1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
32
33#include <linux/types.h>
34#include <linux/kernel.h>
35#include <linux/ip.h>
36#include <linux/ipv6.h>
37#include <linux/net.h>
38#include <linux/inet.h>
39#include <linux/slab.h>
40#include <net/sock.h>
41#include <net/inet_ecn.h>
42#include <linux/skbuff.h>
43#include <net/sctp/sctp.h>
44#include <net/sctp/sm.h>
45#include <net/sctp/structs.h>
46
47#define CREATE_TRACE_POINTS
48#include <trace/events/sctp.h>
49
50static struct sctp_packet *sctp_abort_pkt_new(
51 struct net *net,
52 const struct sctp_endpoint *ep,
53 const struct sctp_association *asoc,
54 struct sctp_chunk *chunk,
55 const void *payload, size_t paylen);
56static int sctp_eat_data(const struct sctp_association *asoc,
57 struct sctp_chunk *chunk,
58 struct sctp_cmd_seq *commands);
59static struct sctp_packet *sctp_ootb_pkt_new(
60 struct net *net,
61 const struct sctp_association *asoc,
62 const struct sctp_chunk *chunk);
63static void sctp_send_stale_cookie_err(struct net *net,
64 const struct sctp_endpoint *ep,
65 const struct sctp_association *asoc,
66 const struct sctp_chunk *chunk,
67 struct sctp_cmd_seq *commands,
68 struct sctp_chunk *err_chunk);
69static enum sctp_disposition sctp_sf_do_5_2_6_stale(
70 struct net *net,
71 const struct sctp_endpoint *ep,
72 const struct sctp_association *asoc,
73 const union sctp_subtype type,
74 void *arg,
75 struct sctp_cmd_seq *commands);
76static enum sctp_disposition sctp_sf_shut_8_4_5(
77 struct net *net,
78 const struct sctp_endpoint *ep,
79 const struct sctp_association *asoc,
80 const union sctp_subtype type,
81 void *arg,
82 struct sctp_cmd_seq *commands);
83static enum sctp_disposition sctp_sf_tabort_8_4_8(
84 struct net *net,
85 const struct sctp_endpoint *ep,
86 const struct sctp_association *asoc,
87 const union sctp_subtype type,
88 void *arg,
89 struct sctp_cmd_seq *commands);
90static enum sctp_disposition sctp_sf_new_encap_port(
91 struct net *net,
92 const struct sctp_endpoint *ep,
93 const struct sctp_association *asoc,
94 const union sctp_subtype type,
95 void *arg,
96 struct sctp_cmd_seq *commands);
97static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk);
98
99static enum sctp_disposition sctp_stop_t1_and_abort(
100 struct net *net,
101 struct sctp_cmd_seq *commands,
102 __be16 error, int sk_err,
103 const struct sctp_association *asoc,
104 struct sctp_transport *transport);
105
106static enum sctp_disposition sctp_sf_abort_violation(
107 struct net *net,
108 const struct sctp_endpoint *ep,
109 const struct sctp_association *asoc,
110 void *arg,
111 struct sctp_cmd_seq *commands,
112 const __u8 *payload,
113 const size_t paylen);
114
115static enum sctp_disposition sctp_sf_violation_chunklen(
116 struct net *net,
117 const struct sctp_endpoint *ep,
118 const struct sctp_association *asoc,
119 const union sctp_subtype type,
120 void *arg,
121 struct sctp_cmd_seq *commands);
122
123static enum sctp_disposition sctp_sf_violation_paramlen(
124 struct net *net,
125 const struct sctp_endpoint *ep,
126 const struct sctp_association *asoc,
127 const union sctp_subtype type,
128 void *arg, void *ext,
129 struct sctp_cmd_seq *commands);
130
131static enum sctp_disposition sctp_sf_violation_ctsn(
132 struct net *net,
133 const struct sctp_endpoint *ep,
134 const struct sctp_association *asoc,
135 const union sctp_subtype type,
136 void *arg,
137 struct sctp_cmd_seq *commands);
138
139static enum sctp_disposition sctp_sf_violation_chunk(
140 struct net *net,
141 const struct sctp_endpoint *ep,
142 const struct sctp_association *asoc,
143 const union sctp_subtype type,
144 void *arg,
145 struct sctp_cmd_seq *commands);
146
147static enum sctp_ierror sctp_sf_authenticate(
148 const struct sctp_association *asoc,
149 struct sctp_chunk *chunk);
150
151static enum sctp_disposition __sctp_sf_do_9_1_abort(
152 struct net *net,
153 const struct sctp_endpoint *ep,
154 const struct sctp_association *asoc,
155 const union sctp_subtype type,
156 void *arg,
157 struct sctp_cmd_seq *commands);
158
159static enum sctp_disposition
160__sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep,
161 const struct sctp_association *asoc,
162 const union sctp_subtype type, void *arg,
163 struct sctp_cmd_seq *commands);
164
165
166
167
168
169
170
171
172static inline bool sctp_chunk_length_valid(struct sctp_chunk *chunk,
173 __u16 required_length)
174{
175 __u16 chunk_length = ntohs(chunk->chunk_hdr->length);
176
177
178 if (unlikely(chunk->pdiscard))
179 return false;
180 if (unlikely(chunk_length < required_length))
181 return false;
182
183 return true;
184}
185
186
187static inline bool sctp_err_chunk_valid(struct sctp_chunk *chunk)
188{
189 struct sctp_errhdr *err;
190
191 sctp_walk_errors(err, chunk->chunk_hdr);
192
193 return (void *)err == (void *)chunk->chunk_end;
194}
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231enum sctp_disposition sctp_sf_do_4_C(struct net *net,
232 const struct sctp_endpoint *ep,
233 const struct sctp_association *asoc,
234 const union sctp_subtype type,
235 void *arg, struct sctp_cmd_seq *commands)
236{
237 struct sctp_chunk *chunk = arg;
238 struct sctp_ulpevent *ev;
239
240 if (!sctp_vtag_verify_either(chunk, asoc))
241 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
242
243
244
245
246
247
248 if (!chunk->singleton)
249 return sctp_sf_violation_chunk(net, ep, asoc, type, arg, commands);
250
251
252 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
253 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
254 commands);
255
256
257
258
259
260
261
262
263 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_SHUTDOWN_COMP,
264 0, 0, 0, NULL, GFP_ATOMIC);
265 if (ev)
266 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
267 SCTP_ULPEVENT(ev));
268
269
270
271
272
273
274
275
276
277 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
278 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
279
280 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
281 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
282
283 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
284 SCTP_STATE(SCTP_STATE_CLOSED));
285
286 SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS);
287 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
288
289 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
290
291 return SCTP_DISPOSITION_DELETE_TCB;
292}
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316enum sctp_disposition sctp_sf_do_5_1B_init(struct net *net,
317 const struct sctp_endpoint *ep,
318 const struct sctp_association *asoc,
319 const union sctp_subtype type,
320 void *arg,
321 struct sctp_cmd_seq *commands)
322{
323 struct sctp_chunk *chunk = arg, *repl, *err_chunk;
324 struct sctp_unrecognized_param *unk_param;
325 struct sctp_association *new_asoc;
326 struct sctp_packet *packet;
327 int len;
328
329
330 if (security_sctp_assoc_request((struct sctp_endpoint *)ep,
331 chunk->skb))
332 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
333
334
335
336
337
338
339
340
341
342
343 if (!chunk->singleton)
344 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
345
346
347
348
349
350
351 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
352 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
353
354
355
356
357 if (ep == sctp_sk(net->sctp.ctl_sock)->ep) {
358 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
359 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
360 }
361
362
363
364
365 if (chunk->sctp_hdr->vtag != 0)
366 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
367
368
369
370
371
372
373
374 if (sctp_sstate(ep->base.sk, CLOSING))
375 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
376
377
378 err_chunk = NULL;
379 if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type,
380 (struct sctp_init_chunk *)chunk->chunk_hdr, chunk,
381 &err_chunk)) {
382
383
384
385 if (err_chunk) {
386 packet = sctp_abort_pkt_new(net, ep, asoc, arg,
387 (__u8 *)(err_chunk->chunk_hdr) +
388 sizeof(struct sctp_chunkhdr),
389 ntohs(err_chunk->chunk_hdr->length) -
390 sizeof(struct sctp_chunkhdr));
391
392 sctp_chunk_free(err_chunk);
393
394 if (packet) {
395 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
396 SCTP_PACKET(packet));
397 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
398 return SCTP_DISPOSITION_CONSUME;
399 } else {
400 return SCTP_DISPOSITION_NOMEM;
401 }
402 } else {
403 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg,
404 commands);
405 }
406 }
407
408
409 chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data;
410
411
412 chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(struct sctp_inithdr));
413
414 new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC);
415 if (!new_asoc)
416 goto nomem;
417
418 if (sctp_assoc_set_bind_addr_from_ep(new_asoc,
419 sctp_scope(sctp_source(chunk)),
420 GFP_ATOMIC) < 0)
421 goto nomem_init;
422
423
424 if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk),
425 (struct sctp_init_chunk *)chunk->chunk_hdr,
426 GFP_ATOMIC))
427 goto nomem_init;
428
429
430
431
432
433
434 len = 0;
435 if (err_chunk)
436 len = ntohs(err_chunk->chunk_hdr->length) -
437 sizeof(struct sctp_chunkhdr);
438
439 repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
440 if (!repl)
441 goto nomem_init;
442
443
444
445
446
447 if (err_chunk) {
448
449
450
451
452
453
454
455 unk_param = (struct sctp_unrecognized_param *)
456 ((__u8 *)(err_chunk->chunk_hdr) +
457 sizeof(struct sctp_chunkhdr));
458
459
460
461 sctp_addto_chunk(repl, len, unk_param);
462 sctp_chunk_free(err_chunk);
463 }
464
465 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
466
467 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
468
469
470
471
472
473
474
475 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
476
477 return SCTP_DISPOSITION_DELETE_TCB;
478
479nomem_init:
480 sctp_association_free(new_asoc);
481nomem:
482 if (err_chunk)
483 sctp_chunk_free(err_chunk);
484 return SCTP_DISPOSITION_NOMEM;
485}
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515enum sctp_disposition sctp_sf_do_5_1C_ack(struct net *net,
516 const struct sctp_endpoint *ep,
517 const struct sctp_association *asoc,
518 const union sctp_subtype type,
519 void *arg,
520 struct sctp_cmd_seq *commands)
521{
522 struct sctp_init_chunk *initchunk;
523 struct sctp_chunk *chunk = arg;
524 struct sctp_chunk *err_chunk;
525 struct sctp_packet *packet;
526
527 if (!sctp_vtag_verify(chunk, asoc))
528 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
529
530
531
532
533
534 if (!chunk->singleton)
535 return sctp_sf_violation_chunk(net, ep, asoc, type, arg, commands);
536
537
538 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_initack_chunk)))
539 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
540 commands);
541
542 chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data;
543
544
545 err_chunk = NULL;
546 if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type,
547 (struct sctp_init_chunk *)chunk->chunk_hdr, chunk,
548 &err_chunk)) {
549
550 enum sctp_error error = SCTP_ERROR_NO_RESOURCE;
551
552
553
554
555
556
557 if (err_chunk) {
558 packet = sctp_abort_pkt_new(net, ep, asoc, arg,
559 (__u8 *)(err_chunk->chunk_hdr) +
560 sizeof(struct sctp_chunkhdr),
561 ntohs(err_chunk->chunk_hdr->length) -
562 sizeof(struct sctp_chunkhdr));
563
564 sctp_chunk_free(err_chunk);
565
566 if (packet) {
567 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
568 SCTP_PACKET(packet));
569 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
570 error = SCTP_ERROR_INV_PARAM;
571 }
572 }
573
574
575
576
577
578
579
580
581
582
583
584
585 if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
586 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
587
588 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
589 return sctp_stop_t1_and_abort(net, commands, error, ECONNREFUSED,
590 asoc, chunk->transport);
591 }
592
593
594
595
596 chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(struct sctp_inithdr));
597
598 initchunk = (struct sctp_init_chunk *)chunk->chunk_hdr;
599
600 sctp_add_cmd_sf(commands, SCTP_CMD_PEER_INIT,
601 SCTP_PEER_INIT(initchunk));
602
603
604 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());
605
606
607
608
609
610 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
611 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
612 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
613 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
614 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
615 SCTP_STATE(SCTP_STATE_COOKIE_ECHOED));
616
617
618
619
620 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_SHKEY, SCTP_NULL());
621
622
623
624
625
626
627
628 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_COOKIE_ECHO,
629 SCTP_CHUNK(err_chunk));
630
631 return SCTP_DISPOSITION_CONSUME;
632}
633
634static bool sctp_auth_chunk_verify(struct net *net, struct sctp_chunk *chunk,
635 const struct sctp_association *asoc)
636{
637 struct sctp_chunk auth;
638
639 if (!chunk->auth_chunk)
640 return true;
641
642
643
644
645
646
647
648
649
650 if (!net->sctp.auth_enable || !asoc->peer.auth_capable)
651 return false;
652
653
654 auth.skb = chunk->auth_chunk;
655 auth.asoc = chunk->asoc;
656 auth.sctp_hdr = chunk->sctp_hdr;
657 auth.chunk_hdr = (struct sctp_chunkhdr *)
658 skb_push(chunk->auth_chunk,
659 sizeof(struct sctp_chunkhdr));
660 skb_pull(chunk->auth_chunk, sizeof(struct sctp_chunkhdr));
661 auth.transport = chunk->transport;
662
663 return sctp_sf_authenticate(asoc, &auth) == SCTP_IERROR_NO_ERROR;
664}
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,
698 const struct sctp_endpoint *ep,
699 const struct sctp_association *asoc,
700 const union sctp_subtype type,
701 void *arg,
702 struct sctp_cmd_seq *commands)
703{
704 struct sctp_ulpevent *ev, *ai_ev = NULL, *auth_ev = NULL;
705 struct sctp_association *new_asoc;
706 struct sctp_init_chunk *peer_init;
707 struct sctp_chunk *chunk = arg;
708 struct sctp_chunk *err_chk_p;
709 struct sctp_chunk *repl;
710 struct sock *sk;
711 int error = 0;
712
713 if (asoc && !sctp_vtag_verify(chunk, asoc))
714 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
715
716
717
718
719 if (ep == sctp_sk(net->sctp.ctl_sock)->ep) {
720 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
721 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
722 }
723
724
725
726
727
728
729 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
730 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
731 commands);
732
733
734
735
736
737 sk = ep->base.sk;
738 if (!sctp_sstate(sk, LISTENING) ||
739 (sctp_style(sk, TCP) && sk_acceptq_is_full(sk)))
740 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
741
742
743
744
745 chunk->subh.cookie_hdr =
746 (struct sctp_signed_cookie *)chunk->skb->data;
747 if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
748 sizeof(struct sctp_chunkhdr)))
749 goto nomem;
750
751
752
753
754
755 new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, &error,
756 &err_chk_p);
757
758
759
760
761
762
763
764 if (!new_asoc) {
765
766
767
768 switch (error) {
769 case -SCTP_IERROR_NOMEM:
770 goto nomem;
771
772 case -SCTP_IERROR_STALE_COOKIE:
773 sctp_send_stale_cookie_err(net, ep, asoc, chunk, commands,
774 err_chk_p);
775 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
776
777 case -SCTP_IERROR_BAD_SIG:
778 default:
779 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
780 }
781 }
782
783
784
785
786
787
788
789
790
791
792 peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
793
794 if (!sctp_process_init(new_asoc, chunk,
795 &chunk->subh.cookie_hdr->c.peer_addr,
796 peer_init, GFP_ATOMIC))
797 goto nomem_init;
798
799
800
801
802
803 error = sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC);
804 if (error)
805 goto nomem_init;
806
807 if (!sctp_auth_chunk_verify(net, chunk, new_asoc)) {
808 sctp_association_free(new_asoc);
809 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
810 }
811
812 repl = sctp_make_cookie_ack(new_asoc, chunk);
813 if (!repl)
814 goto nomem_init;
815
816
817
818
819
820
821
822 ev = sctp_ulpevent_make_assoc_change(new_asoc, 0, SCTP_COMM_UP, 0,
823 new_asoc->c.sinit_num_ostreams,
824 new_asoc->c.sinit_max_instreams,
825 NULL, GFP_ATOMIC);
826 if (!ev)
827 goto nomem_ev;
828
829
830
831
832
833
834 if (new_asoc->peer.adaptation_ind) {
835 ai_ev = sctp_ulpevent_make_adaptation_indication(new_asoc,
836 GFP_ATOMIC);
837 if (!ai_ev)
838 goto nomem_aiev;
839 }
840
841 if (!new_asoc->peer.auth_capable) {
842 auth_ev = sctp_ulpevent_make_authkey(new_asoc, 0,
843 SCTP_AUTH_NO_AUTH,
844 GFP_ATOMIC);
845 if (!auth_ev)
846 goto nomem_authev;
847 }
848
849
850
851
852
853
854 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
855 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
856 SCTP_STATE(SCTP_STATE_ESTABLISHED));
857 SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
858 SCTP_INC_STATS(net, SCTP_MIB_PASSIVEESTABS);
859 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
860
861 if (new_asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
862 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
863 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
864
865
866 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
867
868
869 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
870
871
872 if (ai_ev)
873 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
874 SCTP_ULPEVENT(ai_ev));
875
876 if (auth_ev)
877 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
878 SCTP_ULPEVENT(auth_ev));
879
880 return SCTP_DISPOSITION_CONSUME;
881
882nomem_authev:
883 sctp_ulpevent_free(ai_ev);
884nomem_aiev:
885 sctp_ulpevent_free(ev);
886nomem_ev:
887 sctp_chunk_free(repl);
888nomem_init:
889 sctp_association_free(new_asoc);
890nomem:
891 return SCTP_DISPOSITION_NOMEM;
892}
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915enum sctp_disposition sctp_sf_do_5_1E_ca(struct net *net,
916 const struct sctp_endpoint *ep,
917 const struct sctp_association *asoc,
918 const union sctp_subtype type,
919 void *arg,
920 struct sctp_cmd_seq *commands)
921{
922 struct sctp_chunk *chunk = arg;
923 struct sctp_ulpevent *ev;
924
925 if (!sctp_vtag_verify(chunk, asoc))
926 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
927
928
929
930
931 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
932 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
933 commands);
934
935
936
937
938
939
940
941 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());
942
943
944 security_inet_conn_established(ep->base.sk, chunk->skb);
945
946
947
948
949
950
951
952 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
953 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
954 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
955 SCTP_STATE(SCTP_STATE_ESTABLISHED));
956 SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
957 SCTP_INC_STATS(net, SCTP_MIB_ACTIVEESTABS);
958 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
959 if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
960 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
961 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
962
963
964
965
966
967 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_COMM_UP,
968 0, asoc->c.sinit_num_ostreams,
969 asoc->c.sinit_max_instreams,
970 NULL, GFP_ATOMIC);
971
972 if (!ev)
973 goto nomem;
974
975 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
976
977
978
979
980
981
982 if (asoc->peer.adaptation_ind) {
983 ev = sctp_ulpevent_make_adaptation_indication(asoc, GFP_ATOMIC);
984 if (!ev)
985 goto nomem;
986
987 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
988 SCTP_ULPEVENT(ev));
989 }
990
991 if (!asoc->peer.auth_capable) {
992 ev = sctp_ulpevent_make_authkey(asoc, 0, SCTP_AUTH_NO_AUTH,
993 GFP_ATOMIC);
994 if (!ev)
995 goto nomem;
996 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
997 SCTP_ULPEVENT(ev));
998 }
999
1000 return SCTP_DISPOSITION_CONSUME;
1001nomem:
1002 return SCTP_DISPOSITION_NOMEM;
1003}
1004
1005
1006static enum sctp_disposition sctp_sf_heartbeat(
1007 const struct sctp_endpoint *ep,
1008 const struct sctp_association *asoc,
1009 const union sctp_subtype type,
1010 void *arg,
1011 struct sctp_cmd_seq *commands)
1012{
1013 struct sctp_transport *transport = (struct sctp_transport *) arg;
1014 struct sctp_chunk *reply;
1015
1016
1017 reply = sctp_make_heartbeat(asoc, transport, 0);
1018 if (!reply)
1019 return SCTP_DISPOSITION_NOMEM;
1020
1021
1022
1023
1024 sctp_add_cmd_sf(commands, SCTP_CMD_RTO_PENDING,
1025 SCTP_TRANSPORT(transport));
1026
1027 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
1028 return SCTP_DISPOSITION_CONSUME;
1029}
1030
1031
1032enum sctp_disposition sctp_sf_sendbeat_8_3(struct net *net,
1033 const struct sctp_endpoint *ep,
1034 const struct sctp_association *asoc,
1035 const union sctp_subtype type,
1036 void *arg,
1037 struct sctp_cmd_seq *commands)
1038{
1039 struct sctp_transport *transport = (struct sctp_transport *) arg;
1040
1041 if (asoc->overall_error_count >= asoc->max_retrans) {
1042 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
1043 SCTP_ERROR(ETIMEDOUT));
1044
1045 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
1046 SCTP_PERR(SCTP_ERROR_NO_ERROR));
1047 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
1048 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
1049 return SCTP_DISPOSITION_DELETE_TCB;
1050 }
1051
1052
1053
1054
1055
1056
1057
1058
1059 if (transport->param_flags & SPP_HB_ENABLE) {
1060 if (SCTP_DISPOSITION_NOMEM ==
1061 sctp_sf_heartbeat(ep, asoc, type, arg,
1062 commands))
1063 return SCTP_DISPOSITION_NOMEM;
1064
1065
1066
1067
1068 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_HB_SENT,
1069 SCTP_TRANSPORT(transport));
1070 }
1071 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_IDLE,
1072 SCTP_TRANSPORT(transport));
1073 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMER_UPDATE,
1074 SCTP_TRANSPORT(transport));
1075
1076 return SCTP_DISPOSITION_CONSUME;
1077}
1078
1079
1080enum sctp_disposition sctp_sf_send_reconf(struct net *net,
1081 const struct sctp_endpoint *ep,
1082 const struct sctp_association *asoc,
1083 const union sctp_subtype type,
1084 void *arg,
1085 struct sctp_cmd_seq *commands)
1086{
1087 struct sctp_transport *transport = arg;
1088
1089 if (asoc->overall_error_count >= asoc->max_retrans) {
1090 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
1091 SCTP_ERROR(ETIMEDOUT));
1092
1093 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
1094 SCTP_PERR(SCTP_ERROR_NO_ERROR));
1095 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
1096 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
1097 return SCTP_DISPOSITION_DELETE_TCB;
1098 }
1099
1100 sctp_chunk_hold(asoc->strreset_chunk);
1101 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
1102 SCTP_CHUNK(asoc->strreset_chunk));
1103 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE, SCTP_TRANSPORT(transport));
1104
1105 return SCTP_DISPOSITION_CONSUME;
1106}
1107
1108
1109enum sctp_disposition sctp_sf_send_probe(struct net *net,
1110 const struct sctp_endpoint *ep,
1111 const struct sctp_association *asoc,
1112 const union sctp_subtype type,
1113 void *arg,
1114 struct sctp_cmd_seq *commands)
1115{
1116 struct sctp_transport *transport = (struct sctp_transport *)arg;
1117 struct sctp_chunk *reply;
1118
1119 if (!sctp_transport_pl_enabled(transport))
1120 return SCTP_DISPOSITION_CONSUME;
1121
1122 if (sctp_transport_pl_send(transport)) {
1123 reply = sctp_make_heartbeat(asoc, transport, transport->pl.probe_size);
1124 if (!reply)
1125 return SCTP_DISPOSITION_NOMEM;
1126 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
1127 }
1128 sctp_add_cmd_sf(commands, SCTP_CMD_PROBE_TIMER_UPDATE,
1129 SCTP_TRANSPORT(transport));
1130
1131 return SCTP_DISPOSITION_CONSUME;
1132}
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158enum sctp_disposition sctp_sf_beat_8_3(struct net *net,
1159 const struct sctp_endpoint *ep,
1160 const struct sctp_association *asoc,
1161 const union sctp_subtype type,
1162 void *arg, struct sctp_cmd_seq *commands)
1163{
1164 struct sctp_paramhdr *param_hdr;
1165 struct sctp_chunk *chunk = arg;
1166 struct sctp_chunk *reply;
1167 size_t paylen = 0;
1168
1169 if (!sctp_vtag_verify(chunk, asoc))
1170 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1171
1172
1173 if (!sctp_chunk_length_valid(chunk,
1174 sizeof(struct sctp_heartbeat_chunk)))
1175 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1176 commands);
1177
1178
1179
1180
1181
1182 chunk->subh.hb_hdr = (struct sctp_heartbeathdr *)chunk->skb->data;
1183 param_hdr = (struct sctp_paramhdr *)chunk->subh.hb_hdr;
1184 paylen = ntohs(chunk->chunk_hdr->length) - sizeof(struct sctp_chunkhdr);
1185
1186 if (ntohs(param_hdr->length) > paylen)
1187 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
1188 param_hdr, commands);
1189
1190 if (!pskb_pull(chunk->skb, paylen))
1191 goto nomem;
1192
1193 reply = sctp_make_heartbeat_ack(asoc, chunk, param_hdr, paylen);
1194 if (!reply)
1195 goto nomem;
1196
1197 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
1198 return SCTP_DISPOSITION_CONSUME;
1199
1200nomem:
1201 return SCTP_DISPOSITION_NOMEM;
1202}
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232enum sctp_disposition sctp_sf_backbeat_8_3(struct net *net,
1233 const struct sctp_endpoint *ep,
1234 const struct sctp_association *asoc,
1235 const union sctp_subtype type,
1236 void *arg,
1237 struct sctp_cmd_seq *commands)
1238{
1239 struct sctp_sender_hb_info *hbinfo;
1240 struct sctp_chunk *chunk = arg;
1241 struct sctp_transport *link;
1242 unsigned long max_interval;
1243 union sctp_addr from_addr;
1244
1245 if (!sctp_vtag_verify(chunk, asoc))
1246 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1247
1248
1249 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr) +
1250 sizeof(*hbinfo)))
1251 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1252 commands);
1253
1254 hbinfo = (struct sctp_sender_hb_info *)chunk->skb->data;
1255
1256 if (ntohs(hbinfo->param_hdr.length) != sizeof(*hbinfo))
1257 return SCTP_DISPOSITION_DISCARD;
1258
1259 from_addr = hbinfo->daddr;
1260 link = sctp_assoc_lookup_paddr(asoc, &from_addr);
1261
1262
1263 if (unlikely(!link)) {
1264 if (from_addr.sa.sa_family == AF_INET6) {
1265 net_warn_ratelimited("%s association %p could not find address %pI6\n",
1266 __func__,
1267 asoc,
1268 &from_addr.v6.sin6_addr);
1269 } else {
1270 net_warn_ratelimited("%s association %p could not find address %pI4\n",
1271 __func__,
1272 asoc,
1273 &from_addr.v4.sin_addr.s_addr);
1274 }
1275 return SCTP_DISPOSITION_DISCARD;
1276 }
1277
1278
1279 if (hbinfo->hb_nonce != link->hb_nonce)
1280 return SCTP_DISPOSITION_DISCARD;
1281
1282 if (hbinfo->probe_size) {
1283 if (hbinfo->probe_size != link->pl.probe_size ||
1284 !sctp_transport_pl_enabled(link))
1285 return SCTP_DISPOSITION_DISCARD;
1286
1287 if (sctp_transport_pl_recv(link))
1288 return SCTP_DISPOSITION_CONSUME;
1289
1290 return sctp_sf_send_probe(net, ep, asoc, type, link, commands);
1291 }
1292
1293 max_interval = link->hbinterval + link->rto;
1294
1295
1296 if (time_after(hbinfo->sent_at, jiffies) ||
1297 time_after(jiffies, hbinfo->sent_at + max_interval)) {
1298 pr_debug("%s: HEARTBEAT ACK with invalid timestamp received "
1299 "for transport:%p\n", __func__, link);
1300
1301 return SCTP_DISPOSITION_DISCARD;
1302 }
1303
1304
1305
1306
1307
1308
1309
1310 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_ON, SCTP_TRANSPORT(link));
1311
1312 return SCTP_DISPOSITION_CONSUME;
1313}
1314
1315
1316
1317
1318static int sctp_sf_send_restart_abort(struct net *net, union sctp_addr *ssa,
1319 struct sctp_chunk *init,
1320 struct sctp_cmd_seq *commands)
1321{
1322 struct sctp_af *af = sctp_get_af_specific(ssa->v4.sin_family);
1323 union sctp_addr_param *addrparm;
1324 struct sctp_errhdr *errhdr;
1325 char buffer[sizeof(*errhdr) + sizeof(*addrparm)];
1326 struct sctp_endpoint *ep;
1327 struct sctp_packet *pkt;
1328 int len;
1329
1330
1331
1332
1333 errhdr = (struct sctp_errhdr *)buffer;
1334 addrparm = (union sctp_addr_param *)errhdr->variable;
1335
1336
1337 len = af->to_addr_param(ssa, addrparm);
1338 len += sizeof(*errhdr);
1339
1340 errhdr->cause = SCTP_ERROR_RESTART;
1341 errhdr->length = htons(len);
1342
1343
1344 ep = sctp_sk(net->sctp.ctl_sock)->ep;
1345
1346
1347
1348
1349 pkt = sctp_abort_pkt_new(net, ep, NULL, init, errhdr, len);
1350
1351 if (!pkt)
1352 goto out;
1353 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT, SCTP_PACKET(pkt));
1354
1355 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
1356
1357
1358 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
1359
1360out:
1361
1362
1363
1364 return 0;
1365}
1366
1367static bool list_has_sctp_addr(const struct list_head *list,
1368 union sctp_addr *ipaddr)
1369{
1370 struct sctp_transport *addr;
1371
1372 list_for_each_entry(addr, list, transports) {
1373 if (sctp_cmp_addr_exact(ipaddr, &addr->ipaddr))
1374 return true;
1375 }
1376
1377 return false;
1378}
1379
1380
1381
1382static int sctp_sf_check_restart_addrs(const struct sctp_association *new_asoc,
1383 const struct sctp_association *asoc,
1384 struct sctp_chunk *init,
1385 struct sctp_cmd_seq *commands)
1386{
1387 struct net *net = new_asoc->base.net;
1388 struct sctp_transport *new_addr;
1389 int ret = 1;
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402 list_for_each_entry(new_addr, &new_asoc->peer.transport_addr_list,
1403 transports) {
1404 if (!list_has_sctp_addr(&asoc->peer.transport_addr_list,
1405 &new_addr->ipaddr)) {
1406 sctp_sf_send_restart_abort(net, &new_addr->ipaddr, init,
1407 commands);
1408 ret = 0;
1409 break;
1410 }
1411 }
1412
1413
1414 return ret;
1415}
1416
1417
1418
1419
1420
1421
1422static void sctp_tietags_populate(struct sctp_association *new_asoc,
1423 const struct sctp_association *asoc)
1424{
1425 switch (asoc->state) {
1426
1427
1428
1429 case SCTP_STATE_COOKIE_WAIT:
1430 new_asoc->c.my_vtag = asoc->c.my_vtag;
1431 new_asoc->c.my_ttag = asoc->c.my_vtag;
1432 new_asoc->c.peer_ttag = 0;
1433 break;
1434
1435 case SCTP_STATE_COOKIE_ECHOED:
1436 new_asoc->c.my_vtag = asoc->c.my_vtag;
1437 new_asoc->c.my_ttag = asoc->c.my_vtag;
1438 new_asoc->c.peer_ttag = asoc->c.peer_vtag;
1439 break;
1440
1441
1442
1443
1444 default:
1445 new_asoc->c.my_ttag = asoc->c.my_vtag;
1446 new_asoc->c.peer_ttag = asoc->c.peer_vtag;
1447 break;
1448 }
1449
1450
1451
1452
1453
1454 new_asoc->rwnd = asoc->rwnd;
1455 new_asoc->c.sinit_num_ostreams = asoc->c.sinit_num_ostreams;
1456 new_asoc->c.sinit_max_instreams = asoc->c.sinit_max_instreams;
1457 new_asoc->c.initial_tsn = asoc->c.initial_tsn;
1458}
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469static char sctp_tietags_compare(struct sctp_association *new_asoc,
1470 const struct sctp_association *asoc)
1471{
1472
1473 if ((asoc->c.my_vtag != new_asoc->c.my_vtag) &&
1474 (asoc->c.peer_vtag != new_asoc->c.peer_vtag) &&
1475 (asoc->c.my_vtag == new_asoc->c.my_ttag) &&
1476 (asoc->c.peer_vtag == new_asoc->c.peer_ttag))
1477 return 'A';
1478
1479
1480 if ((asoc->c.my_vtag == new_asoc->c.my_vtag) &&
1481 ((asoc->c.peer_vtag != new_asoc->c.peer_vtag) ||
1482 (0 == asoc->c.peer_vtag))) {
1483 return 'B';
1484 }
1485
1486
1487 if ((asoc->c.my_vtag == new_asoc->c.my_vtag) &&
1488 (asoc->c.peer_vtag == new_asoc->c.peer_vtag))
1489 return 'D';
1490
1491
1492 if ((asoc->c.my_vtag != new_asoc->c.my_vtag) &&
1493 (asoc->c.peer_vtag == new_asoc->c.peer_vtag) &&
1494 (0 == new_asoc->c.my_ttag) &&
1495 (0 == new_asoc->c.peer_ttag))
1496 return 'C';
1497
1498
1499 return 'E';
1500}
1501
1502
1503
1504
1505static enum sctp_disposition sctp_sf_do_unexpected_init(
1506 struct net *net,
1507 const struct sctp_endpoint *ep,
1508 const struct sctp_association *asoc,
1509 const union sctp_subtype type,
1510 void *arg,
1511 struct sctp_cmd_seq *commands)
1512{
1513 struct sctp_chunk *chunk = arg, *repl, *err_chunk;
1514 struct sctp_unrecognized_param *unk_param;
1515 struct sctp_association *new_asoc;
1516 enum sctp_disposition retval;
1517 struct sctp_packet *packet;
1518 int len;
1519
1520
1521 if (security_sctp_assoc_request((struct sctp_endpoint *)ep,
1522 chunk->skb))
1523 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534 if (!chunk->singleton)
1535 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1536
1537
1538 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
1539 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1540
1541
1542
1543
1544 if (chunk->sctp_hdr->vtag != 0)
1545 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
1546
1547 if (SCTP_INPUT_CB(chunk->skb)->encap_port != chunk->transport->encap_port)
1548 return sctp_sf_new_encap_port(net, ep, asoc, type, arg, commands);
1549
1550
1551 chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data;
1552
1553
1554 chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(struct sctp_inithdr));
1555
1556
1557 err_chunk = NULL;
1558 if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type,
1559 (struct sctp_init_chunk *)chunk->chunk_hdr, chunk,
1560 &err_chunk)) {
1561
1562
1563
1564 if (err_chunk) {
1565 packet = sctp_abort_pkt_new(net, ep, asoc, arg,
1566 (__u8 *)(err_chunk->chunk_hdr) +
1567 sizeof(struct sctp_chunkhdr),
1568 ntohs(err_chunk->chunk_hdr->length) -
1569 sizeof(struct sctp_chunkhdr));
1570
1571 if (packet) {
1572 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
1573 SCTP_PACKET(packet));
1574 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
1575 retval = SCTP_DISPOSITION_CONSUME;
1576 } else {
1577 retval = SCTP_DISPOSITION_NOMEM;
1578 }
1579 goto cleanup;
1580 } else {
1581 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg,
1582 commands);
1583 }
1584 }
1585
1586
1587
1588
1589
1590
1591
1592
1593 new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC);
1594 if (!new_asoc)
1595 goto nomem;
1596
1597 if (sctp_assoc_set_bind_addr_from_ep(new_asoc,
1598 sctp_scope(sctp_source(chunk)), GFP_ATOMIC) < 0)
1599 goto nomem;
1600
1601
1602
1603
1604
1605 if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk),
1606 (struct sctp_init_chunk *)chunk->chunk_hdr,
1607 GFP_ATOMIC))
1608 goto nomem;
1609
1610
1611
1612
1613
1614
1615 if (!sctp_state(asoc, COOKIE_WAIT)) {
1616 if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk,
1617 commands)) {
1618 retval = SCTP_DISPOSITION_CONSUME;
1619 goto nomem_retval;
1620 }
1621 }
1622
1623 sctp_tietags_populate(new_asoc, asoc);
1624
1625
1626
1627
1628
1629
1630 len = 0;
1631 if (err_chunk) {
1632 len = ntohs(err_chunk->chunk_hdr->length) -
1633 sizeof(struct sctp_chunkhdr);
1634 }
1635
1636 repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
1637 if (!repl)
1638 goto nomem;
1639
1640
1641
1642
1643
1644 if (err_chunk) {
1645
1646
1647
1648
1649
1650
1651
1652 unk_param = (struct sctp_unrecognized_param *)
1653 ((__u8 *)(err_chunk->chunk_hdr) +
1654 sizeof(struct sctp_chunkhdr));
1655
1656
1657
1658 sctp_addto_chunk(repl, len, unk_param);
1659 }
1660
1661 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
1662 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1663
1664
1665
1666
1667
1668
1669 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
1670 retval = SCTP_DISPOSITION_CONSUME;
1671
1672 return retval;
1673
1674nomem:
1675 retval = SCTP_DISPOSITION_NOMEM;
1676nomem_retval:
1677 if (new_asoc)
1678 sctp_association_free(new_asoc);
1679cleanup:
1680 if (err_chunk)
1681 sctp_chunk_free(err_chunk);
1682 return retval;
1683}
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723enum sctp_disposition sctp_sf_do_5_2_1_siminit(
1724 struct net *net,
1725 const struct sctp_endpoint *ep,
1726 const struct sctp_association *asoc,
1727 const union sctp_subtype type,
1728 void *arg,
1729 struct sctp_cmd_seq *commands)
1730{
1731
1732
1733
1734 return sctp_sf_do_unexpected_init(net, ep, asoc, type, arg, commands);
1735}
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778enum sctp_disposition sctp_sf_do_5_2_2_dupinit(
1779 struct net *net,
1780 const struct sctp_endpoint *ep,
1781 const struct sctp_association *asoc,
1782 const union sctp_subtype type,
1783 void *arg,
1784 struct sctp_cmd_seq *commands)
1785{
1786
1787
1788
1789 return sctp_sf_do_unexpected_init(net, ep, asoc, type, arg, commands);
1790}
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802enum sctp_disposition sctp_sf_do_5_2_3_initack(
1803 struct net *net,
1804 const struct sctp_endpoint *ep,
1805 const struct sctp_association *asoc,
1806 const union sctp_subtype type,
1807 void *arg,
1808 struct sctp_cmd_seq *commands)
1809{
1810
1811
1812
1813 if (ep == sctp_sk(net->sctp.ctl_sock)->ep)
1814 return sctp_sf_ootb(net, ep, asoc, type, arg, commands);
1815 else
1816 return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
1817}
1818
1819static int sctp_sf_do_assoc_update(struct sctp_association *asoc,
1820 struct sctp_association *new,
1821 struct sctp_cmd_seq *cmds)
1822{
1823 struct net *net = asoc->base.net;
1824 struct sctp_chunk *abort;
1825
1826 if (!sctp_assoc_update(asoc, new))
1827 return 0;
1828
1829 abort = sctp_make_abort(asoc, NULL, sizeof(struct sctp_errhdr));
1830 if (abort) {
1831 sctp_init_cause(abort, SCTP_ERROR_RSRC_LOW, 0);
1832 sctp_add_cmd_sf(cmds, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
1833 }
1834 sctp_add_cmd_sf(cmds, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(ECONNABORTED));
1835 sctp_add_cmd_sf(cmds, SCTP_CMD_ASSOC_FAILED,
1836 SCTP_PERR(SCTP_ERROR_RSRC_LOW));
1837 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
1838 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
1839
1840 return -ENOMEM;
1841}
1842
1843
1844
1845
1846
1847
1848static enum sctp_disposition sctp_sf_do_dupcook_a(
1849 struct net *net,
1850 const struct sctp_endpoint *ep,
1851 const struct sctp_association *asoc,
1852 struct sctp_chunk *chunk,
1853 struct sctp_cmd_seq *commands,
1854 struct sctp_association *new_asoc)
1855{
1856 struct sctp_init_chunk *peer_init;
1857 enum sctp_disposition disposition;
1858 struct sctp_ulpevent *ev;
1859 struct sctp_chunk *repl;
1860 struct sctp_chunk *err;
1861
1862
1863
1864
1865 peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
1866
1867 if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk), peer_init,
1868 GFP_ATOMIC))
1869 goto nomem;
1870
1871 if (sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC))
1872 goto nomem;
1873
1874 if (!sctp_auth_chunk_verify(net, chunk, new_asoc))
1875 return SCTP_DISPOSITION_DISCARD;
1876
1877
1878
1879
1880
1881 if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk, commands))
1882 return SCTP_DISPOSITION_CONSUME;
1883
1884
1885
1886
1887
1888
1889
1890 if (sctp_state(asoc, SHUTDOWN_ACK_SENT)) {
1891 disposition = __sctp_sf_do_9_2_reshutack(net, ep, asoc,
1892 SCTP_ST_CHUNK(chunk->chunk_hdr->type),
1893 chunk, commands);
1894 if (SCTP_DISPOSITION_NOMEM == disposition)
1895 goto nomem;
1896
1897 err = sctp_make_op_error(asoc, chunk,
1898 SCTP_ERROR_COOKIE_IN_SHUTDOWN,
1899 NULL, 0, 0);
1900 if (err)
1901 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
1902 SCTP_CHUNK(err));
1903
1904 return SCTP_DISPOSITION_CONSUME;
1905 }
1906
1907
1908
1909
1910 sctp_add_cmd_sf(commands, SCTP_CMD_T3_RTX_TIMERS_STOP, SCTP_NULL());
1911 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
1912 SCTP_TO(SCTP_EVENT_TIMEOUT_SACK));
1913 sctp_add_cmd_sf(commands, SCTP_CMD_PURGE_OUTQUEUE, SCTP_NULL());
1914
1915
1916
1917
1918 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
1919 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
1920 sctp_add_cmd_sf(commands, SCTP_CMD_PURGE_ASCONF_QUEUE, SCTP_NULL());
1921
1922
1923 if (sctp_sf_do_assoc_update((struct sctp_association *)asoc, new_asoc, commands))
1924 goto nomem;
1925
1926 repl = sctp_make_cookie_ack(asoc, chunk);
1927 if (!repl)
1928 goto nomem;
1929
1930
1931 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_RESTART, 0,
1932 asoc->c.sinit_num_ostreams,
1933 asoc->c.sinit_max_instreams,
1934 NULL, GFP_ATOMIC);
1935 if (!ev)
1936 goto nomem_ev;
1937
1938 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
1939 if ((sctp_state(asoc, SHUTDOWN_PENDING) ||
1940 sctp_state(asoc, SHUTDOWN_SENT)) &&
1941 (sctp_sstate(asoc->base.sk, CLOSING) ||
1942 sock_flag(asoc->base.sk, SOCK_DEAD))) {
1943
1944
1945
1946
1947 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1948 return sctp_sf_do_9_2_start_shutdown(net, ep, asoc,
1949 SCTP_ST_CHUNK(0), repl,
1950 commands);
1951 } else {
1952 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
1953 SCTP_STATE(SCTP_STATE_ESTABLISHED));
1954 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1955 }
1956 return SCTP_DISPOSITION_CONSUME;
1957
1958nomem_ev:
1959 sctp_chunk_free(repl);
1960nomem:
1961 return SCTP_DISPOSITION_NOMEM;
1962}
1963
1964
1965
1966
1967
1968
1969
1970
1971
1972static enum sctp_disposition sctp_sf_do_dupcook_b(
1973 struct net *net,
1974 const struct sctp_endpoint *ep,
1975 const struct sctp_association *asoc,
1976 struct sctp_chunk *chunk,
1977 struct sctp_cmd_seq *commands,
1978 struct sctp_association *new_asoc)
1979{
1980 struct sctp_init_chunk *peer_init;
1981 struct sctp_chunk *repl;
1982
1983
1984
1985
1986 peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
1987 if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk), peer_init,
1988 GFP_ATOMIC))
1989 goto nomem;
1990
1991 if (sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC))
1992 goto nomem;
1993
1994 if (!sctp_auth_chunk_verify(net, chunk, new_asoc))
1995 return SCTP_DISPOSITION_DISCARD;
1996
1997 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
1998 SCTP_STATE(SCTP_STATE_ESTABLISHED));
1999 if (asoc->state < SCTP_STATE_ESTABLISHED)
2000 SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
2001 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
2002
2003
2004 if (sctp_sf_do_assoc_update((struct sctp_association *)asoc, new_asoc, commands))
2005 goto nomem;
2006
2007 repl = sctp_make_cookie_ack(asoc, chunk);
2008 if (!repl)
2009 goto nomem;
2010
2011 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_CHANGE, SCTP_U8(SCTP_COMM_UP));
2026
2027
2028
2029
2030
2031
2032
2033
2034
2035 if (asoc->peer.adaptation_ind)
2036 sctp_add_cmd_sf(commands, SCTP_CMD_ADAPTATION_IND, SCTP_NULL());
2037
2038 if (!asoc->peer.auth_capable)
2039 sctp_add_cmd_sf(commands, SCTP_CMD_PEER_NO_AUTH, SCTP_NULL());
2040
2041 return SCTP_DISPOSITION_CONSUME;
2042
2043nomem:
2044 return SCTP_DISPOSITION_NOMEM;
2045}
2046
2047
2048
2049
2050
2051
2052
2053
2054
2055
2056static enum sctp_disposition sctp_sf_do_dupcook_c(
2057 struct net *net,
2058 const struct sctp_endpoint *ep,
2059 const struct sctp_association *asoc,
2060 struct sctp_chunk *chunk,
2061 struct sctp_cmd_seq *commands,
2062 struct sctp_association *new_asoc)
2063{
2064
2065
2066
2067
2068 return SCTP_DISPOSITION_DISCARD;
2069}
2070
2071
2072
2073
2074
2075
2076
2077
2078
2079static enum sctp_disposition sctp_sf_do_dupcook_d(
2080 struct net *net,
2081 const struct sctp_endpoint *ep,
2082 const struct sctp_association *asoc,
2083 struct sctp_chunk *chunk,
2084 struct sctp_cmd_seq *commands,
2085 struct sctp_association *new_asoc)
2086{
2087 struct sctp_ulpevent *ev = NULL, *ai_ev = NULL, *auth_ev = NULL;
2088 struct sctp_chunk *repl;
2089
2090
2091
2092
2093
2094
2095
2096
2097 if (!sctp_auth_chunk_verify(net, chunk, asoc))
2098 return SCTP_DISPOSITION_DISCARD;
2099
2100
2101 if (asoc->state < SCTP_STATE_ESTABLISHED) {
2102 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2103 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
2104 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2105 SCTP_STATE(SCTP_STATE_ESTABLISHED));
2106 SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
2107 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START,
2108 SCTP_NULL());
2109
2110
2111
2112
2113
2114
2115
2116
2117 ev = sctp_ulpevent_make_assoc_change(asoc, 0,
2118 SCTP_COMM_UP, 0,
2119 asoc->c.sinit_num_ostreams,
2120 asoc->c.sinit_max_instreams,
2121 NULL, GFP_ATOMIC);
2122 if (!ev)
2123 goto nomem;
2124
2125
2126
2127
2128
2129
2130 if (asoc->peer.adaptation_ind) {
2131 ai_ev = sctp_ulpevent_make_adaptation_indication(asoc,
2132 GFP_ATOMIC);
2133 if (!ai_ev)
2134 goto nomem;
2135
2136 }
2137
2138 if (!asoc->peer.auth_capable) {
2139 auth_ev = sctp_ulpevent_make_authkey(asoc, 0,
2140 SCTP_AUTH_NO_AUTH,
2141 GFP_ATOMIC);
2142 if (!auth_ev)
2143 goto nomem;
2144 }
2145 }
2146
2147 repl = sctp_make_cookie_ack(asoc, chunk);
2148 if (!repl)
2149 goto nomem;
2150
2151 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
2152
2153 if (ev)
2154 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
2155 SCTP_ULPEVENT(ev));
2156 if (ai_ev)
2157 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
2158 SCTP_ULPEVENT(ai_ev));
2159 if (auth_ev)
2160 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
2161 SCTP_ULPEVENT(auth_ev));
2162
2163 return SCTP_DISPOSITION_CONSUME;
2164
2165nomem:
2166 if (auth_ev)
2167 sctp_ulpevent_free(auth_ev);
2168 if (ai_ev)
2169 sctp_ulpevent_free(ai_ev);
2170 if (ev)
2171 sctp_ulpevent_free(ev);
2172 return SCTP_DISPOSITION_NOMEM;
2173}
2174
2175
2176
2177
2178
2179
2180
2181
2182
2183
2184
2185
2186
2187
2188
2189
2190
2191enum sctp_disposition sctp_sf_do_5_2_4_dupcook(
2192 struct net *net,
2193 const struct sctp_endpoint *ep,
2194 const struct sctp_association *asoc,
2195 const union sctp_subtype type,
2196 void *arg,
2197 struct sctp_cmd_seq *commands)
2198{
2199 struct sctp_association *new_asoc;
2200 struct sctp_chunk *chunk = arg;
2201 enum sctp_disposition retval;
2202 struct sctp_chunk *err_chk_p;
2203 int error = 0;
2204 char action;
2205
2206
2207
2208
2209
2210
2211 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) {
2212 if (!sctp_vtag_verify(chunk, asoc))
2213 asoc = NULL;
2214 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, commands);
2215 }
2216
2217
2218
2219
2220 chunk->subh.cookie_hdr = (struct sctp_signed_cookie *)chunk->skb->data;
2221 if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
2222 sizeof(struct sctp_chunkhdr)))
2223 goto nomem;
2224
2225
2226
2227
2228
2229
2230 new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, &error,
2231 &err_chk_p);
2232
2233
2234
2235
2236
2237
2238
2239 if (!new_asoc) {
2240
2241
2242
2243 switch (error) {
2244 case -SCTP_IERROR_NOMEM:
2245 goto nomem;
2246
2247 case -SCTP_IERROR_STALE_COOKIE:
2248 sctp_send_stale_cookie_err(net, ep, asoc, chunk, commands,
2249 err_chk_p);
2250 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2251 case -SCTP_IERROR_BAD_SIG:
2252 default:
2253 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2254 }
2255 }
2256
2257
2258 if (security_sctp_assoc_request((struct sctp_endpoint *)ep,
2259 chunk->skb)) {
2260 sctp_association_free(new_asoc);
2261 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2262 }
2263
2264
2265 new_asoc->temp = 1;
2266
2267
2268
2269
2270 action = sctp_tietags_compare(new_asoc, asoc);
2271
2272 switch (action) {
2273 case 'A':
2274 retval = sctp_sf_do_dupcook_a(net, ep, asoc, chunk, commands,
2275 new_asoc);
2276 break;
2277
2278 case 'B':
2279 retval = sctp_sf_do_dupcook_b(net, ep, asoc, chunk, commands,
2280 new_asoc);
2281 break;
2282
2283 case 'C':
2284 retval = sctp_sf_do_dupcook_c(net, ep, asoc, chunk, commands,
2285 new_asoc);
2286 break;
2287
2288 case 'D':
2289 retval = sctp_sf_do_dupcook_d(net, ep, asoc, chunk, commands,
2290 new_asoc);
2291 break;
2292
2293 default:
2294 retval = sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2295 break;
2296 }
2297
2298
2299 sctp_add_cmd_sf(commands, SCTP_CMD_SET_ASOC, SCTP_ASOC(new_asoc));
2300 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
2301
2302
2303
2304
2305 sctp_add_cmd_sf(commands, SCTP_CMD_SET_ASOC,
2306 SCTP_ASOC((struct sctp_association *)asoc));
2307
2308 return retval;
2309
2310nomem:
2311 return SCTP_DISPOSITION_NOMEM;
2312}
2313
2314
2315
2316
2317
2318
2319enum sctp_disposition sctp_sf_shutdown_pending_abort(
2320 struct net *net,
2321 const struct sctp_endpoint *ep,
2322 const struct sctp_association *asoc,
2323 const union sctp_subtype type,
2324 void *arg,
2325 struct sctp_cmd_seq *commands)
2326{
2327 struct sctp_chunk *chunk = arg;
2328
2329 if (!sctp_vtag_verify_either(chunk, asoc))
2330 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2331
2332
2333
2334
2335
2336
2337
2338
2339
2340
2341
2342 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_abort_chunk)))
2343 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2344
2345
2346
2347
2348
2349
2350 if (SCTP_ADDR_DEL ==
2351 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2352 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2353
2354 if (!sctp_err_chunk_valid(chunk))
2355 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2356
2357 return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
2358}
2359
2360
2361
2362
2363
2364
2365enum sctp_disposition sctp_sf_shutdown_sent_abort(
2366 struct net *net,
2367 const struct sctp_endpoint *ep,
2368 const struct sctp_association *asoc,
2369 const union sctp_subtype type,
2370 void *arg,
2371 struct sctp_cmd_seq *commands)
2372{
2373 struct sctp_chunk *chunk = arg;
2374
2375 if (!sctp_vtag_verify_either(chunk, asoc))
2376 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2377
2378
2379
2380
2381
2382
2383
2384
2385
2386
2387
2388 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_abort_chunk)))
2389 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2390
2391
2392
2393
2394
2395
2396 if (SCTP_ADDR_DEL ==
2397 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2398 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2399
2400 if (!sctp_err_chunk_valid(chunk))
2401 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2402
2403
2404 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2405 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
2406
2407
2408 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2409 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
2410
2411 return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
2412}
2413
2414
2415
2416
2417
2418
2419enum sctp_disposition sctp_sf_shutdown_ack_sent_abort(
2420 struct net *net,
2421 const struct sctp_endpoint *ep,
2422 const struct sctp_association *asoc,
2423 const union sctp_subtype type,
2424 void *arg,
2425 struct sctp_cmd_seq *commands)
2426{
2427
2428
2429
2430 return sctp_sf_shutdown_sent_abort(net, ep, asoc, type, arg, commands);
2431}
2432
2433
2434
2435
2436
2437
2438
2439
2440
2441
2442
2443
2444
2445
2446
2447enum sctp_disposition sctp_sf_cookie_echoed_err(
2448 struct net *net,
2449 const struct sctp_endpoint *ep,
2450 const struct sctp_association *asoc,
2451 const union sctp_subtype type,
2452 void *arg,
2453 struct sctp_cmd_seq *commands)
2454{
2455 struct sctp_chunk *chunk = arg;
2456 struct sctp_errhdr *err;
2457
2458 if (!sctp_vtag_verify(chunk, asoc))
2459 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2460
2461
2462
2463
2464 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_operr_chunk)))
2465 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2466 commands);
2467
2468
2469
2470
2471
2472
2473 sctp_walk_errors(err, chunk->chunk_hdr) {
2474 if (SCTP_ERROR_STALE_COOKIE == err->cause)
2475 return sctp_sf_do_5_2_6_stale(net, ep, asoc, type,
2476 arg, commands);
2477 }
2478
2479
2480
2481
2482
2483
2484 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2485}
2486
2487
2488
2489
2490
2491
2492
2493
2494
2495
2496
2497
2498
2499
2500
2501
2502
2503
2504
2505
2506
2507
2508
2509
2510
2511
2512static enum sctp_disposition sctp_sf_do_5_2_6_stale(
2513 struct net *net,
2514 const struct sctp_endpoint *ep,
2515 const struct sctp_association *asoc,
2516 const union sctp_subtype type,
2517 void *arg,
2518 struct sctp_cmd_seq *commands)
2519{
2520 int attempts = asoc->init_err_counter + 1;
2521 struct sctp_chunk *chunk = arg, *reply;
2522 struct sctp_cookie_preserve_param bht;
2523 struct sctp_bind_addr *bp;
2524 struct sctp_errhdr *err;
2525 u32 stale;
2526
2527 if (attempts > asoc->max_init_attempts) {
2528 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
2529 SCTP_ERROR(ETIMEDOUT));
2530 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
2531 SCTP_PERR(SCTP_ERROR_STALE_COOKIE));
2532 return SCTP_DISPOSITION_DELETE_TCB;
2533 }
2534
2535 err = (struct sctp_errhdr *)(chunk->skb->data);
2536
2537
2538
2539
2540
2541
2542
2543
2544
2545
2546
2547
2548
2549
2550
2551 stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err)));
2552 stale = (stale * 2) / 1000;
2553
2554 bht.param_hdr.type = SCTP_PARAM_COOKIE_PRESERVATIVE;
2555 bht.param_hdr.length = htons(sizeof(bht));
2556 bht.lifespan_increment = htonl(stale);
2557
2558
2559 bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
2560 reply = sctp_make_init(asoc, bp, GFP_ATOMIC, sizeof(bht));
2561 if (!reply)
2562 goto nomem;
2563
2564 sctp_addto_chunk(reply, sizeof(bht), &bht);
2565
2566
2567 sctp_add_cmd_sf(commands, SCTP_CMD_CLEAR_INIT_TAG, SCTP_NULL());
2568
2569
2570 sctp_add_cmd_sf(commands, SCTP_CMD_T3_RTX_TIMERS_STOP, SCTP_NULL());
2571 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
2572
2573
2574
2575
2576 sctp_add_cmd_sf(commands, SCTP_CMD_DEL_NON_PRIMARY, SCTP_NULL());
2577
2578
2579
2580
2581 sctp_add_cmd_sf(commands, SCTP_CMD_T1_RETRAN,
2582 SCTP_TRANSPORT(asoc->peer.primary_path));
2583
2584
2585
2586
2587 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_INC, SCTP_NULL());
2588
2589 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2590 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
2591 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2592 SCTP_STATE(SCTP_STATE_COOKIE_WAIT));
2593 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
2594 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
2595
2596 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
2597
2598 return SCTP_DISPOSITION_CONSUME;
2599
2600nomem:
2601 return SCTP_DISPOSITION_NOMEM;
2602}
2603
2604
2605
2606
2607
2608
2609
2610
2611
2612
2613
2614
2615
2616
2617
2618
2619
2620
2621
2622
2623
2624
2625
2626
2627
2628
2629
2630
2631
2632
2633
2634
2635enum sctp_disposition sctp_sf_do_9_1_abort(
2636 struct net *net,
2637 const struct sctp_endpoint *ep,
2638 const struct sctp_association *asoc,
2639 const union sctp_subtype type,
2640 void *arg,
2641 struct sctp_cmd_seq *commands)
2642{
2643 struct sctp_chunk *chunk = arg;
2644
2645 if (!sctp_vtag_verify_either(chunk, asoc))
2646 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2647
2648
2649
2650
2651
2652
2653
2654
2655
2656
2657
2658 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_abort_chunk)))
2659 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2660
2661
2662
2663
2664
2665
2666 if (SCTP_ADDR_DEL ==
2667 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2668 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2669
2670 if (!sctp_err_chunk_valid(chunk))
2671 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2672
2673 return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
2674}
2675
2676static enum sctp_disposition __sctp_sf_do_9_1_abort(
2677 struct net *net,
2678 const struct sctp_endpoint *ep,
2679 const struct sctp_association *asoc,
2680 const union sctp_subtype type,
2681 void *arg,
2682 struct sctp_cmd_seq *commands)
2683{
2684 __be16 error = SCTP_ERROR_NO_ERROR;
2685 struct sctp_chunk *chunk = arg;
2686 unsigned int len;
2687
2688
2689 len = ntohs(chunk->chunk_hdr->length);
2690 if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
2691 error = ((struct sctp_errhdr *)chunk->skb->data)->cause;
2692
2693 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(ECONNRESET));
2694
2695 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, SCTP_PERR(error));
2696 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
2697 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
2698
2699 return SCTP_DISPOSITION_ABORT;
2700}
2701
2702
2703
2704
2705
2706
2707enum sctp_disposition sctp_sf_cookie_wait_abort(
2708 struct net *net,
2709 const struct sctp_endpoint *ep,
2710 const struct sctp_association *asoc,
2711 const union sctp_subtype type,
2712 void *arg,
2713 struct sctp_cmd_seq *commands)
2714{
2715 __be16 error = SCTP_ERROR_NO_ERROR;
2716 struct sctp_chunk *chunk = arg;
2717 unsigned int len;
2718
2719 if (!sctp_vtag_verify_either(chunk, asoc))
2720 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2721
2722
2723
2724
2725
2726
2727
2728
2729
2730
2731
2732 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_abort_chunk)))
2733 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2734
2735
2736 len = ntohs(chunk->chunk_hdr->length);
2737 if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
2738 error = ((struct sctp_errhdr *)chunk->skb->data)->cause;
2739
2740 return sctp_stop_t1_and_abort(net, commands, error, ECONNREFUSED, asoc,
2741 chunk->transport);
2742}
2743
2744
2745
2746
2747enum sctp_disposition sctp_sf_cookie_wait_icmp_abort(
2748 struct net *net,
2749 const struct sctp_endpoint *ep,
2750 const struct sctp_association *asoc,
2751 const union sctp_subtype type,
2752 void *arg,
2753 struct sctp_cmd_seq *commands)
2754{
2755 return sctp_stop_t1_and_abort(net, commands, SCTP_ERROR_NO_ERROR,
2756 ENOPROTOOPT, asoc,
2757 (struct sctp_transport *)arg);
2758}
2759
2760
2761
2762
2763enum sctp_disposition sctp_sf_cookie_echoed_abort(
2764 struct net *net,
2765 const struct sctp_endpoint *ep,
2766 const struct sctp_association *asoc,
2767 const union sctp_subtype type,
2768 void *arg,
2769 struct sctp_cmd_seq *commands)
2770{
2771
2772
2773
2774 return sctp_sf_cookie_wait_abort(net, ep, asoc, type, arg, commands);
2775}
2776
2777
2778
2779
2780
2781
2782static enum sctp_disposition sctp_stop_t1_and_abort(
2783 struct net *net,
2784 struct sctp_cmd_seq *commands,
2785 __be16 error, int sk_err,
2786 const struct sctp_association *asoc,
2787 struct sctp_transport *transport)
2788{
2789 pr_debug("%s: ABORT received (INIT)\n", __func__);
2790
2791 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2792 SCTP_STATE(SCTP_STATE_CLOSED));
2793 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
2794 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2795 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
2796 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(sk_err));
2797
2798 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
2799 SCTP_PERR(error));
2800
2801 return SCTP_DISPOSITION_ABORT;
2802}
2803
2804
2805
2806
2807
2808
2809
2810
2811
2812
2813
2814
2815
2816
2817
2818
2819
2820
2821
2822
2823
2824
2825
2826
2827
2828
2829
2830
2831
2832
2833
2834
2835
2836
2837enum sctp_disposition sctp_sf_do_9_2_shutdown(
2838 struct net *net,
2839 const struct sctp_endpoint *ep,
2840 const struct sctp_association *asoc,
2841 const union sctp_subtype type,
2842 void *arg,
2843 struct sctp_cmd_seq *commands)
2844{
2845 enum sctp_disposition disposition;
2846 struct sctp_chunk *chunk = arg;
2847 struct sctp_shutdownhdr *sdh;
2848 struct sctp_ulpevent *ev;
2849 __u32 ctsn;
2850
2851 if (!sctp_vtag_verify(chunk, asoc))
2852 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2853
2854
2855 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_shutdown_chunk)))
2856 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2857 commands);
2858
2859
2860 sdh = (struct sctp_shutdownhdr *)chunk->skb->data;
2861 skb_pull(chunk->skb, sizeof(*sdh));
2862 chunk->subh.shutdown_hdr = sdh;
2863 ctsn = ntohl(sdh->cum_tsn_ack);
2864
2865 if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
2866 pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn,
2867 asoc->ctsn_ack_point);
2868
2869 return SCTP_DISPOSITION_DISCARD;
2870 }
2871
2872
2873
2874
2875
2876 if (!TSN_lt(ctsn, asoc->next_tsn))
2877 return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands);
2878
2879
2880
2881
2882
2883 ev = sctp_ulpevent_make_shutdown_event(asoc, 0, GFP_ATOMIC);
2884 if (!ev) {
2885 disposition = SCTP_DISPOSITION_NOMEM;
2886 goto out;
2887 }
2888 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
2889
2890
2891
2892
2893
2894
2895
2896 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2897 SCTP_STATE(SCTP_STATE_SHUTDOWN_RECEIVED));
2898 disposition = SCTP_DISPOSITION_CONSUME;
2899
2900 if (sctp_outq_is_empty(&asoc->outqueue)) {
2901 disposition = sctp_sf_do_9_2_shutdown_ack(net, ep, asoc, type,
2902 arg, commands);
2903 }
2904
2905 if (SCTP_DISPOSITION_NOMEM == disposition)
2906 goto out;
2907
2908
2909
2910
2911
2912 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_CTSN,
2913 SCTP_BE32(chunk->subh.shutdown_hdr->cum_tsn_ack));
2914
2915out:
2916 return disposition;
2917}
2918
2919
2920
2921
2922
2923
2924
2925
2926
2927enum sctp_disposition sctp_sf_do_9_2_shut_ctsn(
2928 struct net *net,
2929 const struct sctp_endpoint *ep,
2930 const struct sctp_association *asoc,
2931 const union sctp_subtype type,
2932 void *arg,
2933 struct sctp_cmd_seq *commands)
2934{
2935 struct sctp_chunk *chunk = arg;
2936 struct sctp_shutdownhdr *sdh;
2937 __u32 ctsn;
2938
2939 if (!sctp_vtag_verify(chunk, asoc))
2940 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2941
2942
2943 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_shutdown_chunk)))
2944 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2945 commands);
2946
2947 sdh = (struct sctp_shutdownhdr *)chunk->skb->data;
2948 ctsn = ntohl(sdh->cum_tsn_ack);
2949
2950 if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
2951 pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn,
2952 asoc->ctsn_ack_point);
2953
2954 return SCTP_DISPOSITION_DISCARD;
2955 }
2956
2957
2958
2959
2960
2961 if (!TSN_lt(ctsn, asoc->next_tsn))
2962 return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands);
2963
2964
2965
2966
2967
2968 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_CTSN,
2969 SCTP_BE32(sdh->cum_tsn_ack));
2970
2971 return SCTP_DISPOSITION_CONSUME;
2972}
2973
2974
2975
2976
2977
2978
2979
2980
2981static enum sctp_disposition
2982__sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep,
2983 const struct sctp_association *asoc,
2984 const union sctp_subtype type, void *arg,
2985 struct sctp_cmd_seq *commands)
2986{
2987 struct sctp_chunk *chunk = arg;
2988 struct sctp_chunk *reply;
2989
2990
2991 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
2992 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2993 commands);
2994
2995
2996
2997
2998
2999 reply = sctp_make_shutdown_ack(asoc, chunk);
3000 if (NULL == reply)
3001 goto nomem;
3002
3003
3004
3005
3006 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
3007
3008
3009 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
3010 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
3011
3012 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
3013
3014 return SCTP_DISPOSITION_CONSUME;
3015nomem:
3016 return SCTP_DISPOSITION_NOMEM;
3017}
3018
3019enum sctp_disposition
3020sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep,
3021 const struct sctp_association *asoc,
3022 const union sctp_subtype type, void *arg,
3023 struct sctp_cmd_seq *commands)
3024{
3025 struct sctp_chunk *chunk = arg;
3026
3027 if (!chunk->singleton)
3028 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3029
3030 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
3031 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3032
3033 if (chunk->sctp_hdr->vtag != 0)
3034 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
3035
3036 return __sctp_sf_do_9_2_reshutack(net, ep, asoc, type, arg, commands);
3037}
3038
3039
3040
3041
3042
3043
3044
3045
3046
3047
3048
3049
3050
3051
3052
3053
3054
3055
3056
3057
3058
3059
3060
3061
3062
3063
3064enum sctp_disposition sctp_sf_do_ecn_cwr(struct net *net,
3065 const struct sctp_endpoint *ep,
3066 const struct sctp_association *asoc,
3067 const union sctp_subtype type,
3068 void *arg,
3069 struct sctp_cmd_seq *commands)
3070{
3071 struct sctp_chunk *chunk = arg;
3072 struct sctp_cwrhdr *cwr;
3073 u32 lowest_tsn;
3074
3075 if (!sctp_vtag_verify(chunk, asoc))
3076 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3077
3078 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_ecne_chunk)))
3079 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3080 commands);
3081
3082 cwr = (struct sctp_cwrhdr *)chunk->skb->data;
3083 skb_pull(chunk->skb, sizeof(*cwr));
3084
3085 lowest_tsn = ntohl(cwr->lowest_tsn);
3086
3087
3088 if (TSN_lte(asoc->last_ecne_tsn, lowest_tsn)) {
3089
3090 sctp_add_cmd_sf(commands,
3091 SCTP_CMD_ECN_CWR,
3092 SCTP_U32(lowest_tsn));
3093 }
3094 return SCTP_DISPOSITION_CONSUME;
3095}
3096
3097
3098
3099
3100
3101
3102
3103
3104
3105
3106
3107
3108
3109
3110
3111
3112
3113
3114
3115
3116
3117
3118
3119
3120enum sctp_disposition sctp_sf_do_ecne(struct net *net,
3121 const struct sctp_endpoint *ep,
3122 const struct sctp_association *asoc,
3123 const union sctp_subtype type,
3124 void *arg, struct sctp_cmd_seq *commands)
3125{
3126 struct sctp_chunk *chunk = arg;
3127 struct sctp_ecnehdr *ecne;
3128
3129 if (!sctp_vtag_verify(chunk, asoc))
3130 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3131
3132 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_ecne_chunk)))
3133 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3134 commands);
3135
3136 ecne = (struct sctp_ecnehdr *)chunk->skb->data;
3137 skb_pull(chunk->skb, sizeof(*ecne));
3138
3139
3140 sctp_add_cmd_sf(commands, SCTP_CMD_ECN_ECNE,
3141 SCTP_U32(ntohl(ecne->lowest_tsn)));
3142
3143 return SCTP_DISPOSITION_CONSUME;
3144}
3145
3146
3147
3148
3149
3150
3151
3152
3153
3154
3155
3156
3157
3158
3159
3160
3161
3162
3163
3164
3165
3166
3167
3168
3169
3170
3171
3172
3173
3174
3175
3176enum sctp_disposition sctp_sf_eat_data_6_2(struct net *net,
3177 const struct sctp_endpoint *ep,
3178 const struct sctp_association *asoc,
3179 const union sctp_subtype type,
3180 void *arg,
3181 struct sctp_cmd_seq *commands)
3182{
3183 union sctp_arg force = SCTP_NOFORCE();
3184 struct sctp_chunk *chunk = arg;
3185 int error;
3186
3187 if (!sctp_vtag_verify(chunk, asoc)) {
3188 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3189 SCTP_NULL());
3190 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3191 }
3192
3193 if (!sctp_chunk_length_valid(chunk, sctp_datachk_len(&asoc->stream)))
3194 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3195 commands);
3196
3197 error = sctp_eat_data(asoc, chunk, commands);
3198 switch (error) {
3199 case SCTP_IERROR_NO_ERROR:
3200 break;
3201 case SCTP_IERROR_HIGH_TSN:
3202 case SCTP_IERROR_BAD_STREAM:
3203 SCTP_INC_STATS(net, SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
3204 goto discard_noforce;
3205 case SCTP_IERROR_DUP_TSN:
3206 case SCTP_IERROR_IGNORE_TSN:
3207 SCTP_INC_STATS(net, SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
3208 goto discard_force;
3209 case SCTP_IERROR_NO_DATA:
3210 return SCTP_DISPOSITION_ABORT;
3211 case SCTP_IERROR_PROTO_VIOLATION:
3212 return sctp_sf_abort_violation(net, ep, asoc, chunk, commands,
3213 (u8 *)chunk->subh.data_hdr,
3214 sctp_datahdr_len(&asoc->stream));
3215 default:
3216 BUG();
3217 }
3218
3219 if (chunk->chunk_hdr->flags & SCTP_DATA_SACK_IMM)
3220 force = SCTP_FORCE();
3221
3222 if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) {
3223 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
3224 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
3225 }
3226
3227
3228
3229
3230
3231
3232
3233
3234
3235
3236
3237
3238
3239
3240
3241
3242
3243
3244
3245
3246
3247
3248
3249 if (chunk->end_of_packet)
3250 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, force);
3251
3252 return SCTP_DISPOSITION_CONSUME;
3253
3254discard_force:
3255
3256
3257
3258
3259
3260
3261
3262
3263
3264
3265
3266
3267
3268
3269 if (chunk->end_of_packet)
3270 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
3271 return SCTP_DISPOSITION_DISCARD;
3272
3273discard_noforce:
3274 if (chunk->end_of_packet)
3275 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, force);
3276
3277 return SCTP_DISPOSITION_DISCARD;
3278}
3279
3280
3281
3282
3283
3284
3285
3286
3287
3288
3289
3290
3291
3292
3293
3294
3295
3296enum sctp_disposition sctp_sf_eat_data_fast_4_4(
3297 struct net *net,
3298 const struct sctp_endpoint *ep,
3299 const struct sctp_association *asoc,
3300 const union sctp_subtype type,
3301 void *arg,
3302 struct sctp_cmd_seq *commands)
3303{
3304 struct sctp_chunk *chunk = arg;
3305 int error;
3306
3307 if (!sctp_vtag_verify(chunk, asoc)) {
3308 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3309 SCTP_NULL());
3310 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3311 }
3312
3313 if (!sctp_chunk_length_valid(chunk, sctp_datachk_len(&asoc->stream)))
3314 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3315 commands);
3316
3317 error = sctp_eat_data(asoc, chunk, commands);
3318 switch (error) {
3319 case SCTP_IERROR_NO_ERROR:
3320 case SCTP_IERROR_HIGH_TSN:
3321 case SCTP_IERROR_DUP_TSN:
3322 case SCTP_IERROR_IGNORE_TSN:
3323 case SCTP_IERROR_BAD_STREAM:
3324 break;
3325 case SCTP_IERROR_NO_DATA:
3326 return SCTP_DISPOSITION_ABORT;
3327 case SCTP_IERROR_PROTO_VIOLATION:
3328 return sctp_sf_abort_violation(net, ep, asoc, chunk, commands,
3329 (u8 *)chunk->subh.data_hdr,
3330 sctp_datahdr_len(&asoc->stream));
3331 default:
3332 BUG();
3333 }
3334
3335
3336
3337
3338
3339
3340
3341
3342
3343 if (chunk->end_of_packet) {
3344
3345
3346
3347 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SHUTDOWN, SCTP_NULL());
3348 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
3349 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
3350 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
3351 }
3352
3353 return SCTP_DISPOSITION_CONSUME;
3354}
3355
3356
3357
3358
3359
3360
3361
3362
3363
3364
3365
3366
3367
3368
3369
3370
3371
3372
3373
3374
3375
3376
3377
3378
3379
3380
3381
3382
3383
3384
3385
3386
3387
3388enum sctp_disposition sctp_sf_eat_sack_6_2(struct net *net,
3389 const struct sctp_endpoint *ep,
3390 const struct sctp_association *asoc,
3391 const union sctp_subtype type,
3392 void *arg,
3393 struct sctp_cmd_seq *commands)
3394{
3395 struct sctp_chunk *chunk = arg;
3396 struct sctp_sackhdr *sackh;
3397 __u32 ctsn;
3398
3399 if (!sctp_vtag_verify(chunk, asoc))
3400 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3401
3402
3403 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_sack_chunk)))
3404 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3405 commands);
3406
3407
3408 sackh = sctp_sm_pull_sack(chunk);
3409
3410 if (!sackh)
3411 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3412 chunk->subh.sack_hdr = sackh;
3413 ctsn = ntohl(sackh->cum_tsn_ack);
3414
3415
3416
3417
3418
3419 if (TSN_lte(asoc->next_tsn, ctsn))
3420 return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands);
3421
3422 trace_sctp_probe(ep, asoc, chunk);
3423
3424
3425
3426
3427
3428
3429
3430 if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
3431 pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn,
3432 asoc->ctsn_ack_point);
3433
3434 return SCTP_DISPOSITION_DISCARD;
3435 }
3436
3437
3438 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_SACK, SCTP_CHUNK(chunk));
3439
3440
3441
3442
3443 return SCTP_DISPOSITION_CONSUME;
3444}
3445
3446
3447
3448
3449
3450
3451
3452
3453
3454
3455
3456
3457
3458
3459
3460
3461
3462
3463
3464static enum sctp_disposition sctp_sf_tabort_8_4_8(
3465 struct net *net,
3466 const struct sctp_endpoint *ep,
3467 const struct sctp_association *asoc,
3468 const union sctp_subtype type,
3469 void *arg,
3470 struct sctp_cmd_seq *commands)
3471{
3472 struct sctp_packet *packet = NULL;
3473 struct sctp_chunk *chunk = arg;
3474 struct sctp_chunk *abort;
3475
3476 packet = sctp_ootb_pkt_new(net, asoc, chunk);
3477 if (!packet)
3478 return SCTP_DISPOSITION_NOMEM;
3479
3480
3481
3482
3483 abort = sctp_make_abort(asoc, chunk, 0);
3484 if (!abort) {
3485 sctp_ootb_pkt_free(packet);
3486 return SCTP_DISPOSITION_NOMEM;
3487 }
3488
3489
3490 if (sctp_test_T_bit(abort))
3491 packet->vtag = ntohl(chunk->sctp_hdr->vtag);
3492
3493
3494 abort->skb->sk = ep->base.sk;
3495
3496 sctp_packet_append_chunk(packet, abort);
3497
3498 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT, SCTP_PACKET(packet));
3499
3500 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
3501
3502 sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3503 return SCTP_DISPOSITION_CONSUME;
3504}
3505
3506
3507
3508
3509
3510
3511static enum sctp_disposition sctp_sf_new_encap_port(
3512 struct net *net,
3513 const struct sctp_endpoint *ep,
3514 const struct sctp_association *asoc,
3515 const union sctp_subtype type,
3516 void *arg,
3517 struct sctp_cmd_seq *commands)
3518{
3519 struct sctp_packet *packet = NULL;
3520 struct sctp_chunk *chunk = arg;
3521 struct sctp_chunk *abort;
3522
3523 packet = sctp_ootb_pkt_new(net, asoc, chunk);
3524 if (!packet)
3525 return SCTP_DISPOSITION_NOMEM;
3526
3527 abort = sctp_make_new_encap_port(asoc, chunk);
3528 if (!abort) {
3529 sctp_ootb_pkt_free(packet);
3530 return SCTP_DISPOSITION_NOMEM;
3531 }
3532
3533 abort->skb->sk = ep->base.sk;
3534
3535 sctp_packet_append_chunk(packet, abort);
3536
3537 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
3538 SCTP_PACKET(packet));
3539
3540 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
3541
3542 sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3543 return SCTP_DISPOSITION_CONSUME;
3544}
3545
3546
3547
3548
3549
3550
3551
3552
3553
3554enum sctp_disposition sctp_sf_operr_notify(struct net *net,
3555 const struct sctp_endpoint *ep,
3556 const struct sctp_association *asoc,
3557 const union sctp_subtype type,
3558 void *arg,
3559 struct sctp_cmd_seq *commands)
3560{
3561 struct sctp_chunk *chunk = arg;
3562 struct sctp_errhdr *err;
3563
3564 if (!sctp_vtag_verify(chunk, asoc))
3565 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3566
3567
3568 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_operr_chunk)))
3569 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3570 commands);
3571 sctp_walk_errors(err, chunk->chunk_hdr);
3572 if ((void *)err != (void *)chunk->chunk_end)
3573 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
3574 (void *)err, commands);
3575
3576 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,
3577 SCTP_CHUNK(chunk));
3578
3579 return SCTP_DISPOSITION_CONSUME;
3580}
3581
3582
3583
3584
3585
3586
3587
3588
3589
3590
3591
3592enum sctp_disposition sctp_sf_do_9_2_final(struct net *net,
3593 const struct sctp_endpoint *ep,
3594 const struct sctp_association *asoc,
3595 const union sctp_subtype type,
3596 void *arg,
3597 struct sctp_cmd_seq *commands)
3598{
3599 struct sctp_chunk *chunk = arg;
3600 struct sctp_chunk *reply;
3601 struct sctp_ulpevent *ev;
3602
3603 if (!sctp_vtag_verify(chunk, asoc))
3604 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3605
3606
3607 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
3608 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3609 commands);
3610
3611
3612
3613
3614
3615 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_SHUTDOWN_COMP,
3616 0, 0, 0, NULL, GFP_ATOMIC);
3617 if (!ev)
3618 goto nomem;
3619
3620
3621 reply = sctp_make_shutdown_complete(asoc, chunk);
3622 if (!reply)
3623 goto nomem_chunk;
3624
3625
3626
3627
3628 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
3629
3630
3631
3632
3633 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3634 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
3635
3636 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3637 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
3638
3639 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
3640 SCTP_STATE(SCTP_STATE_CLOSED));
3641 SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS);
3642 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
3643 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
3644
3645
3646 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
3647 return SCTP_DISPOSITION_DELETE_TCB;
3648
3649nomem_chunk:
3650 sctp_ulpevent_free(ev);
3651nomem:
3652 return SCTP_DISPOSITION_NOMEM;
3653}
3654
3655
3656
3657
3658
3659
3660
3661
3662
3663
3664
3665
3666
3667
3668
3669
3670
3671
3672
3673
3674
3675enum sctp_disposition sctp_sf_ootb(struct net *net,
3676 const struct sctp_endpoint *ep,
3677 const struct sctp_association *asoc,
3678 const union sctp_subtype type,
3679 void *arg, struct sctp_cmd_seq *commands)
3680{
3681 struct sctp_chunk *chunk = arg;
3682 struct sk_buff *skb = chunk->skb;
3683 struct sctp_chunkhdr *ch;
3684 struct sctp_errhdr *err;
3685 int ootb_cookie_ack = 0;
3686 int ootb_shut_ack = 0;
3687 __u8 *ch_end;
3688
3689 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
3690
3691 if (asoc && !sctp_vtag_verify(chunk, asoc))
3692 asoc = NULL;
3693
3694 ch = (struct sctp_chunkhdr *)chunk->chunk_hdr;
3695 do {
3696
3697 if (ntohs(ch->length) < sizeof(*ch))
3698 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3699 commands);
3700
3701
3702 ch_end = ((__u8 *)ch) + SCTP_PAD4(ntohs(ch->length));
3703 if (ch_end > skb_tail_pointer(skb))
3704 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3705 commands);
3706
3707
3708
3709
3710 if (SCTP_CID_SHUTDOWN_ACK == ch->type)
3711 ootb_shut_ack = 1;
3712
3713
3714
3715
3716
3717
3718 if (SCTP_CID_ABORT == ch->type)
3719 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3720
3721
3722
3723
3724
3725
3726 if (SCTP_CID_COOKIE_ACK == ch->type)
3727 ootb_cookie_ack = 1;
3728
3729 if (SCTP_CID_ERROR == ch->type) {
3730 sctp_walk_errors(err, ch) {
3731 if (SCTP_ERROR_STALE_COOKIE == err->cause) {
3732 ootb_cookie_ack = 1;
3733 break;
3734 }
3735 }
3736 }
3737
3738 ch = (struct sctp_chunkhdr *)ch_end;
3739 } while (ch_end < skb_tail_pointer(skb));
3740
3741 if (ootb_shut_ack)
3742 return sctp_sf_shut_8_4_5(net, ep, asoc, type, arg, commands);
3743 else if (ootb_cookie_ack)
3744 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3745 else
3746 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
3747}
3748
3749
3750
3751
3752
3753
3754
3755
3756
3757
3758
3759
3760
3761
3762
3763
3764
3765
3766
3767
3768
3769
3770static enum sctp_disposition sctp_sf_shut_8_4_5(
3771 struct net *net,
3772 const struct sctp_endpoint *ep,
3773 const struct sctp_association *asoc,
3774 const union sctp_subtype type,
3775 void *arg,
3776 struct sctp_cmd_seq *commands)
3777{
3778 struct sctp_packet *packet = NULL;
3779 struct sctp_chunk *chunk = arg;
3780 struct sctp_chunk *shut;
3781
3782 packet = sctp_ootb_pkt_new(net, asoc, chunk);
3783 if (!packet)
3784 return SCTP_DISPOSITION_NOMEM;
3785
3786
3787
3788
3789 shut = sctp_make_shutdown_complete(asoc, chunk);
3790 if (!shut) {
3791 sctp_ootb_pkt_free(packet);
3792 return SCTP_DISPOSITION_NOMEM;
3793 }
3794
3795
3796 if (sctp_test_T_bit(shut))
3797 packet->vtag = ntohl(chunk->sctp_hdr->vtag);
3798
3799
3800 shut->skb->sk = ep->base.sk;
3801
3802 sctp_packet_append_chunk(packet, shut);
3803
3804 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
3805 SCTP_PACKET(packet));
3806
3807 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
3808
3809
3810
3811
3812
3813 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3814}
3815
3816
3817
3818
3819
3820
3821
3822
3823
3824
3825
3826
3827enum sctp_disposition sctp_sf_do_8_5_1_E_sa(struct net *net,
3828 const struct sctp_endpoint *ep,
3829 const struct sctp_association *asoc,
3830 const union sctp_subtype type,
3831 void *arg,
3832 struct sctp_cmd_seq *commands)
3833{
3834 struct sctp_chunk *chunk = arg;
3835
3836 if (!sctp_vtag_verify(chunk, asoc))
3837 asoc = NULL;
3838
3839
3840 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
3841 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3842 commands);
3843
3844
3845
3846
3847
3848
3849 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
3850
3851 return sctp_sf_shut_8_4_5(net, ep, NULL, type, arg, commands);
3852}
3853
3854
3855enum sctp_disposition sctp_sf_do_asconf(struct net *net,
3856 const struct sctp_endpoint *ep,
3857 const struct sctp_association *asoc,
3858 const union sctp_subtype type,
3859 void *arg,
3860 struct sctp_cmd_seq *commands)
3861{
3862 struct sctp_paramhdr *err_param = NULL;
3863 struct sctp_chunk *asconf_ack = NULL;
3864 struct sctp_chunk *chunk = arg;
3865 struct sctp_addiphdr *hdr;
3866 __u32 serial;
3867
3868 if (!sctp_vtag_verify(chunk, asoc)) {
3869 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3870 SCTP_NULL());
3871 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3872 }
3873
3874
3875 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_addip_chunk)))
3876 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3877 commands);
3878
3879
3880
3881
3882
3883
3884
3885 if (!asoc->peer.asconf_capable ||
3886 (!net->sctp.addip_noauth && !chunk->auth))
3887 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3888
3889 hdr = (struct sctp_addiphdr *)chunk->skb->data;
3890 serial = ntohl(hdr->serial);
3891
3892
3893 if (!sctp_verify_asconf(asoc, chunk, true, &err_param))
3894 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
3895 (void *)err_param, commands);
3896
3897
3898
3899
3900
3901 if (serial == asoc->peer.addip_serial + 1) {
3902
3903
3904
3905 if (!chunk->has_asconf)
3906 sctp_assoc_clean_asconf_ack_cache(asoc);
3907
3908
3909
3910
3911
3912
3913
3914
3915
3916 asconf_ack = sctp_process_asconf((struct sctp_association *)
3917 asoc, chunk);
3918 if (!asconf_ack)
3919 return SCTP_DISPOSITION_NOMEM;
3920 } else if (serial < asoc->peer.addip_serial + 1) {
3921
3922
3923
3924
3925
3926
3927
3928
3929
3930
3931
3932
3933 asconf_ack = sctp_assoc_lookup_asconf_ack(asoc, hdr->serial);
3934 if (!asconf_ack)
3935 return SCTP_DISPOSITION_DISCARD;
3936
3937
3938
3939
3940
3941 asconf_ack->transport = NULL;
3942 } else {
3943
3944
3945
3946 return SCTP_DISPOSITION_DISCARD;
3947 }
3948
3949
3950
3951
3952
3953
3954
3955
3956
3957
3958 asconf_ack->dest = chunk->source;
3959 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(asconf_ack));
3960 if (asoc->new_transport) {
3961 sctp_sf_heartbeat(ep, asoc, type, asoc->new_transport, commands);
3962 ((struct sctp_association *)asoc)->new_transport = NULL;
3963 }
3964
3965 return SCTP_DISPOSITION_CONSUME;
3966}
3967
3968static enum sctp_disposition sctp_send_next_asconf(
3969 struct net *net,
3970 const struct sctp_endpoint *ep,
3971 struct sctp_association *asoc,
3972 const union sctp_subtype type,
3973 struct sctp_cmd_seq *commands)
3974{
3975 struct sctp_chunk *asconf;
3976 struct list_head *entry;
3977
3978 if (list_empty(&asoc->addip_chunk_list))
3979 return SCTP_DISPOSITION_CONSUME;
3980
3981 entry = asoc->addip_chunk_list.next;
3982 asconf = list_entry(entry, struct sctp_chunk, list);
3983
3984 list_del_init(entry);
3985 sctp_chunk_hold(asconf);
3986 asoc->addip_last_asconf = asconf;
3987
3988 return sctp_sf_do_prm_asconf(net, ep, asoc, type, asconf, commands);
3989}
3990
3991
3992
3993
3994
3995
3996enum sctp_disposition sctp_sf_do_asconf_ack(struct net *net,
3997 const struct sctp_endpoint *ep,
3998 const struct sctp_association *asoc,
3999 const union sctp_subtype type,
4000 void *arg,
4001 struct sctp_cmd_seq *commands)
4002{
4003 struct sctp_chunk *last_asconf = asoc->addip_last_asconf;
4004 struct sctp_paramhdr *err_param = NULL;
4005 struct sctp_chunk *asconf_ack = arg;
4006 struct sctp_addiphdr *addip_hdr;
4007 __u32 sent_serial, rcvd_serial;
4008 struct sctp_chunk *abort;
4009
4010 if (!sctp_vtag_verify(asconf_ack, asoc)) {
4011 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
4012 SCTP_NULL());
4013 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4014 }
4015
4016
4017 if (!sctp_chunk_length_valid(asconf_ack,
4018 sizeof(struct sctp_addip_chunk)))
4019 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4020 commands);
4021
4022
4023
4024
4025
4026
4027
4028 if (!asoc->peer.asconf_capable ||
4029 (!net->sctp.addip_noauth && !asconf_ack->auth))
4030 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4031
4032 addip_hdr = (struct sctp_addiphdr *)asconf_ack->skb->data;
4033 rcvd_serial = ntohl(addip_hdr->serial);
4034
4035
4036 if (!sctp_verify_asconf(asoc, asconf_ack, false, &err_param))
4037 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
4038 (void *)err_param, commands);
4039
4040 if (last_asconf) {
4041 addip_hdr = (struct sctp_addiphdr *)last_asconf->subh.addip_hdr;
4042 sent_serial = ntohl(addip_hdr->serial);
4043 } else {
4044 sent_serial = asoc->addip_serial - 1;
4045 }
4046
4047
4048
4049
4050
4051
4052
4053 if (ADDIP_SERIAL_gte(rcvd_serial, sent_serial + 1) &&
4054 !(asoc->addip_last_asconf)) {
4055 abort = sctp_make_abort(asoc, asconf_ack,
4056 sizeof(struct sctp_errhdr));
4057 if (abort) {
4058 sctp_init_cause(abort, SCTP_ERROR_ASCONF_ACK, 0);
4059 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
4060 SCTP_CHUNK(abort));
4061 }
4062
4063
4064
4065 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4066 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
4067 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
4068 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4069 SCTP_ERROR(ECONNABORTED));
4070 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
4071 SCTP_PERR(SCTP_ERROR_ASCONF_ACK));
4072 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
4073 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
4074 return SCTP_DISPOSITION_ABORT;
4075 }
4076
4077 if ((rcvd_serial == sent_serial) && asoc->addip_last_asconf) {
4078 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4079 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
4080
4081 if (!sctp_process_asconf_ack((struct sctp_association *)asoc,
4082 asconf_ack))
4083 return sctp_send_next_asconf(net, ep,
4084 (struct sctp_association *)asoc,
4085 type, commands);
4086
4087 abort = sctp_make_abort(asoc, asconf_ack,
4088 sizeof(struct sctp_errhdr));
4089 if (abort) {
4090 sctp_init_cause(abort, SCTP_ERROR_RSRC_LOW, 0);
4091 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
4092 SCTP_CHUNK(abort));
4093 }
4094
4095
4096
4097 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
4098 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4099 SCTP_ERROR(ECONNABORTED));
4100 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
4101 SCTP_PERR(SCTP_ERROR_ASCONF_ACK));
4102 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
4103 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
4104 return SCTP_DISPOSITION_ABORT;
4105 }
4106
4107 return SCTP_DISPOSITION_DISCARD;
4108}
4109
4110
4111enum sctp_disposition sctp_sf_do_reconf(struct net *net,
4112 const struct sctp_endpoint *ep,
4113 const struct sctp_association *asoc,
4114 const union sctp_subtype type,
4115 void *arg,
4116 struct sctp_cmd_seq *commands)
4117{
4118 struct sctp_paramhdr *err_param = NULL;
4119 struct sctp_chunk *chunk = arg;
4120 struct sctp_reconf_chunk *hdr;
4121 union sctp_params param;
4122
4123 if (!sctp_vtag_verify(chunk, asoc)) {
4124 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
4125 SCTP_NULL());
4126 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4127 }
4128
4129
4130 if (!sctp_chunk_length_valid(chunk, sizeof(*hdr)))
4131 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4132 commands);
4133
4134 if (!sctp_verify_reconf(asoc, chunk, &err_param))
4135 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
4136 (void *)err_param, commands);
4137
4138 hdr = (struct sctp_reconf_chunk *)chunk->chunk_hdr;
4139 sctp_walk_params(param, hdr, params) {
4140 struct sctp_chunk *reply = NULL;
4141 struct sctp_ulpevent *ev = NULL;
4142
4143 if (param.p->type == SCTP_PARAM_RESET_OUT_REQUEST)
4144 reply = sctp_process_strreset_outreq(
4145 (struct sctp_association *)asoc, param, &ev);
4146 else if (param.p->type == SCTP_PARAM_RESET_IN_REQUEST)
4147 reply = sctp_process_strreset_inreq(
4148 (struct sctp_association *)asoc, param, &ev);
4149 else if (param.p->type == SCTP_PARAM_RESET_TSN_REQUEST)
4150 reply = sctp_process_strreset_tsnreq(
4151 (struct sctp_association *)asoc, param, &ev);
4152 else if (param.p->type == SCTP_PARAM_RESET_ADD_OUT_STREAMS)
4153 reply = sctp_process_strreset_addstrm_out(
4154 (struct sctp_association *)asoc, param, &ev);
4155 else if (param.p->type == SCTP_PARAM_RESET_ADD_IN_STREAMS)
4156 reply = sctp_process_strreset_addstrm_in(
4157 (struct sctp_association *)asoc, param, &ev);
4158 else if (param.p->type == SCTP_PARAM_RESET_RESPONSE)
4159 reply = sctp_process_strreset_resp(
4160 (struct sctp_association *)asoc, param, &ev);
4161
4162 if (ev)
4163 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
4164 SCTP_ULPEVENT(ev));
4165
4166 if (reply)
4167 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
4168 SCTP_CHUNK(reply));
4169 }
4170
4171 return SCTP_DISPOSITION_CONSUME;
4172}
4173
4174
4175
4176
4177
4178
4179
4180
4181
4182
4183
4184
4185
4186
4187
4188enum sctp_disposition sctp_sf_eat_fwd_tsn(struct net *net,
4189 const struct sctp_endpoint *ep,
4190 const struct sctp_association *asoc,
4191 const union sctp_subtype type,
4192 void *arg,
4193 struct sctp_cmd_seq *commands)
4194{
4195 struct sctp_fwdtsn_hdr *fwdtsn_hdr;
4196 struct sctp_chunk *chunk = arg;
4197 __u16 len;
4198 __u32 tsn;
4199
4200 if (!sctp_vtag_verify(chunk, asoc)) {
4201 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
4202 SCTP_NULL());
4203 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4204 }
4205
4206 if (!asoc->peer.prsctp_capable)
4207 return sctp_sf_unk_chunk(net, ep, asoc, type, arg, commands);
4208
4209
4210 if (!sctp_chunk_length_valid(chunk, sctp_ftsnchk_len(&asoc->stream)))
4211 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4212 commands);
4213
4214 fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data;
4215 chunk->subh.fwdtsn_hdr = fwdtsn_hdr;
4216 len = ntohs(chunk->chunk_hdr->length);
4217 len -= sizeof(struct sctp_chunkhdr);
4218 skb_pull(chunk->skb, len);
4219
4220 tsn = ntohl(fwdtsn_hdr->new_cum_tsn);
4221 pr_debug("%s: TSN 0x%x\n", __func__, tsn);
4222
4223
4224
4225
4226 if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
4227 goto discard_noforce;
4228
4229 if (!asoc->stream.si->validate_ftsn(chunk))
4230 goto discard_noforce;
4231
4232 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
4233 if (len > sctp_ftsnhdr_len(&asoc->stream))
4234 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
4235 SCTP_CHUNK(chunk));
4236
4237
4238 if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) {
4239 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
4240 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
4241 }
4242
4243
4244
4245
4246 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_NOFORCE());
4247
4248 return SCTP_DISPOSITION_CONSUME;
4249
4250discard_noforce:
4251 return SCTP_DISPOSITION_DISCARD;
4252}
4253
4254enum sctp_disposition sctp_sf_eat_fwd_tsn_fast(
4255 struct net *net,
4256 const struct sctp_endpoint *ep,
4257 const struct sctp_association *asoc,
4258 const union sctp_subtype type,
4259 void *arg,
4260 struct sctp_cmd_seq *commands)
4261{
4262 struct sctp_fwdtsn_hdr *fwdtsn_hdr;
4263 struct sctp_chunk *chunk = arg;
4264 __u16 len;
4265 __u32 tsn;
4266
4267 if (!sctp_vtag_verify(chunk, asoc)) {
4268 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
4269 SCTP_NULL());
4270 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4271 }
4272
4273 if (!asoc->peer.prsctp_capable)
4274 return sctp_sf_unk_chunk(net, ep, asoc, type, arg, commands);
4275
4276
4277 if (!sctp_chunk_length_valid(chunk, sctp_ftsnchk_len(&asoc->stream)))
4278 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4279 commands);
4280
4281 fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data;
4282 chunk->subh.fwdtsn_hdr = fwdtsn_hdr;
4283 len = ntohs(chunk->chunk_hdr->length);
4284 len -= sizeof(struct sctp_chunkhdr);
4285 skb_pull(chunk->skb, len);
4286
4287 tsn = ntohl(fwdtsn_hdr->new_cum_tsn);
4288 pr_debug("%s: TSN 0x%x\n", __func__, tsn);
4289
4290
4291
4292
4293 if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
4294 goto gen_shutdown;
4295
4296 if (!asoc->stream.si->validate_ftsn(chunk))
4297 goto gen_shutdown;
4298
4299 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
4300 if (len > sctp_ftsnhdr_len(&asoc->stream))
4301 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
4302 SCTP_CHUNK(chunk));
4303
4304
4305gen_shutdown:
4306
4307
4308
4309
4310
4311
4312 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SHUTDOWN, SCTP_NULL());
4313 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
4314 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
4315 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
4316
4317 return SCTP_DISPOSITION_CONSUME;
4318}
4319
4320
4321
4322
4323
4324
4325
4326
4327
4328
4329
4330
4331
4332
4333
4334
4335
4336
4337
4338
4339
4340
4341
4342static enum sctp_ierror sctp_sf_authenticate(
4343 const struct sctp_association *asoc,
4344 struct sctp_chunk *chunk)
4345{
4346 struct sctp_shared_key *sh_key = NULL;
4347 struct sctp_authhdr *auth_hdr;
4348 __u8 *save_digest, *digest;
4349 struct sctp_hmac *hmac;
4350 unsigned int sig_len;
4351 __u16 key_id;
4352
4353
4354 auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
4355 chunk->subh.auth_hdr = auth_hdr;
4356 skb_pull(chunk->skb, sizeof(*auth_hdr));
4357
4358
4359
4360
4361 if (!sctp_auth_asoc_verify_hmac_id(asoc, auth_hdr->hmac_id))
4362 return SCTP_IERROR_AUTH_BAD_HMAC;
4363
4364
4365
4366
4367 key_id = ntohs(auth_hdr->shkey_id);
4368 if (key_id != asoc->active_key_id) {
4369 sh_key = sctp_auth_get_shkey(asoc, key_id);
4370 if (!sh_key)
4371 return SCTP_IERROR_AUTH_BAD_KEYID;
4372 }
4373
4374
4375
4376
4377 sig_len = ntohs(chunk->chunk_hdr->length) -
4378 sizeof(struct sctp_auth_chunk);
4379 hmac = sctp_auth_get_hmac(ntohs(auth_hdr->hmac_id));
4380 if (sig_len != hmac->hmac_len)
4381 return SCTP_IERROR_PROTO_VIOLATION;
4382
4383
4384
4385
4386
4387
4388
4389
4390 digest = auth_hdr->hmac;
4391 skb_pull(chunk->skb, sig_len);
4392
4393 save_digest = kmemdup(digest, sig_len, GFP_ATOMIC);
4394 if (!save_digest)
4395 goto nomem;
4396
4397 memset(digest, 0, sig_len);
4398
4399 sctp_auth_calculate_hmac(asoc, chunk->skb,
4400 (struct sctp_auth_chunk *)chunk->chunk_hdr,
4401 sh_key, GFP_ATOMIC);
4402
4403
4404 if (memcmp(save_digest, digest, sig_len)) {
4405 kfree(save_digest);
4406 return SCTP_IERROR_BAD_SIG;
4407 }
4408
4409 kfree(save_digest);
4410 chunk->auth = 1;
4411
4412 return SCTP_IERROR_NO_ERROR;
4413nomem:
4414 return SCTP_IERROR_NOMEM;
4415}
4416
4417enum sctp_disposition sctp_sf_eat_auth(struct net *net,
4418 const struct sctp_endpoint *ep,
4419 const struct sctp_association *asoc,
4420 const union sctp_subtype type,
4421 void *arg, struct sctp_cmd_seq *commands)
4422{
4423 struct sctp_chunk *chunk = arg;
4424 struct sctp_authhdr *auth_hdr;
4425 struct sctp_chunk *err_chunk;
4426 enum sctp_ierror error;
4427
4428
4429 if (!asoc->peer.auth_capable)
4430 return sctp_sf_unk_chunk(net, ep, asoc, type, arg, commands);
4431
4432 if (!sctp_vtag_verify(chunk, asoc)) {
4433 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
4434 SCTP_NULL());
4435 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4436 }
4437
4438
4439 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_auth_chunk)))
4440 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4441 commands);
4442
4443 auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
4444 error = sctp_sf_authenticate(asoc, chunk);
4445 switch (error) {
4446 case SCTP_IERROR_AUTH_BAD_HMAC:
4447
4448
4449
4450 err_chunk = sctp_make_op_error(asoc, chunk,
4451 SCTP_ERROR_UNSUP_HMAC,
4452 &auth_hdr->hmac_id,
4453 sizeof(__u16), 0);
4454 if (err_chunk) {
4455 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
4456 SCTP_CHUNK(err_chunk));
4457 }
4458 fallthrough;
4459 case SCTP_IERROR_AUTH_BAD_KEYID:
4460 case SCTP_IERROR_BAD_SIG:
4461 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4462
4463 case SCTP_IERROR_PROTO_VIOLATION:
4464 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4465 commands);
4466
4467 case SCTP_IERROR_NOMEM:
4468 return SCTP_DISPOSITION_NOMEM;
4469
4470 default:
4471 break;
4472 }
4473
4474 if (asoc->active_key_id != ntohs(auth_hdr->shkey_id)) {
4475 struct sctp_ulpevent *ev;
4476
4477 ev = sctp_ulpevent_make_authkey(asoc, ntohs(auth_hdr->shkey_id),
4478 SCTP_AUTH_NEW_KEY, GFP_ATOMIC);
4479
4480 if (!ev)
4481 return -ENOMEM;
4482
4483 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
4484 SCTP_ULPEVENT(ev));
4485 }
4486
4487 return SCTP_DISPOSITION_CONSUME;
4488}
4489
4490
4491
4492
4493
4494
4495
4496
4497
4498
4499
4500
4501
4502
4503
4504
4505
4506
4507
4508
4509
4510
4511
4512
4513enum sctp_disposition sctp_sf_unk_chunk(struct net *net,
4514 const struct sctp_endpoint *ep,
4515 const struct sctp_association *asoc,
4516 const union sctp_subtype type,
4517 void *arg,
4518 struct sctp_cmd_seq *commands)
4519{
4520 struct sctp_chunk *unk_chunk = arg;
4521 struct sctp_chunk *err_chunk;
4522 struct sctp_chunkhdr *hdr;
4523
4524 pr_debug("%s: processing unknown chunk id:%d\n", __func__, type.chunk);
4525
4526 if (!sctp_vtag_verify(unk_chunk, asoc))
4527 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4528
4529
4530
4531
4532
4533 if (!sctp_chunk_length_valid(unk_chunk, sizeof(*hdr)))
4534 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4535 commands);
4536
4537 switch (type.chunk & SCTP_CID_ACTION_MASK) {
4538 case SCTP_CID_ACTION_DISCARD:
4539
4540 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4541 case SCTP_CID_ACTION_DISCARD_ERR:
4542
4543 hdr = unk_chunk->chunk_hdr;
4544 err_chunk = sctp_make_op_error(asoc, unk_chunk,
4545 SCTP_ERROR_UNKNOWN_CHUNK, hdr,
4546 SCTP_PAD4(ntohs(hdr->length)),
4547 0);
4548 if (err_chunk) {
4549 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
4550 SCTP_CHUNK(err_chunk));
4551 }
4552
4553
4554 sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4555 return SCTP_DISPOSITION_CONSUME;
4556 case SCTP_CID_ACTION_SKIP:
4557
4558 return SCTP_DISPOSITION_DISCARD;
4559 case SCTP_CID_ACTION_SKIP_ERR:
4560
4561 hdr = unk_chunk->chunk_hdr;
4562 err_chunk = sctp_make_op_error(asoc, unk_chunk,
4563 SCTP_ERROR_UNKNOWN_CHUNK, hdr,
4564 SCTP_PAD4(ntohs(hdr->length)),
4565 0);
4566 if (err_chunk) {
4567 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
4568 SCTP_CHUNK(err_chunk));
4569 }
4570
4571 return SCTP_DISPOSITION_CONSUME;
4572 default:
4573 break;
4574 }
4575
4576 return SCTP_DISPOSITION_DISCARD;
4577}
4578
4579
4580
4581
4582
4583
4584
4585
4586
4587
4588
4589
4590
4591
4592
4593enum sctp_disposition sctp_sf_discard_chunk(struct net *net,
4594 const struct sctp_endpoint *ep,
4595 const struct sctp_association *asoc,
4596 const union sctp_subtype type,
4597 void *arg,
4598 struct sctp_cmd_seq *commands)
4599{
4600 struct sctp_chunk *chunk = arg;
4601
4602 if (asoc && !sctp_vtag_verify(chunk, asoc))
4603 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4604
4605
4606
4607
4608
4609 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
4610 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4611 commands);
4612
4613 pr_debug("%s: chunk:%d is discarded\n", __func__, type.chunk);
4614
4615 return SCTP_DISPOSITION_DISCARD;
4616}
4617
4618
4619
4620
4621
4622
4623
4624
4625
4626
4627
4628
4629
4630
4631
4632
4633
4634
4635
4636enum sctp_disposition sctp_sf_pdiscard(struct net *net,
4637 const struct sctp_endpoint *ep,
4638 const struct sctp_association *asoc,
4639 const union sctp_subtype type,
4640 void *arg, struct sctp_cmd_seq *commands)
4641{
4642 SCTP_INC_STATS(net, SCTP_MIB_IN_PKT_DISCARDS);
4643 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
4644
4645 return SCTP_DISPOSITION_CONSUME;
4646}
4647
4648
4649
4650
4651
4652
4653
4654
4655
4656
4657
4658
4659
4660
4661
4662
4663enum sctp_disposition sctp_sf_violation(struct net *net,
4664 const struct sctp_endpoint *ep,
4665 const struct sctp_association *asoc,
4666 const union sctp_subtype type,
4667 void *arg,
4668 struct sctp_cmd_seq *commands)
4669{
4670 struct sctp_chunk *chunk = arg;
4671
4672 if (!sctp_vtag_verify(chunk, asoc))
4673 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4674
4675
4676 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
4677 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4678 commands);
4679
4680 return SCTP_DISPOSITION_VIOLATION;
4681}
4682
4683
4684
4685
4686static enum sctp_disposition sctp_sf_abort_violation(
4687 struct net *net,
4688 const struct sctp_endpoint *ep,
4689 const struct sctp_association *asoc,
4690 void *arg,
4691 struct sctp_cmd_seq *commands,
4692 const __u8 *payload,
4693 const size_t paylen)
4694{
4695 struct sctp_packet *packet = NULL;
4696 struct sctp_chunk *chunk = arg;
4697 struct sctp_chunk *abort = NULL;
4698
4699
4700
4701
4702
4703
4704
4705
4706
4707
4708
4709
4710 if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
4711 goto discard;
4712
4713
4714 abort = sctp_make_abort_violation(asoc, chunk, payload, paylen);
4715 if (!abort)
4716 goto nomem;
4717
4718 if (asoc) {
4719
4720 if (chunk->chunk_hdr->type == SCTP_CID_INIT_ACK &&
4721 !asoc->peer.i.init_tag) {
4722 struct sctp_initack_chunk *initack;
4723
4724 initack = (struct sctp_initack_chunk *)chunk->chunk_hdr;
4725 if (!sctp_chunk_length_valid(chunk, sizeof(*initack)))
4726 abort->chunk_hdr->flags |= SCTP_CHUNK_FLAG_T;
4727 else {
4728 unsigned int inittag;
4729
4730 inittag = ntohl(initack->init_hdr.init_tag);
4731 sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_INITTAG,
4732 SCTP_U32(inittag));
4733 }
4734 }
4735
4736 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
4737 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
4738
4739 if (asoc->state <= SCTP_STATE_COOKIE_ECHOED) {
4740 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4741 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
4742 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4743 SCTP_ERROR(ECONNREFUSED));
4744 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
4745 SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
4746 } else {
4747 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4748 SCTP_ERROR(ECONNABORTED));
4749 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
4750 SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
4751 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
4752 }
4753 } else {
4754 packet = sctp_ootb_pkt_new(net, asoc, chunk);
4755
4756 if (!packet)
4757 goto nomem_pkt;
4758
4759 if (sctp_test_T_bit(abort))
4760 packet->vtag = ntohl(chunk->sctp_hdr->vtag);
4761
4762 abort->skb->sk = ep->base.sk;
4763
4764 sctp_packet_append_chunk(packet, abort);
4765
4766 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
4767 SCTP_PACKET(packet));
4768
4769 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
4770 }
4771
4772 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
4773
4774discard:
4775 sctp_sf_pdiscard(net, ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
4776 return SCTP_DISPOSITION_ABORT;
4777
4778nomem_pkt:
4779 sctp_chunk_free(abort);
4780nomem:
4781 return SCTP_DISPOSITION_NOMEM;
4782}
4783
4784
4785
4786
4787
4788
4789
4790
4791
4792
4793
4794
4795
4796
4797
4798
4799
4800
4801
4802
4803static enum sctp_disposition sctp_sf_violation_chunklen(
4804 struct net *net,
4805 const struct sctp_endpoint *ep,
4806 const struct sctp_association *asoc,
4807 const union sctp_subtype type,
4808 void *arg,
4809 struct sctp_cmd_seq *commands)
4810{
4811 static const char err_str[] = "The following chunk had invalid length:";
4812
4813 return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str,
4814 sizeof(err_str));
4815}
4816
4817
4818
4819
4820
4821
4822
4823static enum sctp_disposition sctp_sf_violation_paramlen(
4824 struct net *net,
4825 const struct sctp_endpoint *ep,
4826 const struct sctp_association *asoc,
4827 const union sctp_subtype type,
4828 void *arg, void *ext,
4829 struct sctp_cmd_seq *commands)
4830{
4831 struct sctp_paramhdr *param = ext;
4832 struct sctp_chunk *abort = NULL;
4833 struct sctp_chunk *chunk = arg;
4834
4835 if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
4836 goto discard;
4837
4838
4839 abort = sctp_make_violation_paramlen(asoc, chunk, param);
4840 if (!abort)
4841 goto nomem;
4842
4843 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
4844 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
4845
4846 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4847 SCTP_ERROR(ECONNABORTED));
4848 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
4849 SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
4850 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
4851 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
4852
4853discard:
4854 sctp_sf_pdiscard(net, ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
4855 return SCTP_DISPOSITION_ABORT;
4856nomem:
4857 return SCTP_DISPOSITION_NOMEM;
4858}
4859
4860
4861
4862
4863
4864
4865
4866static enum sctp_disposition sctp_sf_violation_ctsn(
4867 struct net *net,
4868 const struct sctp_endpoint *ep,
4869 const struct sctp_association *asoc,
4870 const union sctp_subtype type,
4871 void *arg,
4872 struct sctp_cmd_seq *commands)
4873{
4874 static const char err_str[] = "The cumulative tsn ack beyond the max tsn currently sent:";
4875
4876 return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str,
4877 sizeof(err_str));
4878}
4879
4880
4881
4882
4883
4884
4885
4886static enum sctp_disposition sctp_sf_violation_chunk(
4887 struct net *net,
4888 const struct sctp_endpoint *ep,
4889 const struct sctp_association *asoc,
4890 const union sctp_subtype type,
4891 void *arg,
4892 struct sctp_cmd_seq *commands)
4893{
4894 static const char err_str[] = "The following chunk violates protocol:";
4895
4896 if (!asoc)
4897 return sctp_sf_violation(net, ep, asoc, type, arg, commands);
4898
4899 return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str,
4900 sizeof(err_str));
4901}
4902
4903
4904
4905
4906
4907
4908
4909
4910
4911
4912
4913
4914
4915
4916
4917
4918
4919
4920
4921
4922
4923
4924
4925
4926
4927
4928
4929
4930
4931
4932
4933
4934
4935
4936
4937
4938
4939
4940
4941
4942
4943
4944
4945
4946
4947
4948
4949
4950
4951
4952
4953
4954
4955
4956
4957
4958
4959
4960
4961
4962enum sctp_disposition sctp_sf_do_prm_asoc(struct net *net,
4963 const struct sctp_endpoint *ep,
4964 const struct sctp_association *asoc,
4965 const union sctp_subtype type,
4966 void *arg,
4967 struct sctp_cmd_seq *commands)
4968{
4969 struct sctp_association *my_asoc;
4970 struct sctp_chunk *repl;
4971
4972
4973
4974
4975
4976 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
4977 SCTP_STATE(SCTP_STATE_COOKIE_WAIT));
4978
4979
4980
4981
4982
4983
4984
4985
4986
4987 repl = sctp_make_init(asoc, &asoc->base.bind_addr, GFP_ATOMIC, 0);
4988 if (!repl)
4989 goto nomem;
4990
4991
4992 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
4993 SCTP_CHUNK(repl));
4994
4995
4996
4997
4998 my_asoc = (struct sctp_association *)asoc;
4999 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(my_asoc));
5000
5001
5002
5003
5004 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
5005 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
5006 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
5007 return SCTP_DISPOSITION_CONSUME;
5008
5009nomem:
5010 return SCTP_DISPOSITION_NOMEM;
5011}
5012
5013
5014
5015
5016
5017
5018
5019
5020
5021
5022
5023
5024
5025
5026
5027
5028
5029
5030
5031
5032
5033
5034
5035
5036
5037
5038
5039
5040
5041
5042
5043
5044
5045
5046
5047
5048
5049
5050
5051
5052
5053
5054
5055
5056
5057
5058
5059
5060
5061
5062
5063
5064
5065
5066
5067
5068
5069
5070
5071
5072
5073
5074enum sctp_disposition sctp_sf_do_prm_send(struct net *net,
5075 const struct sctp_endpoint *ep,
5076 const struct sctp_association *asoc,
5077 const union sctp_subtype type,
5078 void *arg,
5079 struct sctp_cmd_seq *commands)
5080{
5081 struct sctp_datamsg *msg = arg;
5082
5083 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_MSG, SCTP_DATAMSG(msg));
5084 return SCTP_DISPOSITION_CONSUME;
5085}
5086
5087
5088
5089
5090
5091
5092
5093
5094
5095
5096
5097
5098
5099
5100
5101
5102
5103
5104
5105
5106
5107
5108
5109
5110
5111
5112
5113enum sctp_disposition sctp_sf_do_9_2_prm_shutdown(
5114 struct net *net,
5115 const struct sctp_endpoint *ep,
5116 const struct sctp_association *asoc,
5117 const union sctp_subtype type,
5118 void *arg,
5119 struct sctp_cmd_seq *commands)
5120{
5121 enum sctp_disposition disposition;
5122
5123
5124
5125
5126
5127
5128
5129
5130
5131 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
5132 SCTP_STATE(SCTP_STATE_SHUTDOWN_PENDING));
5133
5134 disposition = SCTP_DISPOSITION_CONSUME;
5135 if (sctp_outq_is_empty(&asoc->outqueue)) {
5136 disposition = sctp_sf_do_9_2_start_shutdown(net, ep, asoc, type,
5137 arg, commands);
5138 }
5139
5140 return disposition;
5141}
5142
5143
5144
5145
5146
5147
5148
5149
5150
5151
5152
5153
5154
5155
5156
5157
5158
5159
5160
5161
5162
5163
5164
5165
5166
5167
5168
5169
5170enum sctp_disposition sctp_sf_do_9_1_prm_abort(
5171 struct net *net,
5172 const struct sctp_endpoint *ep,
5173 const struct sctp_association *asoc,
5174 const union sctp_subtype type,
5175 void *arg,
5176 struct sctp_cmd_seq *commands)
5177{
5178
5179
5180
5181
5182
5183
5184
5185
5186 struct sctp_chunk *abort = arg;
5187
5188 if (abort)
5189 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
5190
5191
5192
5193
5194
5195 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5196 SCTP_ERROR(ECONNABORTED));
5197
5198 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5199 SCTP_PERR(SCTP_ERROR_USER_ABORT));
5200
5201 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
5202 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
5203
5204 return SCTP_DISPOSITION_ABORT;
5205}
5206
5207
5208enum sctp_disposition sctp_sf_error_closed(struct net *net,
5209 const struct sctp_endpoint *ep,
5210 const struct sctp_association *asoc,
5211 const union sctp_subtype type,
5212 void *arg,
5213 struct sctp_cmd_seq *commands)
5214{
5215 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_ERROR, SCTP_ERROR(-EINVAL));
5216 return SCTP_DISPOSITION_CONSUME;
5217}
5218
5219
5220
5221
5222enum sctp_disposition sctp_sf_error_shutdown(
5223 struct net *net,
5224 const struct sctp_endpoint *ep,
5225 const struct sctp_association *asoc,
5226 const union sctp_subtype type,
5227 void *arg,
5228 struct sctp_cmd_seq *commands)
5229{
5230 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_ERROR,
5231 SCTP_ERROR(-ESHUTDOWN));
5232 return SCTP_DISPOSITION_CONSUME;
5233}
5234
5235
5236
5237
5238
5239
5240
5241
5242
5243
5244
5245
5246
5247
5248
5249enum sctp_disposition sctp_sf_cookie_wait_prm_shutdown(
5250 struct net *net,
5251 const struct sctp_endpoint *ep,
5252 const struct sctp_association *asoc,
5253 const union sctp_subtype type,
5254 void *arg,
5255 struct sctp_cmd_seq *commands)
5256{
5257 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5258 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
5259
5260 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
5261 SCTP_STATE(SCTP_STATE_CLOSED));
5262
5263 SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS);
5264
5265 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
5266
5267 return SCTP_DISPOSITION_DELETE_TCB;
5268}
5269
5270
5271
5272
5273
5274
5275
5276
5277
5278
5279
5280
5281
5282
5283
5284enum sctp_disposition sctp_sf_cookie_echoed_prm_shutdown(
5285 struct net *net,
5286 const struct sctp_endpoint *ep,
5287 const struct sctp_association *asoc,
5288 const union sctp_subtype type,
5289 void *arg,
5290 struct sctp_cmd_seq *commands)
5291{
5292
5293
5294
5295 return sctp_sf_cookie_wait_prm_shutdown(net, ep, asoc, type, arg, commands);
5296}
5297
5298
5299
5300
5301
5302
5303
5304
5305
5306
5307
5308
5309
5310
5311
5312enum sctp_disposition sctp_sf_cookie_wait_prm_abort(
5313 struct net *net,
5314 const struct sctp_endpoint *ep,
5315 const struct sctp_association *asoc,
5316 const union sctp_subtype type,
5317 void *arg,
5318 struct sctp_cmd_seq *commands)
5319{
5320 struct sctp_chunk *abort = arg;
5321
5322
5323 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5324 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
5325
5326 if (abort)
5327 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
5328
5329 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
5330 SCTP_STATE(SCTP_STATE_CLOSED));
5331
5332 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
5333
5334
5335
5336
5337
5338 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5339 SCTP_ERROR(ECONNREFUSED));
5340
5341 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
5342 SCTP_PERR(SCTP_ERROR_USER_ABORT));
5343
5344 return SCTP_DISPOSITION_ABORT;
5345}
5346
5347
5348
5349
5350
5351
5352
5353
5354
5355
5356
5357
5358
5359
5360
5361enum sctp_disposition sctp_sf_cookie_echoed_prm_abort(
5362 struct net *net,
5363 const struct sctp_endpoint *ep,
5364 const struct sctp_association *asoc,
5365 const union sctp_subtype type,
5366 void *arg,
5367 struct sctp_cmd_seq *commands)
5368{
5369
5370
5371
5372 return sctp_sf_cookie_wait_prm_abort(net, ep, asoc, type, arg, commands);
5373}
5374
5375
5376
5377
5378
5379
5380
5381
5382
5383
5384
5385
5386
5387enum sctp_disposition sctp_sf_shutdown_pending_prm_abort(
5388 struct net *net,
5389 const struct sctp_endpoint *ep,
5390 const struct sctp_association *asoc,
5391 const union sctp_subtype type,
5392 void *arg,
5393 struct sctp_cmd_seq *commands)
5394{
5395
5396 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5397 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5398
5399 return sctp_sf_do_9_1_prm_abort(net, ep, asoc, type, arg, commands);
5400}
5401
5402
5403
5404
5405
5406
5407
5408
5409
5410
5411
5412
5413
5414enum sctp_disposition sctp_sf_shutdown_sent_prm_abort(
5415 struct net *net,
5416 const struct sctp_endpoint *ep,
5417 const struct sctp_association *asoc,
5418 const union sctp_subtype type,
5419 void *arg,
5420 struct sctp_cmd_seq *commands)
5421{
5422
5423 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5424 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5425
5426
5427 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5428 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5429
5430 return sctp_sf_do_9_1_prm_abort(net, ep, asoc, type, arg, commands);
5431}
5432
5433
5434
5435
5436
5437
5438
5439
5440
5441
5442
5443
5444
5445enum sctp_disposition sctp_sf_shutdown_ack_sent_prm_abort(
5446 struct net *net,
5447 const struct sctp_endpoint *ep,
5448 const struct sctp_association *asoc,
5449 const union sctp_subtype type,
5450 void *arg,
5451 struct sctp_cmd_seq *commands)
5452{
5453
5454
5455
5456 return sctp_sf_shutdown_sent_prm_abort(net, ep, asoc, type, arg, commands);
5457}
5458
5459
5460
5461
5462
5463
5464
5465
5466
5467
5468
5469
5470
5471
5472
5473
5474
5475
5476
5477
5478
5479
5480
5481enum sctp_disposition sctp_sf_do_prm_requestheartbeat(
5482 struct net *net,
5483 const struct sctp_endpoint *ep,
5484 const struct sctp_association *asoc,
5485 const union sctp_subtype type,
5486 void *arg,
5487 struct sctp_cmd_seq *commands)
5488{
5489 if (SCTP_DISPOSITION_NOMEM == sctp_sf_heartbeat(ep, asoc, type,
5490 (struct sctp_transport *)arg, commands))
5491 return SCTP_DISPOSITION_NOMEM;
5492
5493
5494
5495
5496
5497
5498
5499
5500
5501
5502
5503
5504 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_HB_SENT,
5505 SCTP_TRANSPORT(arg));
5506 return SCTP_DISPOSITION_CONSUME;
5507}
5508
5509
5510
5511
5512
5513
5514enum sctp_disposition sctp_sf_do_prm_asconf(struct net *net,
5515 const struct sctp_endpoint *ep,
5516 const struct sctp_association *asoc,
5517 const union sctp_subtype type,
5518 void *arg,
5519 struct sctp_cmd_seq *commands)
5520{
5521 struct sctp_chunk *chunk = arg;
5522
5523 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T4, SCTP_CHUNK(chunk));
5524 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
5525 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
5526 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(chunk));
5527 return SCTP_DISPOSITION_CONSUME;
5528}
5529
5530
5531enum sctp_disposition sctp_sf_do_prm_reconf(struct net *net,
5532 const struct sctp_endpoint *ep,
5533 const struct sctp_association *asoc,
5534 const union sctp_subtype type,
5535 void *arg,
5536 struct sctp_cmd_seq *commands)
5537{
5538 struct sctp_chunk *chunk = arg;
5539
5540 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(chunk));
5541 return SCTP_DISPOSITION_CONSUME;
5542}
5543
5544
5545
5546
5547
5548
5549enum sctp_disposition sctp_sf_ignore_primitive(
5550 struct net *net,
5551 const struct sctp_endpoint *ep,
5552 const struct sctp_association *asoc,
5553 const union sctp_subtype type,
5554 void *arg,
5555 struct sctp_cmd_seq *commands)
5556{
5557 pr_debug("%s: primitive type:%d is ignored\n", __func__,
5558 type.primitive);
5559
5560 return SCTP_DISPOSITION_DISCARD;
5561}
5562
5563
5564
5565
5566
5567
5568
5569
5570
5571
5572
5573enum sctp_disposition sctp_sf_do_no_pending_tsn(
5574 struct net *net,
5575 const struct sctp_endpoint *ep,
5576 const struct sctp_association *asoc,
5577 const union sctp_subtype type,
5578 void *arg,
5579 struct sctp_cmd_seq *commands)
5580{
5581 struct sctp_ulpevent *event;
5582
5583 event = sctp_ulpevent_make_sender_dry_event(asoc, GFP_ATOMIC);
5584 if (!event)
5585 return SCTP_DISPOSITION_NOMEM;
5586
5587 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(event));
5588
5589 return SCTP_DISPOSITION_CONSUME;
5590}
5591
5592
5593
5594
5595
5596
5597
5598
5599
5600
5601
5602
5603
5604
5605enum sctp_disposition sctp_sf_do_9_2_start_shutdown(
5606 struct net *net,
5607 const struct sctp_endpoint *ep,
5608 const struct sctp_association *asoc,
5609 const union sctp_subtype type,
5610 void *arg,
5611 struct sctp_cmd_seq *commands)
5612{
5613 struct sctp_chunk *reply;
5614
5615
5616
5617
5618
5619
5620 reply = sctp_make_shutdown(asoc, arg);
5621 if (!reply)
5622 goto nomem;
5623
5624
5625
5626
5627 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
5628
5629
5630 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
5631 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5632
5633
5634
5635
5636
5637 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
5638 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5639
5640 if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
5641 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5642 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
5643
5644
5645 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
5646 SCTP_STATE(SCTP_STATE_SHUTDOWN_SENT));
5647
5648
5649
5650
5651
5652
5653 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
5654
5655 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
5656
5657 return SCTP_DISPOSITION_CONSUME;
5658
5659nomem:
5660 return SCTP_DISPOSITION_NOMEM;
5661}
5662
5663
5664
5665
5666
5667
5668
5669
5670
5671
5672
5673
5674
5675enum sctp_disposition sctp_sf_do_9_2_shutdown_ack(
5676 struct net *net,
5677 const struct sctp_endpoint *ep,
5678 const struct sctp_association *asoc,
5679 const union sctp_subtype type,
5680 void *arg,
5681 struct sctp_cmd_seq *commands)
5682{
5683 struct sctp_chunk *chunk = arg;
5684 struct sctp_chunk *reply;
5685
5686
5687
5688
5689
5690
5691
5692
5693 if (chunk) {
5694 if (!sctp_vtag_verify(chunk, asoc))
5695 return sctp_sf_pdiscard(net, ep, asoc, type, arg,
5696 commands);
5697
5698
5699 if (!sctp_chunk_length_valid(
5700 chunk, sizeof(struct sctp_shutdown_chunk)))
5701 return sctp_sf_violation_chunklen(net, ep, asoc, type,
5702 arg, commands);
5703 }
5704
5705
5706
5707
5708 reply = sctp_make_shutdown_ack(asoc, chunk);
5709 if (!reply)
5710 goto nomem;
5711
5712
5713
5714
5715 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
5716
5717
5718 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
5719 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5720
5721 if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
5722 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5723 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
5724
5725
5726 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
5727 SCTP_STATE(SCTP_STATE_SHUTDOWN_ACK_SENT));
5728
5729
5730
5731
5732
5733
5734 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
5735
5736 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
5737
5738 return SCTP_DISPOSITION_CONSUME;
5739
5740nomem:
5741 return SCTP_DISPOSITION_NOMEM;
5742}
5743
5744
5745
5746
5747
5748
5749enum sctp_disposition sctp_sf_ignore_other(struct net *net,
5750 const struct sctp_endpoint *ep,
5751 const struct sctp_association *asoc,
5752 const union sctp_subtype type,
5753 void *arg,
5754 struct sctp_cmd_seq *commands)
5755{
5756 pr_debug("%s: the event other type:%d is ignored\n",
5757 __func__, type.other);
5758
5759 return SCTP_DISPOSITION_DISCARD;
5760}
5761
5762
5763
5764
5765
5766
5767
5768
5769
5770
5771
5772
5773
5774
5775
5776
5777enum sctp_disposition sctp_sf_do_6_3_3_rtx(struct net *net,
5778 const struct sctp_endpoint *ep,
5779 const struct sctp_association *asoc,
5780 const union sctp_subtype type,
5781 void *arg,
5782 struct sctp_cmd_seq *commands)
5783{
5784 struct sctp_transport *transport = arg;
5785
5786 SCTP_INC_STATS(net, SCTP_MIB_T3_RTX_EXPIREDS);
5787
5788 if (asoc->overall_error_count >= asoc->max_retrans) {
5789 if (asoc->peer.zero_window_announced &&
5790 asoc->state == SCTP_STATE_SHUTDOWN_PENDING) {
5791
5792
5793
5794
5795
5796
5797
5798
5799
5800 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START_ONCE,
5801 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5802 } else {
5803 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5804 SCTP_ERROR(ETIMEDOUT));
5805
5806 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5807 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5808 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
5809 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
5810 return SCTP_DISPOSITION_DELETE_TCB;
5811 }
5812 }
5813
5814
5815
5816
5817
5818
5819
5820
5821
5822
5823
5824
5825
5826
5827
5828
5829
5830
5831
5832
5833
5834
5835
5836
5837
5838
5839
5840
5841
5842 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE, SCTP_TRANSPORT(transport));
5843
5844
5845 sctp_add_cmd_sf(commands, SCTP_CMD_RETRAN, SCTP_TRANSPORT(transport));
5846
5847 return SCTP_DISPOSITION_CONSUME;
5848}
5849
5850
5851
5852
5853
5854
5855
5856
5857
5858
5859
5860
5861
5862
5863
5864
5865enum sctp_disposition sctp_sf_do_6_2_sack(struct net *net,
5866 const struct sctp_endpoint *ep,
5867 const struct sctp_association *asoc,
5868 const union sctp_subtype type,
5869 void *arg,
5870 struct sctp_cmd_seq *commands)
5871{
5872 SCTP_INC_STATS(net, SCTP_MIB_DELAY_SACK_EXPIREDS);
5873 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
5874 return SCTP_DISPOSITION_CONSUME;
5875}
5876
5877
5878
5879
5880
5881
5882
5883
5884
5885
5886
5887
5888
5889
5890
5891
5892
5893
5894
5895
5896enum sctp_disposition sctp_sf_t1_init_timer_expire(
5897 struct net *net,
5898 const struct sctp_endpoint *ep,
5899 const struct sctp_association *asoc,
5900 const union sctp_subtype type,
5901 void *arg,
5902 struct sctp_cmd_seq *commands)
5903{
5904 int attempts = asoc->init_err_counter + 1;
5905 struct sctp_chunk *repl = NULL;
5906 struct sctp_bind_addr *bp;
5907
5908 pr_debug("%s: timer T1 expired (INIT)\n", __func__);
5909
5910 SCTP_INC_STATS(net, SCTP_MIB_T1_INIT_EXPIREDS);
5911
5912 if (attempts <= asoc->max_init_attempts) {
5913 bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
5914 repl = sctp_make_init(asoc, bp, GFP_ATOMIC, 0);
5915 if (!repl)
5916 return SCTP_DISPOSITION_NOMEM;
5917
5918
5919 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
5920 SCTP_CHUNK(repl));
5921
5922
5923 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_RESTART,
5924 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
5925
5926 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
5927 } else {
5928 pr_debug("%s: giving up on INIT, attempts:%d "
5929 "max_init_attempts:%d\n", __func__, attempts,
5930 asoc->max_init_attempts);
5931
5932 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5933 SCTP_ERROR(ETIMEDOUT));
5934 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
5935 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5936 return SCTP_DISPOSITION_DELETE_TCB;
5937 }
5938
5939 return SCTP_DISPOSITION_CONSUME;
5940}
5941
5942
5943
5944
5945
5946
5947
5948
5949
5950
5951
5952
5953
5954
5955
5956
5957
5958
5959
5960
5961enum sctp_disposition sctp_sf_t1_cookie_timer_expire(
5962 struct net *net,
5963 const struct sctp_endpoint *ep,
5964 const struct sctp_association *asoc,
5965 const union sctp_subtype type,
5966 void *arg,
5967 struct sctp_cmd_seq *commands)
5968{
5969 int attempts = asoc->init_err_counter + 1;
5970 struct sctp_chunk *repl = NULL;
5971
5972 pr_debug("%s: timer T1 expired (COOKIE-ECHO)\n", __func__);
5973
5974 SCTP_INC_STATS(net, SCTP_MIB_T1_COOKIE_EXPIREDS);
5975
5976 if (attempts <= asoc->max_init_attempts) {
5977 repl = sctp_make_cookie_echo(asoc, NULL);
5978 if (!repl)
5979 return SCTP_DISPOSITION_NOMEM;
5980
5981 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
5982 SCTP_CHUNK(repl));
5983
5984 sctp_add_cmd_sf(commands, SCTP_CMD_COOKIEECHO_RESTART,
5985 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
5986
5987 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
5988 } else {
5989 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5990 SCTP_ERROR(ETIMEDOUT));
5991 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
5992 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5993 return SCTP_DISPOSITION_DELETE_TCB;
5994 }
5995
5996 return SCTP_DISPOSITION_CONSUME;
5997}
5998
5999
6000
6001
6002
6003
6004
6005
6006
6007
6008
6009
6010
6011
6012enum sctp_disposition sctp_sf_t2_timer_expire(
6013 struct net *net,
6014 const struct sctp_endpoint *ep,
6015 const struct sctp_association *asoc,
6016 const union sctp_subtype type,
6017 void *arg,
6018 struct sctp_cmd_seq *commands)
6019{
6020 struct sctp_chunk *reply = NULL;
6021
6022 pr_debug("%s: timer T2 expired\n", __func__);
6023
6024 SCTP_INC_STATS(net, SCTP_MIB_T2_SHUTDOWN_EXPIREDS);
6025
6026 ((struct sctp_association *)asoc)->shutdown_retries++;
6027
6028 if (asoc->overall_error_count >= asoc->max_retrans) {
6029 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
6030 SCTP_ERROR(ETIMEDOUT));
6031
6032 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
6033 SCTP_PERR(SCTP_ERROR_NO_ERROR));
6034 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
6035 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
6036 return SCTP_DISPOSITION_DELETE_TCB;
6037 }
6038
6039 switch (asoc->state) {
6040 case SCTP_STATE_SHUTDOWN_SENT:
6041 reply = sctp_make_shutdown(asoc, NULL);
6042 break;
6043
6044 case SCTP_STATE_SHUTDOWN_ACK_SENT:
6045 reply = sctp_make_shutdown_ack(asoc, NULL);
6046 break;
6047
6048 default:
6049 BUG();
6050 break;
6051 }
6052
6053 if (!reply)
6054 goto nomem;
6055
6056
6057
6058
6059
6060 if (asoc->shutdown_last_sent_to)
6061 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE,
6062 SCTP_TRANSPORT(asoc->shutdown_last_sent_to));
6063
6064
6065
6066
6067 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
6068
6069
6070 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
6071 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
6072 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
6073 return SCTP_DISPOSITION_CONSUME;
6074
6075nomem:
6076 return SCTP_DISPOSITION_NOMEM;
6077}
6078
6079
6080
6081
6082
6083enum sctp_disposition sctp_sf_t4_timer_expire(
6084 struct net *net,
6085 const struct sctp_endpoint *ep,
6086 const struct sctp_association *asoc,
6087 const union sctp_subtype type,
6088 void *arg,
6089 struct sctp_cmd_seq *commands)
6090{
6091 struct sctp_chunk *chunk = asoc->addip_last_asconf;
6092 struct sctp_transport *transport = chunk->transport;
6093
6094 SCTP_INC_STATS(net, SCTP_MIB_T4_RTO_EXPIREDS);
6095
6096
6097
6098
6099
6100 if (transport)
6101 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE,
6102 SCTP_TRANSPORT(transport));
6103
6104
6105 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T4, SCTP_CHUNK(chunk));
6106
6107
6108
6109
6110
6111
6112 if (asoc->overall_error_count >= asoc->max_retrans) {
6113 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
6114 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
6115 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
6116 SCTP_ERROR(ETIMEDOUT));
6117 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
6118 SCTP_PERR(SCTP_ERROR_NO_ERROR));
6119 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
6120 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
6121 return SCTP_DISPOSITION_ABORT;
6122 }
6123
6124
6125
6126
6127
6128
6129
6130
6131
6132
6133
6134
6135 sctp_chunk_hold(asoc->addip_last_asconf);
6136 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
6137 SCTP_CHUNK(asoc->addip_last_asconf));
6138
6139
6140
6141
6142
6143 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
6144 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
6145
6146 return SCTP_DISPOSITION_CONSUME;
6147}
6148
6149
6150
6151
6152
6153
6154
6155enum sctp_disposition sctp_sf_t5_timer_expire(
6156 struct net *net,
6157 const struct sctp_endpoint *ep,
6158 const struct sctp_association *asoc,
6159 const union sctp_subtype type,
6160 void *arg,
6161 struct sctp_cmd_seq *commands)
6162{
6163 struct sctp_chunk *reply = NULL;
6164
6165 pr_debug("%s: timer T5 expired\n", __func__);
6166
6167 SCTP_INC_STATS(net, SCTP_MIB_T5_SHUTDOWN_GUARD_EXPIREDS);
6168
6169 reply = sctp_make_abort(asoc, NULL, 0);
6170 if (!reply)
6171 goto nomem;
6172
6173 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
6174 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
6175 SCTP_ERROR(ETIMEDOUT));
6176 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
6177 SCTP_PERR(SCTP_ERROR_NO_ERROR));
6178
6179 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
6180 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
6181
6182 return SCTP_DISPOSITION_DELETE_TCB;
6183nomem:
6184 return SCTP_DISPOSITION_NOMEM;
6185}
6186
6187
6188
6189
6190
6191
6192enum sctp_disposition sctp_sf_autoclose_timer_expire(
6193 struct net *net,
6194 const struct sctp_endpoint *ep,
6195 const struct sctp_association *asoc,
6196 const union sctp_subtype type,
6197 void *arg,
6198 struct sctp_cmd_seq *commands)
6199{
6200 enum sctp_disposition disposition;
6201
6202 SCTP_INC_STATS(net, SCTP_MIB_AUTOCLOSE_EXPIREDS);
6203
6204
6205
6206
6207
6208
6209
6210
6211
6212 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
6213 SCTP_STATE(SCTP_STATE_SHUTDOWN_PENDING));
6214
6215 disposition = SCTP_DISPOSITION_CONSUME;
6216 if (sctp_outq_is_empty(&asoc->outqueue)) {
6217 disposition = sctp_sf_do_9_2_start_shutdown(net, ep, asoc, type,
6218 NULL, commands);
6219 }
6220
6221 return disposition;
6222}
6223
6224
6225
6226
6227
6228
6229
6230
6231
6232
6233
6234
6235
6236enum sctp_disposition sctp_sf_not_impl(struct net *net,
6237 const struct sctp_endpoint *ep,
6238 const struct sctp_association *asoc,
6239 const union sctp_subtype type,
6240 void *arg, struct sctp_cmd_seq *commands)
6241{
6242 return SCTP_DISPOSITION_NOT_IMPL;
6243}
6244
6245
6246
6247
6248
6249
6250
6251
6252
6253enum sctp_disposition sctp_sf_bug(struct net *net,
6254 const struct sctp_endpoint *ep,
6255 const struct sctp_association *asoc,
6256 const union sctp_subtype type,
6257 void *arg, struct sctp_cmd_seq *commands)
6258{
6259 return SCTP_DISPOSITION_BUG;
6260}
6261
6262
6263
6264
6265
6266
6267
6268
6269
6270
6271
6272
6273enum sctp_disposition sctp_sf_timer_ignore(struct net *net,
6274 const struct sctp_endpoint *ep,
6275 const struct sctp_association *asoc,
6276 const union sctp_subtype type,
6277 void *arg,
6278 struct sctp_cmd_seq *commands)
6279{
6280 pr_debug("%s: timer %d ignored\n", __func__, type.chunk);
6281
6282 return SCTP_DISPOSITION_CONSUME;
6283}
6284
6285
6286
6287
6288
6289
6290static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk)
6291{
6292 struct sctp_sackhdr *sack;
6293 __u16 num_dup_tsns;
6294 unsigned int len;
6295 __u16 num_blocks;
6296
6297
6298
6299
6300 sack = (struct sctp_sackhdr *) chunk->skb->data;
6301
6302 num_blocks = ntohs(sack->num_gap_ack_blocks);
6303 num_dup_tsns = ntohs(sack->num_dup_tsns);
6304 len = sizeof(struct sctp_sackhdr);
6305 len += (num_blocks + num_dup_tsns) * sizeof(__u32);
6306 if (len > chunk->skb->len)
6307 return NULL;
6308
6309 skb_pull(chunk->skb, len);
6310
6311 return sack;
6312}
6313
6314
6315
6316
6317static struct sctp_packet *sctp_abort_pkt_new(
6318 struct net *net,
6319 const struct sctp_endpoint *ep,
6320 const struct sctp_association *asoc,
6321 struct sctp_chunk *chunk,
6322 const void *payload, size_t paylen)
6323{
6324 struct sctp_packet *packet;
6325 struct sctp_chunk *abort;
6326
6327 packet = sctp_ootb_pkt_new(net, asoc, chunk);
6328
6329 if (packet) {
6330
6331
6332
6333 abort = sctp_make_abort(asoc, chunk, paylen);
6334 if (!abort) {
6335 sctp_ootb_pkt_free(packet);
6336 return NULL;
6337 }
6338
6339
6340 if (sctp_test_T_bit(abort))
6341 packet->vtag = ntohl(chunk->sctp_hdr->vtag);
6342
6343
6344
6345
6346 sctp_addto_chunk(abort, paylen, payload);
6347
6348
6349 abort->skb->sk = ep->base.sk;
6350
6351 sctp_packet_append_chunk(packet, abort);
6352
6353 }
6354
6355 return packet;
6356}
6357
6358
6359static struct sctp_packet *sctp_ootb_pkt_new(
6360 struct net *net,
6361 const struct sctp_association *asoc,
6362 const struct sctp_chunk *chunk)
6363{
6364 struct sctp_transport *transport;
6365 struct sctp_packet *packet;
6366 __u16 sport, dport;
6367 __u32 vtag;
6368
6369
6370 sport = ntohs(chunk->sctp_hdr->dest);
6371 dport = ntohs(chunk->sctp_hdr->source);
6372
6373
6374
6375
6376 if (asoc) {
6377
6378
6379
6380 switch (chunk->chunk_hdr->type) {
6381 case SCTP_CID_INIT:
6382 case SCTP_CID_INIT_ACK:
6383 {
6384 struct sctp_initack_chunk *initack;
6385
6386 initack = (struct sctp_initack_chunk *)chunk->chunk_hdr;
6387 vtag = ntohl(initack->init_hdr.init_tag);
6388 break;
6389 }
6390 default:
6391 vtag = asoc->peer.i.init_tag;
6392 break;
6393 }
6394 } else {
6395
6396
6397
6398 switch (chunk->chunk_hdr->type) {
6399 case SCTP_CID_INIT:
6400 {
6401 struct sctp_init_chunk *init;
6402
6403 init = (struct sctp_init_chunk *)chunk->chunk_hdr;
6404 vtag = ntohl(init->init_hdr.init_tag);
6405 break;
6406 }
6407 default:
6408 vtag = ntohl(chunk->sctp_hdr->vtag);
6409 break;
6410 }
6411 }
6412
6413
6414 transport = sctp_transport_new(net, sctp_source(chunk), GFP_ATOMIC);
6415 if (!transport)
6416 goto nomem;
6417
6418 transport->encap_port = SCTP_INPUT_CB(chunk->skb)->encap_port;
6419
6420
6421
6422
6423 sctp_transport_route(transport, (union sctp_addr *)&chunk->dest,
6424 sctp_sk(net->sctp.ctl_sock));
6425
6426 packet = &transport->packet;
6427 sctp_packet_init(packet, transport, sport, dport);
6428 sctp_packet_config(packet, vtag, 0);
6429
6430 return packet;
6431
6432nomem:
6433 return NULL;
6434}
6435
6436
6437void sctp_ootb_pkt_free(struct sctp_packet *packet)
6438{
6439 sctp_transport_free(packet->transport);
6440}
6441
6442
6443static void sctp_send_stale_cookie_err(struct net *net,
6444 const struct sctp_endpoint *ep,
6445 const struct sctp_association *asoc,
6446 const struct sctp_chunk *chunk,
6447 struct sctp_cmd_seq *commands,
6448 struct sctp_chunk *err_chunk)
6449{
6450 struct sctp_packet *packet;
6451
6452 if (err_chunk) {
6453 packet = sctp_ootb_pkt_new(net, asoc, chunk);
6454 if (packet) {
6455 struct sctp_signed_cookie *cookie;
6456
6457
6458 cookie = chunk->subh.cookie_hdr;
6459 packet->vtag = cookie->c.peer_vtag;
6460
6461
6462 err_chunk->skb->sk = ep->base.sk;
6463 sctp_packet_append_chunk(packet, err_chunk);
6464 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
6465 SCTP_PACKET(packet));
6466 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
6467 } else
6468 sctp_chunk_free (err_chunk);
6469 }
6470}
6471
6472
6473
6474static int sctp_eat_data(const struct sctp_association *asoc,
6475 struct sctp_chunk *chunk,
6476 struct sctp_cmd_seq *commands)
6477{
6478 struct sctp_tsnmap *map = (struct sctp_tsnmap *)&asoc->peer.tsn_map;
6479 struct sock *sk = asoc->base.sk;
6480 struct net *net = sock_net(sk);
6481 struct sctp_datahdr *data_hdr;
6482 struct sctp_chunk *err;
6483 enum sctp_verb deliver;
6484 size_t datalen;
6485 __u32 tsn;
6486 int tmp;
6487
6488 data_hdr = (struct sctp_datahdr *)chunk->skb->data;
6489 chunk->subh.data_hdr = data_hdr;
6490 skb_pull(chunk->skb, sctp_datahdr_len(&asoc->stream));
6491
6492 tsn = ntohl(data_hdr->tsn);
6493 pr_debug("%s: TSN 0x%x\n", __func__, tsn);
6494
6495
6496
6497
6498
6499
6500
6501
6502
6503
6504
6505
6506
6507 if (asoc->peer.ecn_capable && !chunk->ecn_ce_done) {
6508 struct sctp_af *af = SCTP_INPUT_CB(chunk->skb)->af;
6509 chunk->ecn_ce_done = 1;
6510
6511 if (af->is_ce(sctp_gso_headskb(chunk->skb))) {
6512
6513 sctp_add_cmd_sf(commands, SCTP_CMD_ECN_CE,
6514 SCTP_U32(tsn));
6515 }
6516 }
6517
6518 tmp = sctp_tsnmap_check(&asoc->peer.tsn_map, tsn);
6519 if (tmp < 0) {
6520
6521
6522
6523 if (chunk->asoc)
6524 chunk->asoc->stats.outofseqtsns++;
6525 return SCTP_IERROR_HIGH_TSN;
6526 } else if (tmp > 0) {
6527
6528 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_DUP, SCTP_U32(tsn));
6529 return SCTP_IERROR_DUP_TSN;
6530 }
6531
6532
6533
6534
6535
6536
6537 datalen = ntohs(chunk->chunk_hdr->length);
6538 datalen -= sctp_datachk_len(&asoc->stream);
6539
6540 deliver = SCTP_CMD_CHUNK_ULP;
6541
6542
6543 if ((datalen >= asoc->rwnd) && (!asoc->ulpq.pd_mode)) {
6544
6545
6546
6547
6548 sctp_add_cmd_sf(commands, SCTP_CMD_PART_DELIVER, SCTP_NULL());
6549 }
6550
6551
6552
6553
6554
6555
6556 if ((!chunk->data_accepted) && (!asoc->rwnd || asoc->rwnd_over ||
6557 (datalen > asoc->rwnd + asoc->frag_point))) {
6558
6559
6560
6561
6562
6563
6564
6565 if (sctp_tsnmap_has_gap(map) &&
6566 (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
6567 pr_debug("%s: reneging for tsn:%u\n", __func__, tsn);
6568 deliver = SCTP_CMD_RENEGE;
6569 } else {
6570 pr_debug("%s: discard tsn:%u len:%zu, rwnd:%d\n",
6571 __func__, tsn, datalen, asoc->rwnd);
6572
6573 return SCTP_IERROR_IGNORE_TSN;
6574 }
6575 }
6576
6577
6578
6579
6580
6581
6582
6583
6584 if (sk_under_memory_pressure(sk)) {
6585 if (sctp_tsnmap_has_gap(map) &&
6586 (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
6587 pr_debug("%s: under pressure, reneging for tsn:%u\n",
6588 __func__, tsn);
6589 deliver = SCTP_CMD_RENEGE;
6590 } else {
6591 sk_mem_reclaim(sk);
6592 }
6593 }
6594
6595
6596
6597
6598
6599
6600
6601
6602
6603 if (unlikely(0 == datalen)) {
6604 err = sctp_make_abort_no_data(asoc, chunk, tsn);
6605 if (err) {
6606 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
6607 SCTP_CHUNK(err));
6608 }
6609
6610
6611
6612 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
6613 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
6614 SCTP_ERROR(ECONNABORTED));
6615 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
6616 SCTP_PERR(SCTP_ERROR_NO_DATA));
6617 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
6618 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
6619 return SCTP_IERROR_NO_DATA;
6620 }
6621
6622 chunk->data_accepted = 1;
6623
6624
6625
6626
6627 if (chunk->chunk_hdr->flags & SCTP_DATA_UNORDERED) {
6628 SCTP_INC_STATS(net, SCTP_MIB_INUNORDERCHUNKS);
6629 if (chunk->asoc)
6630 chunk->asoc->stats.iuodchunks++;
6631 } else {
6632 SCTP_INC_STATS(net, SCTP_MIB_INORDERCHUNKS);
6633 if (chunk->asoc)
6634 chunk->asoc->stats.iodchunks++;
6635 }
6636
6637
6638
6639
6640
6641
6642
6643
6644
6645 if (ntohs(data_hdr->stream) >= asoc->stream.incnt) {
6646
6647 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_TSN, SCTP_U32(tsn));
6648
6649 err = sctp_make_op_error(asoc, chunk, SCTP_ERROR_INV_STRM,
6650 &data_hdr->stream,
6651 sizeof(data_hdr->stream),
6652 sizeof(u16));
6653 if (err)
6654 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
6655 SCTP_CHUNK(err));
6656 return SCTP_IERROR_BAD_STREAM;
6657 }
6658
6659
6660
6661
6662
6663
6664
6665
6666 if (!asoc->stream.si->validate_data(chunk))
6667 return SCTP_IERROR_PROTO_VIOLATION;
6668
6669
6670
6671
6672
6673 sctp_add_cmd_sf(commands, deliver, SCTP_CHUNK(chunk));
6674
6675 return SCTP_IERROR_NO_ERROR;
6676}
6677