1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
32
33#include <linux/types.h>
34#include <linux/kernel.h>
35#include <linux/ip.h>
36#include <linux/ipv6.h>
37#include <linux/net.h>
38#include <linux/inet.h>
39#include <linux/slab.h>
40#include <net/sock.h>
41#include <net/inet_ecn.h>
42#include <linux/skbuff.h>
43#include <net/sctp/sctp.h>
44#include <net/sctp/sm.h>
45#include <net/sctp/structs.h>
46
47#define CREATE_TRACE_POINTS
48#include <trace/events/sctp.h>
49
50static struct sctp_packet *sctp_abort_pkt_new(
51 struct net *net,
52 const struct sctp_endpoint *ep,
53 const struct sctp_association *asoc,
54 struct sctp_chunk *chunk,
55 const void *payload, size_t paylen);
56static int sctp_eat_data(const struct sctp_association *asoc,
57 struct sctp_chunk *chunk,
58 struct sctp_cmd_seq *commands);
59static struct sctp_packet *sctp_ootb_pkt_new(
60 struct net *net,
61 const struct sctp_association *asoc,
62 const struct sctp_chunk *chunk);
63static void sctp_send_stale_cookie_err(struct net *net,
64 const struct sctp_endpoint *ep,
65 const struct sctp_association *asoc,
66 const struct sctp_chunk *chunk,
67 struct sctp_cmd_seq *commands,
68 struct sctp_chunk *err_chunk);
69static enum sctp_disposition sctp_sf_do_5_2_6_stale(
70 struct net *net,
71 const struct sctp_endpoint *ep,
72 const struct sctp_association *asoc,
73 const union sctp_subtype type,
74 void *arg,
75 struct sctp_cmd_seq *commands);
76static enum sctp_disposition sctp_sf_shut_8_4_5(
77 struct net *net,
78 const struct sctp_endpoint *ep,
79 const struct sctp_association *asoc,
80 const union sctp_subtype type,
81 void *arg,
82 struct sctp_cmd_seq *commands);
83static enum sctp_disposition sctp_sf_tabort_8_4_8(
84 struct net *net,
85 const struct sctp_endpoint *ep,
86 const struct sctp_association *asoc,
87 const union sctp_subtype type,
88 void *arg,
89 struct sctp_cmd_seq *commands);
90static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk);
91
92static enum sctp_disposition sctp_stop_t1_and_abort(
93 struct net *net,
94 struct sctp_cmd_seq *commands,
95 __be16 error, int sk_err,
96 const struct sctp_association *asoc,
97 struct sctp_transport *transport);
98
99static enum sctp_disposition sctp_sf_abort_violation(
100 struct net *net,
101 const struct sctp_endpoint *ep,
102 const struct sctp_association *asoc,
103 void *arg,
104 struct sctp_cmd_seq *commands,
105 const __u8 *payload,
106 const size_t paylen);
107
108static enum sctp_disposition sctp_sf_violation_chunklen(
109 struct net *net,
110 const struct sctp_endpoint *ep,
111 const struct sctp_association *asoc,
112 const union sctp_subtype type,
113 void *arg,
114 struct sctp_cmd_seq *commands);
115
116static enum sctp_disposition sctp_sf_violation_paramlen(
117 struct net *net,
118 const struct sctp_endpoint *ep,
119 const struct sctp_association *asoc,
120 const union sctp_subtype type,
121 void *arg, void *ext,
122 struct sctp_cmd_seq *commands);
123
124static enum sctp_disposition sctp_sf_violation_ctsn(
125 struct net *net,
126 const struct sctp_endpoint *ep,
127 const struct sctp_association *asoc,
128 const union sctp_subtype type,
129 void *arg,
130 struct sctp_cmd_seq *commands);
131
132static enum sctp_disposition sctp_sf_violation_chunk(
133 struct net *net,
134 const struct sctp_endpoint *ep,
135 const struct sctp_association *asoc,
136 const union sctp_subtype type,
137 void *arg,
138 struct sctp_cmd_seq *commands);
139
140static enum sctp_ierror sctp_sf_authenticate(
141 const struct sctp_association *asoc,
142 struct sctp_chunk *chunk);
143
144static enum sctp_disposition __sctp_sf_do_9_1_abort(
145 struct net *net,
146 const struct sctp_endpoint *ep,
147 const struct sctp_association *asoc,
148 const union sctp_subtype type,
149 void *arg,
150 struct sctp_cmd_seq *commands);
151
152
153
154
155
156
157
158
159static inline bool sctp_chunk_length_valid(struct sctp_chunk *chunk,
160 __u16 required_length)
161{
162 __u16 chunk_length = ntohs(chunk->chunk_hdr->length);
163
164
165 if (unlikely(chunk->pdiscard))
166 return false;
167 if (unlikely(chunk_length < required_length))
168 return false;
169
170 return true;
171}
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208enum sctp_disposition sctp_sf_do_4_C(struct net *net,
209 const struct sctp_endpoint *ep,
210 const struct sctp_association *asoc,
211 const union sctp_subtype type,
212 void *arg, struct sctp_cmd_seq *commands)
213{
214 struct sctp_chunk *chunk = arg;
215 struct sctp_ulpevent *ev;
216
217 if (!sctp_vtag_verify_either(chunk, asoc))
218 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
219
220
221
222
223
224
225 if (!chunk->singleton)
226 return sctp_sf_violation_chunk(net, ep, asoc, type, arg, commands);
227
228
229 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
230 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
231 commands);
232
233
234
235
236
237
238
239
240 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_SHUTDOWN_COMP,
241 0, 0, 0, NULL, GFP_ATOMIC);
242 if (ev)
243 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
244 SCTP_ULPEVENT(ev));
245
246
247
248
249
250
251
252
253
254 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
255 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
256
257 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
258 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
259
260 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
261 SCTP_STATE(SCTP_STATE_CLOSED));
262
263 SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS);
264 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
265
266 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
267
268 return SCTP_DISPOSITION_DELETE_TCB;
269}
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293enum sctp_disposition sctp_sf_do_5_1B_init(struct net *net,
294 const struct sctp_endpoint *ep,
295 const struct sctp_association *asoc,
296 const union sctp_subtype type,
297 void *arg,
298 struct sctp_cmd_seq *commands)
299{
300 struct sctp_chunk *chunk = arg, *repl, *err_chunk;
301 struct sctp_unrecognized_param *unk_param;
302 struct sctp_association *new_asoc;
303 struct sctp_packet *packet;
304 int len;
305
306
307 if (security_sctp_assoc_request((struct sctp_endpoint *)ep,
308 chunk->skb))
309 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
310
311
312
313
314
315
316
317
318
319
320 if (!chunk->singleton)
321 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
322
323
324
325
326 if (ep == sctp_sk(net->sctp.ctl_sock)->ep) {
327 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
328 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
329 }
330
331
332
333
334 if (chunk->sctp_hdr->vtag != 0)
335 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
336
337
338
339
340
341
342 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
343 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
344
345
346
347
348
349
350
351 if (sctp_sstate(ep->base.sk, CLOSING))
352 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
353
354
355 err_chunk = NULL;
356 if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type,
357 (struct sctp_init_chunk *)chunk->chunk_hdr, chunk,
358 &err_chunk)) {
359
360
361
362 if (err_chunk) {
363 packet = sctp_abort_pkt_new(net, ep, asoc, arg,
364 (__u8 *)(err_chunk->chunk_hdr) +
365 sizeof(struct sctp_chunkhdr),
366 ntohs(err_chunk->chunk_hdr->length) -
367 sizeof(struct sctp_chunkhdr));
368
369 sctp_chunk_free(err_chunk);
370
371 if (packet) {
372 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
373 SCTP_PACKET(packet));
374 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
375 return SCTP_DISPOSITION_CONSUME;
376 } else {
377 return SCTP_DISPOSITION_NOMEM;
378 }
379 } else {
380 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg,
381 commands);
382 }
383 }
384
385
386 chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data;
387
388
389 chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(struct sctp_inithdr));
390
391 new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC);
392 if (!new_asoc)
393 goto nomem;
394
395 if (sctp_assoc_set_bind_addr_from_ep(new_asoc,
396 sctp_scope(sctp_source(chunk)),
397 GFP_ATOMIC) < 0)
398 goto nomem_init;
399
400
401 if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk),
402 (struct sctp_init_chunk *)chunk->chunk_hdr,
403 GFP_ATOMIC))
404 goto nomem_init;
405
406
407
408
409
410
411 len = 0;
412 if (err_chunk)
413 len = ntohs(err_chunk->chunk_hdr->length) -
414 sizeof(struct sctp_chunkhdr);
415
416 repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
417 if (!repl)
418 goto nomem_init;
419
420
421
422
423
424 if (err_chunk) {
425
426
427
428
429
430
431
432 unk_param = (struct sctp_unrecognized_param *)
433 ((__u8 *)(err_chunk->chunk_hdr) +
434 sizeof(struct sctp_chunkhdr));
435
436
437
438 sctp_addto_chunk(repl, len, unk_param);
439 sctp_chunk_free(err_chunk);
440 }
441
442 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
443
444 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
445
446
447
448
449
450
451
452 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
453
454 return SCTP_DISPOSITION_DELETE_TCB;
455
456nomem_init:
457 sctp_association_free(new_asoc);
458nomem:
459 if (err_chunk)
460 sctp_chunk_free(err_chunk);
461 return SCTP_DISPOSITION_NOMEM;
462}
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492enum sctp_disposition sctp_sf_do_5_1C_ack(struct net *net,
493 const struct sctp_endpoint *ep,
494 const struct sctp_association *asoc,
495 const union sctp_subtype type,
496 void *arg,
497 struct sctp_cmd_seq *commands)
498{
499 struct sctp_init_chunk *initchunk;
500 struct sctp_chunk *chunk = arg;
501 struct sctp_chunk *err_chunk;
502 struct sctp_packet *packet;
503
504 if (!sctp_vtag_verify(chunk, asoc))
505 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
506
507
508
509
510
511 if (!chunk->singleton)
512 return sctp_sf_violation_chunk(net, ep, asoc, type, arg, commands);
513
514
515 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_initack_chunk)))
516 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
517 commands);
518
519 chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data;
520
521
522 err_chunk = NULL;
523 if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type,
524 (struct sctp_init_chunk *)chunk->chunk_hdr, chunk,
525 &err_chunk)) {
526
527 enum sctp_error error = SCTP_ERROR_NO_RESOURCE;
528
529
530
531
532
533
534 if (err_chunk) {
535 packet = sctp_abort_pkt_new(net, ep, asoc, arg,
536 (__u8 *)(err_chunk->chunk_hdr) +
537 sizeof(struct sctp_chunkhdr),
538 ntohs(err_chunk->chunk_hdr->length) -
539 sizeof(struct sctp_chunkhdr));
540
541 sctp_chunk_free(err_chunk);
542
543 if (packet) {
544 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
545 SCTP_PACKET(packet));
546 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
547 error = SCTP_ERROR_INV_PARAM;
548 }
549 }
550
551
552
553
554
555
556
557
558
559
560
561
562 if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
563 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
564
565 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
566 return sctp_stop_t1_and_abort(net, commands, error, ECONNREFUSED,
567 asoc, chunk->transport);
568 }
569
570
571
572
573 chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(struct sctp_inithdr));
574
575 initchunk = (struct sctp_init_chunk *)chunk->chunk_hdr;
576
577 sctp_add_cmd_sf(commands, SCTP_CMD_PEER_INIT,
578 SCTP_PEER_INIT(initchunk));
579
580
581 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());
582
583
584
585
586
587 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
588 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
589 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
590 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
591 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
592 SCTP_STATE(SCTP_STATE_COOKIE_ECHOED));
593
594
595
596
597 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_SHKEY, SCTP_NULL());
598
599
600
601
602
603
604
605 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_COOKIE_ECHO,
606 SCTP_CHUNK(err_chunk));
607
608 return SCTP_DISPOSITION_CONSUME;
609}
610
611static bool sctp_auth_chunk_verify(struct net *net, struct sctp_chunk *chunk,
612 const struct sctp_association *asoc)
613{
614 struct sctp_chunk auth;
615
616 if (!chunk->auth_chunk)
617 return true;
618
619
620
621
622
623
624
625
626
627 if (!net->sctp.auth_enable || !asoc->peer.auth_capable)
628 return false;
629
630
631 auth.skb = chunk->auth_chunk;
632 auth.asoc = chunk->asoc;
633 auth.sctp_hdr = chunk->sctp_hdr;
634 auth.chunk_hdr = (struct sctp_chunkhdr *)
635 skb_push(chunk->auth_chunk,
636 sizeof(struct sctp_chunkhdr));
637 skb_pull(chunk->auth_chunk, sizeof(struct sctp_chunkhdr));
638 auth.transport = chunk->transport;
639
640 return sctp_sf_authenticate(asoc, &auth) == SCTP_IERROR_NO_ERROR;
641}
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,
675 const struct sctp_endpoint *ep,
676 const struct sctp_association *asoc,
677 const union sctp_subtype type,
678 void *arg,
679 struct sctp_cmd_seq *commands)
680{
681 struct sctp_ulpevent *ev, *ai_ev = NULL, *auth_ev = NULL;
682 struct sctp_association *new_asoc;
683 struct sctp_init_chunk *peer_init;
684 struct sctp_chunk *chunk = arg;
685 struct sctp_chunk *err_chk_p;
686 struct sctp_chunk *repl;
687 struct sock *sk;
688 int error = 0;
689
690
691
692
693 if (ep == sctp_sk(net->sctp.ctl_sock)->ep) {
694 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
695 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
696 }
697
698
699
700
701
702
703 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
704 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
705
706
707
708
709
710 sk = ep->base.sk;
711 if (!sctp_sstate(sk, LISTENING) ||
712 (sctp_style(sk, TCP) && sk_acceptq_is_full(sk)))
713 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
714
715
716
717
718 chunk->subh.cookie_hdr =
719 (struct sctp_signed_cookie *)chunk->skb->data;
720 if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
721 sizeof(struct sctp_chunkhdr)))
722 goto nomem;
723
724
725
726
727
728 new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, &error,
729 &err_chk_p);
730
731
732
733
734
735
736
737 if (!new_asoc) {
738
739
740
741 switch (error) {
742 case -SCTP_IERROR_NOMEM:
743 goto nomem;
744
745 case -SCTP_IERROR_STALE_COOKIE:
746 sctp_send_stale_cookie_err(net, ep, asoc, chunk, commands,
747 err_chk_p);
748 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
749
750 case -SCTP_IERROR_BAD_SIG:
751 default:
752 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
753 }
754 }
755
756
757
758
759
760
761
762
763
764
765 peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
766
767 if (!sctp_process_init(new_asoc, chunk,
768 &chunk->subh.cookie_hdr->c.peer_addr,
769 peer_init, GFP_ATOMIC))
770 goto nomem_init;
771
772
773
774
775
776 error = sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC);
777 if (error)
778 goto nomem_init;
779
780 if (!sctp_auth_chunk_verify(net, chunk, new_asoc)) {
781 sctp_association_free(new_asoc);
782 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
783 }
784
785 repl = sctp_make_cookie_ack(new_asoc, chunk);
786 if (!repl)
787 goto nomem_init;
788
789
790
791
792
793
794
795 ev = sctp_ulpevent_make_assoc_change(new_asoc, 0, SCTP_COMM_UP, 0,
796 new_asoc->c.sinit_num_ostreams,
797 new_asoc->c.sinit_max_instreams,
798 NULL, GFP_ATOMIC);
799 if (!ev)
800 goto nomem_ev;
801
802
803
804
805
806
807 if (new_asoc->peer.adaptation_ind) {
808 ai_ev = sctp_ulpevent_make_adaptation_indication(new_asoc,
809 GFP_ATOMIC);
810 if (!ai_ev)
811 goto nomem_aiev;
812 }
813
814 if (!new_asoc->peer.auth_capable) {
815 auth_ev = sctp_ulpevent_make_authkey(new_asoc, 0,
816 SCTP_AUTH_NO_AUTH,
817 GFP_ATOMIC);
818 if (!auth_ev)
819 goto nomem_authev;
820 }
821
822
823
824
825
826
827 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
828 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
829 SCTP_STATE(SCTP_STATE_ESTABLISHED));
830 SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
831 SCTP_INC_STATS(net, SCTP_MIB_PASSIVEESTABS);
832 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
833
834 if (new_asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
835 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
836 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
837
838
839 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
840
841
842 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
843
844
845 if (ai_ev)
846 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
847 SCTP_ULPEVENT(ai_ev));
848
849 if (auth_ev)
850 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
851 SCTP_ULPEVENT(auth_ev));
852
853 return SCTP_DISPOSITION_CONSUME;
854
855nomem_authev:
856 sctp_ulpevent_free(ai_ev);
857nomem_aiev:
858 sctp_ulpevent_free(ev);
859nomem_ev:
860 sctp_chunk_free(repl);
861nomem_init:
862 sctp_association_free(new_asoc);
863nomem:
864 return SCTP_DISPOSITION_NOMEM;
865}
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888enum sctp_disposition sctp_sf_do_5_1E_ca(struct net *net,
889 const struct sctp_endpoint *ep,
890 const struct sctp_association *asoc,
891 const union sctp_subtype type,
892 void *arg,
893 struct sctp_cmd_seq *commands)
894{
895 struct sctp_chunk *chunk = arg;
896 struct sctp_ulpevent *ev;
897
898 if (!sctp_vtag_verify(chunk, asoc))
899 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
900
901
902
903
904 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
905 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
906 commands);
907
908
909
910
911
912
913
914 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());
915
916
917 security_inet_conn_established(ep->base.sk, chunk->skb);
918
919
920
921
922
923
924
925 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
926 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
927 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
928 SCTP_STATE(SCTP_STATE_ESTABLISHED));
929 SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
930 SCTP_INC_STATS(net, SCTP_MIB_ACTIVEESTABS);
931 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
932 if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
933 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
934 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
935
936
937
938
939
940 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_COMM_UP,
941 0, asoc->c.sinit_num_ostreams,
942 asoc->c.sinit_max_instreams,
943 NULL, GFP_ATOMIC);
944
945 if (!ev)
946 goto nomem;
947
948 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
949
950
951
952
953
954
955 if (asoc->peer.adaptation_ind) {
956 ev = sctp_ulpevent_make_adaptation_indication(asoc, GFP_ATOMIC);
957 if (!ev)
958 goto nomem;
959
960 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
961 SCTP_ULPEVENT(ev));
962 }
963
964 if (!asoc->peer.auth_capable) {
965 ev = sctp_ulpevent_make_authkey(asoc, 0, SCTP_AUTH_NO_AUTH,
966 GFP_ATOMIC);
967 if (!ev)
968 goto nomem;
969 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
970 SCTP_ULPEVENT(ev));
971 }
972
973 return SCTP_DISPOSITION_CONSUME;
974nomem:
975 return SCTP_DISPOSITION_NOMEM;
976}
977
978
979static enum sctp_disposition sctp_sf_heartbeat(
980 const struct sctp_endpoint *ep,
981 const struct sctp_association *asoc,
982 const union sctp_subtype type,
983 void *arg,
984 struct sctp_cmd_seq *commands)
985{
986 struct sctp_transport *transport = (struct sctp_transport *) arg;
987 struct sctp_chunk *reply;
988
989
990 reply = sctp_make_heartbeat(asoc, transport);
991 if (!reply)
992 return SCTP_DISPOSITION_NOMEM;
993
994
995
996
997 sctp_add_cmd_sf(commands, SCTP_CMD_RTO_PENDING,
998 SCTP_TRANSPORT(transport));
999
1000 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
1001 return SCTP_DISPOSITION_CONSUME;
1002}
1003
1004
1005enum sctp_disposition sctp_sf_sendbeat_8_3(struct net *net,
1006 const struct sctp_endpoint *ep,
1007 const struct sctp_association *asoc,
1008 const union sctp_subtype type,
1009 void *arg,
1010 struct sctp_cmd_seq *commands)
1011{
1012 struct sctp_transport *transport = (struct sctp_transport *) arg;
1013
1014 if (asoc->overall_error_count >= asoc->max_retrans) {
1015 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
1016 SCTP_ERROR(ETIMEDOUT));
1017
1018 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
1019 SCTP_PERR(SCTP_ERROR_NO_ERROR));
1020 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
1021 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
1022 return SCTP_DISPOSITION_DELETE_TCB;
1023 }
1024
1025
1026
1027
1028
1029
1030
1031
1032 if (transport->param_flags & SPP_HB_ENABLE) {
1033 if (SCTP_DISPOSITION_NOMEM ==
1034 sctp_sf_heartbeat(ep, asoc, type, arg,
1035 commands))
1036 return SCTP_DISPOSITION_NOMEM;
1037
1038
1039
1040
1041 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_HB_SENT,
1042 SCTP_TRANSPORT(transport));
1043 }
1044 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_IDLE,
1045 SCTP_TRANSPORT(transport));
1046 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMER_UPDATE,
1047 SCTP_TRANSPORT(transport));
1048
1049 return SCTP_DISPOSITION_CONSUME;
1050}
1051
1052
1053enum sctp_disposition sctp_sf_send_reconf(struct net *net,
1054 const struct sctp_endpoint *ep,
1055 const struct sctp_association *asoc,
1056 const union sctp_subtype type,
1057 void *arg,
1058 struct sctp_cmd_seq *commands)
1059{
1060 struct sctp_transport *transport = arg;
1061
1062 if (asoc->overall_error_count >= asoc->max_retrans) {
1063 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
1064 SCTP_ERROR(ETIMEDOUT));
1065
1066 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
1067 SCTP_PERR(SCTP_ERROR_NO_ERROR));
1068 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
1069 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
1070 return SCTP_DISPOSITION_DELETE_TCB;
1071 }
1072
1073 sctp_chunk_hold(asoc->strreset_chunk);
1074 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
1075 SCTP_CHUNK(asoc->strreset_chunk));
1076 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE, SCTP_TRANSPORT(transport));
1077
1078 return SCTP_DISPOSITION_CONSUME;
1079}
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105enum sctp_disposition sctp_sf_beat_8_3(struct net *net,
1106 const struct sctp_endpoint *ep,
1107 const struct sctp_association *asoc,
1108 const union sctp_subtype type,
1109 void *arg, struct sctp_cmd_seq *commands)
1110{
1111 struct sctp_paramhdr *param_hdr;
1112 struct sctp_chunk *chunk = arg;
1113 struct sctp_chunk *reply;
1114 size_t paylen = 0;
1115
1116 if (!sctp_vtag_verify(chunk, asoc))
1117 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1118
1119
1120 if (!sctp_chunk_length_valid(chunk,
1121 sizeof(struct sctp_heartbeat_chunk)))
1122 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1123 commands);
1124
1125
1126
1127
1128
1129 chunk->subh.hb_hdr = (struct sctp_heartbeathdr *)chunk->skb->data;
1130 param_hdr = (struct sctp_paramhdr *)chunk->subh.hb_hdr;
1131 paylen = ntohs(chunk->chunk_hdr->length) - sizeof(struct sctp_chunkhdr);
1132
1133 if (ntohs(param_hdr->length) > paylen)
1134 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
1135 param_hdr, commands);
1136
1137 if (!pskb_pull(chunk->skb, paylen))
1138 goto nomem;
1139
1140 reply = sctp_make_heartbeat_ack(asoc, chunk, param_hdr, paylen);
1141 if (!reply)
1142 goto nomem;
1143
1144 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
1145 return SCTP_DISPOSITION_CONSUME;
1146
1147nomem:
1148 return SCTP_DISPOSITION_NOMEM;
1149}
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179enum sctp_disposition sctp_sf_backbeat_8_3(struct net *net,
1180 const struct sctp_endpoint *ep,
1181 const struct sctp_association *asoc,
1182 const union sctp_subtype type,
1183 void *arg,
1184 struct sctp_cmd_seq *commands)
1185{
1186 struct sctp_sender_hb_info *hbinfo;
1187 struct sctp_chunk *chunk = arg;
1188 struct sctp_transport *link;
1189 unsigned long max_interval;
1190 union sctp_addr from_addr;
1191
1192 if (!sctp_vtag_verify(chunk, asoc))
1193 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1194
1195
1196 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr) +
1197 sizeof(*hbinfo)))
1198 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1199 commands);
1200
1201 hbinfo = (struct sctp_sender_hb_info *)chunk->skb->data;
1202
1203 if (ntohs(hbinfo->param_hdr.length) != sizeof(*hbinfo))
1204 return SCTP_DISPOSITION_DISCARD;
1205
1206 from_addr = hbinfo->daddr;
1207 link = sctp_assoc_lookup_paddr(asoc, &from_addr);
1208
1209
1210 if (unlikely(!link)) {
1211 if (from_addr.sa.sa_family == AF_INET6) {
1212 net_warn_ratelimited("%s association %p could not find address %pI6\n",
1213 __func__,
1214 asoc,
1215 &from_addr.v6.sin6_addr);
1216 } else {
1217 net_warn_ratelimited("%s association %p could not find address %pI4\n",
1218 __func__,
1219 asoc,
1220 &from_addr.v4.sin_addr.s_addr);
1221 }
1222 return SCTP_DISPOSITION_DISCARD;
1223 }
1224
1225
1226 if (hbinfo->hb_nonce != link->hb_nonce)
1227 return SCTP_DISPOSITION_DISCARD;
1228
1229 max_interval = link->hbinterval + link->rto;
1230
1231
1232 if (time_after(hbinfo->sent_at, jiffies) ||
1233 time_after(jiffies, hbinfo->sent_at + max_interval)) {
1234 pr_debug("%s: HEARTBEAT ACK with invalid timestamp received "
1235 "for transport:%p\n", __func__, link);
1236
1237 return SCTP_DISPOSITION_DISCARD;
1238 }
1239
1240
1241
1242
1243
1244
1245
1246 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_ON, SCTP_TRANSPORT(link));
1247
1248 return SCTP_DISPOSITION_CONSUME;
1249}
1250
1251
1252
1253
1254static int sctp_sf_send_restart_abort(struct net *net, union sctp_addr *ssa,
1255 struct sctp_chunk *init,
1256 struct sctp_cmd_seq *commands)
1257{
1258 struct sctp_af *af = sctp_get_af_specific(ssa->v4.sin_family);
1259 union sctp_addr_param *addrparm;
1260 struct sctp_errhdr *errhdr;
1261 char buffer[sizeof(*errhdr) + sizeof(*addrparm)];
1262 struct sctp_endpoint *ep;
1263 struct sctp_packet *pkt;
1264 int len;
1265
1266
1267
1268
1269 errhdr = (struct sctp_errhdr *)buffer;
1270 addrparm = (union sctp_addr_param *)errhdr->variable;
1271
1272
1273 len = af->to_addr_param(ssa, addrparm);
1274 len += sizeof(*errhdr);
1275
1276 errhdr->cause = SCTP_ERROR_RESTART;
1277 errhdr->length = htons(len);
1278
1279
1280 ep = sctp_sk(net->sctp.ctl_sock)->ep;
1281
1282
1283
1284
1285 pkt = sctp_abort_pkt_new(net, ep, NULL, init, errhdr, len);
1286
1287 if (!pkt)
1288 goto out;
1289 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT, SCTP_PACKET(pkt));
1290
1291 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
1292
1293
1294 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
1295
1296out:
1297
1298
1299
1300 return 0;
1301}
1302
1303static bool list_has_sctp_addr(const struct list_head *list,
1304 union sctp_addr *ipaddr)
1305{
1306 struct sctp_transport *addr;
1307
1308 list_for_each_entry(addr, list, transports) {
1309 if (sctp_cmp_addr_exact(ipaddr, &addr->ipaddr))
1310 return true;
1311 }
1312
1313 return false;
1314}
1315
1316
1317
1318static int sctp_sf_check_restart_addrs(const struct sctp_association *new_asoc,
1319 const struct sctp_association *asoc,
1320 struct sctp_chunk *init,
1321 struct sctp_cmd_seq *commands)
1322{
1323 struct net *net = sock_net(new_asoc->base.sk);
1324 struct sctp_transport *new_addr;
1325 int ret = 1;
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338 list_for_each_entry(new_addr, &new_asoc->peer.transport_addr_list,
1339 transports) {
1340 if (!list_has_sctp_addr(&asoc->peer.transport_addr_list,
1341 &new_addr->ipaddr)) {
1342 sctp_sf_send_restart_abort(net, &new_addr->ipaddr, init,
1343 commands);
1344 ret = 0;
1345 break;
1346 }
1347 }
1348
1349
1350 return ret;
1351}
1352
1353
1354
1355
1356
1357
1358static void sctp_tietags_populate(struct sctp_association *new_asoc,
1359 const struct sctp_association *asoc)
1360{
1361 switch (asoc->state) {
1362
1363
1364
1365 case SCTP_STATE_COOKIE_WAIT:
1366 new_asoc->c.my_vtag = asoc->c.my_vtag;
1367 new_asoc->c.my_ttag = asoc->c.my_vtag;
1368 new_asoc->c.peer_ttag = 0;
1369 break;
1370
1371 case SCTP_STATE_COOKIE_ECHOED:
1372 new_asoc->c.my_vtag = asoc->c.my_vtag;
1373 new_asoc->c.my_ttag = asoc->c.my_vtag;
1374 new_asoc->c.peer_ttag = asoc->c.peer_vtag;
1375 break;
1376
1377
1378
1379
1380 default:
1381 new_asoc->c.my_ttag = asoc->c.my_vtag;
1382 new_asoc->c.peer_ttag = asoc->c.peer_vtag;
1383 break;
1384 }
1385
1386
1387
1388
1389
1390 new_asoc->rwnd = asoc->rwnd;
1391 new_asoc->c.sinit_num_ostreams = asoc->c.sinit_num_ostreams;
1392 new_asoc->c.sinit_max_instreams = asoc->c.sinit_max_instreams;
1393 new_asoc->c.initial_tsn = asoc->c.initial_tsn;
1394}
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405static char sctp_tietags_compare(struct sctp_association *new_asoc,
1406 const struct sctp_association *asoc)
1407{
1408
1409 if ((asoc->c.my_vtag != new_asoc->c.my_vtag) &&
1410 (asoc->c.peer_vtag != new_asoc->c.peer_vtag) &&
1411 (asoc->c.my_vtag == new_asoc->c.my_ttag) &&
1412 (asoc->c.peer_vtag == new_asoc->c.peer_ttag))
1413 return 'A';
1414
1415
1416 if ((asoc->c.my_vtag == new_asoc->c.my_vtag) &&
1417 ((asoc->c.peer_vtag != new_asoc->c.peer_vtag) ||
1418 (0 == asoc->c.peer_vtag))) {
1419 return 'B';
1420 }
1421
1422
1423 if ((asoc->c.my_vtag == new_asoc->c.my_vtag) &&
1424 (asoc->c.peer_vtag == new_asoc->c.peer_vtag))
1425 return 'D';
1426
1427
1428 if ((asoc->c.my_vtag != new_asoc->c.my_vtag) &&
1429 (asoc->c.peer_vtag == new_asoc->c.peer_vtag) &&
1430 (0 == new_asoc->c.my_ttag) &&
1431 (0 == new_asoc->c.peer_ttag))
1432 return 'C';
1433
1434
1435 return 'E';
1436}
1437
1438
1439
1440
1441static enum sctp_disposition sctp_sf_do_unexpected_init(
1442 struct net *net,
1443 const struct sctp_endpoint *ep,
1444 const struct sctp_association *asoc,
1445 const union sctp_subtype type,
1446 void *arg,
1447 struct sctp_cmd_seq *commands)
1448{
1449 struct sctp_chunk *chunk = arg, *repl, *err_chunk;
1450 struct sctp_unrecognized_param *unk_param;
1451 struct sctp_association *new_asoc;
1452 enum sctp_disposition retval;
1453 struct sctp_packet *packet;
1454 int len;
1455
1456
1457 if (security_sctp_assoc_request((struct sctp_endpoint *)ep,
1458 chunk->skb))
1459 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470 if (!chunk->singleton)
1471 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1472
1473
1474
1475
1476 if (chunk->sctp_hdr->vtag != 0)
1477 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
1478
1479
1480
1481
1482
1483 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
1484 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1485 commands);
1486
1487 chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data;
1488
1489
1490 chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(struct sctp_inithdr));
1491
1492
1493 err_chunk = NULL;
1494 if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type,
1495 (struct sctp_init_chunk *)chunk->chunk_hdr, chunk,
1496 &err_chunk)) {
1497
1498
1499
1500 if (err_chunk) {
1501 packet = sctp_abort_pkt_new(net, ep, asoc, arg,
1502 (__u8 *)(err_chunk->chunk_hdr) +
1503 sizeof(struct sctp_chunkhdr),
1504 ntohs(err_chunk->chunk_hdr->length) -
1505 sizeof(struct sctp_chunkhdr));
1506
1507 if (packet) {
1508 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
1509 SCTP_PACKET(packet));
1510 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
1511 retval = SCTP_DISPOSITION_CONSUME;
1512 } else {
1513 retval = SCTP_DISPOSITION_NOMEM;
1514 }
1515 goto cleanup;
1516 } else {
1517 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg,
1518 commands);
1519 }
1520 }
1521
1522
1523
1524
1525
1526
1527
1528
1529 new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC);
1530 if (!new_asoc)
1531 goto nomem;
1532
1533 if (sctp_assoc_set_bind_addr_from_ep(new_asoc,
1534 sctp_scope(sctp_source(chunk)), GFP_ATOMIC) < 0)
1535 goto nomem;
1536
1537
1538
1539
1540
1541 if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk),
1542 (struct sctp_init_chunk *)chunk->chunk_hdr,
1543 GFP_ATOMIC))
1544 goto nomem;
1545
1546
1547
1548
1549
1550
1551 if (!sctp_state(asoc, COOKIE_WAIT)) {
1552 if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk,
1553 commands)) {
1554 retval = SCTP_DISPOSITION_CONSUME;
1555 goto nomem_retval;
1556 }
1557 }
1558
1559 sctp_tietags_populate(new_asoc, asoc);
1560
1561
1562
1563
1564
1565
1566 len = 0;
1567 if (err_chunk) {
1568 len = ntohs(err_chunk->chunk_hdr->length) -
1569 sizeof(struct sctp_chunkhdr);
1570 }
1571
1572 repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
1573 if (!repl)
1574 goto nomem;
1575
1576
1577
1578
1579
1580 if (err_chunk) {
1581
1582
1583
1584
1585
1586
1587
1588 unk_param = (struct sctp_unrecognized_param *)
1589 ((__u8 *)(err_chunk->chunk_hdr) +
1590 sizeof(struct sctp_chunkhdr));
1591
1592
1593
1594 sctp_addto_chunk(repl, len, unk_param);
1595 }
1596
1597 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
1598 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1599
1600
1601
1602
1603
1604
1605 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
1606 retval = SCTP_DISPOSITION_CONSUME;
1607
1608 return retval;
1609
1610nomem:
1611 retval = SCTP_DISPOSITION_NOMEM;
1612nomem_retval:
1613 if (new_asoc)
1614 sctp_association_free(new_asoc);
1615cleanup:
1616 if (err_chunk)
1617 sctp_chunk_free(err_chunk);
1618 return retval;
1619}
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659enum sctp_disposition sctp_sf_do_5_2_1_siminit(
1660 struct net *net,
1661 const struct sctp_endpoint *ep,
1662 const struct sctp_association *asoc,
1663 const union sctp_subtype type,
1664 void *arg,
1665 struct sctp_cmd_seq *commands)
1666{
1667
1668
1669
1670 return sctp_sf_do_unexpected_init(net, ep, asoc, type, arg, commands);
1671}
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714enum sctp_disposition sctp_sf_do_5_2_2_dupinit(
1715 struct net *net,
1716 const struct sctp_endpoint *ep,
1717 const struct sctp_association *asoc,
1718 const union sctp_subtype type,
1719 void *arg,
1720 struct sctp_cmd_seq *commands)
1721{
1722
1723
1724
1725 return sctp_sf_do_unexpected_init(net, ep, asoc, type, arg, commands);
1726}
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738enum sctp_disposition sctp_sf_do_5_2_3_initack(
1739 struct net *net,
1740 const struct sctp_endpoint *ep,
1741 const struct sctp_association *asoc,
1742 const union sctp_subtype type,
1743 void *arg,
1744 struct sctp_cmd_seq *commands)
1745{
1746
1747
1748
1749 if (ep == sctp_sk(net->sctp.ctl_sock)->ep)
1750 return sctp_sf_ootb(net, ep, asoc, type, arg, commands);
1751 else
1752 return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
1753}
1754
1755
1756
1757
1758
1759
1760static enum sctp_disposition sctp_sf_do_dupcook_a(
1761 struct net *net,
1762 const struct sctp_endpoint *ep,
1763 const struct sctp_association *asoc,
1764 struct sctp_chunk *chunk,
1765 struct sctp_cmd_seq *commands,
1766 struct sctp_association *new_asoc)
1767{
1768 struct sctp_init_chunk *peer_init;
1769 enum sctp_disposition disposition;
1770 struct sctp_ulpevent *ev;
1771 struct sctp_chunk *repl;
1772 struct sctp_chunk *err;
1773
1774
1775
1776
1777 peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
1778
1779 if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk), peer_init,
1780 GFP_ATOMIC))
1781 goto nomem;
1782
1783 if (sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC))
1784 goto nomem;
1785
1786 if (!sctp_auth_chunk_verify(net, chunk, new_asoc))
1787 return SCTP_DISPOSITION_DISCARD;
1788
1789
1790
1791
1792
1793 if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk, commands))
1794 return SCTP_DISPOSITION_CONSUME;
1795
1796
1797
1798
1799
1800
1801
1802 if (sctp_state(asoc, SHUTDOWN_ACK_SENT)) {
1803 disposition = sctp_sf_do_9_2_reshutack(net, ep, asoc,
1804 SCTP_ST_CHUNK(chunk->chunk_hdr->type),
1805 chunk, commands);
1806 if (SCTP_DISPOSITION_NOMEM == disposition)
1807 goto nomem;
1808
1809 err = sctp_make_op_error(asoc, chunk,
1810 SCTP_ERROR_COOKIE_IN_SHUTDOWN,
1811 NULL, 0, 0);
1812 if (err)
1813 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
1814 SCTP_CHUNK(err));
1815
1816 return SCTP_DISPOSITION_CONSUME;
1817 }
1818
1819
1820
1821
1822 sctp_add_cmd_sf(commands, SCTP_CMD_T3_RTX_TIMERS_STOP, SCTP_NULL());
1823 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
1824 SCTP_TO(SCTP_EVENT_TIMEOUT_SACK));
1825 sctp_add_cmd_sf(commands, SCTP_CMD_PURGE_OUTQUEUE, SCTP_NULL());
1826
1827
1828
1829
1830 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
1831 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
1832 sctp_add_cmd_sf(commands, SCTP_CMD_PURGE_ASCONF_QUEUE, SCTP_NULL());
1833
1834 repl = sctp_make_cookie_ack(new_asoc, chunk);
1835 if (!repl)
1836 goto nomem;
1837
1838
1839 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_RESTART, 0,
1840 new_asoc->c.sinit_num_ostreams,
1841 new_asoc->c.sinit_max_instreams,
1842 NULL, GFP_ATOMIC);
1843 if (!ev)
1844 goto nomem_ev;
1845
1846
1847 sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
1848 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
1849 if (sctp_state(asoc, SHUTDOWN_PENDING) &&
1850 (sctp_sstate(asoc->base.sk, CLOSING) ||
1851 sock_flag(asoc->base.sk, SOCK_DEAD))) {
1852
1853
1854
1855
1856 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1857 return sctp_sf_do_9_2_start_shutdown(net, ep, asoc,
1858 SCTP_ST_CHUNK(0), NULL,
1859 commands);
1860 } else {
1861 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
1862 SCTP_STATE(SCTP_STATE_ESTABLISHED));
1863 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1864 }
1865 return SCTP_DISPOSITION_CONSUME;
1866
1867nomem_ev:
1868 sctp_chunk_free(repl);
1869nomem:
1870 return SCTP_DISPOSITION_NOMEM;
1871}
1872
1873
1874
1875
1876
1877
1878
1879
1880
1881static enum sctp_disposition sctp_sf_do_dupcook_b(
1882 struct net *net,
1883 const struct sctp_endpoint *ep,
1884 const struct sctp_association *asoc,
1885 struct sctp_chunk *chunk,
1886 struct sctp_cmd_seq *commands,
1887 struct sctp_association *new_asoc)
1888{
1889 struct sctp_init_chunk *peer_init;
1890 struct sctp_chunk *repl;
1891
1892
1893
1894
1895 peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
1896 if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk), peer_init,
1897 GFP_ATOMIC))
1898 goto nomem;
1899
1900 if (sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC))
1901 goto nomem;
1902
1903 if (!sctp_auth_chunk_verify(net, chunk, new_asoc))
1904 return SCTP_DISPOSITION_DISCARD;
1905
1906
1907 sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
1908 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
1909 SCTP_STATE(SCTP_STATE_ESTABLISHED));
1910 SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
1911 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
1912
1913 repl = sctp_make_cookie_ack(new_asoc, chunk);
1914 if (!repl)
1915 goto nomem;
1916
1917 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1918
1919
1920
1921
1922
1923
1924
1925
1926
1927
1928
1929
1930
1931 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_CHANGE, SCTP_U8(SCTP_COMM_UP));
1932
1933
1934
1935
1936
1937
1938
1939
1940
1941 if (asoc->peer.adaptation_ind)
1942 sctp_add_cmd_sf(commands, SCTP_CMD_ADAPTATION_IND, SCTP_NULL());
1943
1944 if (!asoc->peer.auth_capable)
1945 sctp_add_cmd_sf(commands, SCTP_CMD_PEER_NO_AUTH, SCTP_NULL());
1946
1947 return SCTP_DISPOSITION_CONSUME;
1948
1949nomem:
1950 return SCTP_DISPOSITION_NOMEM;
1951}
1952
1953
1954
1955
1956
1957
1958
1959
1960
1961
1962static enum sctp_disposition sctp_sf_do_dupcook_c(
1963 struct net *net,
1964 const struct sctp_endpoint *ep,
1965 const struct sctp_association *asoc,
1966 struct sctp_chunk *chunk,
1967 struct sctp_cmd_seq *commands,
1968 struct sctp_association *new_asoc)
1969{
1970
1971
1972
1973
1974 return SCTP_DISPOSITION_DISCARD;
1975}
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985static enum sctp_disposition sctp_sf_do_dupcook_d(
1986 struct net *net,
1987 const struct sctp_endpoint *ep,
1988 const struct sctp_association *asoc,
1989 struct sctp_chunk *chunk,
1990 struct sctp_cmd_seq *commands,
1991 struct sctp_association *new_asoc)
1992{
1993 struct sctp_ulpevent *ev = NULL, *ai_ev = NULL, *auth_ev = NULL;
1994 struct sctp_chunk *repl;
1995
1996
1997
1998
1999
2000
2001
2002
2003 if (!sctp_auth_chunk_verify(net, chunk, asoc))
2004 return SCTP_DISPOSITION_DISCARD;
2005
2006
2007 if (asoc->state < SCTP_STATE_ESTABLISHED) {
2008 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2009 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
2010 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2011 SCTP_STATE(SCTP_STATE_ESTABLISHED));
2012 SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
2013 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START,
2014 SCTP_NULL());
2015
2016
2017
2018
2019
2020
2021
2022
2023 ev = sctp_ulpevent_make_assoc_change(asoc, 0,
2024 SCTP_COMM_UP, 0,
2025 asoc->c.sinit_num_ostreams,
2026 asoc->c.sinit_max_instreams,
2027 NULL, GFP_ATOMIC);
2028 if (!ev)
2029 goto nomem;
2030
2031
2032
2033
2034
2035
2036 if (asoc->peer.adaptation_ind) {
2037 ai_ev = sctp_ulpevent_make_adaptation_indication(asoc,
2038 GFP_ATOMIC);
2039 if (!ai_ev)
2040 goto nomem;
2041
2042 }
2043
2044 if (!asoc->peer.auth_capable) {
2045 auth_ev = sctp_ulpevent_make_authkey(asoc, 0,
2046 SCTP_AUTH_NO_AUTH,
2047 GFP_ATOMIC);
2048 if (!auth_ev)
2049 goto nomem;
2050 }
2051 }
2052
2053 repl = sctp_make_cookie_ack(asoc, chunk);
2054 if (!repl)
2055 goto nomem;
2056
2057 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
2058
2059 if (ev)
2060 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
2061 SCTP_ULPEVENT(ev));
2062 if (ai_ev)
2063 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
2064 SCTP_ULPEVENT(ai_ev));
2065 if (auth_ev)
2066 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
2067 SCTP_ULPEVENT(auth_ev));
2068
2069 return SCTP_DISPOSITION_CONSUME;
2070
2071nomem:
2072 if (auth_ev)
2073 sctp_ulpevent_free(auth_ev);
2074 if (ai_ev)
2075 sctp_ulpevent_free(ai_ev);
2076 if (ev)
2077 sctp_ulpevent_free(ev);
2078 return SCTP_DISPOSITION_NOMEM;
2079}
2080
2081
2082
2083
2084
2085
2086
2087
2088
2089
2090
2091
2092
2093
2094
2095
2096
2097enum sctp_disposition sctp_sf_do_5_2_4_dupcook(
2098 struct net *net,
2099 const struct sctp_endpoint *ep,
2100 const struct sctp_association *asoc,
2101 const union sctp_subtype type,
2102 void *arg,
2103 struct sctp_cmd_seq *commands)
2104{
2105 struct sctp_association *new_asoc;
2106 struct sctp_chunk *chunk = arg;
2107 enum sctp_disposition retval;
2108 struct sctp_chunk *err_chk_p;
2109 int error = 0;
2110 char action;
2111
2112
2113
2114
2115
2116
2117 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
2118 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2119 commands);
2120
2121
2122
2123
2124 chunk->subh.cookie_hdr = (struct sctp_signed_cookie *)chunk->skb->data;
2125 if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
2126 sizeof(struct sctp_chunkhdr)))
2127 goto nomem;
2128
2129
2130
2131
2132
2133
2134 new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, &error,
2135 &err_chk_p);
2136
2137
2138
2139
2140
2141
2142
2143 if (!new_asoc) {
2144
2145
2146
2147 switch (error) {
2148 case -SCTP_IERROR_NOMEM:
2149 goto nomem;
2150
2151 case -SCTP_IERROR_STALE_COOKIE:
2152 sctp_send_stale_cookie_err(net, ep, asoc, chunk, commands,
2153 err_chk_p);
2154 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2155 case -SCTP_IERROR_BAD_SIG:
2156 default:
2157 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2158 }
2159 }
2160
2161
2162 if (security_sctp_assoc_request((struct sctp_endpoint *)ep,
2163 chunk->skb))
2164 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2165
2166
2167 new_asoc->temp = 1;
2168
2169
2170
2171
2172 action = sctp_tietags_compare(new_asoc, asoc);
2173
2174 switch (action) {
2175 case 'A':
2176 retval = sctp_sf_do_dupcook_a(net, ep, asoc, chunk, commands,
2177 new_asoc);
2178 break;
2179
2180 case 'B':
2181 retval = sctp_sf_do_dupcook_b(net, ep, asoc, chunk, commands,
2182 new_asoc);
2183 break;
2184
2185 case 'C':
2186 retval = sctp_sf_do_dupcook_c(net, ep, asoc, chunk, commands,
2187 new_asoc);
2188 break;
2189
2190 case 'D':
2191 retval = sctp_sf_do_dupcook_d(net, ep, asoc, chunk, commands,
2192 new_asoc);
2193 break;
2194
2195 default:
2196 retval = sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2197 break;
2198 }
2199
2200
2201 sctp_add_cmd_sf(commands, SCTP_CMD_SET_ASOC, SCTP_ASOC(new_asoc));
2202 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
2203
2204
2205
2206
2207 sctp_add_cmd_sf(commands, SCTP_CMD_SET_ASOC,
2208 SCTP_ASOC((struct sctp_association *)asoc));
2209
2210 return retval;
2211
2212nomem:
2213 return SCTP_DISPOSITION_NOMEM;
2214}
2215
2216
2217
2218
2219
2220
2221enum sctp_disposition sctp_sf_shutdown_pending_abort(
2222 struct net *net,
2223 const struct sctp_endpoint *ep,
2224 const struct sctp_association *asoc,
2225 const union sctp_subtype type,
2226 void *arg,
2227 struct sctp_cmd_seq *commands)
2228{
2229 struct sctp_chunk *chunk = arg;
2230
2231 if (!sctp_vtag_verify_either(chunk, asoc))
2232 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2233
2234
2235
2236
2237
2238
2239
2240
2241
2242
2243
2244 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_abort_chunk)))
2245 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2246
2247
2248
2249
2250
2251
2252 if (SCTP_ADDR_DEL ==
2253 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2254 return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
2255
2256 return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
2257}
2258
2259
2260
2261
2262
2263
2264enum sctp_disposition sctp_sf_shutdown_sent_abort(
2265 struct net *net,
2266 const struct sctp_endpoint *ep,
2267 const struct sctp_association *asoc,
2268 const union sctp_subtype type,
2269 void *arg,
2270 struct sctp_cmd_seq *commands)
2271{
2272 struct sctp_chunk *chunk = arg;
2273
2274 if (!sctp_vtag_verify_either(chunk, asoc))
2275 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2276
2277
2278
2279
2280
2281
2282
2283
2284
2285
2286
2287 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_abort_chunk)))
2288 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2289
2290
2291
2292
2293
2294
2295 if (SCTP_ADDR_DEL ==
2296 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2297 return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
2298
2299
2300 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2301 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
2302
2303
2304 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2305 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
2306
2307 return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
2308}
2309
2310
2311
2312
2313
2314
2315enum sctp_disposition sctp_sf_shutdown_ack_sent_abort(
2316 struct net *net,
2317 const struct sctp_endpoint *ep,
2318 const struct sctp_association *asoc,
2319 const union sctp_subtype type,
2320 void *arg,
2321 struct sctp_cmd_seq *commands)
2322{
2323
2324
2325
2326 return sctp_sf_shutdown_sent_abort(net, ep, asoc, type, arg, commands);
2327}
2328
2329
2330
2331
2332
2333
2334
2335
2336
2337
2338
2339
2340
2341
2342
2343enum sctp_disposition sctp_sf_cookie_echoed_err(
2344 struct net *net,
2345 const struct sctp_endpoint *ep,
2346 const struct sctp_association *asoc,
2347 const union sctp_subtype type,
2348 void *arg,
2349 struct sctp_cmd_seq *commands)
2350{
2351 struct sctp_chunk *chunk = arg;
2352 struct sctp_errhdr *err;
2353
2354 if (!sctp_vtag_verify(chunk, asoc))
2355 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2356
2357
2358
2359
2360 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_operr_chunk)))
2361 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2362 commands);
2363
2364
2365
2366
2367
2368
2369 sctp_walk_errors(err, chunk->chunk_hdr) {
2370 if (SCTP_ERROR_STALE_COOKIE == err->cause)
2371 return sctp_sf_do_5_2_6_stale(net, ep, asoc, type,
2372 arg, commands);
2373 }
2374
2375
2376
2377
2378
2379
2380 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2381}
2382
2383
2384
2385
2386
2387
2388
2389
2390
2391
2392
2393
2394
2395
2396
2397
2398
2399
2400
2401
2402
2403
2404
2405
2406
2407
2408static enum sctp_disposition sctp_sf_do_5_2_6_stale(
2409 struct net *net,
2410 const struct sctp_endpoint *ep,
2411 const struct sctp_association *asoc,
2412 const union sctp_subtype type,
2413 void *arg,
2414 struct sctp_cmd_seq *commands)
2415{
2416 int attempts = asoc->init_err_counter + 1;
2417 struct sctp_chunk *chunk = arg, *reply;
2418 struct sctp_cookie_preserve_param bht;
2419 struct sctp_bind_addr *bp;
2420 struct sctp_errhdr *err;
2421 u32 stale;
2422
2423 if (attempts > asoc->max_init_attempts) {
2424 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
2425 SCTP_ERROR(ETIMEDOUT));
2426 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
2427 SCTP_PERR(SCTP_ERROR_STALE_COOKIE));
2428 return SCTP_DISPOSITION_DELETE_TCB;
2429 }
2430
2431 err = (struct sctp_errhdr *)(chunk->skb->data);
2432
2433
2434
2435
2436
2437
2438
2439
2440
2441
2442
2443
2444
2445
2446
2447 stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err)));
2448 stale = (stale * 2) / 1000;
2449
2450 bht.param_hdr.type = SCTP_PARAM_COOKIE_PRESERVATIVE;
2451 bht.param_hdr.length = htons(sizeof(bht));
2452 bht.lifespan_increment = htonl(stale);
2453
2454
2455 bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
2456 reply = sctp_make_init(asoc, bp, GFP_ATOMIC, sizeof(bht));
2457 if (!reply)
2458 goto nomem;
2459
2460 sctp_addto_chunk(reply, sizeof(bht), &bht);
2461
2462
2463 sctp_add_cmd_sf(commands, SCTP_CMD_CLEAR_INIT_TAG, SCTP_NULL());
2464
2465
2466 sctp_add_cmd_sf(commands, SCTP_CMD_T3_RTX_TIMERS_STOP, SCTP_NULL());
2467 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
2468
2469
2470
2471
2472 sctp_add_cmd_sf(commands, SCTP_CMD_DEL_NON_PRIMARY, SCTP_NULL());
2473
2474
2475
2476
2477 sctp_add_cmd_sf(commands, SCTP_CMD_T1_RETRAN,
2478 SCTP_TRANSPORT(asoc->peer.primary_path));
2479
2480
2481
2482
2483 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_INC, SCTP_NULL());
2484
2485 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2486 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
2487 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2488 SCTP_STATE(SCTP_STATE_COOKIE_WAIT));
2489 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
2490 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
2491
2492 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
2493
2494 return SCTP_DISPOSITION_CONSUME;
2495
2496nomem:
2497 return SCTP_DISPOSITION_NOMEM;
2498}
2499
2500
2501
2502
2503
2504
2505
2506
2507
2508
2509
2510
2511
2512
2513
2514
2515
2516
2517
2518
2519
2520
2521
2522
2523
2524
2525
2526
2527
2528
2529
2530
2531enum sctp_disposition sctp_sf_do_9_1_abort(
2532 struct net *net,
2533 const struct sctp_endpoint *ep,
2534 const struct sctp_association *asoc,
2535 const union sctp_subtype type,
2536 void *arg,
2537 struct sctp_cmd_seq *commands)
2538{
2539 struct sctp_chunk *chunk = arg;
2540
2541 if (!sctp_vtag_verify_either(chunk, asoc))
2542 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2543
2544
2545
2546
2547
2548
2549
2550
2551
2552
2553
2554 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_abort_chunk)))
2555 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2556
2557
2558
2559
2560
2561
2562 if (SCTP_ADDR_DEL ==
2563 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2564 return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
2565
2566 return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
2567}
2568
2569static enum sctp_disposition __sctp_sf_do_9_1_abort(
2570 struct net *net,
2571 const struct sctp_endpoint *ep,
2572 const struct sctp_association *asoc,
2573 const union sctp_subtype type,
2574 void *arg,
2575 struct sctp_cmd_seq *commands)
2576{
2577 __be16 error = SCTP_ERROR_NO_ERROR;
2578 struct sctp_chunk *chunk = arg;
2579 unsigned int len;
2580
2581
2582 len = ntohs(chunk->chunk_hdr->length);
2583 if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr)) {
2584 struct sctp_errhdr *err;
2585
2586 sctp_walk_errors(err, chunk->chunk_hdr);
2587 if ((void *)err != (void *)chunk->chunk_end)
2588 return sctp_sf_pdiscard(net, ep, asoc, type, arg,
2589 commands);
2590
2591 error = ((struct sctp_errhdr *)chunk->skb->data)->cause;
2592 }
2593
2594 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(ECONNRESET));
2595
2596 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, SCTP_PERR(error));
2597 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
2598 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
2599
2600 return SCTP_DISPOSITION_ABORT;
2601}
2602
2603
2604
2605
2606
2607
2608enum sctp_disposition sctp_sf_cookie_wait_abort(
2609 struct net *net,
2610 const struct sctp_endpoint *ep,
2611 const struct sctp_association *asoc,
2612 const union sctp_subtype type,
2613 void *arg,
2614 struct sctp_cmd_seq *commands)
2615{
2616 __be16 error = SCTP_ERROR_NO_ERROR;
2617 struct sctp_chunk *chunk = arg;
2618 unsigned int len;
2619
2620 if (!sctp_vtag_verify_either(chunk, asoc))
2621 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2622
2623
2624
2625
2626
2627
2628
2629
2630
2631
2632
2633 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_abort_chunk)))
2634 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2635
2636
2637 len = ntohs(chunk->chunk_hdr->length);
2638 if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
2639 error = ((struct sctp_errhdr *)chunk->skb->data)->cause;
2640
2641 return sctp_stop_t1_and_abort(net, commands, error, ECONNREFUSED, asoc,
2642 chunk->transport);
2643}
2644
2645
2646
2647
2648enum sctp_disposition sctp_sf_cookie_wait_icmp_abort(
2649 struct net *net,
2650 const struct sctp_endpoint *ep,
2651 const struct sctp_association *asoc,
2652 const union sctp_subtype type,
2653 void *arg,
2654 struct sctp_cmd_seq *commands)
2655{
2656 return sctp_stop_t1_and_abort(net, commands, SCTP_ERROR_NO_ERROR,
2657 ENOPROTOOPT, asoc,
2658 (struct sctp_transport *)arg);
2659}
2660
2661
2662
2663
2664enum sctp_disposition sctp_sf_cookie_echoed_abort(
2665 struct net *net,
2666 const struct sctp_endpoint *ep,
2667 const struct sctp_association *asoc,
2668 const union sctp_subtype type,
2669 void *arg,
2670 struct sctp_cmd_seq *commands)
2671{
2672
2673
2674
2675 return sctp_sf_cookie_wait_abort(net, ep, asoc, type, arg, commands);
2676}
2677
2678
2679
2680
2681
2682
2683static enum sctp_disposition sctp_stop_t1_and_abort(
2684 struct net *net,
2685 struct sctp_cmd_seq *commands,
2686 __be16 error, int sk_err,
2687 const struct sctp_association *asoc,
2688 struct sctp_transport *transport)
2689{
2690 pr_debug("%s: ABORT received (INIT)\n", __func__);
2691
2692 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2693 SCTP_STATE(SCTP_STATE_CLOSED));
2694 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
2695 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2696 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
2697 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(sk_err));
2698
2699 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
2700 SCTP_PERR(error));
2701
2702 return SCTP_DISPOSITION_ABORT;
2703}
2704
2705
2706
2707
2708
2709
2710
2711
2712
2713
2714
2715
2716
2717
2718
2719
2720
2721
2722
2723
2724
2725
2726
2727
2728
2729
2730
2731
2732
2733
2734
2735
2736
2737
2738enum sctp_disposition sctp_sf_do_9_2_shutdown(
2739 struct net *net,
2740 const struct sctp_endpoint *ep,
2741 const struct sctp_association *asoc,
2742 const union sctp_subtype type,
2743 void *arg,
2744 struct sctp_cmd_seq *commands)
2745{
2746 enum sctp_disposition disposition;
2747 struct sctp_chunk *chunk = arg;
2748 struct sctp_shutdownhdr *sdh;
2749 struct sctp_ulpevent *ev;
2750 __u32 ctsn;
2751
2752 if (!sctp_vtag_verify(chunk, asoc))
2753 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2754
2755
2756 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_shutdown_chunk)))
2757 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2758 commands);
2759
2760
2761 sdh = (struct sctp_shutdownhdr *)chunk->skb->data;
2762 skb_pull(chunk->skb, sizeof(*sdh));
2763 chunk->subh.shutdown_hdr = sdh;
2764 ctsn = ntohl(sdh->cum_tsn_ack);
2765
2766 if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
2767 pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn,
2768 asoc->ctsn_ack_point);
2769
2770 return SCTP_DISPOSITION_DISCARD;
2771 }
2772
2773
2774
2775
2776
2777 if (!TSN_lt(ctsn, asoc->next_tsn))
2778 return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands);
2779
2780
2781
2782
2783
2784 ev = sctp_ulpevent_make_shutdown_event(asoc, 0, GFP_ATOMIC);
2785 if (!ev) {
2786 disposition = SCTP_DISPOSITION_NOMEM;
2787 goto out;
2788 }
2789 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
2790
2791
2792
2793
2794
2795
2796
2797 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2798 SCTP_STATE(SCTP_STATE_SHUTDOWN_RECEIVED));
2799 disposition = SCTP_DISPOSITION_CONSUME;
2800
2801 if (sctp_outq_is_empty(&asoc->outqueue)) {
2802 disposition = sctp_sf_do_9_2_shutdown_ack(net, ep, asoc, type,
2803 arg, commands);
2804 }
2805
2806 if (SCTP_DISPOSITION_NOMEM == disposition)
2807 goto out;
2808
2809
2810
2811
2812
2813 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_CTSN,
2814 SCTP_BE32(chunk->subh.shutdown_hdr->cum_tsn_ack));
2815
2816out:
2817 return disposition;
2818}
2819
2820
2821
2822
2823
2824
2825
2826
2827
2828enum sctp_disposition sctp_sf_do_9_2_shut_ctsn(
2829 struct net *net,
2830 const struct sctp_endpoint *ep,
2831 const struct sctp_association *asoc,
2832 const union sctp_subtype type,
2833 void *arg,
2834 struct sctp_cmd_seq *commands)
2835{
2836 struct sctp_chunk *chunk = arg;
2837 struct sctp_shutdownhdr *sdh;
2838 __u32 ctsn;
2839
2840 if (!sctp_vtag_verify(chunk, asoc))
2841 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2842
2843
2844 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_shutdown_chunk)))
2845 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2846 commands);
2847
2848 sdh = (struct sctp_shutdownhdr *)chunk->skb->data;
2849 ctsn = ntohl(sdh->cum_tsn_ack);
2850
2851 if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
2852 pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn,
2853 asoc->ctsn_ack_point);
2854
2855 return SCTP_DISPOSITION_DISCARD;
2856 }
2857
2858
2859
2860
2861
2862 if (!TSN_lt(ctsn, asoc->next_tsn))
2863 return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands);
2864
2865
2866
2867
2868
2869 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_CTSN,
2870 SCTP_BE32(sdh->cum_tsn_ack));
2871
2872 return SCTP_DISPOSITION_CONSUME;
2873}
2874
2875
2876
2877
2878
2879
2880
2881
2882enum sctp_disposition sctp_sf_do_9_2_reshutack(
2883 struct net *net,
2884 const struct sctp_endpoint *ep,
2885 const struct sctp_association *asoc,
2886 const union sctp_subtype type,
2887 void *arg,
2888 struct sctp_cmd_seq *commands)
2889{
2890 struct sctp_chunk *chunk = arg;
2891 struct sctp_chunk *reply;
2892
2893
2894 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
2895 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2896 commands);
2897
2898
2899
2900
2901
2902 reply = sctp_make_shutdown_ack(asoc, chunk);
2903 if (NULL == reply)
2904 goto nomem;
2905
2906
2907
2908
2909 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
2910
2911
2912 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
2913 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
2914
2915 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
2916
2917 return SCTP_DISPOSITION_CONSUME;
2918nomem:
2919 return SCTP_DISPOSITION_NOMEM;
2920}
2921
2922
2923
2924
2925
2926
2927
2928
2929
2930
2931
2932
2933
2934
2935
2936
2937
2938
2939
2940
2941
2942
2943
2944
2945
2946
2947enum sctp_disposition sctp_sf_do_ecn_cwr(struct net *net,
2948 const struct sctp_endpoint *ep,
2949 const struct sctp_association *asoc,
2950 const union sctp_subtype type,
2951 void *arg,
2952 struct sctp_cmd_seq *commands)
2953{
2954 struct sctp_chunk *chunk = arg;
2955 struct sctp_cwrhdr *cwr;
2956 u32 lowest_tsn;
2957
2958 if (!sctp_vtag_verify(chunk, asoc))
2959 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2960
2961 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_ecne_chunk)))
2962 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2963 commands);
2964
2965 cwr = (struct sctp_cwrhdr *)chunk->skb->data;
2966 skb_pull(chunk->skb, sizeof(*cwr));
2967
2968 lowest_tsn = ntohl(cwr->lowest_tsn);
2969
2970
2971 if (TSN_lte(asoc->last_ecne_tsn, lowest_tsn)) {
2972
2973 sctp_add_cmd_sf(commands,
2974 SCTP_CMD_ECN_CWR,
2975 SCTP_U32(lowest_tsn));
2976 }
2977 return SCTP_DISPOSITION_CONSUME;
2978}
2979
2980
2981
2982
2983
2984
2985
2986
2987
2988
2989
2990
2991
2992
2993
2994
2995
2996
2997
2998
2999
3000
3001
3002
3003enum sctp_disposition sctp_sf_do_ecne(struct net *net,
3004 const struct sctp_endpoint *ep,
3005 const struct sctp_association *asoc,
3006 const union sctp_subtype type,
3007 void *arg, struct sctp_cmd_seq *commands)
3008{
3009 struct sctp_chunk *chunk = arg;
3010 struct sctp_ecnehdr *ecne;
3011
3012 if (!sctp_vtag_verify(chunk, asoc))
3013 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3014
3015 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_ecne_chunk)))
3016 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3017 commands);
3018
3019 ecne = (struct sctp_ecnehdr *)chunk->skb->data;
3020 skb_pull(chunk->skb, sizeof(*ecne));
3021
3022
3023 sctp_add_cmd_sf(commands, SCTP_CMD_ECN_ECNE,
3024 SCTP_U32(ntohl(ecne->lowest_tsn)));
3025
3026 return SCTP_DISPOSITION_CONSUME;
3027}
3028
3029
3030
3031
3032
3033
3034
3035
3036
3037
3038
3039
3040
3041
3042
3043
3044
3045
3046
3047
3048
3049
3050
3051
3052
3053
3054
3055
3056
3057
3058
3059enum sctp_disposition sctp_sf_eat_data_6_2(struct net *net,
3060 const struct sctp_endpoint *ep,
3061 const struct sctp_association *asoc,
3062 const union sctp_subtype type,
3063 void *arg,
3064 struct sctp_cmd_seq *commands)
3065{
3066 union sctp_arg force = SCTP_NOFORCE();
3067 struct sctp_chunk *chunk = arg;
3068 int error;
3069
3070 if (!sctp_vtag_verify(chunk, asoc)) {
3071 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3072 SCTP_NULL());
3073 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3074 }
3075
3076 if (!sctp_chunk_length_valid(chunk, sctp_datachk_len(&asoc->stream)))
3077 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3078 commands);
3079
3080 error = sctp_eat_data(asoc, chunk, commands);
3081 switch (error) {
3082 case SCTP_IERROR_NO_ERROR:
3083 break;
3084 case SCTP_IERROR_HIGH_TSN:
3085 case SCTP_IERROR_BAD_STREAM:
3086 SCTP_INC_STATS(net, SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
3087 goto discard_noforce;
3088 case SCTP_IERROR_DUP_TSN:
3089 case SCTP_IERROR_IGNORE_TSN:
3090 SCTP_INC_STATS(net, SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
3091 goto discard_force;
3092 case SCTP_IERROR_NO_DATA:
3093 return SCTP_DISPOSITION_ABORT;
3094 case SCTP_IERROR_PROTO_VIOLATION:
3095 return sctp_sf_abort_violation(net, ep, asoc, chunk, commands,
3096 (u8 *)chunk->subh.data_hdr,
3097 sctp_datahdr_len(&asoc->stream));
3098 default:
3099 BUG();
3100 }
3101
3102 if (chunk->chunk_hdr->flags & SCTP_DATA_SACK_IMM)
3103 force = SCTP_FORCE();
3104
3105 if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) {
3106 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
3107 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
3108 }
3109
3110
3111
3112
3113
3114
3115
3116
3117
3118
3119
3120
3121
3122
3123
3124
3125
3126
3127
3128
3129
3130
3131
3132 if (chunk->end_of_packet)
3133 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, force);
3134
3135 return SCTP_DISPOSITION_CONSUME;
3136
3137discard_force:
3138
3139
3140
3141
3142
3143
3144
3145
3146
3147
3148
3149
3150
3151
3152 if (chunk->end_of_packet)
3153 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
3154 return SCTP_DISPOSITION_DISCARD;
3155
3156discard_noforce:
3157 if (chunk->end_of_packet)
3158 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, force);
3159
3160 return SCTP_DISPOSITION_DISCARD;
3161}
3162
3163
3164
3165
3166
3167
3168
3169
3170
3171
3172
3173
3174
3175
3176
3177
3178
3179enum sctp_disposition sctp_sf_eat_data_fast_4_4(
3180 struct net *net,
3181 const struct sctp_endpoint *ep,
3182 const struct sctp_association *asoc,
3183 const union sctp_subtype type,
3184 void *arg,
3185 struct sctp_cmd_seq *commands)
3186{
3187 struct sctp_chunk *chunk = arg;
3188 int error;
3189
3190 if (!sctp_vtag_verify(chunk, asoc)) {
3191 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3192 SCTP_NULL());
3193 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3194 }
3195
3196 if (!sctp_chunk_length_valid(chunk, sctp_datachk_len(&asoc->stream)))
3197 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3198 commands);
3199
3200 error = sctp_eat_data(asoc, chunk, commands);
3201 switch (error) {
3202 case SCTP_IERROR_NO_ERROR:
3203 case SCTP_IERROR_HIGH_TSN:
3204 case SCTP_IERROR_DUP_TSN:
3205 case SCTP_IERROR_IGNORE_TSN:
3206 case SCTP_IERROR_BAD_STREAM:
3207 break;
3208 case SCTP_IERROR_NO_DATA:
3209 return SCTP_DISPOSITION_ABORT;
3210 case SCTP_IERROR_PROTO_VIOLATION:
3211 return sctp_sf_abort_violation(net, ep, asoc, chunk, commands,
3212 (u8 *)chunk->subh.data_hdr,
3213 sctp_datahdr_len(&asoc->stream));
3214 default:
3215 BUG();
3216 }
3217
3218
3219
3220
3221
3222
3223
3224
3225
3226 if (chunk->end_of_packet) {
3227
3228
3229
3230 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SHUTDOWN, SCTP_NULL());
3231 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
3232 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
3233 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
3234 }
3235
3236 return SCTP_DISPOSITION_CONSUME;
3237}
3238
3239
3240
3241
3242
3243
3244
3245
3246
3247
3248
3249
3250
3251
3252
3253
3254
3255
3256
3257
3258
3259
3260
3261
3262
3263
3264
3265
3266
3267
3268
3269
3270
3271enum sctp_disposition sctp_sf_eat_sack_6_2(struct net *net,
3272 const struct sctp_endpoint *ep,
3273 const struct sctp_association *asoc,
3274 const union sctp_subtype type,
3275 void *arg,
3276 struct sctp_cmd_seq *commands)
3277{
3278 struct sctp_chunk *chunk = arg;
3279 struct sctp_sackhdr *sackh;
3280 __u32 ctsn;
3281
3282 trace_sctp_probe(ep, asoc, chunk);
3283
3284 if (!sctp_vtag_verify(chunk, asoc))
3285 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3286
3287
3288 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_sack_chunk)))
3289 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3290 commands);
3291
3292
3293 sackh = sctp_sm_pull_sack(chunk);
3294
3295 if (!sackh)
3296 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3297 chunk->subh.sack_hdr = sackh;
3298 ctsn = ntohl(sackh->cum_tsn_ack);
3299
3300
3301
3302
3303
3304
3305
3306 if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
3307 pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn,
3308 asoc->ctsn_ack_point);
3309
3310 return SCTP_DISPOSITION_DISCARD;
3311 }
3312
3313
3314
3315
3316
3317 if (!TSN_lt(ctsn, asoc->next_tsn))
3318 return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands);
3319
3320
3321 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_SACK, SCTP_CHUNK(chunk));
3322
3323
3324
3325
3326 return SCTP_DISPOSITION_CONSUME;
3327}
3328
3329
3330
3331
3332
3333
3334
3335
3336
3337
3338
3339
3340
3341
3342
3343
3344
3345
3346
3347static enum sctp_disposition sctp_sf_tabort_8_4_8(
3348 struct net *net,
3349 const struct sctp_endpoint *ep,
3350 const struct sctp_association *asoc,
3351 const union sctp_subtype type,
3352 void *arg,
3353 struct sctp_cmd_seq *commands)
3354{
3355 struct sctp_packet *packet = NULL;
3356 struct sctp_chunk *chunk = arg;
3357 struct sctp_chunk *abort;
3358
3359 packet = sctp_ootb_pkt_new(net, asoc, chunk);
3360 if (!packet)
3361 return SCTP_DISPOSITION_NOMEM;
3362
3363
3364
3365
3366 abort = sctp_make_abort(asoc, chunk, 0);
3367 if (!abort) {
3368 sctp_ootb_pkt_free(packet);
3369 return SCTP_DISPOSITION_NOMEM;
3370 }
3371
3372
3373 if (sctp_test_T_bit(abort))
3374 packet->vtag = ntohl(chunk->sctp_hdr->vtag);
3375
3376
3377 abort->skb->sk = ep->base.sk;
3378
3379 sctp_packet_append_chunk(packet, abort);
3380
3381 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
3382 SCTP_PACKET(packet));
3383
3384 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
3385
3386 sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3387 return SCTP_DISPOSITION_CONSUME;
3388}
3389
3390
3391
3392
3393
3394
3395
3396
3397
3398enum sctp_disposition sctp_sf_operr_notify(struct net *net,
3399 const struct sctp_endpoint *ep,
3400 const struct sctp_association *asoc,
3401 const union sctp_subtype type,
3402 void *arg,
3403 struct sctp_cmd_seq *commands)
3404{
3405 struct sctp_chunk *chunk = arg;
3406 struct sctp_errhdr *err;
3407
3408 if (!sctp_vtag_verify(chunk, asoc))
3409 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3410
3411
3412 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_operr_chunk)))
3413 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3414 commands);
3415 sctp_walk_errors(err, chunk->chunk_hdr);
3416 if ((void *)err != (void *)chunk->chunk_end)
3417 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
3418 (void *)err, commands);
3419
3420 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,
3421 SCTP_CHUNK(chunk));
3422
3423 return SCTP_DISPOSITION_CONSUME;
3424}
3425
3426
3427
3428
3429
3430
3431
3432
3433
3434
3435
3436enum sctp_disposition sctp_sf_do_9_2_final(struct net *net,
3437 const struct sctp_endpoint *ep,
3438 const struct sctp_association *asoc,
3439 const union sctp_subtype type,
3440 void *arg,
3441 struct sctp_cmd_seq *commands)
3442{
3443 struct sctp_chunk *chunk = arg;
3444 struct sctp_chunk *reply;
3445 struct sctp_ulpevent *ev;
3446
3447 if (!sctp_vtag_verify(chunk, asoc))
3448 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3449
3450
3451 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
3452 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3453 commands);
3454
3455
3456
3457
3458
3459 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_SHUTDOWN_COMP,
3460 0, 0, 0, NULL, GFP_ATOMIC);
3461 if (!ev)
3462 goto nomem;
3463
3464
3465 reply = sctp_make_shutdown_complete(asoc, chunk);
3466 if (!reply)
3467 goto nomem_chunk;
3468
3469
3470
3471
3472 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
3473
3474
3475
3476
3477 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3478 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
3479
3480 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3481 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
3482
3483 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
3484 SCTP_STATE(SCTP_STATE_CLOSED));
3485 SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS);
3486 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
3487 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
3488
3489
3490 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
3491 return SCTP_DISPOSITION_DELETE_TCB;
3492
3493nomem_chunk:
3494 sctp_ulpevent_free(ev);
3495nomem:
3496 return SCTP_DISPOSITION_NOMEM;
3497}
3498
3499
3500
3501
3502
3503
3504
3505
3506
3507
3508
3509
3510
3511
3512
3513
3514
3515
3516
3517
3518
3519enum sctp_disposition sctp_sf_ootb(struct net *net,
3520 const struct sctp_endpoint *ep,
3521 const struct sctp_association *asoc,
3522 const union sctp_subtype type,
3523 void *arg, struct sctp_cmd_seq *commands)
3524{
3525 struct sctp_chunk *chunk = arg;
3526 struct sk_buff *skb = chunk->skb;
3527 struct sctp_chunkhdr *ch;
3528 struct sctp_errhdr *err;
3529 int ootb_cookie_ack = 0;
3530 int ootb_shut_ack = 0;
3531 __u8 *ch_end;
3532
3533 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
3534
3535 ch = (struct sctp_chunkhdr *)chunk->chunk_hdr;
3536 do {
3537
3538 if (ntohs(ch->length) < sizeof(*ch))
3539 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3540 commands);
3541
3542
3543 ch_end = ((__u8 *)ch) + SCTP_PAD4(ntohs(ch->length));
3544 if (ch_end > skb_tail_pointer(skb))
3545 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3546 commands);
3547
3548
3549
3550
3551 if (SCTP_CID_SHUTDOWN_ACK == ch->type)
3552 ootb_shut_ack = 1;
3553
3554
3555
3556
3557
3558
3559 if (SCTP_CID_ABORT == ch->type)
3560 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3561
3562
3563
3564
3565
3566
3567 if (SCTP_CID_COOKIE_ACK == ch->type)
3568 ootb_cookie_ack = 1;
3569
3570 if (SCTP_CID_ERROR == ch->type) {
3571 sctp_walk_errors(err, ch) {
3572 if (SCTP_ERROR_STALE_COOKIE == err->cause) {
3573 ootb_cookie_ack = 1;
3574 break;
3575 }
3576 }
3577 }
3578
3579 ch = (struct sctp_chunkhdr *)ch_end;
3580 } while (ch_end < skb_tail_pointer(skb));
3581
3582 if (ootb_shut_ack)
3583 return sctp_sf_shut_8_4_5(net, ep, asoc, type, arg, commands);
3584 else if (ootb_cookie_ack)
3585 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3586 else
3587 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
3588}
3589
3590
3591
3592
3593
3594
3595
3596
3597
3598
3599
3600
3601
3602
3603
3604
3605
3606
3607
3608
3609
3610
3611static enum sctp_disposition sctp_sf_shut_8_4_5(
3612 struct net *net,
3613 const struct sctp_endpoint *ep,
3614 const struct sctp_association *asoc,
3615 const union sctp_subtype type,
3616 void *arg,
3617 struct sctp_cmd_seq *commands)
3618{
3619 struct sctp_packet *packet = NULL;
3620 struct sctp_chunk *chunk = arg;
3621 struct sctp_chunk *shut;
3622
3623 packet = sctp_ootb_pkt_new(net, asoc, chunk);
3624 if (!packet)
3625 return SCTP_DISPOSITION_NOMEM;
3626
3627
3628
3629
3630 shut = sctp_make_shutdown_complete(asoc, chunk);
3631 if (!shut) {
3632 sctp_ootb_pkt_free(packet);
3633 return SCTP_DISPOSITION_NOMEM;
3634 }
3635
3636
3637 if (sctp_test_T_bit(shut))
3638 packet->vtag = ntohl(chunk->sctp_hdr->vtag);
3639
3640
3641 shut->skb->sk = ep->base.sk;
3642
3643 sctp_packet_append_chunk(packet, shut);
3644
3645 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
3646 SCTP_PACKET(packet));
3647
3648 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
3649
3650
3651
3652
3653 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
3654 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3655
3656
3657
3658
3659
3660 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3661}
3662
3663
3664
3665
3666
3667
3668
3669
3670
3671
3672
3673
3674enum sctp_disposition sctp_sf_do_8_5_1_E_sa(struct net *net,
3675 const struct sctp_endpoint *ep,
3676 const struct sctp_association *asoc,
3677 const union sctp_subtype type,
3678 void *arg,
3679 struct sctp_cmd_seq *commands)
3680{
3681 struct sctp_chunk *chunk = arg;
3682
3683
3684 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
3685 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3686 commands);
3687
3688
3689
3690
3691
3692
3693 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
3694
3695 return sctp_sf_shut_8_4_5(net, ep, NULL, type, arg, commands);
3696}
3697
3698
3699enum sctp_disposition sctp_sf_do_asconf(struct net *net,
3700 const struct sctp_endpoint *ep,
3701 const struct sctp_association *asoc,
3702 const union sctp_subtype type,
3703 void *arg,
3704 struct sctp_cmd_seq *commands)
3705{
3706 struct sctp_paramhdr *err_param = NULL;
3707 struct sctp_chunk *asconf_ack = NULL;
3708 struct sctp_chunk *chunk = arg;
3709 struct sctp_addiphdr *hdr;
3710 __u32 serial;
3711
3712 if (!sctp_vtag_verify(chunk, asoc)) {
3713 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3714 SCTP_NULL());
3715 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3716 }
3717
3718
3719
3720
3721
3722
3723
3724 if (!net->sctp.addip_noauth && !chunk->auth)
3725 return sctp_sf_discard_chunk(net, ep, asoc, type, arg,
3726 commands);
3727
3728
3729 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_addip_chunk)))
3730 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3731 commands);
3732
3733 hdr = (struct sctp_addiphdr *)chunk->skb->data;
3734 serial = ntohl(hdr->serial);
3735
3736
3737 if (!sctp_verify_asconf(asoc, chunk, true, &err_param))
3738 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
3739 (void *)err_param, commands);
3740
3741
3742
3743
3744
3745 if (serial == asoc->peer.addip_serial + 1) {
3746
3747
3748
3749 if (!chunk->has_asconf)
3750 sctp_assoc_clean_asconf_ack_cache(asoc);
3751
3752
3753
3754
3755
3756
3757
3758
3759
3760 asconf_ack = sctp_process_asconf((struct sctp_association *)
3761 asoc, chunk);
3762 if (!asconf_ack)
3763 return SCTP_DISPOSITION_NOMEM;
3764 } else if (serial < asoc->peer.addip_serial + 1) {
3765
3766
3767
3768
3769
3770
3771
3772
3773
3774
3775
3776
3777 asconf_ack = sctp_assoc_lookup_asconf_ack(asoc, hdr->serial);
3778 if (!asconf_ack)
3779 return SCTP_DISPOSITION_DISCARD;
3780
3781
3782
3783
3784
3785 asconf_ack->transport = NULL;
3786 } else {
3787
3788
3789
3790 return SCTP_DISPOSITION_DISCARD;
3791 }
3792
3793
3794
3795
3796
3797
3798
3799
3800
3801
3802 asconf_ack->dest = chunk->source;
3803 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(asconf_ack));
3804 if (asoc->new_transport) {
3805 sctp_sf_heartbeat(ep, asoc, type, asoc->new_transport, commands);
3806 ((struct sctp_association *)asoc)->new_transport = NULL;
3807 }
3808
3809 return SCTP_DISPOSITION_CONSUME;
3810}
3811
3812static enum sctp_disposition sctp_send_next_asconf(
3813 struct net *net,
3814 const struct sctp_endpoint *ep,
3815 struct sctp_association *asoc,
3816 const union sctp_subtype type,
3817 struct sctp_cmd_seq *commands)
3818{
3819 struct sctp_chunk *asconf;
3820 struct list_head *entry;
3821
3822 if (list_empty(&asoc->addip_chunk_list))
3823 return SCTP_DISPOSITION_CONSUME;
3824
3825 entry = asoc->addip_chunk_list.next;
3826 asconf = list_entry(entry, struct sctp_chunk, list);
3827
3828 list_del_init(entry);
3829 sctp_chunk_hold(asconf);
3830 asoc->addip_last_asconf = asconf;
3831
3832 return sctp_sf_do_prm_asconf(net, ep, asoc, type, asconf, commands);
3833}
3834
3835
3836
3837
3838
3839
3840enum sctp_disposition sctp_sf_do_asconf_ack(struct net *net,
3841 const struct sctp_endpoint *ep,
3842 const struct sctp_association *asoc,
3843 const union sctp_subtype type,
3844 void *arg,
3845 struct sctp_cmd_seq *commands)
3846{
3847 struct sctp_chunk *last_asconf = asoc->addip_last_asconf;
3848 struct sctp_paramhdr *err_param = NULL;
3849 struct sctp_chunk *asconf_ack = arg;
3850 struct sctp_addiphdr *addip_hdr;
3851 __u32 sent_serial, rcvd_serial;
3852 struct sctp_chunk *abort;
3853
3854 if (!sctp_vtag_verify(asconf_ack, asoc)) {
3855 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3856 SCTP_NULL());
3857 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3858 }
3859
3860
3861
3862
3863
3864
3865
3866 if (!net->sctp.addip_noauth && !asconf_ack->auth)
3867 return sctp_sf_discard_chunk(net, ep, asoc, type, arg,
3868 commands);
3869
3870
3871 if (!sctp_chunk_length_valid(asconf_ack,
3872 sizeof(struct sctp_addip_chunk)))
3873 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3874 commands);
3875
3876 addip_hdr = (struct sctp_addiphdr *)asconf_ack->skb->data;
3877 rcvd_serial = ntohl(addip_hdr->serial);
3878
3879
3880 if (!sctp_verify_asconf(asoc, asconf_ack, false, &err_param))
3881 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
3882 (void *)err_param, commands);
3883
3884 if (last_asconf) {
3885 addip_hdr = (struct sctp_addiphdr *)last_asconf->subh.addip_hdr;
3886 sent_serial = ntohl(addip_hdr->serial);
3887 } else {
3888 sent_serial = asoc->addip_serial - 1;
3889 }
3890
3891
3892
3893
3894
3895
3896
3897 if (ADDIP_SERIAL_gte(rcvd_serial, sent_serial + 1) &&
3898 !(asoc->addip_last_asconf)) {
3899 abort = sctp_make_abort(asoc, asconf_ack,
3900 sizeof(struct sctp_errhdr));
3901 if (abort) {
3902 sctp_init_cause(abort, SCTP_ERROR_ASCONF_ACK, 0);
3903 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
3904 SCTP_CHUNK(abort));
3905 }
3906
3907
3908
3909 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3910 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
3911 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
3912 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
3913 SCTP_ERROR(ECONNABORTED));
3914 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
3915 SCTP_PERR(SCTP_ERROR_ASCONF_ACK));
3916 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
3917 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
3918 return SCTP_DISPOSITION_ABORT;
3919 }
3920
3921 if ((rcvd_serial == sent_serial) && asoc->addip_last_asconf) {
3922 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3923 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
3924
3925 if (!sctp_process_asconf_ack((struct sctp_association *)asoc,
3926 asconf_ack))
3927 return sctp_send_next_asconf(net, ep,
3928 (struct sctp_association *)asoc,
3929 type, commands);
3930
3931 abort = sctp_make_abort(asoc, asconf_ack,
3932 sizeof(struct sctp_errhdr));
3933 if (abort) {
3934 sctp_init_cause(abort, SCTP_ERROR_RSRC_LOW, 0);
3935 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
3936 SCTP_CHUNK(abort));
3937 }
3938
3939
3940
3941 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
3942 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
3943 SCTP_ERROR(ECONNABORTED));
3944 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
3945 SCTP_PERR(SCTP_ERROR_ASCONF_ACK));
3946 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
3947 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
3948 return SCTP_DISPOSITION_ABORT;
3949 }
3950
3951 return SCTP_DISPOSITION_DISCARD;
3952}
3953
3954
3955enum sctp_disposition sctp_sf_do_reconf(struct net *net,
3956 const struct sctp_endpoint *ep,
3957 const struct sctp_association *asoc,
3958 const union sctp_subtype type,
3959 void *arg,
3960 struct sctp_cmd_seq *commands)
3961{
3962 struct sctp_paramhdr *err_param = NULL;
3963 struct sctp_chunk *chunk = arg;
3964 struct sctp_reconf_chunk *hdr;
3965 union sctp_params param;
3966
3967 if (!sctp_vtag_verify(chunk, asoc)) {
3968 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3969 SCTP_NULL());
3970 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3971 }
3972
3973
3974 if (!sctp_chunk_length_valid(chunk, sizeof(*hdr)))
3975 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3976 commands);
3977
3978 if (!sctp_verify_reconf(asoc, chunk, &err_param))
3979 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
3980 (void *)err_param, commands);
3981
3982 hdr = (struct sctp_reconf_chunk *)chunk->chunk_hdr;
3983 sctp_walk_params(param, hdr, params) {
3984 struct sctp_chunk *reply = NULL;
3985 struct sctp_ulpevent *ev = NULL;
3986
3987 if (param.p->type == SCTP_PARAM_RESET_OUT_REQUEST)
3988 reply = sctp_process_strreset_outreq(
3989 (struct sctp_association *)asoc, param, &ev);
3990 else if (param.p->type == SCTP_PARAM_RESET_IN_REQUEST)
3991 reply = sctp_process_strreset_inreq(
3992 (struct sctp_association *)asoc, param, &ev);
3993 else if (param.p->type == SCTP_PARAM_RESET_TSN_REQUEST)
3994 reply = sctp_process_strreset_tsnreq(
3995 (struct sctp_association *)asoc, param, &ev);
3996 else if (param.p->type == SCTP_PARAM_RESET_ADD_OUT_STREAMS)
3997 reply = sctp_process_strreset_addstrm_out(
3998 (struct sctp_association *)asoc, param, &ev);
3999 else if (param.p->type == SCTP_PARAM_RESET_ADD_IN_STREAMS)
4000 reply = sctp_process_strreset_addstrm_in(
4001 (struct sctp_association *)asoc, param, &ev);
4002 else if (param.p->type == SCTP_PARAM_RESET_RESPONSE)
4003 reply = sctp_process_strreset_resp(
4004 (struct sctp_association *)asoc, param, &ev);
4005
4006 if (ev)
4007 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
4008 SCTP_ULPEVENT(ev));
4009
4010 if (reply)
4011 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
4012 SCTP_CHUNK(reply));
4013 }
4014
4015 return SCTP_DISPOSITION_CONSUME;
4016}
4017
4018
4019
4020
4021
4022
4023
4024
4025
4026
4027
4028
4029
4030
4031
4032enum sctp_disposition sctp_sf_eat_fwd_tsn(struct net *net,
4033 const struct sctp_endpoint *ep,
4034 const struct sctp_association *asoc,
4035 const union sctp_subtype type,
4036 void *arg,
4037 struct sctp_cmd_seq *commands)
4038{
4039 struct sctp_fwdtsn_hdr *fwdtsn_hdr;
4040 struct sctp_chunk *chunk = arg;
4041 __u16 len;
4042 __u32 tsn;
4043
4044 if (!sctp_vtag_verify(chunk, asoc)) {
4045 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
4046 SCTP_NULL());
4047 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4048 }
4049
4050 if (!asoc->peer.prsctp_capable)
4051 return sctp_sf_unk_chunk(net, ep, asoc, type, arg, commands);
4052
4053
4054 if (!sctp_chunk_length_valid(chunk, sctp_ftsnchk_len(&asoc->stream)))
4055 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4056 commands);
4057
4058 fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data;
4059 chunk->subh.fwdtsn_hdr = fwdtsn_hdr;
4060 len = ntohs(chunk->chunk_hdr->length);
4061 len -= sizeof(struct sctp_chunkhdr);
4062 skb_pull(chunk->skb, len);
4063
4064 tsn = ntohl(fwdtsn_hdr->new_cum_tsn);
4065 pr_debug("%s: TSN 0x%x\n", __func__, tsn);
4066
4067
4068
4069
4070 if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
4071 goto discard_noforce;
4072
4073 if (!asoc->stream.si->validate_ftsn(chunk))
4074 goto discard_noforce;
4075
4076 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
4077 if (len > sctp_ftsnhdr_len(&asoc->stream))
4078 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
4079 SCTP_CHUNK(chunk));
4080
4081
4082 if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) {
4083 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
4084 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
4085 }
4086
4087
4088
4089
4090 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_NOFORCE());
4091
4092 return SCTP_DISPOSITION_CONSUME;
4093
4094discard_noforce:
4095 return SCTP_DISPOSITION_DISCARD;
4096}
4097
4098enum sctp_disposition sctp_sf_eat_fwd_tsn_fast(
4099 struct net *net,
4100 const struct sctp_endpoint *ep,
4101 const struct sctp_association *asoc,
4102 const union sctp_subtype type,
4103 void *arg,
4104 struct sctp_cmd_seq *commands)
4105{
4106 struct sctp_fwdtsn_hdr *fwdtsn_hdr;
4107 struct sctp_chunk *chunk = arg;
4108 __u16 len;
4109 __u32 tsn;
4110
4111 if (!sctp_vtag_verify(chunk, asoc)) {
4112 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
4113 SCTP_NULL());
4114 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4115 }
4116
4117 if (!asoc->peer.prsctp_capable)
4118 return sctp_sf_unk_chunk(net, ep, asoc, type, arg, commands);
4119
4120
4121 if (!sctp_chunk_length_valid(chunk, sctp_ftsnchk_len(&asoc->stream)))
4122 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4123 commands);
4124
4125 fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data;
4126 chunk->subh.fwdtsn_hdr = fwdtsn_hdr;
4127 len = ntohs(chunk->chunk_hdr->length);
4128 len -= sizeof(struct sctp_chunkhdr);
4129 skb_pull(chunk->skb, len);
4130
4131 tsn = ntohl(fwdtsn_hdr->new_cum_tsn);
4132 pr_debug("%s: TSN 0x%x\n", __func__, tsn);
4133
4134
4135
4136
4137 if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
4138 goto gen_shutdown;
4139
4140 if (!asoc->stream.si->validate_ftsn(chunk))
4141 goto gen_shutdown;
4142
4143 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
4144 if (len > sctp_ftsnhdr_len(&asoc->stream))
4145 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
4146 SCTP_CHUNK(chunk));
4147
4148
4149gen_shutdown:
4150
4151
4152
4153
4154
4155
4156 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SHUTDOWN, SCTP_NULL());
4157 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
4158 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
4159 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
4160
4161 return SCTP_DISPOSITION_CONSUME;
4162}
4163
4164
4165
4166
4167
4168
4169
4170
4171
4172
4173
4174
4175
4176
4177
4178
4179
4180
4181
4182
4183
4184
4185
4186static enum sctp_ierror sctp_sf_authenticate(
4187 const struct sctp_association *asoc,
4188 struct sctp_chunk *chunk)
4189{
4190 struct sctp_shared_key *sh_key = NULL;
4191 struct sctp_authhdr *auth_hdr;
4192 __u8 *save_digest, *digest;
4193 struct sctp_hmac *hmac;
4194 unsigned int sig_len;
4195 __u16 key_id;
4196
4197
4198 auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
4199 chunk->subh.auth_hdr = auth_hdr;
4200 skb_pull(chunk->skb, sizeof(*auth_hdr));
4201
4202
4203
4204
4205 if (!sctp_auth_asoc_verify_hmac_id(asoc, auth_hdr->hmac_id))
4206 return SCTP_IERROR_AUTH_BAD_HMAC;
4207
4208
4209
4210
4211 key_id = ntohs(auth_hdr->shkey_id);
4212 if (key_id != asoc->active_key_id) {
4213 sh_key = sctp_auth_get_shkey(asoc, key_id);
4214 if (!sh_key)
4215 return SCTP_IERROR_AUTH_BAD_KEYID;
4216 }
4217
4218
4219
4220
4221 sig_len = ntohs(chunk->chunk_hdr->length) -
4222 sizeof(struct sctp_auth_chunk);
4223 hmac = sctp_auth_get_hmac(ntohs(auth_hdr->hmac_id));
4224 if (sig_len != hmac->hmac_len)
4225 return SCTP_IERROR_PROTO_VIOLATION;
4226
4227
4228
4229
4230
4231
4232
4233
4234 digest = auth_hdr->hmac;
4235 skb_pull(chunk->skb, sig_len);
4236
4237 save_digest = kmemdup(digest, sig_len, GFP_ATOMIC);
4238 if (!save_digest)
4239 goto nomem;
4240
4241 memset(digest, 0, sig_len);
4242
4243 sctp_auth_calculate_hmac(asoc, chunk->skb,
4244 (struct sctp_auth_chunk *)chunk->chunk_hdr,
4245 sh_key, GFP_ATOMIC);
4246
4247
4248 if (memcmp(save_digest, digest, sig_len)) {
4249 kfree(save_digest);
4250 return SCTP_IERROR_BAD_SIG;
4251 }
4252
4253 kfree(save_digest);
4254 chunk->auth = 1;
4255
4256 return SCTP_IERROR_NO_ERROR;
4257nomem:
4258 return SCTP_IERROR_NOMEM;
4259}
4260
4261enum sctp_disposition sctp_sf_eat_auth(struct net *net,
4262 const struct sctp_endpoint *ep,
4263 const struct sctp_association *asoc,
4264 const union sctp_subtype type,
4265 void *arg, struct sctp_cmd_seq *commands)
4266{
4267 struct sctp_chunk *chunk = arg;
4268 struct sctp_authhdr *auth_hdr;
4269 struct sctp_chunk *err_chunk;
4270 enum sctp_ierror error;
4271
4272
4273 if (!asoc->peer.auth_capable)
4274 return sctp_sf_unk_chunk(net, ep, asoc, type, arg, commands);
4275
4276 if (!sctp_vtag_verify(chunk, asoc)) {
4277 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
4278 SCTP_NULL());
4279 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4280 }
4281
4282
4283 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_auth_chunk)))
4284 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4285 commands);
4286
4287 auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
4288 error = sctp_sf_authenticate(asoc, chunk);
4289 switch (error) {
4290 case SCTP_IERROR_AUTH_BAD_HMAC:
4291
4292
4293
4294 err_chunk = sctp_make_op_error(asoc, chunk,
4295 SCTP_ERROR_UNSUP_HMAC,
4296 &auth_hdr->hmac_id,
4297 sizeof(__u16), 0);
4298 if (err_chunk) {
4299 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
4300 SCTP_CHUNK(err_chunk));
4301 }
4302
4303 case SCTP_IERROR_AUTH_BAD_KEYID:
4304 case SCTP_IERROR_BAD_SIG:
4305 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4306
4307 case SCTP_IERROR_PROTO_VIOLATION:
4308 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4309 commands);
4310
4311 case SCTP_IERROR_NOMEM:
4312 return SCTP_DISPOSITION_NOMEM;
4313
4314 default:
4315 break;
4316 }
4317
4318 if (asoc->active_key_id != ntohs(auth_hdr->shkey_id)) {
4319 struct sctp_ulpevent *ev;
4320
4321 ev = sctp_ulpevent_make_authkey(asoc, ntohs(auth_hdr->shkey_id),
4322 SCTP_AUTH_NEW_KEY, GFP_ATOMIC);
4323
4324 if (!ev)
4325 return -ENOMEM;
4326
4327 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
4328 SCTP_ULPEVENT(ev));
4329 }
4330
4331 return SCTP_DISPOSITION_CONSUME;
4332}
4333
4334
4335
4336
4337
4338
4339
4340
4341
4342
4343
4344
4345
4346
4347
4348
4349
4350
4351
4352
4353
4354
4355
4356
4357enum sctp_disposition sctp_sf_unk_chunk(struct net *net,
4358 const struct sctp_endpoint *ep,
4359 const struct sctp_association *asoc,
4360 const union sctp_subtype type,
4361 void *arg,
4362 struct sctp_cmd_seq *commands)
4363{
4364 struct sctp_chunk *unk_chunk = arg;
4365 struct sctp_chunk *err_chunk;
4366 struct sctp_chunkhdr *hdr;
4367
4368 pr_debug("%s: processing unknown chunk id:%d\n", __func__, type.chunk);
4369
4370 if (!sctp_vtag_verify(unk_chunk, asoc))
4371 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4372
4373
4374
4375
4376
4377 if (!sctp_chunk_length_valid(unk_chunk, sizeof(*hdr)))
4378 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4379 commands);
4380
4381 switch (type.chunk & SCTP_CID_ACTION_MASK) {
4382 case SCTP_CID_ACTION_DISCARD:
4383
4384 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4385 case SCTP_CID_ACTION_DISCARD_ERR:
4386
4387 hdr = unk_chunk->chunk_hdr;
4388 err_chunk = sctp_make_op_error(asoc, unk_chunk,
4389 SCTP_ERROR_UNKNOWN_CHUNK, hdr,
4390 SCTP_PAD4(ntohs(hdr->length)),
4391 0);
4392 if (err_chunk) {
4393 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
4394 SCTP_CHUNK(err_chunk));
4395 }
4396
4397
4398 sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4399 return SCTP_DISPOSITION_CONSUME;
4400 case SCTP_CID_ACTION_SKIP:
4401
4402 return SCTP_DISPOSITION_DISCARD;
4403 case SCTP_CID_ACTION_SKIP_ERR:
4404
4405 hdr = unk_chunk->chunk_hdr;
4406 err_chunk = sctp_make_op_error(asoc, unk_chunk,
4407 SCTP_ERROR_UNKNOWN_CHUNK, hdr,
4408 SCTP_PAD4(ntohs(hdr->length)),
4409 0);
4410 if (err_chunk) {
4411 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
4412 SCTP_CHUNK(err_chunk));
4413 }
4414
4415 return SCTP_DISPOSITION_CONSUME;
4416 default:
4417 break;
4418 }
4419
4420 return SCTP_DISPOSITION_DISCARD;
4421}
4422
4423
4424
4425
4426
4427
4428
4429
4430
4431
4432
4433
4434
4435
4436
4437enum sctp_disposition sctp_sf_discard_chunk(struct net *net,
4438 const struct sctp_endpoint *ep,
4439 const struct sctp_association *asoc,
4440 const union sctp_subtype type,
4441 void *arg,
4442 struct sctp_cmd_seq *commands)
4443{
4444 struct sctp_chunk *chunk = arg;
4445
4446
4447
4448
4449
4450 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
4451 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4452 commands);
4453
4454 pr_debug("%s: chunk:%d is discarded\n", __func__, type.chunk);
4455
4456 return SCTP_DISPOSITION_DISCARD;
4457}
4458
4459
4460
4461
4462
4463
4464
4465
4466
4467
4468
4469
4470
4471
4472
4473
4474
4475
4476
4477enum sctp_disposition sctp_sf_pdiscard(struct net *net,
4478 const struct sctp_endpoint *ep,
4479 const struct sctp_association *asoc,
4480 const union sctp_subtype type,
4481 void *arg, struct sctp_cmd_seq *commands)
4482{
4483 SCTP_INC_STATS(net, SCTP_MIB_IN_PKT_DISCARDS);
4484 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
4485
4486 return SCTP_DISPOSITION_CONSUME;
4487}
4488
4489
4490
4491
4492
4493
4494
4495
4496
4497
4498
4499
4500
4501
4502
4503
4504enum sctp_disposition sctp_sf_violation(struct net *net,
4505 const struct sctp_endpoint *ep,
4506 const struct sctp_association *asoc,
4507 const union sctp_subtype type,
4508 void *arg,
4509 struct sctp_cmd_seq *commands)
4510{
4511 struct sctp_chunk *chunk = arg;
4512
4513
4514 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
4515 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4516 commands);
4517
4518 return SCTP_DISPOSITION_VIOLATION;
4519}
4520
4521
4522
4523
4524static enum sctp_disposition sctp_sf_abort_violation(
4525 struct net *net,
4526 const struct sctp_endpoint *ep,
4527 const struct sctp_association *asoc,
4528 void *arg,
4529 struct sctp_cmd_seq *commands,
4530 const __u8 *payload,
4531 const size_t paylen)
4532{
4533 struct sctp_packet *packet = NULL;
4534 struct sctp_chunk *chunk = arg;
4535 struct sctp_chunk *abort = NULL;
4536
4537
4538
4539
4540
4541
4542
4543
4544
4545
4546
4547
4548 if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
4549 goto discard;
4550
4551
4552 abort = sctp_make_abort_violation(asoc, chunk, payload, paylen);
4553 if (!abort)
4554 goto nomem;
4555
4556 if (asoc) {
4557
4558 if (chunk->chunk_hdr->type == SCTP_CID_INIT_ACK &&
4559 !asoc->peer.i.init_tag) {
4560 struct sctp_initack_chunk *initack;
4561
4562 initack = (struct sctp_initack_chunk *)chunk->chunk_hdr;
4563 if (!sctp_chunk_length_valid(chunk, sizeof(*initack)))
4564 abort->chunk_hdr->flags |= SCTP_CHUNK_FLAG_T;
4565 else {
4566 unsigned int inittag;
4567
4568 inittag = ntohl(initack->init_hdr.init_tag);
4569 sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_INITTAG,
4570 SCTP_U32(inittag));
4571 }
4572 }
4573
4574 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
4575 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
4576
4577 if (asoc->state <= SCTP_STATE_COOKIE_ECHOED) {
4578 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4579 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
4580 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4581 SCTP_ERROR(ECONNREFUSED));
4582 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
4583 SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
4584 } else {
4585 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4586 SCTP_ERROR(ECONNABORTED));
4587 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
4588 SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
4589 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
4590 }
4591 } else {
4592 packet = sctp_ootb_pkt_new(net, asoc, chunk);
4593
4594 if (!packet)
4595 goto nomem_pkt;
4596
4597 if (sctp_test_T_bit(abort))
4598 packet->vtag = ntohl(chunk->sctp_hdr->vtag);
4599
4600 abort->skb->sk = ep->base.sk;
4601
4602 sctp_packet_append_chunk(packet, abort);
4603
4604 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
4605 SCTP_PACKET(packet));
4606
4607 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
4608 }
4609
4610 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
4611
4612discard:
4613 sctp_sf_pdiscard(net, ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
4614 return SCTP_DISPOSITION_ABORT;
4615
4616nomem_pkt:
4617 sctp_chunk_free(abort);
4618nomem:
4619 return SCTP_DISPOSITION_NOMEM;
4620}
4621
4622
4623
4624
4625
4626
4627
4628
4629
4630
4631
4632
4633
4634
4635
4636
4637
4638
4639
4640
4641static enum sctp_disposition sctp_sf_violation_chunklen(
4642 struct net *net,
4643 const struct sctp_endpoint *ep,
4644 const struct sctp_association *asoc,
4645 const union sctp_subtype type,
4646 void *arg,
4647 struct sctp_cmd_seq *commands)
4648{
4649 static const char err_str[] = "The following chunk had invalid length:";
4650
4651 return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str,
4652 sizeof(err_str));
4653}
4654
4655
4656
4657
4658
4659
4660
4661static enum sctp_disposition sctp_sf_violation_paramlen(
4662 struct net *net,
4663 const struct sctp_endpoint *ep,
4664 const struct sctp_association *asoc,
4665 const union sctp_subtype type,
4666 void *arg, void *ext,
4667 struct sctp_cmd_seq *commands)
4668{
4669 struct sctp_paramhdr *param = ext;
4670 struct sctp_chunk *abort = NULL;
4671 struct sctp_chunk *chunk = arg;
4672
4673 if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
4674 goto discard;
4675
4676
4677 abort = sctp_make_violation_paramlen(asoc, chunk, param);
4678 if (!abort)
4679 goto nomem;
4680
4681 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
4682 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
4683
4684 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4685 SCTP_ERROR(ECONNABORTED));
4686 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
4687 SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
4688 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
4689 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
4690
4691discard:
4692 sctp_sf_pdiscard(net, ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
4693 return SCTP_DISPOSITION_ABORT;
4694nomem:
4695 return SCTP_DISPOSITION_NOMEM;
4696}
4697
4698
4699
4700
4701
4702
4703
4704static enum sctp_disposition sctp_sf_violation_ctsn(
4705 struct net *net,
4706 const struct sctp_endpoint *ep,
4707 const struct sctp_association *asoc,
4708 const union sctp_subtype type,
4709 void *arg,
4710 struct sctp_cmd_seq *commands)
4711{
4712 static const char err_str[] = "The cumulative tsn ack beyond the max tsn currently sent:";
4713
4714 return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str,
4715 sizeof(err_str));
4716}
4717
4718
4719
4720
4721
4722
4723
4724static enum sctp_disposition sctp_sf_violation_chunk(
4725 struct net *net,
4726 const struct sctp_endpoint *ep,
4727 const struct sctp_association *asoc,
4728 const union sctp_subtype type,
4729 void *arg,
4730 struct sctp_cmd_seq *commands)
4731{
4732 static const char err_str[] = "The following chunk violates protocol:";
4733
4734 if (!asoc)
4735 return sctp_sf_violation(net, ep, asoc, type, arg, commands);
4736
4737 return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str,
4738 sizeof(err_str));
4739}
4740
4741
4742
4743
4744
4745
4746
4747
4748
4749
4750
4751
4752
4753
4754
4755
4756
4757
4758
4759
4760
4761
4762
4763
4764
4765
4766
4767
4768
4769
4770
4771
4772
4773
4774
4775
4776
4777
4778
4779
4780
4781
4782
4783
4784
4785
4786
4787
4788
4789
4790
4791
4792
4793
4794
4795
4796
4797
4798
4799
4800enum sctp_disposition sctp_sf_do_prm_asoc(struct net *net,
4801 const struct sctp_endpoint *ep,
4802 const struct sctp_association *asoc,
4803 const union sctp_subtype type,
4804 void *arg,
4805 struct sctp_cmd_seq *commands)
4806{
4807 struct sctp_association *my_asoc;
4808 struct sctp_chunk *repl;
4809
4810
4811
4812
4813
4814 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
4815 SCTP_STATE(SCTP_STATE_COOKIE_WAIT));
4816
4817
4818
4819
4820
4821
4822
4823
4824
4825 repl = sctp_make_init(asoc, &asoc->base.bind_addr, GFP_ATOMIC, 0);
4826 if (!repl)
4827 goto nomem;
4828
4829
4830 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
4831 SCTP_CHUNK(repl));
4832
4833
4834
4835
4836 my_asoc = (struct sctp_association *)asoc;
4837 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(my_asoc));
4838
4839
4840
4841
4842 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
4843 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
4844 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
4845 return SCTP_DISPOSITION_CONSUME;
4846
4847nomem:
4848 return SCTP_DISPOSITION_NOMEM;
4849}
4850
4851
4852
4853
4854
4855
4856
4857
4858
4859
4860
4861
4862
4863
4864
4865
4866
4867
4868
4869
4870
4871
4872
4873
4874
4875
4876
4877
4878
4879
4880
4881
4882
4883
4884
4885
4886
4887
4888
4889
4890
4891
4892
4893
4894
4895
4896
4897
4898
4899
4900
4901
4902
4903
4904
4905
4906
4907
4908
4909
4910
4911
4912enum sctp_disposition sctp_sf_do_prm_send(struct net *net,
4913 const struct sctp_endpoint *ep,
4914 const struct sctp_association *asoc,
4915 const union sctp_subtype type,
4916 void *arg,
4917 struct sctp_cmd_seq *commands)
4918{
4919 struct sctp_datamsg *msg = arg;
4920
4921 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_MSG, SCTP_DATAMSG(msg));
4922 return SCTP_DISPOSITION_CONSUME;
4923}
4924
4925
4926
4927
4928
4929
4930
4931
4932
4933
4934
4935
4936
4937
4938
4939
4940
4941
4942
4943
4944
4945
4946
4947
4948
4949
4950
4951enum sctp_disposition sctp_sf_do_9_2_prm_shutdown(
4952 struct net *net,
4953 const struct sctp_endpoint *ep,
4954 const struct sctp_association *asoc,
4955 const union sctp_subtype type,
4956 void *arg,
4957 struct sctp_cmd_seq *commands)
4958{
4959 enum sctp_disposition disposition;
4960
4961
4962
4963
4964
4965
4966
4967
4968
4969 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
4970 SCTP_STATE(SCTP_STATE_SHUTDOWN_PENDING));
4971
4972 disposition = SCTP_DISPOSITION_CONSUME;
4973 if (sctp_outq_is_empty(&asoc->outqueue)) {
4974 disposition = sctp_sf_do_9_2_start_shutdown(net, ep, asoc, type,
4975 arg, commands);
4976 }
4977
4978 return disposition;
4979}
4980
4981
4982
4983
4984
4985
4986
4987
4988
4989
4990
4991
4992
4993
4994
4995
4996
4997
4998
4999
5000
5001
5002
5003
5004
5005
5006
5007
5008enum sctp_disposition sctp_sf_do_9_1_prm_abort(
5009 struct net *net,
5010 const struct sctp_endpoint *ep,
5011 const struct sctp_association *asoc,
5012 const union sctp_subtype type,
5013 void *arg,
5014 struct sctp_cmd_seq *commands)
5015{
5016
5017
5018
5019
5020
5021
5022
5023
5024 struct sctp_chunk *abort = arg;
5025
5026 if (abort)
5027 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
5028
5029
5030
5031
5032
5033 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5034 SCTP_ERROR(ECONNABORTED));
5035
5036 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5037 SCTP_PERR(SCTP_ERROR_USER_ABORT));
5038
5039 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
5040 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
5041
5042 return SCTP_DISPOSITION_ABORT;
5043}
5044
5045
5046enum sctp_disposition sctp_sf_error_closed(struct net *net,
5047 const struct sctp_endpoint *ep,
5048 const struct sctp_association *asoc,
5049 const union sctp_subtype type,
5050 void *arg,
5051 struct sctp_cmd_seq *commands)
5052{
5053 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_ERROR, SCTP_ERROR(-EINVAL));
5054 return SCTP_DISPOSITION_CONSUME;
5055}
5056
5057
5058
5059
5060enum sctp_disposition sctp_sf_error_shutdown(
5061 struct net *net,
5062 const struct sctp_endpoint *ep,
5063 const struct sctp_association *asoc,
5064 const union sctp_subtype type,
5065 void *arg,
5066 struct sctp_cmd_seq *commands)
5067{
5068 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_ERROR,
5069 SCTP_ERROR(-ESHUTDOWN));
5070 return SCTP_DISPOSITION_CONSUME;
5071}
5072
5073
5074
5075
5076
5077
5078
5079
5080
5081
5082
5083
5084
5085
5086
5087enum sctp_disposition sctp_sf_cookie_wait_prm_shutdown(
5088 struct net *net,
5089 const struct sctp_endpoint *ep,
5090 const struct sctp_association *asoc,
5091 const union sctp_subtype type,
5092 void *arg,
5093 struct sctp_cmd_seq *commands)
5094{
5095 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5096 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
5097
5098 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
5099 SCTP_STATE(SCTP_STATE_CLOSED));
5100
5101 SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS);
5102
5103 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
5104
5105 return SCTP_DISPOSITION_DELETE_TCB;
5106}
5107
5108
5109
5110
5111
5112
5113
5114
5115
5116
5117
5118
5119
5120
5121
5122enum sctp_disposition sctp_sf_cookie_echoed_prm_shutdown(
5123 struct net *net,
5124 const struct sctp_endpoint *ep,
5125 const struct sctp_association *asoc,
5126 const union sctp_subtype type,
5127 void *arg,
5128 struct sctp_cmd_seq *commands)
5129{
5130
5131
5132
5133 return sctp_sf_cookie_wait_prm_shutdown(net, ep, asoc, type, arg, commands);
5134}
5135
5136
5137
5138
5139
5140
5141
5142
5143
5144
5145
5146
5147
5148
5149
5150enum sctp_disposition sctp_sf_cookie_wait_prm_abort(
5151 struct net *net,
5152 const struct sctp_endpoint *ep,
5153 const struct sctp_association *asoc,
5154 const union sctp_subtype type,
5155 void *arg,
5156 struct sctp_cmd_seq *commands)
5157{
5158 struct sctp_chunk *abort = arg;
5159
5160
5161 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5162 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
5163
5164 if (abort)
5165 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
5166
5167 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
5168 SCTP_STATE(SCTP_STATE_CLOSED));
5169
5170 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
5171
5172
5173
5174
5175
5176 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5177 SCTP_ERROR(ECONNREFUSED));
5178
5179 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
5180 SCTP_PERR(SCTP_ERROR_USER_ABORT));
5181
5182 return SCTP_DISPOSITION_ABORT;
5183}
5184
5185
5186
5187
5188
5189
5190
5191
5192
5193
5194
5195
5196
5197
5198
5199enum sctp_disposition sctp_sf_cookie_echoed_prm_abort(
5200 struct net *net,
5201 const struct sctp_endpoint *ep,
5202 const struct sctp_association *asoc,
5203 const union sctp_subtype type,
5204 void *arg,
5205 struct sctp_cmd_seq *commands)
5206{
5207
5208
5209
5210 return sctp_sf_cookie_wait_prm_abort(net, ep, asoc, type, arg, commands);
5211}
5212
5213
5214
5215
5216
5217
5218
5219
5220
5221
5222
5223
5224
5225enum sctp_disposition sctp_sf_shutdown_pending_prm_abort(
5226 struct net *net,
5227 const struct sctp_endpoint *ep,
5228 const struct sctp_association *asoc,
5229 const union sctp_subtype type,
5230 void *arg,
5231 struct sctp_cmd_seq *commands)
5232{
5233
5234 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5235 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5236
5237 return sctp_sf_do_9_1_prm_abort(net, ep, asoc, type, arg, commands);
5238}
5239
5240
5241
5242
5243
5244
5245
5246
5247
5248
5249
5250
5251
5252enum sctp_disposition sctp_sf_shutdown_sent_prm_abort(
5253 struct net *net,
5254 const struct sctp_endpoint *ep,
5255 const struct sctp_association *asoc,
5256 const union sctp_subtype type,
5257 void *arg,
5258 struct sctp_cmd_seq *commands)
5259{
5260
5261 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5262 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5263
5264
5265 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5266 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5267
5268 return sctp_sf_do_9_1_prm_abort(net, ep, asoc, type, arg, commands);
5269}
5270
5271
5272
5273
5274
5275
5276
5277
5278
5279
5280
5281
5282
5283enum sctp_disposition sctp_sf_shutdown_ack_sent_prm_abort(
5284 struct net *net,
5285 const struct sctp_endpoint *ep,
5286 const struct sctp_association *asoc,
5287 const union sctp_subtype type,
5288 void *arg,
5289 struct sctp_cmd_seq *commands)
5290{
5291
5292
5293
5294 return sctp_sf_shutdown_sent_prm_abort(net, ep, asoc, type, arg, commands);
5295}
5296
5297
5298
5299
5300
5301
5302
5303
5304
5305
5306
5307
5308
5309
5310
5311
5312
5313
5314
5315
5316
5317
5318
5319enum sctp_disposition sctp_sf_do_prm_requestheartbeat(
5320 struct net *net,
5321 const struct sctp_endpoint *ep,
5322 const struct sctp_association *asoc,
5323 const union sctp_subtype type,
5324 void *arg,
5325 struct sctp_cmd_seq *commands)
5326{
5327 if (SCTP_DISPOSITION_NOMEM == sctp_sf_heartbeat(ep, asoc, type,
5328 (struct sctp_transport *)arg, commands))
5329 return SCTP_DISPOSITION_NOMEM;
5330
5331
5332
5333
5334
5335
5336
5337
5338
5339
5340
5341
5342 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_HB_SENT,
5343 SCTP_TRANSPORT(arg));
5344 return SCTP_DISPOSITION_CONSUME;
5345}
5346
5347
5348
5349
5350
5351
5352enum sctp_disposition sctp_sf_do_prm_asconf(struct net *net,
5353 const struct sctp_endpoint *ep,
5354 const struct sctp_association *asoc,
5355 const union sctp_subtype type,
5356 void *arg,
5357 struct sctp_cmd_seq *commands)
5358{
5359 struct sctp_chunk *chunk = arg;
5360
5361 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T4, SCTP_CHUNK(chunk));
5362 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
5363 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
5364 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(chunk));
5365 return SCTP_DISPOSITION_CONSUME;
5366}
5367
5368
5369enum sctp_disposition sctp_sf_do_prm_reconf(struct net *net,
5370 const struct sctp_endpoint *ep,
5371 const struct sctp_association *asoc,
5372 const union sctp_subtype type,
5373 void *arg,
5374 struct sctp_cmd_seq *commands)
5375{
5376 struct sctp_chunk *chunk = arg;
5377
5378 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(chunk));
5379 return SCTP_DISPOSITION_CONSUME;
5380}
5381
5382
5383
5384
5385
5386
5387enum sctp_disposition sctp_sf_ignore_primitive(
5388 struct net *net,
5389 const struct sctp_endpoint *ep,
5390 const struct sctp_association *asoc,
5391 const union sctp_subtype type,
5392 void *arg,
5393 struct sctp_cmd_seq *commands)
5394{
5395 pr_debug("%s: primitive type:%d is ignored\n", __func__,
5396 type.primitive);
5397
5398 return SCTP_DISPOSITION_DISCARD;
5399}
5400
5401
5402
5403
5404
5405
5406
5407
5408
5409
5410
5411enum sctp_disposition sctp_sf_do_no_pending_tsn(
5412 struct net *net,
5413 const struct sctp_endpoint *ep,
5414 const struct sctp_association *asoc,
5415 const union sctp_subtype type,
5416 void *arg,
5417 struct sctp_cmd_seq *commands)
5418{
5419 struct sctp_ulpevent *event;
5420
5421 event = sctp_ulpevent_make_sender_dry_event(asoc, GFP_ATOMIC);
5422 if (!event)
5423 return SCTP_DISPOSITION_NOMEM;
5424
5425 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(event));
5426
5427 return SCTP_DISPOSITION_CONSUME;
5428}
5429
5430
5431
5432
5433
5434
5435
5436
5437
5438
5439
5440
5441
5442
5443enum sctp_disposition sctp_sf_do_9_2_start_shutdown(
5444 struct net *net,
5445 const struct sctp_endpoint *ep,
5446 const struct sctp_association *asoc,
5447 const union sctp_subtype type,
5448 void *arg,
5449 struct sctp_cmd_seq *commands)
5450{
5451 struct sctp_chunk *reply;
5452
5453
5454
5455
5456
5457
5458 reply = sctp_make_shutdown(asoc, NULL);
5459 if (!reply)
5460 goto nomem;
5461
5462
5463
5464
5465 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
5466
5467
5468 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
5469 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5470
5471
5472
5473
5474
5475 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
5476 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5477
5478 if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
5479 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5480 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
5481
5482
5483 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
5484 SCTP_STATE(SCTP_STATE_SHUTDOWN_SENT));
5485
5486
5487
5488
5489
5490
5491 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
5492
5493 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
5494
5495 return SCTP_DISPOSITION_CONSUME;
5496
5497nomem:
5498 return SCTP_DISPOSITION_NOMEM;
5499}
5500
5501
5502
5503
5504
5505
5506
5507
5508
5509
5510
5511
5512
5513enum sctp_disposition sctp_sf_do_9_2_shutdown_ack(
5514 struct net *net,
5515 const struct sctp_endpoint *ep,
5516 const struct sctp_association *asoc,
5517 const union sctp_subtype type,
5518 void *arg,
5519 struct sctp_cmd_seq *commands)
5520{
5521 struct sctp_chunk *chunk = arg;
5522 struct sctp_chunk *reply;
5523
5524
5525
5526
5527
5528
5529
5530
5531 if (chunk) {
5532 if (!sctp_vtag_verify(chunk, asoc))
5533 return sctp_sf_pdiscard(net, ep, asoc, type, arg,
5534 commands);
5535
5536
5537 if (!sctp_chunk_length_valid(
5538 chunk, sizeof(struct sctp_shutdown_chunk)))
5539 return sctp_sf_violation_chunklen(net, ep, asoc, type,
5540 arg, commands);
5541 }
5542
5543
5544
5545
5546 reply = sctp_make_shutdown_ack(asoc, chunk);
5547 if (!reply)
5548 goto nomem;
5549
5550
5551
5552
5553 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
5554
5555
5556 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
5557 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5558
5559 if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
5560 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5561 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
5562
5563
5564 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
5565 SCTP_STATE(SCTP_STATE_SHUTDOWN_ACK_SENT));
5566
5567
5568
5569
5570
5571
5572 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
5573
5574 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
5575
5576 return SCTP_DISPOSITION_CONSUME;
5577
5578nomem:
5579 return SCTP_DISPOSITION_NOMEM;
5580}
5581
5582
5583
5584
5585
5586
5587enum sctp_disposition sctp_sf_ignore_other(struct net *net,
5588 const struct sctp_endpoint *ep,
5589 const struct sctp_association *asoc,
5590 const union sctp_subtype type,
5591 void *arg,
5592 struct sctp_cmd_seq *commands)
5593{
5594 pr_debug("%s: the event other type:%d is ignored\n",
5595 __func__, type.other);
5596
5597 return SCTP_DISPOSITION_DISCARD;
5598}
5599
5600
5601
5602
5603
5604
5605
5606
5607
5608
5609
5610
5611
5612
5613
5614
5615enum sctp_disposition sctp_sf_do_6_3_3_rtx(struct net *net,
5616 const struct sctp_endpoint *ep,
5617 const struct sctp_association *asoc,
5618 const union sctp_subtype type,
5619 void *arg,
5620 struct sctp_cmd_seq *commands)
5621{
5622 struct sctp_transport *transport = arg;
5623
5624 SCTP_INC_STATS(net, SCTP_MIB_T3_RTX_EXPIREDS);
5625
5626 if (asoc->overall_error_count >= asoc->max_retrans) {
5627 if (asoc->peer.zero_window_announced &&
5628 asoc->state == SCTP_STATE_SHUTDOWN_PENDING) {
5629
5630
5631
5632
5633
5634
5635
5636
5637
5638 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START_ONCE,
5639 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5640 } else {
5641 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5642 SCTP_ERROR(ETIMEDOUT));
5643
5644 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5645 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5646 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
5647 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
5648 return SCTP_DISPOSITION_DELETE_TCB;
5649 }
5650 }
5651
5652
5653
5654
5655
5656
5657
5658
5659
5660
5661
5662
5663
5664
5665
5666
5667
5668
5669
5670
5671
5672
5673
5674
5675
5676
5677
5678
5679
5680 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE, SCTP_TRANSPORT(transport));
5681
5682
5683 sctp_add_cmd_sf(commands, SCTP_CMD_RETRAN, SCTP_TRANSPORT(transport));
5684
5685 return SCTP_DISPOSITION_CONSUME;
5686}
5687
5688
5689
5690
5691
5692
5693
5694
5695
5696
5697
5698
5699
5700
5701
5702
5703enum sctp_disposition sctp_sf_do_6_2_sack(struct net *net,
5704 const struct sctp_endpoint *ep,
5705 const struct sctp_association *asoc,
5706 const union sctp_subtype type,
5707 void *arg,
5708 struct sctp_cmd_seq *commands)
5709{
5710 SCTP_INC_STATS(net, SCTP_MIB_DELAY_SACK_EXPIREDS);
5711 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
5712 return SCTP_DISPOSITION_CONSUME;
5713}
5714
5715
5716
5717
5718
5719
5720
5721
5722
5723
5724
5725
5726
5727
5728
5729
5730
5731
5732
5733
5734enum sctp_disposition sctp_sf_t1_init_timer_expire(
5735 struct net *net,
5736 const struct sctp_endpoint *ep,
5737 const struct sctp_association *asoc,
5738 const union sctp_subtype type,
5739 void *arg,
5740 struct sctp_cmd_seq *commands)
5741{
5742 int attempts = asoc->init_err_counter + 1;
5743 struct sctp_chunk *repl = NULL;
5744 struct sctp_bind_addr *bp;
5745
5746 pr_debug("%s: timer T1 expired (INIT)\n", __func__);
5747
5748 SCTP_INC_STATS(net, SCTP_MIB_T1_INIT_EXPIREDS);
5749
5750 if (attempts <= asoc->max_init_attempts) {
5751 bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
5752 repl = sctp_make_init(asoc, bp, GFP_ATOMIC, 0);
5753 if (!repl)
5754 return SCTP_DISPOSITION_NOMEM;
5755
5756
5757 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
5758 SCTP_CHUNK(repl));
5759
5760
5761 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_RESTART,
5762 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
5763
5764 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
5765 } else {
5766 pr_debug("%s: giving up on INIT, attempts:%d "
5767 "max_init_attempts:%d\n", __func__, attempts,
5768 asoc->max_init_attempts);
5769
5770 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5771 SCTP_ERROR(ETIMEDOUT));
5772 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
5773 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5774 return SCTP_DISPOSITION_DELETE_TCB;
5775 }
5776
5777 return SCTP_DISPOSITION_CONSUME;
5778}
5779
5780
5781
5782
5783
5784
5785
5786
5787
5788
5789
5790
5791
5792
5793
5794
5795
5796
5797
5798
5799enum sctp_disposition sctp_sf_t1_cookie_timer_expire(
5800 struct net *net,
5801 const struct sctp_endpoint *ep,
5802 const struct sctp_association *asoc,
5803 const union sctp_subtype type,
5804 void *arg,
5805 struct sctp_cmd_seq *commands)
5806{
5807 int attempts = asoc->init_err_counter + 1;
5808 struct sctp_chunk *repl = NULL;
5809
5810 pr_debug("%s: timer T1 expired (COOKIE-ECHO)\n", __func__);
5811
5812 SCTP_INC_STATS(net, SCTP_MIB_T1_COOKIE_EXPIREDS);
5813
5814 if (attempts <= asoc->max_init_attempts) {
5815 repl = sctp_make_cookie_echo(asoc, NULL);
5816 if (!repl)
5817 return SCTP_DISPOSITION_NOMEM;
5818
5819 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
5820 SCTP_CHUNK(repl));
5821
5822 sctp_add_cmd_sf(commands, SCTP_CMD_COOKIEECHO_RESTART,
5823 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
5824
5825 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
5826 } else {
5827 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5828 SCTP_ERROR(ETIMEDOUT));
5829 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
5830 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5831 return SCTP_DISPOSITION_DELETE_TCB;
5832 }
5833
5834 return SCTP_DISPOSITION_CONSUME;
5835}
5836
5837
5838
5839
5840
5841
5842
5843
5844
5845
5846
5847
5848
5849
5850enum sctp_disposition sctp_sf_t2_timer_expire(
5851 struct net *net,
5852 const struct sctp_endpoint *ep,
5853 const struct sctp_association *asoc,
5854 const union sctp_subtype type,
5855 void *arg,
5856 struct sctp_cmd_seq *commands)
5857{
5858 struct sctp_chunk *reply = NULL;
5859
5860 pr_debug("%s: timer T2 expired\n", __func__);
5861
5862 SCTP_INC_STATS(net, SCTP_MIB_T2_SHUTDOWN_EXPIREDS);
5863
5864 ((struct sctp_association *)asoc)->shutdown_retries++;
5865
5866 if (asoc->overall_error_count >= asoc->max_retrans) {
5867 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5868 SCTP_ERROR(ETIMEDOUT));
5869
5870 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5871 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5872 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
5873 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
5874 return SCTP_DISPOSITION_DELETE_TCB;
5875 }
5876
5877 switch (asoc->state) {
5878 case SCTP_STATE_SHUTDOWN_SENT:
5879 reply = sctp_make_shutdown(asoc, NULL);
5880 break;
5881
5882 case SCTP_STATE_SHUTDOWN_ACK_SENT:
5883 reply = sctp_make_shutdown_ack(asoc, NULL);
5884 break;
5885
5886 default:
5887 BUG();
5888 break;
5889 }
5890
5891 if (!reply)
5892 goto nomem;
5893
5894
5895
5896
5897
5898 if (asoc->shutdown_last_sent_to)
5899 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE,
5900 SCTP_TRANSPORT(asoc->shutdown_last_sent_to));
5901
5902
5903
5904
5905 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
5906
5907
5908 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
5909 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5910 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
5911 return SCTP_DISPOSITION_CONSUME;
5912
5913nomem:
5914 return SCTP_DISPOSITION_NOMEM;
5915}
5916
5917
5918
5919
5920
5921enum sctp_disposition sctp_sf_t4_timer_expire(
5922 struct net *net,
5923 const struct sctp_endpoint *ep,
5924 const struct sctp_association *asoc,
5925 const union sctp_subtype type,
5926 void *arg,
5927 struct sctp_cmd_seq *commands)
5928{
5929 struct sctp_chunk *chunk = asoc->addip_last_asconf;
5930 struct sctp_transport *transport = chunk->transport;
5931
5932 SCTP_INC_STATS(net, SCTP_MIB_T4_RTO_EXPIREDS);
5933
5934
5935
5936
5937
5938 if (transport)
5939 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE,
5940 SCTP_TRANSPORT(transport));
5941
5942
5943 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T4, SCTP_CHUNK(chunk));
5944
5945
5946
5947
5948
5949
5950 if (asoc->overall_error_count >= asoc->max_retrans) {
5951 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5952 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
5953 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5954 SCTP_ERROR(ETIMEDOUT));
5955 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5956 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5957 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
5958 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
5959 return SCTP_DISPOSITION_ABORT;
5960 }
5961
5962
5963
5964
5965
5966
5967
5968
5969
5970
5971
5972
5973 sctp_chunk_hold(asoc->addip_last_asconf);
5974 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
5975 SCTP_CHUNK(asoc->addip_last_asconf));
5976
5977
5978
5979
5980
5981 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
5982 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
5983
5984 return SCTP_DISPOSITION_CONSUME;
5985}
5986
5987
5988
5989
5990
5991
5992
5993enum sctp_disposition sctp_sf_t5_timer_expire(
5994 struct net *net,
5995 const struct sctp_endpoint *ep,
5996 const struct sctp_association *asoc,
5997 const union sctp_subtype type,
5998 void *arg,
5999 struct sctp_cmd_seq *commands)
6000{
6001 struct sctp_chunk *reply = NULL;
6002
6003 pr_debug("%s: timer T5 expired\n", __func__);
6004
6005 SCTP_INC_STATS(net, SCTP_MIB_T5_SHUTDOWN_GUARD_EXPIREDS);
6006
6007 reply = sctp_make_abort(asoc, NULL, 0);
6008 if (!reply)
6009 goto nomem;
6010
6011 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
6012 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
6013 SCTP_ERROR(ETIMEDOUT));
6014 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
6015 SCTP_PERR(SCTP_ERROR_NO_ERROR));
6016
6017 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
6018 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
6019
6020 return SCTP_DISPOSITION_DELETE_TCB;
6021nomem:
6022 return SCTP_DISPOSITION_NOMEM;
6023}
6024
6025
6026
6027
6028
6029
6030enum sctp_disposition sctp_sf_autoclose_timer_expire(
6031 struct net *net,
6032 const struct sctp_endpoint *ep,
6033 const struct sctp_association *asoc,
6034 const union sctp_subtype type,
6035 void *arg,
6036 struct sctp_cmd_seq *commands)
6037{
6038 enum sctp_disposition disposition;
6039
6040 SCTP_INC_STATS(net, SCTP_MIB_AUTOCLOSE_EXPIREDS);
6041
6042
6043
6044
6045
6046
6047
6048
6049
6050 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
6051 SCTP_STATE(SCTP_STATE_SHUTDOWN_PENDING));
6052
6053 disposition = SCTP_DISPOSITION_CONSUME;
6054 if (sctp_outq_is_empty(&asoc->outqueue)) {
6055 disposition = sctp_sf_do_9_2_start_shutdown(net, ep, asoc, type,
6056 arg, commands);
6057 }
6058
6059 return disposition;
6060}
6061
6062
6063
6064
6065
6066
6067
6068
6069
6070
6071
6072
6073
6074enum sctp_disposition sctp_sf_not_impl(struct net *net,
6075 const struct sctp_endpoint *ep,
6076 const struct sctp_association *asoc,
6077 const union sctp_subtype type,
6078 void *arg, struct sctp_cmd_seq *commands)
6079{
6080 return SCTP_DISPOSITION_NOT_IMPL;
6081}
6082
6083
6084
6085
6086
6087
6088
6089
6090
6091enum sctp_disposition sctp_sf_bug(struct net *net,
6092 const struct sctp_endpoint *ep,
6093 const struct sctp_association *asoc,
6094 const union sctp_subtype type,
6095 void *arg, struct sctp_cmd_seq *commands)
6096{
6097 return SCTP_DISPOSITION_BUG;
6098}
6099
6100
6101
6102
6103
6104
6105
6106
6107
6108
6109
6110
6111enum sctp_disposition sctp_sf_timer_ignore(struct net *net,
6112 const struct sctp_endpoint *ep,
6113 const struct sctp_association *asoc,
6114 const union sctp_subtype type,
6115 void *arg,
6116 struct sctp_cmd_seq *commands)
6117{
6118 pr_debug("%s: timer %d ignored\n", __func__, type.chunk);
6119
6120 return SCTP_DISPOSITION_CONSUME;
6121}
6122
6123
6124
6125
6126
6127
6128static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk)
6129{
6130 struct sctp_sackhdr *sack;
6131 __u16 num_dup_tsns;
6132 unsigned int len;
6133 __u16 num_blocks;
6134
6135
6136
6137
6138 sack = (struct sctp_sackhdr *) chunk->skb->data;
6139
6140 num_blocks = ntohs(sack->num_gap_ack_blocks);
6141 num_dup_tsns = ntohs(sack->num_dup_tsns);
6142 len = sizeof(struct sctp_sackhdr);
6143 len += (num_blocks + num_dup_tsns) * sizeof(__u32);
6144 if (len > chunk->skb->len)
6145 return NULL;
6146
6147 skb_pull(chunk->skb, len);
6148
6149 return sack;
6150}
6151
6152
6153
6154
6155static struct sctp_packet *sctp_abort_pkt_new(
6156 struct net *net,
6157 const struct sctp_endpoint *ep,
6158 const struct sctp_association *asoc,
6159 struct sctp_chunk *chunk,
6160 const void *payload, size_t paylen)
6161{
6162 struct sctp_packet *packet;
6163 struct sctp_chunk *abort;
6164
6165 packet = sctp_ootb_pkt_new(net, asoc, chunk);
6166
6167 if (packet) {
6168
6169
6170
6171 abort = sctp_make_abort(asoc, chunk, paylen);
6172 if (!abort) {
6173 sctp_ootb_pkt_free(packet);
6174 return NULL;
6175 }
6176
6177
6178 if (sctp_test_T_bit(abort))
6179 packet->vtag = ntohl(chunk->sctp_hdr->vtag);
6180
6181
6182
6183
6184 sctp_addto_chunk(abort, paylen, payload);
6185
6186
6187 abort->skb->sk = ep->base.sk;
6188
6189 sctp_packet_append_chunk(packet, abort);
6190
6191 }
6192
6193 return packet;
6194}
6195
6196
6197static struct sctp_packet *sctp_ootb_pkt_new(
6198 struct net *net,
6199 const struct sctp_association *asoc,
6200 const struct sctp_chunk *chunk)
6201{
6202 struct sctp_transport *transport;
6203 struct sctp_packet *packet;
6204 __u16 sport, dport;
6205 __u32 vtag;
6206
6207
6208 sport = ntohs(chunk->sctp_hdr->dest);
6209 dport = ntohs(chunk->sctp_hdr->source);
6210
6211
6212
6213
6214 if (asoc) {
6215
6216
6217
6218 switch (chunk->chunk_hdr->type) {
6219 case SCTP_CID_INIT_ACK:
6220 {
6221 struct sctp_initack_chunk *initack;
6222
6223 initack = (struct sctp_initack_chunk *)chunk->chunk_hdr;
6224 vtag = ntohl(initack->init_hdr.init_tag);
6225 break;
6226 }
6227 default:
6228 vtag = asoc->peer.i.init_tag;
6229 break;
6230 }
6231 } else {
6232
6233
6234
6235 switch (chunk->chunk_hdr->type) {
6236 case SCTP_CID_INIT:
6237 {
6238 struct sctp_init_chunk *init;
6239
6240 init = (struct sctp_init_chunk *)chunk->chunk_hdr;
6241 vtag = ntohl(init->init_hdr.init_tag);
6242 break;
6243 }
6244 default:
6245 vtag = ntohl(chunk->sctp_hdr->vtag);
6246 break;
6247 }
6248 }
6249
6250
6251 transport = sctp_transport_new(net, sctp_source(chunk), GFP_ATOMIC);
6252 if (!transport)
6253 goto nomem;
6254
6255
6256
6257
6258 sctp_transport_route(transport, (union sctp_addr *)&chunk->dest,
6259 sctp_sk(net->sctp.ctl_sock));
6260
6261 packet = &transport->packet;
6262 sctp_packet_init(packet, transport, sport, dport);
6263 sctp_packet_config(packet, vtag, 0);
6264
6265 return packet;
6266
6267nomem:
6268 return NULL;
6269}
6270
6271
6272void sctp_ootb_pkt_free(struct sctp_packet *packet)
6273{
6274 sctp_transport_free(packet->transport);
6275}
6276
6277
6278static void sctp_send_stale_cookie_err(struct net *net,
6279 const struct sctp_endpoint *ep,
6280 const struct sctp_association *asoc,
6281 const struct sctp_chunk *chunk,
6282 struct sctp_cmd_seq *commands,
6283 struct sctp_chunk *err_chunk)
6284{
6285 struct sctp_packet *packet;
6286
6287 if (err_chunk) {
6288 packet = sctp_ootb_pkt_new(net, asoc, chunk);
6289 if (packet) {
6290 struct sctp_signed_cookie *cookie;
6291
6292
6293 cookie = chunk->subh.cookie_hdr;
6294 packet->vtag = cookie->c.peer_vtag;
6295
6296
6297 err_chunk->skb->sk = ep->base.sk;
6298 sctp_packet_append_chunk(packet, err_chunk);
6299 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
6300 SCTP_PACKET(packet));
6301 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
6302 } else
6303 sctp_chunk_free (err_chunk);
6304 }
6305}
6306
6307
6308
6309static int sctp_eat_data(const struct sctp_association *asoc,
6310 struct sctp_chunk *chunk,
6311 struct sctp_cmd_seq *commands)
6312{
6313 struct sctp_tsnmap *map = (struct sctp_tsnmap *)&asoc->peer.tsn_map;
6314 struct sock *sk = asoc->base.sk;
6315 struct net *net = sock_net(sk);
6316 struct sctp_datahdr *data_hdr;
6317 struct sctp_chunk *err;
6318 enum sctp_verb deliver;
6319 size_t datalen;
6320 __u32 tsn;
6321 int tmp;
6322
6323 data_hdr = (struct sctp_datahdr *)chunk->skb->data;
6324 chunk->subh.data_hdr = data_hdr;
6325 skb_pull(chunk->skb, sctp_datahdr_len(&asoc->stream));
6326
6327 tsn = ntohl(data_hdr->tsn);
6328 pr_debug("%s: TSN 0x%x\n", __func__, tsn);
6329
6330
6331
6332
6333
6334
6335
6336
6337
6338
6339
6340
6341
6342 if (asoc->peer.ecn_capable && !chunk->ecn_ce_done) {
6343 struct sctp_af *af = SCTP_INPUT_CB(chunk->skb)->af;
6344 chunk->ecn_ce_done = 1;
6345
6346 if (af->is_ce(sctp_gso_headskb(chunk->skb))) {
6347
6348 sctp_add_cmd_sf(commands, SCTP_CMD_ECN_CE,
6349 SCTP_U32(tsn));
6350 }
6351 }
6352
6353 tmp = sctp_tsnmap_check(&asoc->peer.tsn_map, tsn);
6354 if (tmp < 0) {
6355
6356
6357
6358 if (chunk->asoc)
6359 chunk->asoc->stats.outofseqtsns++;
6360 return SCTP_IERROR_HIGH_TSN;
6361 } else if (tmp > 0) {
6362
6363 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_DUP, SCTP_U32(tsn));
6364 return SCTP_IERROR_DUP_TSN;
6365 }
6366
6367
6368
6369
6370
6371
6372 datalen = ntohs(chunk->chunk_hdr->length);
6373 datalen -= sctp_datachk_len(&asoc->stream);
6374
6375 deliver = SCTP_CMD_CHUNK_ULP;
6376
6377
6378 if ((datalen >= asoc->rwnd) && (!asoc->ulpq.pd_mode)) {
6379
6380
6381
6382
6383 sctp_add_cmd_sf(commands, SCTP_CMD_PART_DELIVER, SCTP_NULL());
6384 }
6385
6386
6387
6388
6389
6390
6391 if ((!chunk->data_accepted) && (!asoc->rwnd || asoc->rwnd_over ||
6392 (datalen > asoc->rwnd + asoc->frag_point))) {
6393
6394
6395
6396
6397
6398
6399
6400 if (sctp_tsnmap_has_gap(map) &&
6401 (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
6402 pr_debug("%s: reneging for tsn:%u\n", __func__, tsn);
6403 deliver = SCTP_CMD_RENEGE;
6404 } else {
6405 pr_debug("%s: discard tsn:%u len:%zu, rwnd:%d\n",
6406 __func__, tsn, datalen, asoc->rwnd);
6407
6408 return SCTP_IERROR_IGNORE_TSN;
6409 }
6410 }
6411
6412
6413
6414
6415
6416
6417
6418
6419 if (sk_under_memory_pressure(sk)) {
6420 if (sctp_tsnmap_has_gap(map) &&
6421 (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
6422 pr_debug("%s: under pressure, reneging for tsn:%u\n",
6423 __func__, tsn);
6424 deliver = SCTP_CMD_RENEGE;
6425 } else {
6426 sk_mem_reclaim(sk);
6427 }
6428 }
6429
6430
6431
6432
6433
6434
6435
6436
6437
6438 if (unlikely(0 == datalen)) {
6439 err = sctp_make_abort_no_data(asoc, chunk, tsn);
6440 if (err) {
6441 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
6442 SCTP_CHUNK(err));
6443 }
6444
6445
6446
6447 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
6448 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
6449 SCTP_ERROR(ECONNABORTED));
6450 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
6451 SCTP_PERR(SCTP_ERROR_NO_DATA));
6452 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
6453 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
6454 return SCTP_IERROR_NO_DATA;
6455 }
6456
6457 chunk->data_accepted = 1;
6458
6459
6460
6461
6462 if (chunk->chunk_hdr->flags & SCTP_DATA_UNORDERED) {
6463 SCTP_INC_STATS(net, SCTP_MIB_INUNORDERCHUNKS);
6464 if (chunk->asoc)
6465 chunk->asoc->stats.iuodchunks++;
6466 } else {
6467 SCTP_INC_STATS(net, SCTP_MIB_INORDERCHUNKS);
6468 if (chunk->asoc)
6469 chunk->asoc->stats.iodchunks++;
6470 }
6471
6472
6473
6474
6475
6476
6477
6478
6479
6480 if (ntohs(data_hdr->stream) >= asoc->stream.incnt) {
6481
6482 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_TSN, SCTP_U32(tsn));
6483
6484 err = sctp_make_op_error(asoc, chunk, SCTP_ERROR_INV_STRM,
6485 &data_hdr->stream,
6486 sizeof(data_hdr->stream),
6487 sizeof(u16));
6488 if (err)
6489 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
6490 SCTP_CHUNK(err));
6491 return SCTP_IERROR_BAD_STREAM;
6492 }
6493
6494
6495
6496
6497
6498
6499
6500
6501 if (!asoc->stream.si->validate_data(chunk))
6502 return SCTP_IERROR_PROTO_VIOLATION;
6503
6504
6505
6506
6507
6508 sctp_add_cmd_sf(commands, deliver, SCTP_CHUNK(chunk));
6509
6510 return SCTP_IERROR_NO_ERROR;
6511}
6512