER_ABORT));
4837
4838 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
4839 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
4840
4841 return SCTP_DISPOSITION_ABORT;
4842}
4843
4844
4845sctp_disposition_t sctp_sf_error_closed(struct net *net,
4846 const struct sctp_endpoint *ep,
4847 const struct sctp_association *asoc,
4848 const sctp_subtype_t type,
4849 void *arg,
4850 sctp_cmd_seq_t *commands)
4851{
4852 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_ERROR, SCTP_ERROR(-EINVAL));
4853 return SCTP_DISPOSITION_CONSUME;
4854}
4855
4856
4857
4858
4859sctp_disposition_t sctp_sf_error_shutdown(struct net *net,
4860 const struct sctp_endpoint *ep,
4861 const struct sctp_association *asoc,
4862 const sctp_subtype_t type,
4863 void *arg,
4864 sctp_cmd_seq_t *commands)
4865{
4866 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_ERROR,
4867 SCTP_ERROR(-ESHUTDOWN));
4868 return SCTP_DISPOSITION_CONSUME;
4869}
4870
4871
4872
4873
4874
4875
4876
4877
4878
4879
4880
4881
4882
4883
4884
4885sctp_disposition_t sctp_sf_cookie_wait_prm_shutdown(
4886 struct net *net,
4887 const struct sctp_endpoint *ep,
4888 const struct sctp_association *asoc,
4889 const sctp_subtype_t type,
4890 void *arg,
4891 sctp_cmd_seq_t *commands)
4892{
4893 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4894 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
4895
4896 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
4897 SCTP_STATE(SCTP_STATE_CLOSED));
4898
4899 SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS);
4900
4901 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
4902
4903 return SCTP_DISPOSITION_DELETE_TCB;
4904}
4905
4906
4907
4908
4909
4910
4911
4912
4913
4914
4915
4916
4917
4918
4919
4920sctp_disposition_t sctp_sf_cookie_echoed_prm_shutdown(
4921 struct net *net,
4922 const struct sctp_endpoint *ep,
4923 const struct sctp_association *asoc,
4924 const sctp_subtype_t type,
4925 void *arg, sctp_cmd_seq_t *commands)
4926{
4927
4928
4929
4930 return sctp_sf_cookie_wait_prm_shutdown(net, ep, asoc, type, arg, commands);
4931}
4932
4933
4934
4935
4936
4937
4938
4939
4940
4941
4942
4943
4944
4945
4946
4947sctp_disposition_t sctp_sf_cookie_wait_prm_abort(
4948 struct net *net,
4949 const struct sctp_endpoint *ep,
4950 const struct sctp_association *asoc,
4951 const sctp_subtype_t type,
4952 void *arg,
4953 sctp_cmd_seq_t *commands)
4954{
4955 struct sctp_chunk *abort = arg;
4956
4957
4958 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4959 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
4960
4961 if (abort)
4962 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
4963
4964 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
4965 SCTP_STATE(SCTP_STATE_CLOSED));
4966
4967 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
4968
4969
4970
4971
4972
4973 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4974 SCTP_ERROR(ECONNREFUSED));
4975
4976 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
4977 SCTP_PERR(SCTP_ERROR_USER_ABORT));
4978
4979 return SCTP_DISPOSITION_ABORT;
4980}
4981
4982
4983
4984
4985
4986
4987
4988
4989
4990
4991
4992
4993
4994
4995
4996sctp_disposition_t sctp_sf_cookie_echoed_prm_abort(
4997 struct net *net,
4998 const struct sctp_endpoint *ep,
4999 const struct sctp_association *asoc,
5000 const sctp_subtype_t type,
5001 void *arg,
5002 sctp_cmd_seq_t *commands)
5003{
5004
5005
5006
5007 return sctp_sf_cookie_wait_prm_abort(net, ep, asoc, type, arg, commands);
5008}
5009
5010
5011
5012
5013
5014
5015
5016
5017
5018
5019
5020
5021
5022sctp_disposition_t sctp_sf_shutdown_pending_prm_abort(
5023 struct net *net,
5024 const struct sctp_endpoint *ep,
5025 const struct sctp_association *asoc,
5026 const sctp_subtype_t type,
5027 void *arg,
5028 sctp_cmd_seq_t *commands)
5029{
5030
5031 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5032 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5033
5034 return sctp_sf_do_9_1_prm_abort(net, ep, asoc, type, arg, commands);
5035}
5036
5037
5038
5039
5040
5041
5042
5043
5044
5045
5046
5047
5048
5049sctp_disposition_t sctp_sf_shutdown_sent_prm_abort(
5050 struct net *net,
5051 const struct sctp_endpoint *ep,
5052 const struct sctp_association *asoc,
5053 const sctp_subtype_t type,
5054 void *arg,
5055 sctp_cmd_seq_t *commands)
5056{
5057
5058 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5059 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5060
5061
5062 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5063 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5064
5065 return sctp_sf_do_9_1_prm_abort(net, ep, asoc, type, arg, commands);
5066}
5067
5068
5069
5070
5071
5072
5073
5074
5075
5076
5077
5078
5079
5080sctp_disposition_t sctp_sf_shutdown_ack_sent_prm_abort(
5081 struct net *net,
5082 const struct sctp_endpoint *ep,
5083 const struct sctp_association *asoc,
5084 const sctp_subtype_t type,
5085 void *arg,
5086 sctp_cmd_seq_t *commands)
5087{
5088
5089
5090
5091 return sctp_sf_shutdown_sent_prm_abort(net, ep, asoc, type, arg, commands);
5092}
5093
5094
5095
5096
5097
5098
5099
5100
5101
5102
5103
5104
5105
5106
5107
5108
5109
5110
5111
5112
5113
5114
5115
5116sctp_disposition_t sctp_sf_do_prm_requestheartbeat(
5117 struct net *net,
5118 const struct sctp_endpoint *ep,
5119 const struct sctp_association *asoc,
5120 const sctp_subtype_t type,
5121 void *arg,
5122 sctp_cmd_seq_t *commands)
5123{
5124 if (SCTP_DISPOSITION_NOMEM == sctp_sf_heartbeat(ep, asoc, type,
5125 (struct sctp_transport *)arg, commands))
5126 return SCTP_DISPOSITION_NOMEM;
5127
5128
5129
5130
5131
5132
5133
5134
5135
5136
5137
5138
5139 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_HB_SENT,
5140 SCTP_TRANSPORT(arg));
5141 return SCTP_DISPOSITION_CONSUME;
5142}
5143
5144
5145
5146
5147
5148
5149sctp_disposition_t sctp_sf_do_prm_asconf(struct net *net,
5150 const struct sctp_endpoint *ep,
5151 const struct sctp_association *asoc,
5152 const sctp_subtype_t type,
5153 void *arg,
5154 sctp_cmd_seq_t *commands)
5155{
5156 struct sctp_chunk *chunk = arg;
5157
5158 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T4, SCTP_CHUNK(chunk));
5159 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
5160 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
5161 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(chunk));
5162 return SCTP_DISPOSITION_CONSUME;
5163}
5164
5165
5166
5167
5168
5169
5170sctp_disposition_t sctp_sf_ignore_primitive(
5171 struct net *net,
5172 const struct sctp_endpoint *ep,
5173 const struct sctp_association *asoc,
5174 const sctp_subtype_t type,
5175 void *arg,
5176 sctp_cmd_seq_t *commands)
5177{
5178 pr_debug("%s: primitive type:%d is ignored\n", __func__,
5179 type.primitive);
5180
5181 return SCTP_DISPOSITION_DISCARD;
5182}
5183
5184
5185
5186
5187
5188
5189
5190
5191
5192
5193
5194sctp_disposition_t sctp_sf_do_no_pending_tsn(
5195 struct net *net,
5196 const struct sctp_endpoint *ep,
5197 const struct sctp_association *asoc,
5198 const sctp_subtype_t type,
5199 void *arg,
5200 sctp_cmd_seq_t *commands)
5201{
5202 struct sctp_ulpevent *event;
5203
5204 event = sctp_ulpevent_make_sender_dry_event(asoc, GFP_ATOMIC);
5205 if (!event)
5206 return SCTP_DISPOSITION_NOMEM;
5207
5208 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(event));
5209
5210 return SCTP_DISPOSITION_CONSUME;
5211}
5212
5213
5214
5215
5216
5217
5218
5219
5220
5221
5222
5223
5224
5225
5226sctp_disposition_t sctp_sf_do_9_2_start_shutdown(
5227 struct net *net,
5228 const struct sctp_endpoint *ep,
5229 const struct sctp_association *asoc,
5230 const sctp_subtype_t type,
5231 void *arg,
5232 sctp_cmd_seq_t *commands)
5233{
5234 struct sctp_chunk *reply;
5235
5236
5237
5238
5239
5240
5241 reply = sctp_make_shutdown(asoc, NULL);
5242 if (!reply)
5243 goto nomem;
5244
5245
5246
5247
5248 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
5249
5250
5251 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
5252 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5253
5254
5255
5256
5257
5258 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
5259 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5260
5261 if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
5262 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5263 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
5264
5265
5266 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
5267 SCTP_STATE(SCTP_STATE_SHUTDOWN_SENT));
5268
5269
5270
5271
5272
5273
5274 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
5275
5276 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
5277
5278 return SCTP_DISPOSITION_CONSUME;
5279
5280nomem:
5281 return SCTP_DISPOSITION_NOMEM;
5282}
5283
5284
5285
5286
5287
5288
5289
5290
5291
5292
5293
5294
5295
5296sctp_disposition_t sctp_sf_do_9_2_shutdown_ack(
5297 struct net *net,
5298 const struct sctp_endpoint *ep,
5299 const struct sctp_association *asoc,
5300 const sctp_subtype_t type,
5301 void *arg,
5302 sctp_cmd_seq_t *commands)
5303{
5304 struct sctp_chunk *chunk = (struct sctp_chunk *) arg;
5305 struct sctp_chunk *reply;
5306
5307
5308
5309
5310
5311
5312
5313
5314 if (chunk) {
5315 if (!sctp_vtag_verify(chunk, asoc))
5316 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
5317
5318
5319 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_shutdown_chunk_t)))
5320 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
5321 commands);
5322 }
5323
5324
5325
5326
5327 reply = sctp_make_shutdown_ack(asoc, chunk);
5328 if (!reply)
5329 goto nomem;
5330
5331
5332
5333
5334 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
5335
5336
5337 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
5338 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5339
5340 if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
5341 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5342 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
5343
5344
5345 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
5346 SCTP_STATE(SCTP_STATE_SHUTDOWN_ACK_SENT));
5347
5348
5349
5350
5351
5352
5353 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
5354
5355 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
5356
5357 return SCTP_DISPOSITION_CONSUME;
5358
5359nomem:
5360 return SCTP_DISPOSITION_NOMEM;
5361}
5362
5363
5364
5365
5366
5367
5368sctp_disposition_t sctp_sf_ignore_other(struct net *net,
5369 const struct sctp_endpoint *ep,
5370 const struct sctp_association *asoc,
5371 const sctp_subtype_t type,
5372 void *arg,
5373 sctp_cmd_seq_t *commands)
5374{
5375 pr_debug("%s: the event other type:%d is ignored\n",
5376 __func__, type.other);
5377
5378 return SCTP_DISPOSITION_DISCARD;
5379}
5380
5381
5382
5383
5384
5385
5386
5387
5388
5389
5390
5391
5392
5393
5394
5395
5396sctp_disposition_t sctp_sf_do_6_3_3_rtx(struct net *net,
5397 const struct sctp_endpoint *ep,
5398 const struct sctp_association *asoc,
5399 const sctp_subtype_t type,
5400 void *arg,
5401 sctp_cmd_seq_t *commands)
5402{
5403 struct sctp_transport *transport = arg;
5404
5405 SCTP_INC_STATS(net, SCTP_MIB_T3_RTX_EXPIREDS);
5406
5407 if (asoc->overall_error_count >= asoc->max_retrans) {
5408 if (asoc->peer.zero_window_announced &&
5409 asoc->state == SCTP_STATE_SHUTDOWN_PENDING) {
5410
5411
5412
5413
5414
5415
5416
5417
5418
5419 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START_ONCE,
5420 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5421 } else {
5422 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5423 SCTP_ERROR(ETIMEDOUT));
5424
5425 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5426 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5427 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
5428 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
5429 return SCTP_DISPOSITION_DELETE_TCB;
5430 }
5431 }
5432
5433
5434
5435
5436
5437
5438
5439
5440
5441
5442
5443
5444
5445
5446
5447
5448
5449
5450
5451
5452
5453
5454
5455
5456
5457
5458
5459
5460
5461 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE, SCTP_TRANSPORT(transport));
5462
5463
5464 sctp_add_cmd_sf(commands, SCTP_CMD_RETRAN, SCTP_TRANSPORT(transport));
5465
5466 return SCTP_DISPOSITION_CONSUME;
5467}
5468
5469
5470
5471
5472
5473
5474
5475
5476
5477
5478
5479
5480
5481
5482
5483
5484sctp_disposition_t sctp_sf_do_6_2_sack(struct net *net,
5485 const struct sctp_endpoint *ep,
5486 const struct sctp_association *asoc,
5487 const sctp_subtype_t type,
5488 void *arg,
5489 sctp_cmd_seq_t *commands)
5490{
5491 SCTP_INC_STATS(net, SCTP_MIB_DELAY_SACK_EXPIREDS);
5492 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
5493 return SCTP_DISPOSITION_CONSUME;
5494}
5495
5496
5497
5498
5499
5500
5501
5502
5503
5504
5505
5506
5507
5508
5509
5510
5511
5512
5513
5514
5515sctp_disposition_t sctp_sf_t1_init_timer_expire(struct net *net,
5516 const struct sctp_endpoint *ep,
5517 const struct sctp_association *asoc,
5518 const sctp_subtype_t type,
5519 void *arg,
5520 sctp_cmd_seq_t *commands)
5521{
5522 struct sctp_chunk *repl = NULL;
5523 struct sctp_bind_addr *bp;
5524 int attempts = asoc->init_err_counter + 1;
5525
5526 pr_debug("%s: timer T1 expired (INIT)\n", __func__);
5527
5528 SCTP_INC_STATS(net, SCTP_MIB_T1_INIT_EXPIREDS);
5529
5530 if (attempts <= asoc->max_init_attempts) {
5531 bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
5532 repl = sctp_make_init(asoc, bp, GFP_ATOMIC, 0);
5533 if (!repl)
5534 return SCTP_DISPOSITION_NOMEM;
5535
5536
5537 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
5538 SCTP_CHUNK(repl));
5539
5540
5541 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_RESTART,
5542 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
5543
5544 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
5545 } else {
5546 pr_debug("%s: giving up on INIT, attempts:%d "
5547 "max_init_attempts:%d\n", __func__, attempts,
5548 asoc->max_init_attempts);
5549
5550 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5551 SCTP_ERROR(ETIMEDOUT));
5552 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
5553 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5554 return SCTP_DISPOSITION_DELETE_TCB;
5555 }
5556
5557 return SCTP_DISPOSITION_CONSUME;
5558}
5559
5560
5561
5562
5563
5564
5565
5566
5567
5568
5569
5570
5571
5572
5573
5574
5575
5576
5577
5578
5579sctp_disposition_t sctp_sf_t1_cookie_timer_expire(struct net *net,
5580 const struct sctp_endpoint *ep,
5581 const struct sctp_association *asoc,
5582 const sctp_subtype_t type,
5583 void *arg,
5584 sctp_cmd_seq_t *commands)
5585{
5586 struct sctp_chunk *repl = NULL;
5587 int attempts = asoc->init_err_counter + 1;
5588
5589 pr_debug("%s: timer T1 expired (COOKIE-ECHO)\n", __func__);
5590
5591 SCTP_INC_STATS(net, SCTP_MIB_T1_COOKIE_EXPIREDS);
5592
5593 if (attempts <= asoc->max_init_attempts) {
5594 repl = sctp_make_cookie_echo(asoc, NULL);
5595 if (!repl)
5596 return SCTP_DISPOSITION_NOMEM;
5597
5598 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
5599 SCTP_CHUNK(repl));
5600
5601 sctp_add_cmd_sf(commands, SCTP_CMD_COOKIEECHO_RESTART,
5602 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
5603
5604 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
5605 } else {
5606 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5607 SCTP_ERROR(ETIMEDOUT));
5608 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
5609 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5610 return SCTP_DISPOSITION_DELETE_TCB;
5611 }
5612
5613 return SCTP_DISPOSITION_CONSUME;
5614}
5615
5616
5617
5618
5619
5620
5621
5622
5623
5624
5625
5626
5627
5628
5629sctp_disposition_t sctp_sf_t2_timer_expire(struct net *net,
5630 const struct sctp_endpoint *ep,
5631 const struct sctp_association *asoc,
5632 const sctp_subtype_t type,
5633 void *arg,
5634 sctp_cmd_seq_t *commands)
5635{
5636 struct sctp_chunk *reply = NULL;
5637
5638 pr_debug("%s: timer T2 expired\n", __func__);
5639
5640 SCTP_INC_STATS(net, SCTP_MIB_T2_SHUTDOWN_EXPIREDS);
5641
5642 ((struct sctp_association *)asoc)->shutdown_retries++;
5643
5644 if (asoc->overall_error_count >= asoc->max_retrans) {
5645 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5646 SCTP_ERROR(ETIMEDOUT));
5647
5648 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5649 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5650 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
5651 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
5652 return SCTP_DISPOSITION_DELETE_TCB;
5653 }
5654
5655 switch (asoc->state) {
5656 case SCTP_STATE_SHUTDOWN_SENT:
5657 reply = sctp_make_shutdown(asoc, NULL);
5658 break;
5659
5660 case SCTP_STATE_SHUTDOWN_ACK_SENT:
5661 reply = sctp_make_shutdown_ack(asoc, NULL);
5662 break;
5663
5664 default:
5665 BUG();
5666 break;
5667 }
5668
5669 if (!reply)
5670 goto nomem;
5671
5672
5673
5674
5675
5676 if (asoc->shutdown_last_sent_to)
5677 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE,
5678 SCTP_TRANSPORT(asoc->shutdown_last_sent_to));
5679
5680
5681
5682
5683 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
5684
5685
5686 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
5687 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5688 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
5689 return SCTP_DISPOSITION_CONSUME;
5690
5691nomem:
5692 return SCTP_DISPOSITION_NOMEM;
5693}
5694
5695
5696
5697
5698
5699sctp_disposition_t sctp_sf_t4_timer_expire(
5700 struct net *net,
5701 const struct sctp_endpoint *ep,
5702 const struct sctp_association *asoc,
5703 const sctp_subtype_t type,
5704 void *arg,
5705 sctp_cmd_seq_t *commands)
5706{
5707 struct sctp_chunk *chunk = asoc->addip_last_asconf;
5708 struct sctp_transport *transport = chunk->transport;
5709
5710 SCTP_INC_STATS(net, SCTP_MIB_T4_RTO_EXPIREDS);
5711
5712
5713
5714
5715
5716 if (transport)
5717 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE,
5718 SCTP_TRANSPORT(transport));
5719
5720
5721 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T4, SCTP_CHUNK(chunk));
5722
5723
5724
5725
5726
5727
5728 if (asoc->overall_error_count >= asoc->max_retrans) {
5729 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5730 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
5731 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5732 SCTP_ERROR(ETIMEDOUT));
5733 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5734 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5735 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
5736 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
5737 return SCTP_DISPOSITION_ABORT;
5738 }
5739
5740
5741
5742
5743
5744
5745
5746
5747
5748
5749
5750
5751 sctp_chunk_hold(asoc->addip_last_asconf);
5752 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
5753 SCTP_CHUNK(asoc->addip_last_asconf));
5754
5755
5756
5757
5758
5759 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
5760 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
5761
5762 return SCTP_DISPOSITION_CONSUME;
5763}
5764
5765
5766
5767
5768
5769
5770
5771sctp_disposition_t sctp_sf_t5_timer_expire(struct net *net,
5772 const struct sctp_endpoint *ep,
5773 const struct sctp_association *asoc,
5774 const sctp_subtype_t type,
5775 void *arg,
5776 sctp_cmd_seq_t *commands)
5777{
5778 struct sctp_chunk *reply = NULL;
5779
5780 pr_debug("%s: timer T5 expired\n", __func__);
5781
5782 SCTP_INC_STATS(net, SCTP_MIB_T5_SHUTDOWN_GUARD_EXPIREDS);
5783
5784 reply = sctp_make_abort(asoc, NULL, 0);
5785 if (!reply)
5786 goto nomem;
5787
5788 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
5789 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5790 SCTP_ERROR(ETIMEDOUT));
5791 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5792 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5793
5794 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
5795 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
5796
5797 return SCTP_DISPOSITION_DELETE_TCB;
5798nomem:
5799 return SCTP_DISPOSITION_NOMEM;
5800}
5801
5802
5803
5804
5805
5806
5807sctp_disposition_t sctp_sf_autoclose_timer_expire(
5808 struct net *net,
5809 const struct sctp_endpoint *ep,
5810 const struct sctp_association *asoc,
5811 const sctp_subtype_t type,
5812 void *arg,
5813 sctp_cmd_seq_t *commands)
5814{
5815 int disposition;
5816
5817 SCTP_INC_STATS(net, SCTP_MIB_AUTOCLOSE_EXPIREDS);
5818
5819
5820
5821
5822
5823
5824
5825
5826
5827 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
5828 SCTP_STATE(SCTP_STATE_SHUTDOWN_PENDING));
5829
5830 disposition = SCTP_DISPOSITION_CONSUME;
5831 if (sctp_outq_is_empty(&asoc->outqueue)) {
5832 disposition = sctp_sf_do_9_2_start_shutdown(net, ep, asoc, type,
5833 arg, commands);
5834 }
5835 return disposition;
5836}
5837
5838
5839
5840
5841
5842
5843
5844
5845
5846
5847
5848
5849
5850sctp_disposition_t sctp_sf_not_impl(struct net *net,
5851 const struct sctp_endpoint *ep,
5852 const struct sctp_association *asoc,
5853 const sctp_subtype_t type,
5854 void *arg,
5855 sctp_cmd_seq_t *commands)
5856{
5857 return SCTP_DISPOSITION_NOT_IMPL;
5858}
5859
5860
5861
5862
5863
5864
5865
5866
5867
5868sctp_disposition_t sctp_sf_bug(struct net *net,
5869 const struct sctp_endpoint *ep,
5870 const struct sctp_association *asoc,
5871 const sctp_subtype_t type,
5872 void *arg,
5873 sctp_cmd_seq_t *commands)
5874{
5875 return SCTP_DISPOSITION_BUG;
5876}
5877
5878
5879
5880
5881
5882
5883
5884
5885
5886
5887
5888
5889sctp_disposition_t sctp_sf_timer_ignore(struct net *net,
5890 const struct sctp_endpoint *ep,
5891 const struct sctp_association *asoc,
5892 const sctp_subtype_t type,
5893 void *arg,
5894 sctp_cmd_seq_t *commands)
5895{
5896 pr_debug("%s: timer %d ignored\n", __func__, type.chunk);
5897
5898 return SCTP_DISPOSITION_CONSUME;
5899}
5900
5901
5902
5903
5904
5905
5906static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk)
5907{
5908 struct sctp_sackhdr *sack;
5909 unsigned int len;
5910 __u16 num_blocks;
5911 __u16 num_dup_tsns;
5912
5913
5914
5915
5916 sack = (struct sctp_sackhdr *) chunk->skb->data;
5917
5918 num_blocks = ntohs(sack->num_gap_ack_blocks);
5919 num_dup_tsns = ntohs(sack->num_dup_tsns);
5920 len = sizeof(struct sctp_sackhdr);
5921 len += (num_blocks + num_dup_tsns) * sizeof(__u32);
5922 if (len > chunk->skb->len)
5923 return NULL;
5924
5925 skb_pull(chunk->skb, len);
5926
5927 return sack;
5928}
5929
5930
5931
5932
5933static struct sctp_packet *sctp_abort_pkt_new(struct net *net,
5934 const struct sctp_endpoint *ep,
5935 const struct sctp_association *asoc,
5936 struct sctp_chunk *chunk,
5937 const void *payload,
5938 size_t paylen)
5939{
5940 struct sctp_packet *packet;
5941 struct sctp_chunk *abort;
5942
5943 packet = sctp_ootb_pkt_new(net, asoc, chunk);
5944
5945 if (packet) {
5946
5947
5948
5949 abort = sctp_make_abort(asoc, chunk, paylen);
5950 if (!abort) {
5951 sctp_ootb_pkt_free(packet);
5952 return NULL;
5953 }
5954
5955
5956 if (sctp_test_T_bit(abort))
5957 packet->vtag = ntohl(chunk->sctp_hdr->vtag);
5958
5959
5960
5961
5962 sctp_addto_chunk(abort, paylen, payload);
5963
5964
5965 abort->skb->sk = ep->base.sk;
5966
5967 sctp_packet_append_chunk(packet, abort);
5968
5969 }
5970
5971 return packet;
5972}
5973
5974
5975static struct sctp_packet *sctp_ootb_pkt_new(struct net *net,
5976 const struct sctp_association *asoc,
5977 const struct sctp_chunk *chunk)
5978{
5979 struct sctp_packet *packet;
5980 struct sctp_transport *transport;
5981 __u16 sport;
5982 __u16 dport;
5983 __u32 vtag;
5984
5985
5986 sport = ntohs(chunk->sctp_hdr->dest);
5987 dport = ntohs(chunk->sctp_hdr->source);
5988
5989
5990
5991
5992 if (asoc) {
5993
5994
5995
5996 switch (chunk->chunk_hdr->type) {
5997 case SCTP_CID_INIT_ACK:
5998 {
5999 sctp_initack_chunk_t *initack;
6000
6001 initack = (sctp_initack_chunk_t *)chunk->chunk_hdr;
6002 vtag = ntohl(initack->init_hdr.init_tag);
6003 break;
6004 }
6005 default:
6006 vtag = asoc->peer.i.init_tag;
6007 break;
6008 }
6009 } else {
6010
6011
6012
6013 switch (chunk->chunk_hdr->type) {
6014 case SCTP_CID_INIT:
6015 {
6016 sctp_init_chunk_t *init;
6017
6018 init = (sctp_init_chunk_t *)chunk->chunk_hdr;
6019 vtag = ntohl(init->init_hdr.init_tag);
6020 break;
6021 }
6022 default:
6023 vtag = ntohl(chunk->sctp_hdr->vtag);
6024 break;
6025 }
6026 }
6027
6028
6029 transport = sctp_transport_new(net, sctp_source(chunk), GFP_ATOMIC);
6030 if (!transport)
6031 goto nomem;
6032
6033
6034
6035
6036 sctp_transport_route(transport, (union sctp_addr *)&chunk->dest,
6037 sctp_sk(net->sctp.ctl_sock));
6038
6039 packet = sctp_packet_init(&transport->packet, transport, sport, dport);
6040 packet = sctp_packet_config(packet, vtag, 0);
6041
6042 return packet;
6043
6044nomem:
6045 return NULL;
6046}
6047
6048
6049void sctp_ootb_pkt_free(struct sctp_packet *packet)
6050{
6051 sctp_transport_free(packet->transport);
6052}
6053
6054
6055static void sctp_send_stale_cookie_err(struct net *net,
6056 const struct sctp_endpoint *ep,
6057 const struct sctp_association *asoc,
6058 const struct sctp_chunk *chunk,
6059 sctp_cmd_seq_t *commands,
6060 struct sctp_chunk *err_chunk)
6061{
6062 struct sctp_packet *packet;
6063
6064 if (err_chunk) {
6065 packet = sctp_ootb_pkt_new(net, asoc, chunk);
6066 if (packet) {
6067 struct sctp_signed_cookie *cookie;
6068
6069
6070 cookie = chunk->subh.cookie_hdr;
6071 packet->vtag = cookie->c.peer_vtag;
6072
6073
6074 err_chunk->skb->sk = ep->base.sk;
6075 sctp_packet_append_chunk(packet, err_chunk);
6076 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
6077 SCTP_PACKET(packet));
6078 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
6079 } else
6080 sctp_chunk_free (err_chunk);
6081 }
6082}
6083
6084
6085
6086static int sctp_eat_data(const struct sctp_association *asoc,
6087 struct sctp_chunk *chunk,
6088 sctp_cmd_seq_t *commands)
6089{
6090 sctp_datahdr_t *data_hdr;
6091 struct sctp_chunk *err;
6092 size_t datalen;
6093 sctp_verb_t deliver;
6094 int tmp;
6095 __u32 tsn;
6096 struct sctp_tsnmap *map = (struct sctp_tsnmap *)&asoc->peer.tsn_map;
6097 struct sock *sk = asoc->base.sk;
6098 struct net *net = sock_net(sk);
6099 u16 ssn;
6100 u16 sid;
6101 u8 ordered = 0;
6102
6103 data_hdr = chunk->subh.data_hdr = (sctp_datahdr_t *)chunk->skb->data;
6104 skb_pull(chunk->skb, sizeof(sctp_datahdr_t));
6105
6106 tsn = ntohl(data_hdr->tsn);
6107 pr_debug("%s: TSN 0x%x\n", __func__, tsn);
6108
6109
6110
6111
6112
6113
6114
6115
6116
6117
6118
6119
6120
6121 if (!chunk->ecn_ce_done) {
6122 struct sctp_af *af;
6123 chunk->ecn_ce_done = 1;
6124
6125 af = sctp_get_af_specific(
6126 ipver2af(ip_hdr(chunk->skb)->version));
6127
6128 if (af && af->is_ce(chunk->skb) && asoc->peer.ecn_capable) {
6129
6130 sctp_add_cmd_sf(commands, SCTP_CMD_ECN_CE,
6131 SCTP_U32(tsn));
6132 }
6133 }
6134
6135 tmp = sctp_tsnmap_check(&asoc->peer.tsn_map, tsn);
6136 if (tmp < 0) {
6137
6138
6139
6140 if (chunk->asoc)
6141 chunk->asoc->stats.outofseqtsns++;
6142 return SCTP_IERROR_HIGH_TSN;
6143 } else if (tmp > 0) {
6144
6145 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_DUP, SCTP_U32(tsn));
6146 return SCTP_IERROR_DUP_TSN;
6147 }
6148
6149
6150
6151
6152
6153
6154 datalen = ntohs(chunk->chunk_hdr->length);
6155 datalen -= sizeof(sctp_data_chunk_t);
6156
6157 deliver = SCTP_CMD_CHUNK_ULP;
6158
6159
6160 if ((datalen >= asoc->rwnd) && (!asoc->ulpq.pd_mode)) {
6161
6162
6163
6164
6165 sctp_add_cmd_sf(commands, SCTP_CMD_PART_DELIVER, SCTP_NULL());
6166 }
6167
6168
6169
6170
6171
6172
6173 if ((!chunk->data_accepted) && (!asoc->rwnd || asoc->rwnd_over ||
6174 (datalen > asoc->rwnd + asoc->frag_point))) {
6175
6176
6177
6178
6179
6180
6181
6182 if (sctp_tsnmap_has_gap(map) &&
6183 (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
6184 pr_debug("%s: reneging for tsn:%u\n", __func__, tsn);
6185 deliver = SCTP_CMD_RENEGE;
6186 } else {
6187 pr_debug("%s: discard tsn:%u len:%zu, rwnd:%d\n",
6188 __func__, tsn, datalen, asoc->rwnd);
6189
6190 return SCTP_IERROR_IGNORE_TSN;
6191 }
6192 }
6193
6194
6195
6196
6197
6198
6199
6200
6201 if (*sk->sk_prot_creator->memory_pressure) {
6202 if (sctp_tsnmap_has_gap(map) &&
6203 (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
6204 pr_debug("%s: under pressure, reneging for tsn:%u\n",
6205 __func__, tsn);
6206 deliver = SCTP_CMD_RENEGE;
6207 }
6208 }
6209
6210
6211
6212
6213
6214
6215
6216
6217
6218 if (unlikely(0 == datalen)) {
6219 err = sctp_make_abort_no_data(asoc, chunk, tsn);
6220 if (err) {
6221 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
6222 SCTP_CHUNK(err));
6223 }
6224
6225
6226
6227 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
6228 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
6229 SCTP_ERROR(ECONNABORTED));
6230 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
6231 SCTP_PERR(SCTP_ERROR_NO_DATA));
6232 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
6233 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
6234 return SCTP_IERROR_NO_DATA;
6235 }
6236
6237 chunk->data_accepted = 1;
6238
6239
6240
6241
6242 if (chunk->chunk_hdr->flags & SCTP_DATA_UNORDERED) {
6243 SCTP_INC_STATS(net, SCTP_MIB_INUNORDERCHUNKS);
6244 if (chunk->asoc)
6245 chunk->asoc->stats.iuodchunks++;
6246 } else {
6247 SCTP_INC_STATS(net, SCTP_MIB_INORDERCHUNKS);
6248 if (chunk->asoc)
6249 chunk->asoc->stats.iodchunks++;
6250 ordered = 1;
6251 }
6252
6253
6254
6255
6256
6257
6258
6259
6260
6261 sid = ntohs(data_hdr->stream);
6262 if (sid >= asoc->c.sinit_max_instreams) {
6263
6264 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_TSN, SCTP_U32(tsn));
6265
6266 err = sctp_make_op_error(asoc, chunk, SCTP_ERROR_INV_STRM,
6267 &data_hdr->stream,
6268 sizeof(data_hdr->stream),
6269 sizeof(u16));
6270 if (err)
6271 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
6272 SCTP_CHUNK(err));
6273 return SCTP_IERROR_BAD_STREAM;
6274 }
6275
6276
6277
6278
6279
6280
6281
6282
6283 ssn = ntohs(data_hdr->ssn);
6284 if (ordered && SSN_lt(ssn, sctp_ssn_peek(&asoc->ssnmap->in, sid))) {
6285 return SCTP_IERROR_PROTO_VIOLATION;
6286 }
6287
6288
6289
6290
6291
6292 sctp_add_cmd_sf(commands, deliver, SCTP_CHUNK(chunk));
6293
6294 return SCTP_IERROR_NO_ERROR;
6295}
6296