sm_statefuns.c 186 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817281828192820282128222823282428252826282728282829283028312832283328342835283628372838283928402841284228432844284528462847284828492850285128522853285428552856285728582859286028612862286328642865286628672868286928702871287228732874287528762877287828792880288128822883288428852886288728882889289028912892289328942895289628972898289929002901290229032904290529062907290829092910291129122913291429152916291729182919292029212922292329242925292629272928292929302931293229332934293529362937293829392940294129422943294429452946294729482949295029512952295329542955295629572958295929602961296229632964296529662967296829692970297129722973297429752976297729782979298029812982298329842985298629872988298929902991299229932994299529962997299829993000300130023003300430053006300730083009301030113012301330143015301630173018301930203021302230233024302530263027302830293030303130323033303430353036303730383039304030413042304330443045304630473048304930503051305230533054305530563057305830593060306130623063306430653066306730683069307030713072307330743075307630773078307930803081308230833084308530863087308830893090309130923093309430953096309730983099310031013102310331043105310631073108310931103111311231133114311531163117311831193120312131223123312431253126312731283129313031313132313331343135313631373138313931403141314231433144314531463147314831493150315131523153315431553156315731583159316031613162316331643165316631673168316931703171317231733174317531763177317831793180318131823183318431853186318731883189319031913192319331943195319631973198319932003201320232033204320532063207320832093210321132123213321432153216321732183219322032213222322332243225322632273228322932303231323232333234323532363237323832393240324132423243324432453246324732483249325032513252325332543255325632573258325932603261326232633264326532663267326832693270327132723273327432753276327732783279328032813282328332843285328632873288328932903291329232933294329532963297329832993300330133023303330433053306330733083309331033113312331333143315331633173318331933203321332233233324332533263327332833293330333133323333333433353336333733383339334033413342334333443345334633473348334933503351335233533354335533563357335833593360336133623363336433653366336733683369337033713372337333743375337633773378337933803381338233833384338533863387338833893390339133923393339433953396339733983399340034013402340334043405340634073408340934103411341234133414341534163417341834193420342134223423342434253426342734283429343034313432343334343435343634373438343934403441344234433444344534463447344834493450345134523453345434553456345734583459346034613462346334643465346634673468346934703471347234733474347534763477347834793480348134823483348434853486348734883489349034913492349334943495349634973498349935003501350235033504350535063507350835093510351135123513351435153516351735183519352035213522352335243525352635273528352935303531353235333534353535363537353835393540354135423543354435453546354735483549355035513552355335543555355635573558355935603561356235633564356535663567356835693570357135723573357435753576357735783579358035813582358335843585358635873588358935903591359235933594359535963597359835993600360136023603360436053606360736083609361036113612361336143615361636173618361936203621362236233624362536263627362836293630363136323633363436353636363736383639364036413642364336443645364636473648364936503651365236533654365536563657365836593660366136623663366436653666366736683669367036713672367336743675367636773678367936803681368236833684368536863687368836893690369136923693369436953696369736983699370037013702370337043705370637073708370937103711371237133714371537163717371837193720372137223723372437253726372737283729373037313732373337343735373637373738373937403741374237433744374537463747374837493750375137523753375437553756375737583759376037613762376337643765376637673768376937703771377237733774377537763777377837793780378137823783378437853786378737883789379037913792379337943795379637973798379938003801380238033804380538063807380838093810381138123813381438153816381738183819382038213822382338243825382638273828382938303831383238333834383538363837383838393840384138423843384438453846384738483849385038513852385338543855385638573858385938603861386238633864386538663867386838693870387138723873387438753876387738783879388038813882388338843885388638873888388938903891389238933894389538963897389838993900390139023903390439053906390739083909391039113912391339143915391639173918391939203921392239233924392539263927392839293930393139323933393439353936393739383939394039413942394339443945394639473948394939503951395239533954395539563957395839593960396139623963396439653966396739683969397039713972397339743975397639773978397939803981398239833984398539863987398839893990399139923993399439953996399739983999400040014002400340044005400640074008400940104011401240134014401540164017401840194020402140224023402440254026402740284029403040314032403340344035403640374038403940404041404240434044404540464047404840494050405140524053405440554056405740584059406040614062406340644065406640674068406940704071407240734074407540764077407840794080408140824083408440854086408740884089409040914092409340944095409640974098409941004101410241034104410541064107410841094110411141124113411441154116411741184119412041214122412341244125412641274128412941304131413241334134413541364137413841394140414141424143414441454146414741484149415041514152415341544155415641574158415941604161416241634164416541664167416841694170417141724173417441754176417741784179418041814182418341844185418641874188418941904191419241934194419541964197419841994200420142024203420442054206420742084209421042114212421342144215421642174218421942204221422242234224422542264227422842294230423142324233423442354236423742384239424042414242424342444245424642474248424942504251425242534254425542564257425842594260426142624263426442654266426742684269427042714272427342744275427642774278427942804281428242834284428542864287428842894290429142924293429442954296429742984299430043014302430343044305430643074308430943104311431243134314431543164317431843194320432143224323432443254326432743284329433043314332433343344335433643374338433943404341434243434344434543464347434843494350435143524353435443554356435743584359436043614362436343644365436643674368436943704371437243734374437543764377437843794380438143824383438443854386438743884389439043914392439343944395439643974398439944004401440244034404440544064407440844094410441144124413441444154416441744184419442044214422442344244425442644274428442944304431443244334434443544364437443844394440444144424443444444454446444744484449445044514452445344544455445644574458445944604461446244634464446544664467446844694470447144724473447444754476447744784479448044814482448344844485448644874488448944904491449244934494449544964497449844994500450145024503450445054506450745084509451045114512451345144515451645174518451945204521452245234524452545264527452845294530453145324533453445354536453745384539454045414542454345444545454645474548454945504551455245534554455545564557455845594560456145624563456445654566456745684569457045714572457345744575457645774578457945804581458245834584458545864587458845894590459145924593459445954596459745984599460046014602460346044605460646074608460946104611461246134614461546164617461846194620462146224623462446254626462746284629463046314632463346344635463646374638463946404641464246434644464546464647464846494650465146524653465446554656465746584659466046614662466346644665466646674668466946704671467246734674467546764677467846794680468146824683468446854686468746884689469046914692469346944695469646974698469947004701470247034704470547064707470847094710471147124713471447154716471747184719472047214722472347244725472647274728472947304731473247334734473547364737473847394740474147424743474447454746474747484749475047514752475347544755475647574758475947604761476247634764476547664767476847694770477147724773477447754776477747784779478047814782478347844785478647874788478947904791479247934794479547964797479847994800480148024803480448054806480748084809481048114812481348144815481648174818481948204821482248234824482548264827482848294830483148324833483448354836483748384839484048414842484348444845484648474848484948504851485248534854485548564857485848594860486148624863486448654866486748684869487048714872487348744875487648774878487948804881488248834884488548864887488848894890489148924893489448954896489748984899490049014902490349044905490649074908490949104911491249134914491549164917491849194920492149224923492449254926492749284929493049314932493349344935493649374938493949404941494249434944494549464947494849494950495149524953495449554956495749584959496049614962496349644965496649674968496949704971497249734974497549764977497849794980498149824983498449854986498749884989499049914992499349944995499649974998499950005001500250035004500550065007500850095010501150125013501450155016501750185019502050215022502350245025502650275028502950305031503250335034503550365037503850395040504150425043504450455046504750485049505050515052505350545055505650575058505950605061506250635064506550665067506850695070507150725073507450755076507750785079508050815082508350845085508650875088508950905091509250935094509550965097509850995100510151025103510451055106510751085109511051115112511351145115511651175118511951205121512251235124512551265127512851295130513151325133513451355136513751385139514051415142514351445145514651475148514951505151515251535154515551565157515851595160516151625163516451655166516751685169517051715172517351745175517651775178517951805181518251835184518551865187518851895190519151925193519451955196519751985199520052015202520352045205520652075208520952105211521252135214521552165217521852195220522152225223522452255226522752285229523052315232523352345235523652375238523952405241524252435244524552465247524852495250525152525253525452555256525752585259526052615262526352645265526652675268526952705271527252735274527552765277527852795280528152825283528452855286528752885289529052915292529352945295529652975298529953005301530253035304530553065307530853095310531153125313531453155316531753185319532053215322532353245325532653275328532953305331533253335334533553365337533853395340534153425343534453455346534753485349535053515352535353545355535653575358535953605361536253635364536553665367536853695370537153725373537453755376537753785379538053815382538353845385538653875388538953905391539253935394539553965397539853995400540154025403540454055406540754085409541054115412541354145415541654175418541954205421542254235424542554265427542854295430543154325433543454355436543754385439544054415442544354445445544654475448544954505451545254535454545554565457545854595460546154625463546454655466546754685469547054715472547354745475547654775478547954805481548254835484548554865487548854895490549154925493549454955496549754985499550055015502550355045505550655075508550955105511551255135514551555165517551855195520552155225523552455255526552755285529553055315532553355345535553655375538553955405541554255435544554555465547554855495550555155525553555455555556555755585559556055615562556355645565556655675568556955705571557255735574557555765577557855795580558155825583558455855586558755885589559055915592559355945595559655975598559956005601560256035604560556065607560856095610561156125613561456155616561756185619562056215622562356245625562656275628562956305631563256335634563556365637563856395640564156425643564456455646564756485649565056515652565356545655565656575658565956605661566256635664566556665667566856695670567156725673567456755676567756785679568056815682568356845685568656875688568956905691569256935694569556965697569856995700570157025703570457055706570757085709571057115712571357145715571657175718571957205721572257235724572557265727572857295730573157325733573457355736573757385739574057415742574357445745574657475748574957505751575257535754575557565757575857595760576157625763576457655766576757685769577057715772577357745775577657775778577957805781578257835784578557865787578857895790579157925793579457955796579757985799580058015802580358045805580658075808580958105811581258135814581558165817581858195820582158225823582458255826582758285829583058315832583358345835583658375838583958405841584258435844584558465847584858495850585158525853585458555856585758585859586058615862586358645865586658675868586958705871587258735874587558765877587858795880588158825883588458855886588758885889589058915892589358945895589658975898589959005901590259035904590559065907590859095910591159125913591459155916591759185919592059215922592359245925592659275928592959305931593259335934593559365937593859395940594159425943594459455946594759485949595059515952595359545955595659575958595959605961596259635964596559665967
  1. /* SCTP kernel implementation
  2. * (C) Copyright IBM Corp. 2001, 2004
  3. * Copyright (c) 1999-2000 Cisco, Inc.
  4. * Copyright (c) 1999-2001 Motorola, Inc.
  5. * Copyright (c) 2001-2002 Intel Corp.
  6. * Copyright (c) 2002 Nokia Corp.
  7. *
  8. * This is part of the SCTP Linux Kernel Implementation.
  9. *
  10. * These are the state functions for the state machine.
  11. *
  12. * This SCTP implementation is free software;
  13. * you can redistribute it and/or modify it under the terms of
  14. * the GNU General Public License as published by
  15. * the Free Software Foundation; either version 2, or (at your option)
  16. * any later version.
  17. *
  18. * This SCTP implementation is distributed in the hope that it
  19. * will be useful, but WITHOUT ANY WARRANTY; without even the implied
  20. * ************************
  21. * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
  22. * See the GNU General Public License for more details.
  23. *
  24. * You should have received a copy of the GNU General Public License
  25. * along with GNU CC; see the file COPYING. If not, write to
  26. * the Free Software Foundation, 59 Temple Place - Suite 330,
  27. * Boston, MA 02111-1307, USA.
  28. *
  29. * Please send any bug reports or fixes you make to the
  30. * email address(es):
  31. * lksctp developers <lksctp-developers@lists.sourceforge.net>
  32. *
  33. * Or submit a bug report through the following website:
  34. * http://www.sf.net/projects/lksctp
  35. *
  36. * Written or modified by:
  37. * La Monte H.P. Yarroll <piggy@acm.org>
  38. * Karl Knutson <karl@athena.chicago.il.us>
  39. * Mathew Kotowsky <kotowsky@sctp.org>
  40. * Sridhar Samudrala <samudrala@us.ibm.com>
  41. * Jon Grimm <jgrimm@us.ibm.com>
  42. * Hui Huang <hui.huang@nokia.com>
  43. * Dajiang Zhang <dajiang.zhang@nokia.com>
  44. * Daisy Chang <daisyc@us.ibm.com>
  45. * Ardelle Fan <ardelle.fan@intel.com>
  46. * Ryan Layer <rmlayer@us.ibm.com>
  47. * Kevin Gao <kevin.gao@intel.com>
  48. *
  49. * Any bugs reported given to us we will try to fix... any fixes shared will
  50. * be incorporated into the next SCTP release.
  51. */
  52. #include <linux/types.h>
  53. #include <linux/kernel.h>
  54. #include <linux/ip.h>
  55. #include <linux/ipv6.h>
  56. #include <linux/net.h>
  57. #include <linux/inet.h>
  58. #include <net/sock.h>
  59. #include <net/inet_ecn.h>
  60. #include <linux/skbuff.h>
  61. #include <net/sctp/sctp.h>
  62. #include <net/sctp/sm.h>
  63. #include <net/sctp/structs.h>
  64. static struct sctp_packet *sctp_abort_pkt_new(const struct sctp_endpoint *ep,
  65. const struct sctp_association *asoc,
  66. struct sctp_chunk *chunk,
  67. const void *payload,
  68. size_t paylen);
  69. static int sctp_eat_data(const struct sctp_association *asoc,
  70. struct sctp_chunk *chunk,
  71. sctp_cmd_seq_t *commands);
  72. static struct sctp_packet *sctp_ootb_pkt_new(const struct sctp_association *asoc,
  73. const struct sctp_chunk *chunk);
  74. static void sctp_send_stale_cookie_err(const struct sctp_endpoint *ep,
  75. const struct sctp_association *asoc,
  76. const struct sctp_chunk *chunk,
  77. sctp_cmd_seq_t *commands,
  78. struct sctp_chunk *err_chunk);
  79. static sctp_disposition_t sctp_sf_do_5_2_6_stale(const struct sctp_endpoint *ep,
  80. const struct sctp_association *asoc,
  81. const sctp_subtype_t type,
  82. void *arg,
  83. sctp_cmd_seq_t *commands);
  84. static sctp_disposition_t sctp_sf_shut_8_4_5(const struct sctp_endpoint *ep,
  85. const struct sctp_association *asoc,
  86. const sctp_subtype_t type,
  87. void *arg,
  88. sctp_cmd_seq_t *commands);
  89. static sctp_disposition_t sctp_sf_tabort_8_4_8(const struct sctp_endpoint *ep,
  90. const struct sctp_association *asoc,
  91. const sctp_subtype_t type,
  92. void *arg,
  93. sctp_cmd_seq_t *commands);
  94. static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk);
  95. static sctp_disposition_t sctp_stop_t1_and_abort(sctp_cmd_seq_t *commands,
  96. __be16 error, int sk_err,
  97. const struct sctp_association *asoc,
  98. struct sctp_transport *transport);
  99. static sctp_disposition_t sctp_sf_abort_violation(
  100. const struct sctp_endpoint *ep,
  101. const struct sctp_association *asoc,
  102. void *arg,
  103. sctp_cmd_seq_t *commands,
  104. const __u8 *payload,
  105. const size_t paylen);
  106. static sctp_disposition_t sctp_sf_violation_chunklen(
  107. const struct sctp_endpoint *ep,
  108. const struct sctp_association *asoc,
  109. const sctp_subtype_t type,
  110. void *arg,
  111. sctp_cmd_seq_t *commands);
  112. static sctp_disposition_t sctp_sf_violation_paramlen(
  113. const struct sctp_endpoint *ep,
  114. const struct sctp_association *asoc,
  115. const sctp_subtype_t type,
  116. void *arg, void *ext,
  117. sctp_cmd_seq_t *commands);
  118. static sctp_disposition_t sctp_sf_violation_ctsn(
  119. const struct sctp_endpoint *ep,
  120. const struct sctp_association *asoc,
  121. const sctp_subtype_t type,
  122. void *arg,
  123. sctp_cmd_seq_t *commands);
  124. static sctp_disposition_t sctp_sf_violation_chunk(
  125. const struct sctp_endpoint *ep,
  126. const struct sctp_association *asoc,
  127. const sctp_subtype_t type,
  128. void *arg,
  129. sctp_cmd_seq_t *commands);
  130. static sctp_ierror_t sctp_sf_authenticate(const struct sctp_endpoint *ep,
  131. const struct sctp_association *asoc,
  132. const sctp_subtype_t type,
  133. struct sctp_chunk *chunk);
  134. static sctp_disposition_t __sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep,
  135. const struct sctp_association *asoc,
  136. const sctp_subtype_t type,
  137. void *arg,
  138. sctp_cmd_seq_t *commands);
  139. /* Small helper function that checks if the chunk length
  140. * is of the appropriate length. The 'required_length' argument
  141. * is set to be the size of a specific chunk we are testing.
  142. * Return Values: 1 = Valid length
  143. * 0 = Invalid length
  144. *
  145. */
  146. static inline int
  147. sctp_chunk_length_valid(struct sctp_chunk *chunk,
  148. __u16 required_length)
  149. {
  150. __u16 chunk_length = ntohs(chunk->chunk_hdr->length);
  151. if (unlikely(chunk_length < required_length))
  152. return 0;
  153. return 1;
  154. }
  155. /**********************************************************
  156. * These are the state functions for handling chunk events.
  157. **********************************************************/
  158. /*
  159. * Process the final SHUTDOWN COMPLETE.
  160. *
  161. * Section: 4 (C) (diagram), 9.2
  162. * Upon reception of the SHUTDOWN COMPLETE chunk the endpoint will verify
  163. * that it is in SHUTDOWN-ACK-SENT state, if it is not the chunk should be
  164. * discarded. If the endpoint is in the SHUTDOWN-ACK-SENT state the endpoint
  165. * should stop the T2-shutdown timer and remove all knowledge of the
  166. * association (and thus the association enters the CLOSED state).
  167. *
  168. * Verification Tag: 8.5.1(C), sctpimpguide 2.41.
  169. * C) Rules for packet carrying SHUTDOWN COMPLETE:
  170. * ...
  171. * - The receiver of a SHUTDOWN COMPLETE shall accept the packet
  172. * if the Verification Tag field of the packet matches its own tag and
  173. * the T bit is not set
  174. * OR
  175. * it is set to its peer's tag and the T bit is set in the Chunk
  176. * Flags.
  177. * Otherwise, the receiver MUST silently discard the packet
  178. * and take no further action. An endpoint MUST ignore the
  179. * SHUTDOWN COMPLETE if it is not in the SHUTDOWN-ACK-SENT state.
  180. *
  181. * Inputs
  182. * (endpoint, asoc, chunk)
  183. *
  184. * Outputs
  185. * (asoc, reply_msg, msg_up, timers, counters)
  186. *
  187. * The return value is the disposition of the chunk.
  188. */
  189. sctp_disposition_t sctp_sf_do_4_C(const struct sctp_endpoint *ep,
  190. const struct sctp_association *asoc,
  191. const sctp_subtype_t type,
  192. void *arg,
  193. sctp_cmd_seq_t *commands)
  194. {
  195. struct sctp_chunk *chunk = arg;
  196. struct sctp_ulpevent *ev;
  197. if (!sctp_vtag_verify_either(chunk, asoc))
  198. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  199. /* RFC 2960 6.10 Bundling
  200. *
  201. * An endpoint MUST NOT bundle INIT, INIT ACK or
  202. * SHUTDOWN COMPLETE with any other chunks.
  203. */
  204. if (!chunk->singleton)
  205. return sctp_sf_violation_chunk(ep, asoc, type, arg, commands);
  206. /* Make sure that the SHUTDOWN_COMPLETE chunk has a valid length. */
  207. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
  208. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  209. commands);
  210. /* RFC 2960 10.2 SCTP-to-ULP
  211. *
  212. * H) SHUTDOWN COMPLETE notification
  213. *
  214. * When SCTP completes the shutdown procedures (section 9.2) this
  215. * notification is passed to the upper layer.
  216. */
  217. ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_SHUTDOWN_COMP,
  218. 0, 0, 0, NULL, GFP_ATOMIC);
  219. if (ev)
  220. sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
  221. SCTP_ULPEVENT(ev));
  222. /* Upon reception of the SHUTDOWN COMPLETE chunk the endpoint
  223. * will verify that it is in SHUTDOWN-ACK-SENT state, if it is
  224. * not the chunk should be discarded. If the endpoint is in
  225. * the SHUTDOWN-ACK-SENT state the endpoint should stop the
  226. * T2-shutdown timer and remove all knowledge of the
  227. * association (and thus the association enters the CLOSED
  228. * state).
  229. */
  230. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  231. SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
  232. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  233. SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
  234. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  235. SCTP_STATE(SCTP_STATE_CLOSED));
  236. SCTP_INC_STATS(SCTP_MIB_SHUTDOWNS);
  237. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  238. sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
  239. return SCTP_DISPOSITION_DELETE_TCB;
  240. }
  241. /*
  242. * Respond to a normal INIT chunk.
  243. * We are the side that is being asked for an association.
  244. *
  245. * Section: 5.1 Normal Establishment of an Association, B
  246. * B) "Z" shall respond immediately with an INIT ACK chunk. The
  247. * destination IP address of the INIT ACK MUST be set to the source
  248. * IP address of the INIT to which this INIT ACK is responding. In
  249. * the response, besides filling in other parameters, "Z" must set the
  250. * Verification Tag field to Tag_A, and also provide its own
  251. * Verification Tag (Tag_Z) in the Initiate Tag field.
  252. *
  253. * Verification Tag: Must be 0.
  254. *
  255. * Inputs
  256. * (endpoint, asoc, chunk)
  257. *
  258. * Outputs
  259. * (asoc, reply_msg, msg_up, timers, counters)
  260. *
  261. * The return value is the disposition of the chunk.
  262. */
  263. sctp_disposition_t sctp_sf_do_5_1B_init(const struct sctp_endpoint *ep,
  264. const struct sctp_association *asoc,
  265. const sctp_subtype_t type,
  266. void *arg,
  267. sctp_cmd_seq_t *commands)
  268. {
  269. struct sctp_chunk *chunk = arg;
  270. struct sctp_chunk *repl;
  271. struct sctp_association *new_asoc;
  272. struct sctp_chunk *err_chunk;
  273. struct sctp_packet *packet;
  274. sctp_unrecognized_param_t *unk_param;
  275. int len;
  276. /* 6.10 Bundling
  277. * An endpoint MUST NOT bundle INIT, INIT ACK or
  278. * SHUTDOWN COMPLETE with any other chunks.
  279. *
  280. * IG Section 2.11.2
  281. * Furthermore, we require that the receiver of an INIT chunk MUST
  282. * enforce these rules by silently discarding an arriving packet
  283. * with an INIT chunk that is bundled with other chunks.
  284. */
  285. if (!chunk->singleton)
  286. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  287. /* If the packet is an OOTB packet which is temporarily on the
  288. * control endpoint, respond with an ABORT.
  289. */
  290. if (ep == sctp_sk((sctp_get_ctl_sock()))->ep) {
  291. SCTP_INC_STATS(SCTP_MIB_OUTOFBLUES);
  292. return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
  293. }
  294. /* 3.1 A packet containing an INIT chunk MUST have a zero Verification
  295. * Tag.
  296. */
  297. if (chunk->sctp_hdr->vtag != 0)
  298. return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
  299. /* Make sure that the INIT chunk has a valid length.
  300. * Normally, this would cause an ABORT with a Protocol Violation
  301. * error, but since we don't have an association, we'll
  302. * just discard the packet.
  303. */
  304. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_init_chunk_t)))
  305. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  306. /* Verify the INIT chunk before processing it. */
  307. err_chunk = NULL;
  308. if (!sctp_verify_init(asoc, chunk->chunk_hdr->type,
  309. (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
  310. &err_chunk)) {
  311. /* This chunk contains fatal error. It is to be discarded.
  312. * Send an ABORT, with causes if there is any.
  313. */
  314. if (err_chunk) {
  315. packet = sctp_abort_pkt_new(ep, asoc, arg,
  316. (__u8 *)(err_chunk->chunk_hdr) +
  317. sizeof(sctp_chunkhdr_t),
  318. ntohs(err_chunk->chunk_hdr->length) -
  319. sizeof(sctp_chunkhdr_t));
  320. sctp_chunk_free(err_chunk);
  321. if (packet) {
  322. sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
  323. SCTP_PACKET(packet));
  324. SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
  325. return SCTP_DISPOSITION_CONSUME;
  326. } else {
  327. return SCTP_DISPOSITION_NOMEM;
  328. }
  329. } else {
  330. return sctp_sf_tabort_8_4_8(ep, asoc, type, arg,
  331. commands);
  332. }
  333. }
  334. /* Grab the INIT header. */
  335. chunk->subh.init_hdr = (sctp_inithdr_t *)chunk->skb->data;
  336. /* Tag the variable length parameters. */
  337. chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(sctp_inithdr_t));
  338. new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC);
  339. if (!new_asoc)
  340. goto nomem;
  341. /* The call, sctp_process_init(), can fail on memory allocation. */
  342. if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
  343. sctp_source(chunk),
  344. (sctp_init_chunk_t *)chunk->chunk_hdr,
  345. GFP_ATOMIC))
  346. goto nomem_init;
  347. /* B) "Z" shall respond immediately with an INIT ACK chunk. */
  348. /* If there are errors need to be reported for unknown parameters,
  349. * make sure to reserve enough room in the INIT ACK for them.
  350. */
  351. len = 0;
  352. if (err_chunk)
  353. len = ntohs(err_chunk->chunk_hdr->length) -
  354. sizeof(sctp_chunkhdr_t);
  355. if (sctp_assoc_set_bind_addr_from_ep(new_asoc, GFP_ATOMIC) < 0)
  356. goto nomem_init;
  357. repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
  358. if (!repl)
  359. goto nomem_init;
  360. /* If there are errors need to be reported for unknown parameters,
  361. * include them in the outgoing INIT ACK as "Unrecognized parameter"
  362. * parameter.
  363. */
  364. if (err_chunk) {
  365. /* Get the "Unrecognized parameter" parameter(s) out of the
  366. * ERROR chunk generated by sctp_verify_init(). Since the
  367. * error cause code for "unknown parameter" and the
  368. * "Unrecognized parameter" type is the same, we can
  369. * construct the parameters in INIT ACK by copying the
  370. * ERROR causes over.
  371. */
  372. unk_param = (sctp_unrecognized_param_t *)
  373. ((__u8 *)(err_chunk->chunk_hdr) +
  374. sizeof(sctp_chunkhdr_t));
  375. /* Replace the cause code with the "Unrecognized parameter"
  376. * parameter type.
  377. */
  378. sctp_addto_chunk(repl, len, unk_param);
  379. sctp_chunk_free(err_chunk);
  380. }
  381. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
  382. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
  383. /*
  384. * Note: After sending out INIT ACK with the State Cookie parameter,
  385. * "Z" MUST NOT allocate any resources, nor keep any states for the
  386. * new association. Otherwise, "Z" will be vulnerable to resource
  387. * attacks.
  388. */
  389. sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
  390. return SCTP_DISPOSITION_DELETE_TCB;
  391. nomem_init:
  392. sctp_association_free(new_asoc);
  393. nomem:
  394. if (err_chunk)
  395. sctp_chunk_free(err_chunk);
  396. return SCTP_DISPOSITION_NOMEM;
  397. }
  398. /*
  399. * Respond to a normal INIT ACK chunk.
  400. * We are the side that is initiating the association.
  401. *
  402. * Section: 5.1 Normal Establishment of an Association, C
  403. * C) Upon reception of the INIT ACK from "Z", "A" shall stop the T1-init
  404. * timer and leave COOKIE-WAIT state. "A" shall then send the State
  405. * Cookie received in the INIT ACK chunk in a COOKIE ECHO chunk, start
  406. * the T1-cookie timer, and enter the COOKIE-ECHOED state.
  407. *
  408. * Note: The COOKIE ECHO chunk can be bundled with any pending outbound
  409. * DATA chunks, but it MUST be the first chunk in the packet and
  410. * until the COOKIE ACK is returned the sender MUST NOT send any
  411. * other packets to the peer.
  412. *
  413. * Verification Tag: 3.3.3
  414. * If the value of the Initiate Tag in a received INIT ACK chunk is
  415. * found to be 0, the receiver MUST treat it as an error and close the
  416. * association by transmitting an ABORT.
  417. *
  418. * Inputs
  419. * (endpoint, asoc, chunk)
  420. *
  421. * Outputs
  422. * (asoc, reply_msg, msg_up, timers, counters)
  423. *
  424. * The return value is the disposition of the chunk.
  425. */
  426. sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
  427. const struct sctp_association *asoc,
  428. const sctp_subtype_t type,
  429. void *arg,
  430. sctp_cmd_seq_t *commands)
  431. {
  432. struct sctp_chunk *chunk = arg;
  433. sctp_init_chunk_t *initchunk;
  434. struct sctp_chunk *err_chunk;
  435. struct sctp_packet *packet;
  436. if (!sctp_vtag_verify(chunk, asoc))
  437. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  438. /* 6.10 Bundling
  439. * An endpoint MUST NOT bundle INIT, INIT ACK or
  440. * SHUTDOWN COMPLETE with any other chunks.
  441. */
  442. if (!chunk->singleton)
  443. return sctp_sf_violation_chunk(ep, asoc, type, arg, commands);
  444. /* Make sure that the INIT-ACK chunk has a valid length */
  445. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_initack_chunk_t)))
  446. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  447. commands);
  448. /* Grab the INIT header. */
  449. chunk->subh.init_hdr = (sctp_inithdr_t *) chunk->skb->data;
  450. /* Verify the INIT chunk before processing it. */
  451. err_chunk = NULL;
  452. if (!sctp_verify_init(asoc, chunk->chunk_hdr->type,
  453. (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
  454. &err_chunk)) {
  455. sctp_error_t error = SCTP_ERROR_NO_RESOURCE;
  456. /* This chunk contains fatal error. It is to be discarded.
  457. * Send an ABORT, with causes. If there are no causes,
  458. * then there wasn't enough memory. Just terminate
  459. * the association.
  460. */
  461. if (err_chunk) {
  462. packet = sctp_abort_pkt_new(ep, asoc, arg,
  463. (__u8 *)(err_chunk->chunk_hdr) +
  464. sizeof(sctp_chunkhdr_t),
  465. ntohs(err_chunk->chunk_hdr->length) -
  466. sizeof(sctp_chunkhdr_t));
  467. sctp_chunk_free(err_chunk);
  468. if (packet) {
  469. sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
  470. SCTP_PACKET(packet));
  471. SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
  472. error = SCTP_ERROR_INV_PARAM;
  473. }
  474. }
  475. /* SCTP-AUTH, Section 6.3:
  476. * It should be noted that if the receiver wants to tear
  477. * down an association in an authenticated way only, the
  478. * handling of malformed packets should not result in
  479. * tearing down the association.
  480. *
  481. * This means that if we only want to abort associations
  482. * in an authenticated way (i.e AUTH+ABORT), then we
  483. * can't destroy this association just becuase the packet
  484. * was malformed.
  485. */
  486. if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
  487. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  488. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  489. return sctp_stop_t1_and_abort(commands, error, ECONNREFUSED,
  490. asoc, chunk->transport);
  491. }
  492. /* Tag the variable length parameters. Note that we never
  493. * convert the parameters in an INIT chunk.
  494. */
  495. chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(sctp_inithdr_t));
  496. initchunk = (sctp_init_chunk_t *) chunk->chunk_hdr;
  497. sctp_add_cmd_sf(commands, SCTP_CMD_PEER_INIT,
  498. SCTP_PEER_INIT(initchunk));
  499. /* Reset init error count upon receipt of INIT-ACK. */
  500. sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());
  501. /* 5.1 C) "A" shall stop the T1-init timer and leave
  502. * COOKIE-WAIT state. "A" shall then ... start the T1-cookie
  503. * timer, and enter the COOKIE-ECHOED state.
  504. */
  505. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  506. SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
  507. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
  508. SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
  509. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  510. SCTP_STATE(SCTP_STATE_COOKIE_ECHOED));
  511. /* SCTP-AUTH: genereate the assocition shared keys so that
  512. * we can potentially signe the COOKIE-ECHO.
  513. */
  514. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_SHKEY, SCTP_NULL());
  515. /* 5.1 C) "A" shall then send the State Cookie received in the
  516. * INIT ACK chunk in a COOKIE ECHO chunk, ...
  517. */
  518. /* If there is any errors to report, send the ERROR chunk generated
  519. * for unknown parameters as well.
  520. */
  521. sctp_add_cmd_sf(commands, SCTP_CMD_GEN_COOKIE_ECHO,
  522. SCTP_CHUNK(err_chunk));
  523. return SCTP_DISPOSITION_CONSUME;
  524. }
  525. /*
  526. * Respond to a normal COOKIE ECHO chunk.
  527. * We are the side that is being asked for an association.
  528. *
  529. * Section: 5.1 Normal Establishment of an Association, D
  530. * D) Upon reception of the COOKIE ECHO chunk, Endpoint "Z" will reply
  531. * with a COOKIE ACK chunk after building a TCB and moving to
  532. * the ESTABLISHED state. A COOKIE ACK chunk may be bundled with
  533. * any pending DATA chunks (and/or SACK chunks), but the COOKIE ACK
  534. * chunk MUST be the first chunk in the packet.
  535. *
  536. * IMPLEMENTATION NOTE: An implementation may choose to send the
  537. * Communication Up notification to the SCTP user upon reception
  538. * of a valid COOKIE ECHO chunk.
  539. *
  540. * Verification Tag: 8.5.1 Exceptions in Verification Tag Rules
  541. * D) Rules for packet carrying a COOKIE ECHO
  542. *
  543. * - When sending a COOKIE ECHO, the endpoint MUST use the value of the
  544. * Initial Tag received in the INIT ACK.
  545. *
  546. * - The receiver of a COOKIE ECHO follows the procedures in Section 5.
  547. *
  548. * Inputs
  549. * (endpoint, asoc, chunk)
  550. *
  551. * Outputs
  552. * (asoc, reply_msg, msg_up, timers, counters)
  553. *
  554. * The return value is the disposition of the chunk.
  555. */
  556. sctp_disposition_t sctp_sf_do_5_1D_ce(const struct sctp_endpoint *ep,
  557. const struct sctp_association *asoc,
  558. const sctp_subtype_t type, void *arg,
  559. sctp_cmd_seq_t *commands)
  560. {
  561. struct sctp_chunk *chunk = arg;
  562. struct sctp_association *new_asoc;
  563. sctp_init_chunk_t *peer_init;
  564. struct sctp_chunk *repl;
  565. struct sctp_ulpevent *ev, *ai_ev = NULL;
  566. int error = 0;
  567. struct sctp_chunk *err_chk_p;
  568. struct sock *sk;
  569. /* If the packet is an OOTB packet which is temporarily on the
  570. * control endpoint, respond with an ABORT.
  571. */
  572. if (ep == sctp_sk((sctp_get_ctl_sock()))->ep) {
  573. SCTP_INC_STATS(SCTP_MIB_OUTOFBLUES);
  574. return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
  575. }
  576. /* Make sure that the COOKIE_ECHO chunk has a valid length.
  577. * In this case, we check that we have enough for at least a
  578. * chunk header. More detailed verification is done
  579. * in sctp_unpack_cookie().
  580. */
  581. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
  582. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  583. /* If the endpoint is not listening or if the number of associations
  584. * on the TCP-style socket exceed the max backlog, respond with an
  585. * ABORT.
  586. */
  587. sk = ep->base.sk;
  588. if (!sctp_sstate(sk, LISTENING) ||
  589. (sctp_style(sk, TCP) && sk_acceptq_is_full(sk)))
  590. return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
  591. /* "Decode" the chunk. We have no optional parameters so we
  592. * are in good shape.
  593. */
  594. chunk->subh.cookie_hdr =
  595. (struct sctp_signed_cookie *)chunk->skb->data;
  596. if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
  597. sizeof(sctp_chunkhdr_t)))
  598. goto nomem;
  599. /* 5.1 D) Upon reception of the COOKIE ECHO chunk, Endpoint
  600. * "Z" will reply with a COOKIE ACK chunk after building a TCB
  601. * and moving to the ESTABLISHED state.
  602. */
  603. new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, &error,
  604. &err_chk_p);
  605. /* FIXME:
  606. * If the re-build failed, what is the proper error path
  607. * from here?
  608. *
  609. * [We should abort the association. --piggy]
  610. */
  611. if (!new_asoc) {
  612. /* FIXME: Several errors are possible. A bad cookie should
  613. * be silently discarded, but think about logging it too.
  614. */
  615. switch (error) {
  616. case -SCTP_IERROR_NOMEM:
  617. goto nomem;
  618. case -SCTP_IERROR_STALE_COOKIE:
  619. sctp_send_stale_cookie_err(ep, asoc, chunk, commands,
  620. err_chk_p);
  621. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  622. case -SCTP_IERROR_BAD_SIG:
  623. default:
  624. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  625. }
  626. }
  627. /* Delay state machine commands until later.
  628. *
  629. * Re-build the bind address for the association is done in
  630. * the sctp_unpack_cookie() already.
  631. */
  632. /* This is a brand-new association, so these are not yet side
  633. * effects--it is safe to run them here.
  634. */
  635. peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
  636. if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
  637. &chunk->subh.cookie_hdr->c.peer_addr,
  638. peer_init, GFP_ATOMIC))
  639. goto nomem_init;
  640. /* SCTP-AUTH: Now that we've populate required fields in
  641. * sctp_process_init, set up the assocaition shared keys as
  642. * necessary so that we can potentially authenticate the ACK
  643. */
  644. error = sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC);
  645. if (error)
  646. goto nomem_init;
  647. /* SCTP-AUTH: auth_chunk pointer is only set when the cookie-echo
  648. * is supposed to be authenticated and we have to do delayed
  649. * authentication. We've just recreated the association using
  650. * the information in the cookie and now it's much easier to
  651. * do the authentication.
  652. */
  653. if (chunk->auth_chunk) {
  654. struct sctp_chunk auth;
  655. sctp_ierror_t ret;
  656. /* set-up our fake chunk so that we can process it */
  657. auth.skb = chunk->auth_chunk;
  658. auth.asoc = chunk->asoc;
  659. auth.sctp_hdr = chunk->sctp_hdr;
  660. auth.chunk_hdr = (sctp_chunkhdr_t *)skb_push(chunk->auth_chunk,
  661. sizeof(sctp_chunkhdr_t));
  662. skb_pull(chunk->auth_chunk, sizeof(sctp_chunkhdr_t));
  663. auth.transport = chunk->transport;
  664. ret = sctp_sf_authenticate(ep, new_asoc, type, &auth);
  665. /* We can now safely free the auth_chunk clone */
  666. kfree_skb(chunk->auth_chunk);
  667. if (ret != SCTP_IERROR_NO_ERROR) {
  668. sctp_association_free(new_asoc);
  669. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  670. }
  671. }
  672. repl = sctp_make_cookie_ack(new_asoc, chunk);
  673. if (!repl)
  674. goto nomem_init;
  675. /* RFC 2960 5.1 Normal Establishment of an Association
  676. *
  677. * D) IMPLEMENTATION NOTE: An implementation may choose to
  678. * send the Communication Up notification to the SCTP user
  679. * upon reception of a valid COOKIE ECHO chunk.
  680. */
  681. ev = sctp_ulpevent_make_assoc_change(new_asoc, 0, SCTP_COMM_UP, 0,
  682. new_asoc->c.sinit_num_ostreams,
  683. new_asoc->c.sinit_max_instreams,
  684. NULL, GFP_ATOMIC);
  685. if (!ev)
  686. goto nomem_ev;
  687. /* Sockets API Draft Section 5.3.1.6
  688. * When a peer sends a Adaptation Layer Indication parameter , SCTP
  689. * delivers this notification to inform the application that of the
  690. * peers requested adaptation layer.
  691. */
  692. if (new_asoc->peer.adaptation_ind) {
  693. ai_ev = sctp_ulpevent_make_adaptation_indication(new_asoc,
  694. GFP_ATOMIC);
  695. if (!ai_ev)
  696. goto nomem_aiev;
  697. }
  698. /* Add all the state machine commands now since we've created
  699. * everything. This way we don't introduce memory corruptions
  700. * during side-effect processing and correclty count established
  701. * associations.
  702. */
  703. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
  704. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  705. SCTP_STATE(SCTP_STATE_ESTABLISHED));
  706. SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
  707. SCTP_INC_STATS(SCTP_MIB_PASSIVEESTABS);
  708. sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
  709. if (new_asoc->autoclose)
  710. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
  711. SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
  712. /* This will send the COOKIE ACK */
  713. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
  714. /* Queue the ASSOC_CHANGE event */
  715. sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
  716. /* Send up the Adaptation Layer Indication event */
  717. if (ai_ev)
  718. sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
  719. SCTP_ULPEVENT(ai_ev));
  720. return SCTP_DISPOSITION_CONSUME;
  721. nomem_aiev:
  722. sctp_ulpevent_free(ev);
  723. nomem_ev:
  724. sctp_chunk_free(repl);
  725. nomem_init:
  726. sctp_association_free(new_asoc);
  727. nomem:
  728. return SCTP_DISPOSITION_NOMEM;
  729. }
  730. /*
  731. * Respond to a normal COOKIE ACK chunk.
  732. * We are the side that is being asked for an association.
  733. *
  734. * RFC 2960 5.1 Normal Establishment of an Association
  735. *
  736. * E) Upon reception of the COOKIE ACK, endpoint "A" will move from the
  737. * COOKIE-ECHOED state to the ESTABLISHED state, stopping the T1-cookie
  738. * timer. It may also notify its ULP about the successful
  739. * establishment of the association with a Communication Up
  740. * notification (see Section 10).
  741. *
  742. * Verification Tag:
  743. * Inputs
  744. * (endpoint, asoc, chunk)
  745. *
  746. * Outputs
  747. * (asoc, reply_msg, msg_up, timers, counters)
  748. *
  749. * The return value is the disposition of the chunk.
  750. */
  751. sctp_disposition_t sctp_sf_do_5_1E_ca(const struct sctp_endpoint *ep,
  752. const struct sctp_association *asoc,
  753. const sctp_subtype_t type, void *arg,
  754. sctp_cmd_seq_t *commands)
  755. {
  756. struct sctp_chunk *chunk = arg;
  757. struct sctp_ulpevent *ev;
  758. if (!sctp_vtag_verify(chunk, asoc))
  759. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  760. /* Verify that the chunk length for the COOKIE-ACK is OK.
  761. * If we don't do this, any bundled chunks may be junked.
  762. */
  763. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
  764. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  765. commands);
  766. /* Reset init error count upon receipt of COOKIE-ACK,
  767. * to avoid problems with the managemement of this
  768. * counter in stale cookie situations when a transition back
  769. * from the COOKIE-ECHOED state to the COOKIE-WAIT
  770. * state is performed.
  771. */
  772. sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());
  773. /* RFC 2960 5.1 Normal Establishment of an Association
  774. *
  775. * E) Upon reception of the COOKIE ACK, endpoint "A" will move
  776. * from the COOKIE-ECHOED state to the ESTABLISHED state,
  777. * stopping the T1-cookie timer.
  778. */
  779. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  780. SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
  781. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  782. SCTP_STATE(SCTP_STATE_ESTABLISHED));
  783. SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
  784. SCTP_INC_STATS(SCTP_MIB_ACTIVEESTABS);
  785. sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
  786. if (asoc->autoclose)
  787. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
  788. SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
  789. /* It may also notify its ULP about the successful
  790. * establishment of the association with a Communication Up
  791. * notification (see Section 10).
  792. */
  793. ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_COMM_UP,
  794. 0, asoc->c.sinit_num_ostreams,
  795. asoc->c.sinit_max_instreams,
  796. NULL, GFP_ATOMIC);
  797. if (!ev)
  798. goto nomem;
  799. sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
  800. /* Sockets API Draft Section 5.3.1.6
  801. * When a peer sends a Adaptation Layer Indication parameter , SCTP
  802. * delivers this notification to inform the application that of the
  803. * peers requested adaptation layer.
  804. */
  805. if (asoc->peer.adaptation_ind) {
  806. ev = sctp_ulpevent_make_adaptation_indication(asoc, GFP_ATOMIC);
  807. if (!ev)
  808. goto nomem;
  809. sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
  810. SCTP_ULPEVENT(ev));
  811. }
  812. return SCTP_DISPOSITION_CONSUME;
  813. nomem:
  814. return SCTP_DISPOSITION_NOMEM;
  815. }
  816. /* Generate and sendout a heartbeat packet. */
  817. static sctp_disposition_t sctp_sf_heartbeat(const struct sctp_endpoint *ep,
  818. const struct sctp_association *asoc,
  819. const sctp_subtype_t type,
  820. void *arg,
  821. sctp_cmd_seq_t *commands)
  822. {
  823. struct sctp_transport *transport = (struct sctp_transport *) arg;
  824. struct sctp_chunk *reply;
  825. sctp_sender_hb_info_t hbinfo;
  826. size_t paylen = 0;
  827. hbinfo.param_hdr.type = SCTP_PARAM_HEARTBEAT_INFO;
  828. hbinfo.param_hdr.length = htons(sizeof(sctp_sender_hb_info_t));
  829. hbinfo.daddr = transport->ipaddr;
  830. hbinfo.sent_at = jiffies;
  831. hbinfo.hb_nonce = transport->hb_nonce;
  832. /* Send a heartbeat to our peer. */
  833. paylen = sizeof(sctp_sender_hb_info_t);
  834. reply = sctp_make_heartbeat(asoc, transport, &hbinfo, paylen);
  835. if (!reply)
  836. return SCTP_DISPOSITION_NOMEM;
  837. /* Set rto_pending indicating that an RTT measurement
  838. * is started with this heartbeat chunk.
  839. */
  840. sctp_add_cmd_sf(commands, SCTP_CMD_RTO_PENDING,
  841. SCTP_TRANSPORT(transport));
  842. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
  843. return SCTP_DISPOSITION_CONSUME;
  844. }
  845. /* Generate a HEARTBEAT packet on the given transport. */
  846. sctp_disposition_t sctp_sf_sendbeat_8_3(const struct sctp_endpoint *ep,
  847. const struct sctp_association *asoc,
  848. const sctp_subtype_t type,
  849. void *arg,
  850. sctp_cmd_seq_t *commands)
  851. {
  852. struct sctp_transport *transport = (struct sctp_transport *) arg;
  853. if (asoc->overall_error_count > asoc->max_retrans) {
  854. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  855. SCTP_ERROR(ETIMEDOUT));
  856. /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
  857. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
  858. SCTP_PERR(SCTP_ERROR_NO_ERROR));
  859. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  860. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  861. return SCTP_DISPOSITION_DELETE_TCB;
  862. }
  863. /* Section 3.3.5.
  864. * The Sender-specific Heartbeat Info field should normally include
  865. * information about the sender's current time when this HEARTBEAT
  866. * chunk is sent and the destination transport address to which this
  867. * HEARTBEAT is sent (see Section 8.3).
  868. */
  869. if (transport->param_flags & SPP_HB_ENABLE) {
  870. if (SCTP_DISPOSITION_NOMEM ==
  871. sctp_sf_heartbeat(ep, asoc, type, arg,
  872. commands))
  873. return SCTP_DISPOSITION_NOMEM;
  874. /* Set transport error counter and association error counter
  875. * when sending heartbeat.
  876. */
  877. sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_RESET,
  878. SCTP_TRANSPORT(transport));
  879. }
  880. sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMER_UPDATE,
  881. SCTP_TRANSPORT(transport));
  882. return SCTP_DISPOSITION_CONSUME;
  883. }
  884. /*
  885. * Process an heartbeat request.
  886. *
  887. * Section: 8.3 Path Heartbeat
  888. * The receiver of the HEARTBEAT should immediately respond with a
  889. * HEARTBEAT ACK that contains the Heartbeat Information field copied
  890. * from the received HEARTBEAT chunk.
  891. *
  892. * Verification Tag: 8.5 Verification Tag [Normal verification]
  893. * When receiving an SCTP packet, the endpoint MUST ensure that the
  894. * value in the Verification Tag field of the received SCTP packet
  895. * matches its own Tag. If the received Verification Tag value does not
  896. * match the receiver's own tag value, the receiver shall silently
  897. * discard the packet and shall not process it any further except for
  898. * those cases listed in Section 8.5.1 below.
  899. *
  900. * Inputs
  901. * (endpoint, asoc, chunk)
  902. *
  903. * Outputs
  904. * (asoc, reply_msg, msg_up, timers, counters)
  905. *
  906. * The return value is the disposition of the chunk.
  907. */
  908. sctp_disposition_t sctp_sf_beat_8_3(const struct sctp_endpoint *ep,
  909. const struct sctp_association *asoc,
  910. const sctp_subtype_t type,
  911. void *arg,
  912. sctp_cmd_seq_t *commands)
  913. {
  914. struct sctp_chunk *chunk = arg;
  915. struct sctp_chunk *reply;
  916. size_t paylen = 0;
  917. if (!sctp_vtag_verify(chunk, asoc))
  918. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  919. /* Make sure that the HEARTBEAT chunk has a valid length. */
  920. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_heartbeat_chunk_t)))
  921. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  922. commands);
  923. /* 8.3 The receiver of the HEARTBEAT should immediately
  924. * respond with a HEARTBEAT ACK that contains the Heartbeat
  925. * Information field copied from the received HEARTBEAT chunk.
  926. */
  927. chunk->subh.hb_hdr = (sctp_heartbeathdr_t *) chunk->skb->data;
  928. paylen = ntohs(chunk->chunk_hdr->length) - sizeof(sctp_chunkhdr_t);
  929. if (!pskb_pull(chunk->skb, paylen))
  930. goto nomem;
  931. reply = sctp_make_heartbeat_ack(asoc, chunk,
  932. chunk->subh.hb_hdr, paylen);
  933. if (!reply)
  934. goto nomem;
  935. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
  936. return SCTP_DISPOSITION_CONSUME;
  937. nomem:
  938. return SCTP_DISPOSITION_NOMEM;
  939. }
  940. /*
  941. * Process the returning HEARTBEAT ACK.
  942. *
  943. * Section: 8.3 Path Heartbeat
  944. * Upon the receipt of the HEARTBEAT ACK, the sender of the HEARTBEAT
  945. * should clear the error counter of the destination transport
  946. * address to which the HEARTBEAT was sent, and mark the destination
  947. * transport address as active if it is not so marked. The endpoint may
  948. * optionally report to the upper layer when an inactive destination
  949. * address is marked as active due to the reception of the latest
  950. * HEARTBEAT ACK. The receiver of the HEARTBEAT ACK must also
  951. * clear the association overall error count as well (as defined
  952. * in section 8.1).
  953. *
  954. * The receiver of the HEARTBEAT ACK should also perform an RTT
  955. * measurement for that destination transport address using the time
  956. * value carried in the HEARTBEAT ACK chunk.
  957. *
  958. * Verification Tag: 8.5 Verification Tag [Normal verification]
  959. *
  960. * Inputs
  961. * (endpoint, asoc, chunk)
  962. *
  963. * Outputs
  964. * (asoc, reply_msg, msg_up, timers, counters)
  965. *
  966. * The return value is the disposition of the chunk.
  967. */
  968. sctp_disposition_t sctp_sf_backbeat_8_3(const struct sctp_endpoint *ep,
  969. const struct sctp_association *asoc,
  970. const sctp_subtype_t type,
  971. void *arg,
  972. sctp_cmd_seq_t *commands)
  973. {
  974. struct sctp_chunk *chunk = arg;
  975. union sctp_addr from_addr;
  976. struct sctp_transport *link;
  977. sctp_sender_hb_info_t *hbinfo;
  978. unsigned long max_interval;
  979. if (!sctp_vtag_verify(chunk, asoc))
  980. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  981. /* Make sure that the HEARTBEAT-ACK chunk has a valid length. */
  982. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_heartbeat_chunk_t)))
  983. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  984. commands);
  985. hbinfo = (sctp_sender_hb_info_t *) chunk->skb->data;
  986. /* Make sure that the length of the parameter is what we expect */
  987. if (ntohs(hbinfo->param_hdr.length) !=
  988. sizeof(sctp_sender_hb_info_t)) {
  989. return SCTP_DISPOSITION_DISCARD;
  990. }
  991. from_addr = hbinfo->daddr;
  992. link = sctp_assoc_lookup_paddr(asoc, &from_addr);
  993. /* This should never happen, but lets log it if so. */
  994. if (unlikely(!link)) {
  995. if (from_addr.sa.sa_family == AF_INET6) {
  996. if (net_ratelimit())
  997. printk(KERN_WARNING
  998. "%s association %p could not find address "
  999. NIP6_FMT "\n",
  1000. __func__,
  1001. asoc,
  1002. NIP6(from_addr.v6.sin6_addr));
  1003. } else {
  1004. if (net_ratelimit())
  1005. printk(KERN_WARNING
  1006. "%s association %p could not find address "
  1007. NIPQUAD_FMT "\n",
  1008. __func__,
  1009. asoc,
  1010. NIPQUAD(from_addr.v4.sin_addr.s_addr));
  1011. }
  1012. return SCTP_DISPOSITION_DISCARD;
  1013. }
  1014. /* Validate the 64-bit random nonce. */
  1015. if (hbinfo->hb_nonce != link->hb_nonce)
  1016. return SCTP_DISPOSITION_DISCARD;
  1017. max_interval = link->hbinterval + link->rto;
  1018. /* Check if the timestamp looks valid. */
  1019. if (time_after(hbinfo->sent_at, jiffies) ||
  1020. time_after(jiffies, hbinfo->sent_at + max_interval)) {
  1021. SCTP_DEBUG_PRINTK("%s: HEARTBEAT ACK with invalid timestamp "
  1022. "received for transport: %p\n",
  1023. __func__, link);
  1024. return SCTP_DISPOSITION_DISCARD;
  1025. }
  1026. /* 8.3 Upon the receipt of the HEARTBEAT ACK, the sender of
  1027. * the HEARTBEAT should clear the error counter of the
  1028. * destination transport address to which the HEARTBEAT was
  1029. * sent and mark the destination transport address as active if
  1030. * it is not so marked.
  1031. */
  1032. sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_ON, SCTP_TRANSPORT(link));
  1033. return SCTP_DISPOSITION_CONSUME;
  1034. }
  1035. /* Helper function to send out an abort for the restart
  1036. * condition.
  1037. */
  1038. static int sctp_sf_send_restart_abort(union sctp_addr *ssa,
  1039. struct sctp_chunk *init,
  1040. sctp_cmd_seq_t *commands)
  1041. {
  1042. int len;
  1043. struct sctp_packet *pkt;
  1044. union sctp_addr_param *addrparm;
  1045. struct sctp_errhdr *errhdr;
  1046. struct sctp_endpoint *ep;
  1047. char buffer[sizeof(struct sctp_errhdr)+sizeof(union sctp_addr_param)];
  1048. struct sctp_af *af = sctp_get_af_specific(ssa->v4.sin_family);
  1049. /* Build the error on the stack. We are way to malloc crazy
  1050. * throughout the code today.
  1051. */
  1052. errhdr = (struct sctp_errhdr *)buffer;
  1053. addrparm = (union sctp_addr_param *)errhdr->variable;
  1054. /* Copy into a parm format. */
  1055. len = af->to_addr_param(ssa, addrparm);
  1056. len += sizeof(sctp_errhdr_t);
  1057. errhdr->cause = SCTP_ERROR_RESTART;
  1058. errhdr->length = htons(len);
  1059. /* Assign to the control socket. */
  1060. ep = sctp_sk((sctp_get_ctl_sock()))->ep;
  1061. /* Association is NULL since this may be a restart attack and we
  1062. * want to send back the attacker's vtag.
  1063. */
  1064. pkt = sctp_abort_pkt_new(ep, NULL, init, errhdr, len);
  1065. if (!pkt)
  1066. goto out;
  1067. sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT, SCTP_PACKET(pkt));
  1068. SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
  1069. /* Discard the rest of the inbound packet. */
  1070. sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
  1071. out:
  1072. /* Even if there is no memory, treat as a failure so
  1073. * the packet will get dropped.
  1074. */
  1075. return 0;
  1076. }
  1077. /* A restart is occurring, check to make sure no new addresses
  1078. * are being added as we may be under a takeover attack.
  1079. */
  1080. static int sctp_sf_check_restart_addrs(const struct sctp_association *new_asoc,
  1081. const struct sctp_association *asoc,
  1082. struct sctp_chunk *init,
  1083. sctp_cmd_seq_t *commands)
  1084. {
  1085. struct sctp_transport *new_addr, *addr;
  1086. int found;
  1087. /* Implementor's Guide - Sectin 5.2.2
  1088. * ...
  1089. * Before responding the endpoint MUST check to see if the
  1090. * unexpected INIT adds new addresses to the association. If new
  1091. * addresses are added to the association, the endpoint MUST respond
  1092. * with an ABORT..
  1093. */
  1094. /* Search through all current addresses and make sure
  1095. * we aren't adding any new ones.
  1096. */
  1097. new_addr = NULL;
  1098. found = 0;
  1099. list_for_each_entry(new_addr, &new_asoc->peer.transport_addr_list,
  1100. transports) {
  1101. found = 0;
  1102. list_for_each_entry(addr, &asoc->peer.transport_addr_list,
  1103. transports) {
  1104. if (sctp_cmp_addr_exact(&new_addr->ipaddr,
  1105. &addr->ipaddr)) {
  1106. found = 1;
  1107. break;
  1108. }
  1109. }
  1110. if (!found)
  1111. break;
  1112. }
  1113. /* If a new address was added, ABORT the sender. */
  1114. if (!found && new_addr) {
  1115. sctp_sf_send_restart_abort(&new_addr->ipaddr, init, commands);
  1116. }
  1117. /* Return success if all addresses were found. */
  1118. return found;
  1119. }
  1120. /* Populate the verification/tie tags based on overlapping INIT
  1121. * scenario.
  1122. *
  1123. * Note: Do not use in CLOSED or SHUTDOWN-ACK-SENT state.
  1124. */
  1125. static void sctp_tietags_populate(struct sctp_association *new_asoc,
  1126. const struct sctp_association *asoc)
  1127. {
  1128. switch (asoc->state) {
  1129. /* 5.2.1 INIT received in COOKIE-WAIT or COOKIE-ECHOED State */
  1130. case SCTP_STATE_COOKIE_WAIT:
  1131. new_asoc->c.my_vtag = asoc->c.my_vtag;
  1132. new_asoc->c.my_ttag = asoc->c.my_vtag;
  1133. new_asoc->c.peer_ttag = 0;
  1134. break;
  1135. case SCTP_STATE_COOKIE_ECHOED:
  1136. new_asoc->c.my_vtag = asoc->c.my_vtag;
  1137. new_asoc->c.my_ttag = asoc->c.my_vtag;
  1138. new_asoc->c.peer_ttag = asoc->c.peer_vtag;
  1139. break;
  1140. /* 5.2.2 Unexpected INIT in States Other than CLOSED, COOKIE-ECHOED,
  1141. * COOKIE-WAIT and SHUTDOWN-ACK-SENT
  1142. */
  1143. default:
  1144. new_asoc->c.my_ttag = asoc->c.my_vtag;
  1145. new_asoc->c.peer_ttag = asoc->c.peer_vtag;
  1146. break;
  1147. }
  1148. /* Other parameters for the endpoint SHOULD be copied from the
  1149. * existing parameters of the association (e.g. number of
  1150. * outbound streams) into the INIT ACK and cookie.
  1151. */
  1152. new_asoc->rwnd = asoc->rwnd;
  1153. new_asoc->c.sinit_num_ostreams = asoc->c.sinit_num_ostreams;
  1154. new_asoc->c.sinit_max_instreams = asoc->c.sinit_max_instreams;
  1155. new_asoc->c.initial_tsn = asoc->c.initial_tsn;
  1156. }
  1157. /*
  1158. * Compare vtag/tietag values to determine unexpected COOKIE-ECHO
  1159. * handling action.
  1160. *
  1161. * RFC 2960 5.2.4 Handle a COOKIE ECHO when a TCB exists.
  1162. *
  1163. * Returns value representing action to be taken. These action values
  1164. * correspond to Action/Description values in RFC 2960, Table 2.
  1165. */
  1166. static char sctp_tietags_compare(struct sctp_association *new_asoc,
  1167. const struct sctp_association *asoc)
  1168. {
  1169. /* In this case, the peer may have restarted. */
  1170. if ((asoc->c.my_vtag != new_asoc->c.my_vtag) &&
  1171. (asoc->c.peer_vtag != new_asoc->c.peer_vtag) &&
  1172. (asoc->c.my_vtag == new_asoc->c.my_ttag) &&
  1173. (asoc->c.peer_vtag == new_asoc->c.peer_ttag))
  1174. return 'A';
  1175. /* Collision case B. */
  1176. if ((asoc->c.my_vtag == new_asoc->c.my_vtag) &&
  1177. ((asoc->c.peer_vtag != new_asoc->c.peer_vtag) ||
  1178. (0 == asoc->c.peer_vtag))) {
  1179. return 'B';
  1180. }
  1181. /* Collision case D. */
  1182. if ((asoc->c.my_vtag == new_asoc->c.my_vtag) &&
  1183. (asoc->c.peer_vtag == new_asoc->c.peer_vtag))
  1184. return 'D';
  1185. /* Collision case C. */
  1186. if ((asoc->c.my_vtag != new_asoc->c.my_vtag) &&
  1187. (asoc->c.peer_vtag == new_asoc->c.peer_vtag) &&
  1188. (0 == new_asoc->c.my_ttag) &&
  1189. (0 == new_asoc->c.peer_ttag))
  1190. return 'C';
  1191. /* No match to any of the special cases; discard this packet. */
  1192. return 'E';
  1193. }
  1194. /* Common helper routine for both duplicate and simulataneous INIT
  1195. * chunk handling.
  1196. */
  1197. static sctp_disposition_t sctp_sf_do_unexpected_init(
  1198. const struct sctp_endpoint *ep,
  1199. const struct sctp_association *asoc,
  1200. const sctp_subtype_t type,
  1201. void *arg, sctp_cmd_seq_t *commands)
  1202. {
  1203. sctp_disposition_t retval;
  1204. struct sctp_chunk *chunk = arg;
  1205. struct sctp_chunk *repl;
  1206. struct sctp_association *new_asoc;
  1207. struct sctp_chunk *err_chunk;
  1208. struct sctp_packet *packet;
  1209. sctp_unrecognized_param_t *unk_param;
  1210. int len;
  1211. /* 6.10 Bundling
  1212. * An endpoint MUST NOT bundle INIT, INIT ACK or
  1213. * SHUTDOWN COMPLETE with any other chunks.
  1214. *
  1215. * IG Section 2.11.2
  1216. * Furthermore, we require that the receiver of an INIT chunk MUST
  1217. * enforce these rules by silently discarding an arriving packet
  1218. * with an INIT chunk that is bundled with other chunks.
  1219. */
  1220. if (!chunk->singleton)
  1221. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  1222. /* 3.1 A packet containing an INIT chunk MUST have a zero Verification
  1223. * Tag.
  1224. */
  1225. if (chunk->sctp_hdr->vtag != 0)
  1226. return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
  1227. /* Make sure that the INIT chunk has a valid length.
  1228. * In this case, we generate a protocol violation since we have
  1229. * an association established.
  1230. */
  1231. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_init_chunk_t)))
  1232. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  1233. commands);
  1234. /* Grab the INIT header. */
  1235. chunk->subh.init_hdr = (sctp_inithdr_t *) chunk->skb->data;
  1236. /* Tag the variable length parameters. */
  1237. chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(sctp_inithdr_t));
  1238. /* Verify the INIT chunk before processing it. */
  1239. err_chunk = NULL;
  1240. if (!sctp_verify_init(asoc, chunk->chunk_hdr->type,
  1241. (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
  1242. &err_chunk)) {
  1243. /* This chunk contains fatal error. It is to be discarded.
  1244. * Send an ABORT, with causes if there is any.
  1245. */
  1246. if (err_chunk) {
  1247. packet = sctp_abort_pkt_new(ep, asoc, arg,
  1248. (__u8 *)(err_chunk->chunk_hdr) +
  1249. sizeof(sctp_chunkhdr_t),
  1250. ntohs(err_chunk->chunk_hdr->length) -
  1251. sizeof(sctp_chunkhdr_t));
  1252. if (packet) {
  1253. sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
  1254. SCTP_PACKET(packet));
  1255. SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
  1256. retval = SCTP_DISPOSITION_CONSUME;
  1257. } else {
  1258. retval = SCTP_DISPOSITION_NOMEM;
  1259. }
  1260. goto cleanup;
  1261. } else {
  1262. return sctp_sf_tabort_8_4_8(ep, asoc, type, arg,
  1263. commands);
  1264. }
  1265. }
  1266. /*
  1267. * Other parameters for the endpoint SHOULD be copied from the
  1268. * existing parameters of the association (e.g. number of
  1269. * outbound streams) into the INIT ACK and cookie.
  1270. * FIXME: We are copying parameters from the endpoint not the
  1271. * association.
  1272. */
  1273. new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC);
  1274. if (!new_asoc)
  1275. goto nomem;
  1276. /* In the outbound INIT ACK the endpoint MUST copy its current
  1277. * Verification Tag and Peers Verification tag into a reserved
  1278. * place (local tie-tag and per tie-tag) within the state cookie.
  1279. */
  1280. if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
  1281. sctp_source(chunk),
  1282. (sctp_init_chunk_t *)chunk->chunk_hdr,
  1283. GFP_ATOMIC))
  1284. goto nomem;
  1285. /* Make sure no new addresses are being added during the
  1286. * restart. Do not do this check for COOKIE-WAIT state,
  1287. * since there are no peer addresses to check against.
  1288. * Upon return an ABORT will have been sent if needed.
  1289. */
  1290. if (!sctp_state(asoc, COOKIE_WAIT)) {
  1291. if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk,
  1292. commands)) {
  1293. retval = SCTP_DISPOSITION_CONSUME;
  1294. goto nomem_retval;
  1295. }
  1296. }
  1297. sctp_tietags_populate(new_asoc, asoc);
  1298. /* B) "Z" shall respond immediately with an INIT ACK chunk. */
  1299. /* If there are errors need to be reported for unknown parameters,
  1300. * make sure to reserve enough room in the INIT ACK for them.
  1301. */
  1302. len = 0;
  1303. if (err_chunk) {
  1304. len = ntohs(err_chunk->chunk_hdr->length) -
  1305. sizeof(sctp_chunkhdr_t);
  1306. }
  1307. if (sctp_assoc_set_bind_addr_from_ep(new_asoc, GFP_ATOMIC) < 0)
  1308. goto nomem;
  1309. repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
  1310. if (!repl)
  1311. goto nomem;
  1312. /* If there are errors need to be reported for unknown parameters,
  1313. * include them in the outgoing INIT ACK as "Unrecognized parameter"
  1314. * parameter.
  1315. */
  1316. if (err_chunk) {
  1317. /* Get the "Unrecognized parameter" parameter(s) out of the
  1318. * ERROR chunk generated by sctp_verify_init(). Since the
  1319. * error cause code for "unknown parameter" and the
  1320. * "Unrecognized parameter" type is the same, we can
  1321. * construct the parameters in INIT ACK by copying the
  1322. * ERROR causes over.
  1323. */
  1324. unk_param = (sctp_unrecognized_param_t *)
  1325. ((__u8 *)(err_chunk->chunk_hdr) +
  1326. sizeof(sctp_chunkhdr_t));
  1327. /* Replace the cause code with the "Unrecognized parameter"
  1328. * parameter type.
  1329. */
  1330. sctp_addto_chunk(repl, len, unk_param);
  1331. }
  1332. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
  1333. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
  1334. /*
  1335. * Note: After sending out INIT ACK with the State Cookie parameter,
  1336. * "Z" MUST NOT allocate any resources for this new association.
  1337. * Otherwise, "Z" will be vulnerable to resource attacks.
  1338. */
  1339. sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
  1340. retval = SCTP_DISPOSITION_CONSUME;
  1341. return retval;
  1342. nomem:
  1343. retval = SCTP_DISPOSITION_NOMEM;
  1344. nomem_retval:
  1345. if (new_asoc)
  1346. sctp_association_free(new_asoc);
  1347. cleanup:
  1348. if (err_chunk)
  1349. sctp_chunk_free(err_chunk);
  1350. return retval;
  1351. }
  1352. /*
  1353. * Handle simultanous INIT.
  1354. * This means we started an INIT and then we got an INIT request from
  1355. * our peer.
  1356. *
  1357. * Section: 5.2.1 INIT received in COOKIE-WAIT or COOKIE-ECHOED State (Item B)
  1358. * This usually indicates an initialization collision, i.e., each
  1359. * endpoint is attempting, at about the same time, to establish an
  1360. * association with the other endpoint.
  1361. *
  1362. * Upon receipt of an INIT in the COOKIE-WAIT or COOKIE-ECHOED state, an
  1363. * endpoint MUST respond with an INIT ACK using the same parameters it
  1364. * sent in its original INIT chunk (including its Verification Tag,
  1365. * unchanged). These original parameters are combined with those from the
  1366. * newly received INIT chunk. The endpoint shall also generate a State
  1367. * Cookie with the INIT ACK. The endpoint uses the parameters sent in its
  1368. * INIT to calculate the State Cookie.
  1369. *
  1370. * After that, the endpoint MUST NOT change its state, the T1-init
  1371. * timer shall be left running and the corresponding TCB MUST NOT be
  1372. * destroyed. The normal procedures for handling State Cookies when
  1373. * a TCB exists will resolve the duplicate INITs to a single association.
  1374. *
  1375. * For an endpoint that is in the COOKIE-ECHOED state it MUST populate
  1376. * its Tie-Tags with the Tag information of itself and its peer (see
  1377. * section 5.2.2 for a description of the Tie-Tags).
  1378. *
  1379. * Verification Tag: Not explicit, but an INIT can not have a valid
  1380. * verification tag, so we skip the check.
  1381. *
  1382. * Inputs
  1383. * (endpoint, asoc, chunk)
  1384. *
  1385. * Outputs
  1386. * (asoc, reply_msg, msg_up, timers, counters)
  1387. *
  1388. * The return value is the disposition of the chunk.
  1389. */
  1390. sctp_disposition_t sctp_sf_do_5_2_1_siminit(const struct sctp_endpoint *ep,
  1391. const struct sctp_association *asoc,
  1392. const sctp_subtype_t type,
  1393. void *arg,
  1394. sctp_cmd_seq_t *commands)
  1395. {
  1396. /* Call helper to do the real work for both simulataneous and
  1397. * duplicate INIT chunk handling.
  1398. */
  1399. return sctp_sf_do_unexpected_init(ep, asoc, type, arg, commands);
  1400. }
  1401. /*
  1402. * Handle duplicated INIT messages. These are usually delayed
  1403. * restransmissions.
  1404. *
  1405. * Section: 5.2.2 Unexpected INIT in States Other than CLOSED,
  1406. * COOKIE-ECHOED and COOKIE-WAIT
  1407. *
  1408. * Unless otherwise stated, upon reception of an unexpected INIT for
  1409. * this association, the endpoint shall generate an INIT ACK with a
  1410. * State Cookie. In the outbound INIT ACK the endpoint MUST copy its
  1411. * current Verification Tag and peer's Verification Tag into a reserved
  1412. * place within the state cookie. We shall refer to these locations as
  1413. * the Peer's-Tie-Tag and the Local-Tie-Tag. The outbound SCTP packet
  1414. * containing this INIT ACK MUST carry a Verification Tag value equal to
  1415. * the Initiation Tag found in the unexpected INIT. And the INIT ACK
  1416. * MUST contain a new Initiation Tag (randomly generated see Section
  1417. * 5.3.1). Other parameters for the endpoint SHOULD be copied from the
  1418. * existing parameters of the association (e.g. number of outbound
  1419. * streams) into the INIT ACK and cookie.
  1420. *
  1421. * After sending out the INIT ACK, the endpoint shall take no further
  1422. * actions, i.e., the existing association, including its current state,
  1423. * and the corresponding TCB MUST NOT be changed.
  1424. *
  1425. * Note: Only when a TCB exists and the association is not in a COOKIE-
  1426. * WAIT state are the Tie-Tags populated. For a normal association INIT
  1427. * (i.e. the endpoint is in a COOKIE-WAIT state), the Tie-Tags MUST be
  1428. * set to 0 (indicating that no previous TCB existed). The INIT ACK and
  1429. * State Cookie are populated as specified in section 5.2.1.
  1430. *
  1431. * Verification Tag: Not specified, but an INIT has no way of knowing
  1432. * what the verification tag could be, so we ignore it.
  1433. *
  1434. * Inputs
  1435. * (endpoint, asoc, chunk)
  1436. *
  1437. * Outputs
  1438. * (asoc, reply_msg, msg_up, timers, counters)
  1439. *
  1440. * The return value is the disposition of the chunk.
  1441. */
  1442. sctp_disposition_t sctp_sf_do_5_2_2_dupinit(const struct sctp_endpoint *ep,
  1443. const struct sctp_association *asoc,
  1444. const sctp_subtype_t type,
  1445. void *arg,
  1446. sctp_cmd_seq_t *commands)
  1447. {
  1448. /* Call helper to do the real work for both simulataneous and
  1449. * duplicate INIT chunk handling.
  1450. */
  1451. return sctp_sf_do_unexpected_init(ep, asoc, type, arg, commands);
  1452. }
  1453. /*
  1454. * Unexpected INIT-ACK handler.
  1455. *
  1456. * Section 5.2.3
  1457. * If an INIT ACK received by an endpoint in any state other than the
  1458. * COOKIE-WAIT state, the endpoint should discard the INIT ACK chunk.
  1459. * An unexpected INIT ACK usually indicates the processing of an old or
  1460. * duplicated INIT chunk.
  1461. */
  1462. sctp_disposition_t sctp_sf_do_5_2_3_initack(const struct sctp_endpoint *ep,
  1463. const struct sctp_association *asoc,
  1464. const sctp_subtype_t type,
  1465. void *arg, sctp_cmd_seq_t *commands)
  1466. {
  1467. /* Per the above section, we'll discard the chunk if we have an
  1468. * endpoint. If this is an OOTB INIT-ACK, treat it as such.
  1469. */
  1470. if (ep == sctp_sk((sctp_get_ctl_sock()))->ep)
  1471. return sctp_sf_ootb(ep, asoc, type, arg, commands);
  1472. else
  1473. return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
  1474. }
  1475. /* Unexpected COOKIE-ECHO handler for peer restart (Table 2, action 'A')
  1476. *
  1477. * Section 5.2.4
  1478. * A) In this case, the peer may have restarted.
  1479. */
  1480. static sctp_disposition_t sctp_sf_do_dupcook_a(const struct sctp_endpoint *ep,
  1481. const struct sctp_association *asoc,
  1482. struct sctp_chunk *chunk,
  1483. sctp_cmd_seq_t *commands,
  1484. struct sctp_association *new_asoc)
  1485. {
  1486. sctp_init_chunk_t *peer_init;
  1487. struct sctp_ulpevent *ev;
  1488. struct sctp_chunk *repl;
  1489. struct sctp_chunk *err;
  1490. sctp_disposition_t disposition;
  1491. /* new_asoc is a brand-new association, so these are not yet
  1492. * side effects--it is safe to run them here.
  1493. */
  1494. peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
  1495. if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
  1496. sctp_source(chunk), peer_init,
  1497. GFP_ATOMIC))
  1498. goto nomem;
  1499. /* Make sure no new addresses are being added during the
  1500. * restart. Though this is a pretty complicated attack
  1501. * since you'd have to get inside the cookie.
  1502. */
  1503. if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk, commands)) {
  1504. return SCTP_DISPOSITION_CONSUME;
  1505. }
  1506. /* If the endpoint is in the SHUTDOWN-ACK-SENT state and recognizes
  1507. * the peer has restarted (Action A), it MUST NOT setup a new
  1508. * association but instead resend the SHUTDOWN ACK and send an ERROR
  1509. * chunk with a "Cookie Received while Shutting Down" error cause to
  1510. * its peer.
  1511. */
  1512. if (sctp_state(asoc, SHUTDOWN_ACK_SENT)) {
  1513. disposition = sctp_sf_do_9_2_reshutack(ep, asoc,
  1514. SCTP_ST_CHUNK(chunk->chunk_hdr->type),
  1515. chunk, commands);
  1516. if (SCTP_DISPOSITION_NOMEM == disposition)
  1517. goto nomem;
  1518. err = sctp_make_op_error(asoc, chunk,
  1519. SCTP_ERROR_COOKIE_IN_SHUTDOWN,
  1520. NULL, 0);
  1521. if (err)
  1522. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
  1523. SCTP_CHUNK(err));
  1524. return SCTP_DISPOSITION_CONSUME;
  1525. }
  1526. /* For now, fail any unsent/unacked data. Consider the optional
  1527. * choice of resending of this data.
  1528. */
  1529. sctp_add_cmd_sf(commands, SCTP_CMD_PURGE_OUTQUEUE, SCTP_NULL());
  1530. repl = sctp_make_cookie_ack(new_asoc, chunk);
  1531. if (!repl)
  1532. goto nomem;
  1533. /* Report association restart to upper layer. */
  1534. ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_RESTART, 0,
  1535. new_asoc->c.sinit_num_ostreams,
  1536. new_asoc->c.sinit_max_instreams,
  1537. NULL, GFP_ATOMIC);
  1538. if (!ev)
  1539. goto nomem_ev;
  1540. /* Update the content of current association. */
  1541. sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
  1542. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
  1543. sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
  1544. return SCTP_DISPOSITION_CONSUME;
  1545. nomem_ev:
  1546. sctp_chunk_free(repl);
  1547. nomem:
  1548. return SCTP_DISPOSITION_NOMEM;
  1549. }
  1550. /* Unexpected COOKIE-ECHO handler for setup collision (Table 2, action 'B')
  1551. *
  1552. * Section 5.2.4
  1553. * B) In this case, both sides may be attempting to start an association
  1554. * at about the same time but the peer endpoint started its INIT
  1555. * after responding to the local endpoint's INIT
  1556. */
  1557. /* This case represents an initialization collision. */
  1558. static sctp_disposition_t sctp_sf_do_dupcook_b(const struct sctp_endpoint *ep,
  1559. const struct sctp_association *asoc,
  1560. struct sctp_chunk *chunk,
  1561. sctp_cmd_seq_t *commands,
  1562. struct sctp_association *new_asoc)
  1563. {
  1564. sctp_init_chunk_t *peer_init;
  1565. struct sctp_chunk *repl;
  1566. /* new_asoc is a brand-new association, so these are not yet
  1567. * side effects--it is safe to run them here.
  1568. */
  1569. peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
  1570. if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
  1571. sctp_source(chunk), peer_init,
  1572. GFP_ATOMIC))
  1573. goto nomem;
  1574. /* Update the content of current association. */
  1575. sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
  1576. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  1577. SCTP_STATE(SCTP_STATE_ESTABLISHED));
  1578. SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
  1579. sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
  1580. repl = sctp_make_cookie_ack(new_asoc, chunk);
  1581. if (!repl)
  1582. goto nomem;
  1583. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
  1584. /* RFC 2960 5.1 Normal Establishment of an Association
  1585. *
  1586. * D) IMPLEMENTATION NOTE: An implementation may choose to
  1587. * send the Communication Up notification to the SCTP user
  1588. * upon reception of a valid COOKIE ECHO chunk.
  1589. *
  1590. * Sadly, this needs to be implemented as a side-effect, because
  1591. * we are not guaranteed to have set the association id of the real
  1592. * association and so these notifications need to be delayed until
  1593. * the association id is allocated.
  1594. */
  1595. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_CHANGE, SCTP_U8(SCTP_COMM_UP));
  1596. /* Sockets API Draft Section 5.3.1.6
  1597. * When a peer sends a Adaptation Layer Indication parameter , SCTP
  1598. * delivers this notification to inform the application that of the
  1599. * peers requested adaptation layer.
  1600. *
  1601. * This also needs to be done as a side effect for the same reason as
  1602. * above.
  1603. */
  1604. if (asoc->peer.adaptation_ind)
  1605. sctp_add_cmd_sf(commands, SCTP_CMD_ADAPTATION_IND, SCTP_NULL());
  1606. return SCTP_DISPOSITION_CONSUME;
  1607. nomem:
  1608. return SCTP_DISPOSITION_NOMEM;
  1609. }
  1610. /* Unexpected COOKIE-ECHO handler for setup collision (Table 2, action 'C')
  1611. *
  1612. * Section 5.2.4
  1613. * C) In this case, the local endpoint's cookie has arrived late.
  1614. * Before it arrived, the local endpoint sent an INIT and received an
  1615. * INIT-ACK and finally sent a COOKIE ECHO with the peer's same tag
  1616. * but a new tag of its own.
  1617. */
  1618. /* This case represents an initialization collision. */
  1619. static sctp_disposition_t sctp_sf_do_dupcook_c(const struct sctp_endpoint *ep,
  1620. const struct sctp_association *asoc,
  1621. struct sctp_chunk *chunk,
  1622. sctp_cmd_seq_t *commands,
  1623. struct sctp_association *new_asoc)
  1624. {
  1625. /* The cookie should be silently discarded.
  1626. * The endpoint SHOULD NOT change states and should leave
  1627. * any timers running.
  1628. */
  1629. return SCTP_DISPOSITION_DISCARD;
  1630. }
  1631. /* Unexpected COOKIE-ECHO handler lost chunk (Table 2, action 'D')
  1632. *
  1633. * Section 5.2.4
  1634. *
  1635. * D) When both local and remote tags match the endpoint should always
  1636. * enter the ESTABLISHED state, if it has not already done so.
  1637. */
  1638. /* This case represents an initialization collision. */
  1639. static sctp_disposition_t sctp_sf_do_dupcook_d(const struct sctp_endpoint *ep,
  1640. const struct sctp_association *asoc,
  1641. struct sctp_chunk *chunk,
  1642. sctp_cmd_seq_t *commands,
  1643. struct sctp_association *new_asoc)
  1644. {
  1645. struct sctp_ulpevent *ev = NULL, *ai_ev = NULL;
  1646. struct sctp_chunk *repl;
  1647. /* Clarification from Implementor's Guide:
  1648. * D) When both local and remote tags match the endpoint should
  1649. * enter the ESTABLISHED state, if it is in the COOKIE-ECHOED state.
  1650. * It should stop any cookie timer that may be running and send
  1651. * a COOKIE ACK.
  1652. */
  1653. /* Don't accidentally move back into established state. */
  1654. if (asoc->state < SCTP_STATE_ESTABLISHED) {
  1655. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  1656. SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
  1657. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  1658. SCTP_STATE(SCTP_STATE_ESTABLISHED));
  1659. SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
  1660. sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START,
  1661. SCTP_NULL());
  1662. /* RFC 2960 5.1 Normal Establishment of an Association
  1663. *
  1664. * D) IMPLEMENTATION NOTE: An implementation may choose
  1665. * to send the Communication Up notification to the
  1666. * SCTP user upon reception of a valid COOKIE
  1667. * ECHO chunk.
  1668. */
  1669. ev = sctp_ulpevent_make_assoc_change(asoc, 0,
  1670. SCTP_COMM_UP, 0,
  1671. asoc->c.sinit_num_ostreams,
  1672. asoc->c.sinit_max_instreams,
  1673. NULL, GFP_ATOMIC);
  1674. if (!ev)
  1675. goto nomem;
  1676. /* Sockets API Draft Section 5.3.1.6
  1677. * When a peer sends a Adaptation Layer Indication parameter,
  1678. * SCTP delivers this notification to inform the application
  1679. * that of the peers requested adaptation layer.
  1680. */
  1681. if (asoc->peer.adaptation_ind) {
  1682. ai_ev = sctp_ulpevent_make_adaptation_indication(asoc,
  1683. GFP_ATOMIC);
  1684. if (!ai_ev)
  1685. goto nomem;
  1686. }
  1687. }
  1688. repl = sctp_make_cookie_ack(new_asoc, chunk);
  1689. if (!repl)
  1690. goto nomem;
  1691. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
  1692. if (ev)
  1693. sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
  1694. SCTP_ULPEVENT(ev));
  1695. if (ai_ev)
  1696. sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
  1697. SCTP_ULPEVENT(ai_ev));
  1698. return SCTP_DISPOSITION_CONSUME;
  1699. nomem:
  1700. if (ai_ev)
  1701. sctp_ulpevent_free(ai_ev);
  1702. if (ev)
  1703. sctp_ulpevent_free(ev);
  1704. return SCTP_DISPOSITION_NOMEM;
  1705. }
  1706. /*
  1707. * Handle a duplicate COOKIE-ECHO. This usually means a cookie-carrying
  1708. * chunk was retransmitted and then delayed in the network.
  1709. *
  1710. * Section: 5.2.4 Handle a COOKIE ECHO when a TCB exists
  1711. *
  1712. * Verification Tag: None. Do cookie validation.
  1713. *
  1714. * Inputs
  1715. * (endpoint, asoc, chunk)
  1716. *
  1717. * Outputs
  1718. * (asoc, reply_msg, msg_up, timers, counters)
  1719. *
  1720. * The return value is the disposition of the chunk.
  1721. */
  1722. sctp_disposition_t sctp_sf_do_5_2_4_dupcook(const struct sctp_endpoint *ep,
  1723. const struct sctp_association *asoc,
  1724. const sctp_subtype_t type,
  1725. void *arg,
  1726. sctp_cmd_seq_t *commands)
  1727. {
  1728. sctp_disposition_t retval;
  1729. struct sctp_chunk *chunk = arg;
  1730. struct sctp_association *new_asoc;
  1731. int error = 0;
  1732. char action;
  1733. struct sctp_chunk *err_chk_p;
  1734. /* Make sure that the chunk has a valid length from the protocol
  1735. * perspective. In this case check to make sure we have at least
  1736. * enough for the chunk header. Cookie length verification is
  1737. * done later.
  1738. */
  1739. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
  1740. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  1741. commands);
  1742. /* "Decode" the chunk. We have no optional parameters so we
  1743. * are in good shape.
  1744. */
  1745. chunk->subh.cookie_hdr = (struct sctp_signed_cookie *)chunk->skb->data;
  1746. if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
  1747. sizeof(sctp_chunkhdr_t)))
  1748. goto nomem;
  1749. /* In RFC 2960 5.2.4 3, if both Verification Tags in the State Cookie
  1750. * of a duplicate COOKIE ECHO match the Verification Tags of the
  1751. * current association, consider the State Cookie valid even if
  1752. * the lifespan is exceeded.
  1753. */
  1754. new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, &error,
  1755. &err_chk_p);
  1756. /* FIXME:
  1757. * If the re-build failed, what is the proper error path
  1758. * from here?
  1759. *
  1760. * [We should abort the association. --piggy]
  1761. */
  1762. if (!new_asoc) {
  1763. /* FIXME: Several errors are possible. A bad cookie should
  1764. * be silently discarded, but think about logging it too.
  1765. */
  1766. switch (error) {
  1767. case -SCTP_IERROR_NOMEM:
  1768. goto nomem;
  1769. case -SCTP_IERROR_STALE_COOKIE:
  1770. sctp_send_stale_cookie_err(ep, asoc, chunk, commands,
  1771. err_chk_p);
  1772. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  1773. case -SCTP_IERROR_BAD_SIG:
  1774. default:
  1775. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  1776. }
  1777. }
  1778. /* Compare the tie_tag in cookie with the verification tag of
  1779. * current association.
  1780. */
  1781. action = sctp_tietags_compare(new_asoc, asoc);
  1782. switch (action) {
  1783. case 'A': /* Association restart. */
  1784. retval = sctp_sf_do_dupcook_a(ep, asoc, chunk, commands,
  1785. new_asoc);
  1786. break;
  1787. case 'B': /* Collision case B. */
  1788. retval = sctp_sf_do_dupcook_b(ep, asoc, chunk, commands,
  1789. new_asoc);
  1790. break;
  1791. case 'C': /* Collision case C. */
  1792. retval = sctp_sf_do_dupcook_c(ep, asoc, chunk, commands,
  1793. new_asoc);
  1794. break;
  1795. case 'D': /* Collision case D. */
  1796. retval = sctp_sf_do_dupcook_d(ep, asoc, chunk, commands,
  1797. new_asoc);
  1798. break;
  1799. default: /* Discard packet for all others. */
  1800. retval = sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  1801. break;
  1802. }
  1803. /* Delete the tempory new association. */
  1804. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
  1805. sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
  1806. return retval;
  1807. nomem:
  1808. return SCTP_DISPOSITION_NOMEM;
  1809. }
  1810. /*
  1811. * Process an ABORT. (SHUTDOWN-PENDING state)
  1812. *
  1813. * See sctp_sf_do_9_1_abort().
  1814. */
  1815. sctp_disposition_t sctp_sf_shutdown_pending_abort(
  1816. const struct sctp_endpoint *ep,
  1817. const struct sctp_association *asoc,
  1818. const sctp_subtype_t type,
  1819. void *arg,
  1820. sctp_cmd_seq_t *commands)
  1821. {
  1822. struct sctp_chunk *chunk = arg;
  1823. if (!sctp_vtag_verify_either(chunk, asoc))
  1824. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  1825. /* Make sure that the ABORT chunk has a valid length.
  1826. * Since this is an ABORT chunk, we have to discard it
  1827. * because of the following text:
  1828. * RFC 2960, Section 3.3.7
  1829. * If an endpoint receives an ABORT with a format error or for an
  1830. * association that doesn't exist, it MUST silently discard it.
  1831. * Becasue the length is "invalid", we can't really discard just
  1832. * as we do not know its true length. So, to be safe, discard the
  1833. * packet.
  1834. */
  1835. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
  1836. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  1837. /* ADD-IP: Special case for ABORT chunks
  1838. * F4) One special consideration is that ABORT Chunks arriving
  1839. * destined to the IP address being deleted MUST be
  1840. * ignored (see Section 5.3.1 for further details).
  1841. */
  1842. if (SCTP_ADDR_DEL ==
  1843. sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
  1844. return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
  1845. return __sctp_sf_do_9_1_abort(ep, asoc, type, arg, commands);
  1846. }
  1847. /*
  1848. * Process an ABORT. (SHUTDOWN-SENT state)
  1849. *
  1850. * See sctp_sf_do_9_1_abort().
  1851. */
  1852. sctp_disposition_t sctp_sf_shutdown_sent_abort(const struct sctp_endpoint *ep,
  1853. const struct sctp_association *asoc,
  1854. const sctp_subtype_t type,
  1855. void *arg,
  1856. sctp_cmd_seq_t *commands)
  1857. {
  1858. struct sctp_chunk *chunk = arg;
  1859. if (!sctp_vtag_verify_either(chunk, asoc))
  1860. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  1861. /* Make sure that the ABORT chunk has a valid length.
  1862. * Since this is an ABORT chunk, we have to discard it
  1863. * because of the following text:
  1864. * RFC 2960, Section 3.3.7
  1865. * If an endpoint receives an ABORT with a format error or for an
  1866. * association that doesn't exist, it MUST silently discard it.
  1867. * Becasue the length is "invalid", we can't really discard just
  1868. * as we do not know its true length. So, to be safe, discard the
  1869. * packet.
  1870. */
  1871. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
  1872. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  1873. /* ADD-IP: Special case for ABORT chunks
  1874. * F4) One special consideration is that ABORT Chunks arriving
  1875. * destined to the IP address being deleted MUST be
  1876. * ignored (see Section 5.3.1 for further details).
  1877. */
  1878. if (SCTP_ADDR_DEL ==
  1879. sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
  1880. return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
  1881. /* Stop the T2-shutdown timer. */
  1882. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  1883. SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
  1884. /* Stop the T5-shutdown guard timer. */
  1885. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  1886. SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
  1887. return __sctp_sf_do_9_1_abort(ep, asoc, type, arg, commands);
  1888. }
  1889. /*
  1890. * Process an ABORT. (SHUTDOWN-ACK-SENT state)
  1891. *
  1892. * See sctp_sf_do_9_1_abort().
  1893. */
  1894. sctp_disposition_t sctp_sf_shutdown_ack_sent_abort(
  1895. const struct sctp_endpoint *ep,
  1896. const struct sctp_association *asoc,
  1897. const sctp_subtype_t type,
  1898. void *arg,
  1899. sctp_cmd_seq_t *commands)
  1900. {
  1901. /* The same T2 timer, so we should be able to use
  1902. * common function with the SHUTDOWN-SENT state.
  1903. */
  1904. return sctp_sf_shutdown_sent_abort(ep, asoc, type, arg, commands);
  1905. }
  1906. /*
  1907. * Handle an Error received in COOKIE_ECHOED state.
  1908. *
  1909. * Only handle the error type of stale COOKIE Error, the other errors will
  1910. * be ignored.
  1911. *
  1912. * Inputs
  1913. * (endpoint, asoc, chunk)
  1914. *
  1915. * Outputs
  1916. * (asoc, reply_msg, msg_up, timers, counters)
  1917. *
  1918. * The return value is the disposition of the chunk.
  1919. */
  1920. sctp_disposition_t sctp_sf_cookie_echoed_err(const struct sctp_endpoint *ep,
  1921. const struct sctp_association *asoc,
  1922. const sctp_subtype_t type,
  1923. void *arg,
  1924. sctp_cmd_seq_t *commands)
  1925. {
  1926. struct sctp_chunk *chunk = arg;
  1927. sctp_errhdr_t *err;
  1928. if (!sctp_vtag_verify(chunk, asoc))
  1929. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  1930. /* Make sure that the ERROR chunk has a valid length.
  1931. * The parameter walking depends on this as well.
  1932. */
  1933. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_operr_chunk_t)))
  1934. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  1935. commands);
  1936. /* Process the error here */
  1937. /* FUTURE FIXME: When PR-SCTP related and other optional
  1938. * parms are emitted, this will have to change to handle multiple
  1939. * errors.
  1940. */
  1941. sctp_walk_errors(err, chunk->chunk_hdr) {
  1942. if (SCTP_ERROR_STALE_COOKIE == err->cause)
  1943. return sctp_sf_do_5_2_6_stale(ep, asoc, type,
  1944. arg, commands);
  1945. }
  1946. /* It is possible to have malformed error causes, and that
  1947. * will cause us to end the walk early. However, since
  1948. * we are discarding the packet, there should be no adverse
  1949. * affects.
  1950. */
  1951. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  1952. }
  1953. /*
  1954. * Handle a Stale COOKIE Error
  1955. *
  1956. * Section: 5.2.6 Handle Stale COOKIE Error
  1957. * If the association is in the COOKIE-ECHOED state, the endpoint may elect
  1958. * one of the following three alternatives.
  1959. * ...
  1960. * 3) Send a new INIT chunk to the endpoint, adding a Cookie
  1961. * Preservative parameter requesting an extension to the lifetime of
  1962. * the State Cookie. When calculating the time extension, an
  1963. * implementation SHOULD use the RTT information measured based on the
  1964. * previous COOKIE ECHO / ERROR exchange, and should add no more
  1965. * than 1 second beyond the measured RTT, due to long State Cookie
  1966. * lifetimes making the endpoint more subject to a replay attack.
  1967. *
  1968. * Verification Tag: Not explicit, but safe to ignore.
  1969. *
  1970. * Inputs
  1971. * (endpoint, asoc, chunk)
  1972. *
  1973. * Outputs
  1974. * (asoc, reply_msg, msg_up, timers, counters)
  1975. *
  1976. * The return value is the disposition of the chunk.
  1977. */
  1978. static sctp_disposition_t sctp_sf_do_5_2_6_stale(const struct sctp_endpoint *ep,
  1979. const struct sctp_association *asoc,
  1980. const sctp_subtype_t type,
  1981. void *arg,
  1982. sctp_cmd_seq_t *commands)
  1983. {
  1984. struct sctp_chunk *chunk = arg;
  1985. time_t stale;
  1986. sctp_cookie_preserve_param_t bht;
  1987. sctp_errhdr_t *err;
  1988. struct sctp_chunk *reply;
  1989. struct sctp_bind_addr *bp;
  1990. int attempts = asoc->init_err_counter + 1;
  1991. if (attempts > asoc->max_init_attempts) {
  1992. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  1993. SCTP_ERROR(ETIMEDOUT));
  1994. sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
  1995. SCTP_PERR(SCTP_ERROR_STALE_COOKIE));
  1996. return SCTP_DISPOSITION_DELETE_TCB;
  1997. }
  1998. err = (sctp_errhdr_t *)(chunk->skb->data);
  1999. /* When calculating the time extension, an implementation
  2000. * SHOULD use the RTT information measured based on the
  2001. * previous COOKIE ECHO / ERROR exchange, and should add no
  2002. * more than 1 second beyond the measured RTT, due to long
  2003. * State Cookie lifetimes making the endpoint more subject to
  2004. * a replay attack.
  2005. * Measure of Staleness's unit is usec. (1/1000000 sec)
  2006. * Suggested Cookie Life-span Increment's unit is msec.
  2007. * (1/1000 sec)
  2008. * In general, if you use the suggested cookie life, the value
  2009. * found in the field of measure of staleness should be doubled
  2010. * to give ample time to retransmit the new cookie and thus
  2011. * yield a higher probability of success on the reattempt.
  2012. */
  2013. stale = ntohl(*(__be32 *)((u8 *)err + sizeof(sctp_errhdr_t)));
  2014. stale = (stale * 2) / 1000;
  2015. bht.param_hdr.type = SCTP_PARAM_COOKIE_PRESERVATIVE;
  2016. bht.param_hdr.length = htons(sizeof(bht));
  2017. bht.lifespan_increment = htonl(stale);
  2018. /* Build that new INIT chunk. */
  2019. bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
  2020. reply = sctp_make_init(asoc, bp, GFP_ATOMIC, sizeof(bht));
  2021. if (!reply)
  2022. goto nomem;
  2023. sctp_addto_chunk(reply, sizeof(bht), &bht);
  2024. /* Clear peer's init_tag cached in assoc as we are sending a new INIT */
  2025. sctp_add_cmd_sf(commands, SCTP_CMD_CLEAR_INIT_TAG, SCTP_NULL());
  2026. /* Stop pending T3-rtx and heartbeat timers */
  2027. sctp_add_cmd_sf(commands, SCTP_CMD_T3_RTX_TIMERS_STOP, SCTP_NULL());
  2028. sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
  2029. /* Delete non-primary peer ip addresses since we are transitioning
  2030. * back to the COOKIE-WAIT state
  2031. */
  2032. sctp_add_cmd_sf(commands, SCTP_CMD_DEL_NON_PRIMARY, SCTP_NULL());
  2033. /* If we've sent any data bundled with COOKIE-ECHO we will need to
  2034. * resend
  2035. */
  2036. sctp_add_cmd_sf(commands, SCTP_CMD_T1_RETRAN,
  2037. SCTP_TRANSPORT(asoc->peer.primary_path));
  2038. /* Cast away the const modifier, as we want to just
  2039. * rerun it through as a sideffect.
  2040. */
  2041. sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_INC, SCTP_NULL());
  2042. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  2043. SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
  2044. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  2045. SCTP_STATE(SCTP_STATE_COOKIE_WAIT));
  2046. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
  2047. SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
  2048. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
  2049. return SCTP_DISPOSITION_CONSUME;
  2050. nomem:
  2051. return SCTP_DISPOSITION_NOMEM;
  2052. }
  2053. /*
  2054. * Process an ABORT.
  2055. *
  2056. * Section: 9.1
  2057. * After checking the Verification Tag, the receiving endpoint shall
  2058. * remove the association from its record, and shall report the
  2059. * termination to its upper layer.
  2060. *
  2061. * Verification Tag: 8.5.1 Exceptions in Verification Tag Rules
  2062. * B) Rules for packet carrying ABORT:
  2063. *
  2064. * - The endpoint shall always fill in the Verification Tag field of the
  2065. * outbound packet with the destination endpoint's tag value if it
  2066. * is known.
  2067. *
  2068. * - If the ABORT is sent in response to an OOTB packet, the endpoint
  2069. * MUST follow the procedure described in Section 8.4.
  2070. *
  2071. * - The receiver MUST accept the packet if the Verification Tag
  2072. * matches either its own tag, OR the tag of its peer. Otherwise, the
  2073. * receiver MUST silently discard the packet and take no further
  2074. * action.
  2075. *
  2076. * Inputs
  2077. * (endpoint, asoc, chunk)
  2078. *
  2079. * Outputs
  2080. * (asoc, reply_msg, msg_up, timers, counters)
  2081. *
  2082. * The return value is the disposition of the chunk.
  2083. */
  2084. sctp_disposition_t sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep,
  2085. const struct sctp_association *asoc,
  2086. const sctp_subtype_t type,
  2087. void *arg,
  2088. sctp_cmd_seq_t *commands)
  2089. {
  2090. struct sctp_chunk *chunk = arg;
  2091. if (!sctp_vtag_verify_either(chunk, asoc))
  2092. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2093. /* Make sure that the ABORT chunk has a valid length.
  2094. * Since this is an ABORT chunk, we have to discard it
  2095. * because of the following text:
  2096. * RFC 2960, Section 3.3.7
  2097. * If an endpoint receives an ABORT with a format error or for an
  2098. * association that doesn't exist, it MUST silently discard it.
  2099. * Becasue the length is "invalid", we can't really discard just
  2100. * as we do not know its true length. So, to be safe, discard the
  2101. * packet.
  2102. */
  2103. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
  2104. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2105. /* ADD-IP: Special case for ABORT chunks
  2106. * F4) One special consideration is that ABORT Chunks arriving
  2107. * destined to the IP address being deleted MUST be
  2108. * ignored (see Section 5.3.1 for further details).
  2109. */
  2110. if (SCTP_ADDR_DEL ==
  2111. sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
  2112. return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
  2113. return __sctp_sf_do_9_1_abort(ep, asoc, type, arg, commands);
  2114. }
  2115. static sctp_disposition_t __sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep,
  2116. const struct sctp_association *asoc,
  2117. const sctp_subtype_t type,
  2118. void *arg,
  2119. sctp_cmd_seq_t *commands)
  2120. {
  2121. struct sctp_chunk *chunk = arg;
  2122. unsigned len;
  2123. __be16 error = SCTP_ERROR_NO_ERROR;
  2124. /* See if we have an error cause code in the chunk. */
  2125. len = ntohs(chunk->chunk_hdr->length);
  2126. if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
  2127. error = ((sctp_errhdr_t *)chunk->skb->data)->cause;
  2128. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(ECONNRESET));
  2129. /* ASSOC_FAILED will DELETE_TCB. */
  2130. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, SCTP_PERR(error));
  2131. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  2132. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  2133. return SCTP_DISPOSITION_ABORT;
  2134. }
  2135. /*
  2136. * Process an ABORT. (COOKIE-WAIT state)
  2137. *
  2138. * See sctp_sf_do_9_1_abort() above.
  2139. */
  2140. sctp_disposition_t sctp_sf_cookie_wait_abort(const struct sctp_endpoint *ep,
  2141. const struct sctp_association *asoc,
  2142. const sctp_subtype_t type,
  2143. void *arg,
  2144. sctp_cmd_seq_t *commands)
  2145. {
  2146. struct sctp_chunk *chunk = arg;
  2147. unsigned len;
  2148. __be16 error = SCTP_ERROR_NO_ERROR;
  2149. if (!sctp_vtag_verify_either(chunk, asoc))
  2150. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2151. /* Make sure that the ABORT chunk has a valid length.
  2152. * Since this is an ABORT chunk, we have to discard it
  2153. * because of the following text:
  2154. * RFC 2960, Section 3.3.7
  2155. * If an endpoint receives an ABORT with a format error or for an
  2156. * association that doesn't exist, it MUST silently discard it.
  2157. * Becasue the length is "invalid", we can't really discard just
  2158. * as we do not know its true length. So, to be safe, discard the
  2159. * packet.
  2160. */
  2161. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
  2162. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2163. /* See if we have an error cause code in the chunk. */
  2164. len = ntohs(chunk->chunk_hdr->length);
  2165. if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
  2166. error = ((sctp_errhdr_t *)chunk->skb->data)->cause;
  2167. return sctp_stop_t1_and_abort(commands, error, ECONNREFUSED, asoc,
  2168. chunk->transport);
  2169. }
  2170. /*
  2171. * Process an incoming ICMP as an ABORT. (COOKIE-WAIT state)
  2172. */
  2173. sctp_disposition_t sctp_sf_cookie_wait_icmp_abort(const struct sctp_endpoint *ep,
  2174. const struct sctp_association *asoc,
  2175. const sctp_subtype_t type,
  2176. void *arg,
  2177. sctp_cmd_seq_t *commands)
  2178. {
  2179. return sctp_stop_t1_and_abort(commands, SCTP_ERROR_NO_ERROR,
  2180. ENOPROTOOPT, asoc,
  2181. (struct sctp_transport *)arg);
  2182. }
  2183. /*
  2184. * Process an ABORT. (COOKIE-ECHOED state)
  2185. */
  2186. sctp_disposition_t sctp_sf_cookie_echoed_abort(const struct sctp_endpoint *ep,
  2187. const struct sctp_association *asoc,
  2188. const sctp_subtype_t type,
  2189. void *arg,
  2190. sctp_cmd_seq_t *commands)
  2191. {
  2192. /* There is a single T1 timer, so we should be able to use
  2193. * common function with the COOKIE-WAIT state.
  2194. */
  2195. return sctp_sf_cookie_wait_abort(ep, asoc, type, arg, commands);
  2196. }
  2197. /*
  2198. * Stop T1 timer and abort association with "INIT failed".
  2199. *
  2200. * This is common code called by several sctp_sf_*_abort() functions above.
  2201. */
  2202. static sctp_disposition_t sctp_stop_t1_and_abort(sctp_cmd_seq_t *commands,
  2203. __be16 error, int sk_err,
  2204. const struct sctp_association *asoc,
  2205. struct sctp_transport *transport)
  2206. {
  2207. SCTP_DEBUG_PRINTK("ABORT received (INIT).\n");
  2208. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  2209. SCTP_STATE(SCTP_STATE_CLOSED));
  2210. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  2211. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  2212. SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
  2213. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(sk_err));
  2214. /* CMD_INIT_FAILED will DELETE_TCB. */
  2215. sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
  2216. SCTP_PERR(error));
  2217. return SCTP_DISPOSITION_ABORT;
  2218. }
  2219. /*
  2220. * sctp_sf_do_9_2_shut
  2221. *
  2222. * Section: 9.2
  2223. * Upon the reception of the SHUTDOWN, the peer endpoint shall
  2224. * - enter the SHUTDOWN-RECEIVED state,
  2225. *
  2226. * - stop accepting new data from its SCTP user
  2227. *
  2228. * - verify, by checking the Cumulative TSN Ack field of the chunk,
  2229. * that all its outstanding DATA chunks have been received by the
  2230. * SHUTDOWN sender.
  2231. *
  2232. * Once an endpoint as reached the SHUTDOWN-RECEIVED state it MUST NOT
  2233. * send a SHUTDOWN in response to a ULP request. And should discard
  2234. * subsequent SHUTDOWN chunks.
  2235. *
  2236. * If there are still outstanding DATA chunks left, the SHUTDOWN
  2237. * receiver shall continue to follow normal data transmission
  2238. * procedures defined in Section 6 until all outstanding DATA chunks
  2239. * are acknowledged; however, the SHUTDOWN receiver MUST NOT accept
  2240. * new data from its SCTP user.
  2241. *
  2242. * Verification Tag: 8.5 Verification Tag [Normal verification]
  2243. *
  2244. * Inputs
  2245. * (endpoint, asoc, chunk)
  2246. *
  2247. * Outputs
  2248. * (asoc, reply_msg, msg_up, timers, counters)
  2249. *
  2250. * The return value is the disposition of the chunk.
  2251. */
  2252. sctp_disposition_t sctp_sf_do_9_2_shutdown(const struct sctp_endpoint *ep,
  2253. const struct sctp_association *asoc,
  2254. const sctp_subtype_t type,
  2255. void *arg,
  2256. sctp_cmd_seq_t *commands)
  2257. {
  2258. struct sctp_chunk *chunk = arg;
  2259. sctp_shutdownhdr_t *sdh;
  2260. sctp_disposition_t disposition;
  2261. struct sctp_ulpevent *ev;
  2262. __u32 ctsn;
  2263. if (!sctp_vtag_verify(chunk, asoc))
  2264. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2265. /* Make sure that the SHUTDOWN chunk has a valid length. */
  2266. if (!sctp_chunk_length_valid(chunk,
  2267. sizeof(struct sctp_shutdown_chunk_t)))
  2268. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  2269. commands);
  2270. /* Convert the elaborate header. */
  2271. sdh = (sctp_shutdownhdr_t *)chunk->skb->data;
  2272. skb_pull(chunk->skb, sizeof(sctp_shutdownhdr_t));
  2273. chunk->subh.shutdown_hdr = sdh;
  2274. ctsn = ntohl(sdh->cum_tsn_ack);
  2275. /* If Cumulative TSN Ack beyond the max tsn currently
  2276. * send, terminating the association and respond to the
  2277. * sender with an ABORT.
  2278. */
  2279. if (!TSN_lt(ctsn, asoc->next_tsn))
  2280. return sctp_sf_violation_ctsn(ep, asoc, type, arg, commands);
  2281. /* API 5.3.1.5 SCTP_SHUTDOWN_EVENT
  2282. * When a peer sends a SHUTDOWN, SCTP delivers this notification to
  2283. * inform the application that it should cease sending data.
  2284. */
  2285. ev = sctp_ulpevent_make_shutdown_event(asoc, 0, GFP_ATOMIC);
  2286. if (!ev) {
  2287. disposition = SCTP_DISPOSITION_NOMEM;
  2288. goto out;
  2289. }
  2290. sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
  2291. /* Upon the reception of the SHUTDOWN, the peer endpoint shall
  2292. * - enter the SHUTDOWN-RECEIVED state,
  2293. * - stop accepting new data from its SCTP user
  2294. *
  2295. * [This is implicit in the new state.]
  2296. */
  2297. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  2298. SCTP_STATE(SCTP_STATE_SHUTDOWN_RECEIVED));
  2299. disposition = SCTP_DISPOSITION_CONSUME;
  2300. if (sctp_outq_is_empty(&asoc->outqueue)) {
  2301. disposition = sctp_sf_do_9_2_shutdown_ack(ep, asoc, type,
  2302. arg, commands);
  2303. }
  2304. if (SCTP_DISPOSITION_NOMEM == disposition)
  2305. goto out;
  2306. /* - verify, by checking the Cumulative TSN Ack field of the
  2307. * chunk, that all its outstanding DATA chunks have been
  2308. * received by the SHUTDOWN sender.
  2309. */
  2310. sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_CTSN,
  2311. SCTP_BE32(chunk->subh.shutdown_hdr->cum_tsn_ack));
  2312. out:
  2313. return disposition;
  2314. }
  2315. /* RFC 2960 9.2
  2316. * If an endpoint is in SHUTDOWN-ACK-SENT state and receives an INIT chunk
  2317. * (e.g., if the SHUTDOWN COMPLETE was lost) with source and destination
  2318. * transport addresses (either in the IP addresses or in the INIT chunk)
  2319. * that belong to this association, it should discard the INIT chunk and
  2320. * retransmit the SHUTDOWN ACK chunk.
  2321. */
  2322. sctp_disposition_t sctp_sf_do_9_2_reshutack(const struct sctp_endpoint *ep,
  2323. const struct sctp_association *asoc,
  2324. const sctp_subtype_t type,
  2325. void *arg,
  2326. sctp_cmd_seq_t *commands)
  2327. {
  2328. struct sctp_chunk *chunk = (struct sctp_chunk *) arg;
  2329. struct sctp_chunk *reply;
  2330. /* Make sure that the chunk has a valid length */
  2331. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
  2332. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  2333. commands);
  2334. /* Since we are not going to really process this INIT, there
  2335. * is no point in verifying chunk boundries. Just generate
  2336. * the SHUTDOWN ACK.
  2337. */
  2338. reply = sctp_make_shutdown_ack(asoc, chunk);
  2339. if (NULL == reply)
  2340. goto nomem;
  2341. /* Set the transport for the SHUTDOWN ACK chunk and the timeout for
  2342. * the T2-SHUTDOWN timer.
  2343. */
  2344. sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
  2345. /* and restart the T2-shutdown timer. */
  2346. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
  2347. SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
  2348. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
  2349. return SCTP_DISPOSITION_CONSUME;
  2350. nomem:
  2351. return SCTP_DISPOSITION_NOMEM;
  2352. }
  2353. /*
  2354. * sctp_sf_do_ecn_cwr
  2355. *
  2356. * Section: Appendix A: Explicit Congestion Notification
  2357. *
  2358. * CWR:
  2359. *
  2360. * RFC 2481 details a specific bit for a sender to send in the header of
  2361. * its next outbound TCP segment to indicate to its peer that it has
  2362. * reduced its congestion window. This is termed the CWR bit. For
  2363. * SCTP the same indication is made by including the CWR chunk.
  2364. * This chunk contains one data element, i.e. the TSN number that
  2365. * was sent in the ECNE chunk. This element represents the lowest
  2366. * TSN number in the datagram that was originally marked with the
  2367. * CE bit.
  2368. *
  2369. * Verification Tag: 8.5 Verification Tag [Normal verification]
  2370. * Inputs
  2371. * (endpoint, asoc, chunk)
  2372. *
  2373. * Outputs
  2374. * (asoc, reply_msg, msg_up, timers, counters)
  2375. *
  2376. * The return value is the disposition of the chunk.
  2377. */
  2378. sctp_disposition_t sctp_sf_do_ecn_cwr(const struct sctp_endpoint *ep,
  2379. const struct sctp_association *asoc,
  2380. const sctp_subtype_t type,
  2381. void *arg,
  2382. sctp_cmd_seq_t *commands)
  2383. {
  2384. sctp_cwrhdr_t *cwr;
  2385. struct sctp_chunk *chunk = arg;
  2386. u32 lowest_tsn;
  2387. if (!sctp_vtag_verify(chunk, asoc))
  2388. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2389. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_ecne_chunk_t)))
  2390. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  2391. commands);
  2392. cwr = (sctp_cwrhdr_t *) chunk->skb->data;
  2393. skb_pull(chunk->skb, sizeof(sctp_cwrhdr_t));
  2394. lowest_tsn = ntohl(cwr->lowest_tsn);
  2395. /* Does this CWR ack the last sent congestion notification? */
  2396. if (TSN_lte(asoc->last_ecne_tsn, lowest_tsn)) {
  2397. /* Stop sending ECNE. */
  2398. sctp_add_cmd_sf(commands,
  2399. SCTP_CMD_ECN_CWR,
  2400. SCTP_U32(lowest_tsn));
  2401. }
  2402. return SCTP_DISPOSITION_CONSUME;
  2403. }
  2404. /*
  2405. * sctp_sf_do_ecne
  2406. *
  2407. * Section: Appendix A: Explicit Congestion Notification
  2408. *
  2409. * ECN-Echo
  2410. *
  2411. * RFC 2481 details a specific bit for a receiver to send back in its
  2412. * TCP acknowledgements to notify the sender of the Congestion
  2413. * Experienced (CE) bit having arrived from the network. For SCTP this
  2414. * same indication is made by including the ECNE chunk. This chunk
  2415. * contains one data element, i.e. the lowest TSN associated with the IP
  2416. * datagram marked with the CE bit.....
  2417. *
  2418. * Verification Tag: 8.5 Verification Tag [Normal verification]
  2419. * Inputs
  2420. * (endpoint, asoc, chunk)
  2421. *
  2422. * Outputs
  2423. * (asoc, reply_msg, msg_up, timers, counters)
  2424. *
  2425. * The return value is the disposition of the chunk.
  2426. */
  2427. sctp_disposition_t sctp_sf_do_ecne(const struct sctp_endpoint *ep,
  2428. const struct sctp_association *asoc,
  2429. const sctp_subtype_t type,
  2430. void *arg,
  2431. sctp_cmd_seq_t *commands)
  2432. {
  2433. sctp_ecnehdr_t *ecne;
  2434. struct sctp_chunk *chunk = arg;
  2435. if (!sctp_vtag_verify(chunk, asoc))
  2436. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2437. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_ecne_chunk_t)))
  2438. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  2439. commands);
  2440. ecne = (sctp_ecnehdr_t *) chunk->skb->data;
  2441. skb_pull(chunk->skb, sizeof(sctp_ecnehdr_t));
  2442. /* If this is a newer ECNE than the last CWR packet we sent out */
  2443. sctp_add_cmd_sf(commands, SCTP_CMD_ECN_ECNE,
  2444. SCTP_U32(ntohl(ecne->lowest_tsn)));
  2445. return SCTP_DISPOSITION_CONSUME;
  2446. }
  2447. /*
  2448. * Section: 6.2 Acknowledgement on Reception of DATA Chunks
  2449. *
  2450. * The SCTP endpoint MUST always acknowledge the reception of each valid
  2451. * DATA chunk.
  2452. *
  2453. * The guidelines on delayed acknowledgement algorithm specified in
  2454. * Section 4.2 of [RFC2581] SHOULD be followed. Specifically, an
  2455. * acknowledgement SHOULD be generated for at least every second packet
  2456. * (not every second DATA chunk) received, and SHOULD be generated within
  2457. * 200 ms of the arrival of any unacknowledged DATA chunk. In some
  2458. * situations it may be beneficial for an SCTP transmitter to be more
  2459. * conservative than the algorithms detailed in this document allow.
  2460. * However, an SCTP transmitter MUST NOT be more aggressive than the
  2461. * following algorithms allow.
  2462. *
  2463. * A SCTP receiver MUST NOT generate more than one SACK for every
  2464. * incoming packet, other than to update the offered window as the
  2465. * receiving application consumes new data.
  2466. *
  2467. * Verification Tag: 8.5 Verification Tag [Normal verification]
  2468. *
  2469. * Inputs
  2470. * (endpoint, asoc, chunk)
  2471. *
  2472. * Outputs
  2473. * (asoc, reply_msg, msg_up, timers, counters)
  2474. *
  2475. * The return value is the disposition of the chunk.
  2476. */
  2477. sctp_disposition_t sctp_sf_eat_data_6_2(const struct sctp_endpoint *ep,
  2478. const struct sctp_association *asoc,
  2479. const sctp_subtype_t type,
  2480. void *arg,
  2481. sctp_cmd_seq_t *commands)
  2482. {
  2483. struct sctp_chunk *chunk = arg;
  2484. int error;
  2485. if (!sctp_vtag_verify(chunk, asoc)) {
  2486. sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
  2487. SCTP_NULL());
  2488. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2489. }
  2490. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_data_chunk_t)))
  2491. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  2492. commands);
  2493. error = sctp_eat_data(asoc, chunk, commands );
  2494. switch (error) {
  2495. case SCTP_IERROR_NO_ERROR:
  2496. break;
  2497. case SCTP_IERROR_HIGH_TSN:
  2498. case SCTP_IERROR_BAD_STREAM:
  2499. SCTP_INC_STATS(SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
  2500. goto discard_noforce;
  2501. case SCTP_IERROR_DUP_TSN:
  2502. case SCTP_IERROR_IGNORE_TSN:
  2503. SCTP_INC_STATS(SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
  2504. goto discard_force;
  2505. case SCTP_IERROR_NO_DATA:
  2506. goto consume;
  2507. default:
  2508. BUG();
  2509. }
  2510. if (asoc->autoclose) {
  2511. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
  2512. SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
  2513. }
  2514. /* If this is the last chunk in a packet, we need to count it
  2515. * toward sack generation. Note that we need to SACK every
  2516. * OTHER packet containing data chunks, EVEN IF WE DISCARD
  2517. * THEM. We elect to NOT generate SACK's if the chunk fails
  2518. * the verification tag test.
  2519. *
  2520. * RFC 2960 6.2 Acknowledgement on Reception of DATA Chunks
  2521. *
  2522. * The SCTP endpoint MUST always acknowledge the reception of
  2523. * each valid DATA chunk.
  2524. *
  2525. * The guidelines on delayed acknowledgement algorithm
  2526. * specified in Section 4.2 of [RFC2581] SHOULD be followed.
  2527. * Specifically, an acknowledgement SHOULD be generated for at
  2528. * least every second packet (not every second DATA chunk)
  2529. * received, and SHOULD be generated within 200 ms of the
  2530. * arrival of any unacknowledged DATA chunk. In some
  2531. * situations it may be beneficial for an SCTP transmitter to
  2532. * be more conservative than the algorithms detailed in this
  2533. * document allow. However, an SCTP transmitter MUST NOT be
  2534. * more aggressive than the following algorithms allow.
  2535. */
  2536. if (chunk->end_of_packet)
  2537. sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_NOFORCE());
  2538. return SCTP_DISPOSITION_CONSUME;
  2539. discard_force:
  2540. /* RFC 2960 6.2 Acknowledgement on Reception of DATA Chunks
  2541. *
  2542. * When a packet arrives with duplicate DATA chunk(s) and with
  2543. * no new DATA chunk(s), the endpoint MUST immediately send a
  2544. * SACK with no delay. If a packet arrives with duplicate
  2545. * DATA chunk(s) bundled with new DATA chunks, the endpoint
  2546. * MAY immediately send a SACK. Normally receipt of duplicate
  2547. * DATA chunks will occur when the original SACK chunk was lost
  2548. * and the peer's RTO has expired. The duplicate TSN number(s)
  2549. * SHOULD be reported in the SACK as duplicate.
  2550. */
  2551. /* In our case, we split the MAY SACK advice up whether or not
  2552. * the last chunk is a duplicate.'
  2553. */
  2554. if (chunk->end_of_packet)
  2555. sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
  2556. return SCTP_DISPOSITION_DISCARD;
  2557. discard_noforce:
  2558. if (chunk->end_of_packet)
  2559. sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_NOFORCE());
  2560. return SCTP_DISPOSITION_DISCARD;
  2561. consume:
  2562. return SCTP_DISPOSITION_CONSUME;
  2563. }
  2564. /*
  2565. * sctp_sf_eat_data_fast_4_4
  2566. *
  2567. * Section: 4 (4)
  2568. * (4) In SHUTDOWN-SENT state the endpoint MUST acknowledge any received
  2569. * DATA chunks without delay.
  2570. *
  2571. * Verification Tag: 8.5 Verification Tag [Normal verification]
  2572. * Inputs
  2573. * (endpoint, asoc, chunk)
  2574. *
  2575. * Outputs
  2576. * (asoc, reply_msg, msg_up, timers, counters)
  2577. *
  2578. * The return value is the disposition of the chunk.
  2579. */
  2580. sctp_disposition_t sctp_sf_eat_data_fast_4_4(const struct sctp_endpoint *ep,
  2581. const struct sctp_association *asoc,
  2582. const sctp_subtype_t type,
  2583. void *arg,
  2584. sctp_cmd_seq_t *commands)
  2585. {
  2586. struct sctp_chunk *chunk = arg;
  2587. int error;
  2588. if (!sctp_vtag_verify(chunk, asoc)) {
  2589. sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
  2590. SCTP_NULL());
  2591. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2592. }
  2593. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_data_chunk_t)))
  2594. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  2595. commands);
  2596. error = sctp_eat_data(asoc, chunk, commands );
  2597. switch (error) {
  2598. case SCTP_IERROR_NO_ERROR:
  2599. case SCTP_IERROR_HIGH_TSN:
  2600. case SCTP_IERROR_DUP_TSN:
  2601. case SCTP_IERROR_IGNORE_TSN:
  2602. case SCTP_IERROR_BAD_STREAM:
  2603. break;
  2604. case SCTP_IERROR_NO_DATA:
  2605. goto consume;
  2606. default:
  2607. BUG();
  2608. }
  2609. /* Go a head and force a SACK, since we are shutting down. */
  2610. /* Implementor's Guide.
  2611. *
  2612. * While in SHUTDOWN-SENT state, the SHUTDOWN sender MUST immediately
  2613. * respond to each received packet containing one or more DATA chunk(s)
  2614. * with a SACK, a SHUTDOWN chunk, and restart the T2-shutdown timer
  2615. */
  2616. if (chunk->end_of_packet) {
  2617. /* We must delay the chunk creation since the cumulative
  2618. * TSN has not been updated yet.
  2619. */
  2620. sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SHUTDOWN, SCTP_NULL());
  2621. sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
  2622. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
  2623. SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
  2624. }
  2625. consume:
  2626. return SCTP_DISPOSITION_CONSUME;
  2627. }
  2628. /*
  2629. * Section: 6.2 Processing a Received SACK
  2630. * D) Any time a SACK arrives, the endpoint performs the following:
  2631. *
  2632. * i) If Cumulative TSN Ack is less than the Cumulative TSN Ack Point,
  2633. * then drop the SACK. Since Cumulative TSN Ack is monotonically
  2634. * increasing, a SACK whose Cumulative TSN Ack is less than the
  2635. * Cumulative TSN Ack Point indicates an out-of-order SACK.
  2636. *
  2637. * ii) Set rwnd equal to the newly received a_rwnd minus the number
  2638. * of bytes still outstanding after processing the Cumulative TSN Ack
  2639. * and the Gap Ack Blocks.
  2640. *
  2641. * iii) If the SACK is missing a TSN that was previously
  2642. * acknowledged via a Gap Ack Block (e.g., the data receiver
  2643. * reneged on the data), then mark the corresponding DATA chunk
  2644. * as available for retransmit: Mark it as missing for fast
  2645. * retransmit as described in Section 7.2.4 and if no retransmit
  2646. * timer is running for the destination address to which the DATA
  2647. * chunk was originally transmitted, then T3-rtx is started for
  2648. * that destination address.
  2649. *
  2650. * Verification Tag: 8.5 Verification Tag [Normal verification]
  2651. *
  2652. * Inputs
  2653. * (endpoint, asoc, chunk)
  2654. *
  2655. * Outputs
  2656. * (asoc, reply_msg, msg_up, timers, counters)
  2657. *
  2658. * The return value is the disposition of the chunk.
  2659. */
  2660. sctp_disposition_t sctp_sf_eat_sack_6_2(const struct sctp_endpoint *ep,
  2661. const struct sctp_association *asoc,
  2662. const sctp_subtype_t type,
  2663. void *arg,
  2664. sctp_cmd_seq_t *commands)
  2665. {
  2666. struct sctp_chunk *chunk = arg;
  2667. sctp_sackhdr_t *sackh;
  2668. __u32 ctsn;
  2669. if (!sctp_vtag_verify(chunk, asoc))
  2670. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2671. /* Make sure that the SACK chunk has a valid length. */
  2672. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_sack_chunk_t)))
  2673. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  2674. commands);
  2675. /* Pull the SACK chunk from the data buffer */
  2676. sackh = sctp_sm_pull_sack(chunk);
  2677. /* Was this a bogus SACK? */
  2678. if (!sackh)
  2679. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2680. chunk->subh.sack_hdr = sackh;
  2681. ctsn = ntohl(sackh->cum_tsn_ack);
  2682. /* i) If Cumulative TSN Ack is less than the Cumulative TSN
  2683. * Ack Point, then drop the SACK. Since Cumulative TSN
  2684. * Ack is monotonically increasing, a SACK whose
  2685. * Cumulative TSN Ack is less than the Cumulative TSN Ack
  2686. * Point indicates an out-of-order SACK.
  2687. */
  2688. if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
  2689. SCTP_DEBUG_PRINTK("ctsn %x\n", ctsn);
  2690. SCTP_DEBUG_PRINTK("ctsn_ack_point %x\n", asoc->ctsn_ack_point);
  2691. return SCTP_DISPOSITION_DISCARD;
  2692. }
  2693. /* If Cumulative TSN Ack beyond the max tsn currently
  2694. * send, terminating the association and respond to the
  2695. * sender with an ABORT.
  2696. */
  2697. if (!TSN_lt(ctsn, asoc->next_tsn))
  2698. return sctp_sf_violation_ctsn(ep, asoc, type, arg, commands);
  2699. /* Return this SACK for further processing. */
  2700. sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_SACK, SCTP_SACKH(sackh));
  2701. /* Note: We do the rest of the work on the PROCESS_SACK
  2702. * sideeffect.
  2703. */
  2704. return SCTP_DISPOSITION_CONSUME;
  2705. }
  2706. /*
  2707. * Generate an ABORT in response to a packet.
  2708. *
  2709. * Section: 8.4 Handle "Out of the blue" Packets, sctpimpguide 2.41
  2710. *
  2711. * 8) The receiver should respond to the sender of the OOTB packet with
  2712. * an ABORT. When sending the ABORT, the receiver of the OOTB packet
  2713. * MUST fill in the Verification Tag field of the outbound packet
  2714. * with the value found in the Verification Tag field of the OOTB
  2715. * packet and set the T-bit in the Chunk Flags to indicate that the
  2716. * Verification Tag is reflected. After sending this ABORT, the
  2717. * receiver of the OOTB packet shall discard the OOTB packet and take
  2718. * no further action.
  2719. *
  2720. * Verification Tag:
  2721. *
  2722. * The return value is the disposition of the chunk.
  2723. */
  2724. static sctp_disposition_t sctp_sf_tabort_8_4_8(const struct sctp_endpoint *ep,
  2725. const struct sctp_association *asoc,
  2726. const sctp_subtype_t type,
  2727. void *arg,
  2728. sctp_cmd_seq_t *commands)
  2729. {
  2730. struct sctp_packet *packet = NULL;
  2731. struct sctp_chunk *chunk = arg;
  2732. struct sctp_chunk *abort;
  2733. packet = sctp_ootb_pkt_new(asoc, chunk);
  2734. if (packet) {
  2735. /* Make an ABORT. The T bit will be set if the asoc
  2736. * is NULL.
  2737. */
  2738. abort = sctp_make_abort(asoc, chunk, 0);
  2739. if (!abort) {
  2740. sctp_ootb_pkt_free(packet);
  2741. return SCTP_DISPOSITION_NOMEM;
  2742. }
  2743. /* Reflect vtag if T-Bit is set */
  2744. if (sctp_test_T_bit(abort))
  2745. packet->vtag = ntohl(chunk->sctp_hdr->vtag);
  2746. /* Set the skb to the belonging sock for accounting. */
  2747. abort->skb->sk = ep->base.sk;
  2748. sctp_packet_append_chunk(packet, abort);
  2749. sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
  2750. SCTP_PACKET(packet));
  2751. SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
  2752. sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2753. return SCTP_DISPOSITION_CONSUME;
  2754. }
  2755. return SCTP_DISPOSITION_NOMEM;
  2756. }
  2757. /*
  2758. * Received an ERROR chunk from peer. Generate SCTP_REMOTE_ERROR
  2759. * event as ULP notification for each cause included in the chunk.
  2760. *
  2761. * API 5.3.1.3 - SCTP_REMOTE_ERROR
  2762. *
  2763. * The return value is the disposition of the chunk.
  2764. */
  2765. sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep,
  2766. const struct sctp_association *asoc,
  2767. const sctp_subtype_t type,
  2768. void *arg,
  2769. sctp_cmd_seq_t *commands)
  2770. {
  2771. struct sctp_chunk *chunk = arg;
  2772. struct sctp_ulpevent *ev;
  2773. if (!sctp_vtag_verify(chunk, asoc))
  2774. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2775. /* Make sure that the ERROR chunk has a valid length. */
  2776. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_operr_chunk_t)))
  2777. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  2778. commands);
  2779. while (chunk->chunk_end > chunk->skb->data) {
  2780. ev = sctp_ulpevent_make_remote_error(asoc, chunk, 0,
  2781. GFP_ATOMIC);
  2782. if (!ev)
  2783. goto nomem;
  2784. sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
  2785. SCTP_ULPEVENT(ev));
  2786. sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,
  2787. SCTP_CHUNK(chunk));
  2788. }
  2789. return SCTP_DISPOSITION_CONSUME;
  2790. nomem:
  2791. return SCTP_DISPOSITION_NOMEM;
  2792. }
  2793. /*
  2794. * Process an inbound SHUTDOWN ACK.
  2795. *
  2796. * From Section 9.2:
  2797. * Upon the receipt of the SHUTDOWN ACK, the SHUTDOWN sender shall
  2798. * stop the T2-shutdown timer, send a SHUTDOWN COMPLETE chunk to its
  2799. * peer, and remove all record of the association.
  2800. *
  2801. * The return value is the disposition.
  2802. */
  2803. sctp_disposition_t sctp_sf_do_9_2_final(const struct sctp_endpoint *ep,
  2804. const struct sctp_association *asoc,
  2805. const sctp_subtype_t type,
  2806. void *arg,
  2807. sctp_cmd_seq_t *commands)
  2808. {
  2809. struct sctp_chunk *chunk = arg;
  2810. struct sctp_chunk *reply;
  2811. struct sctp_ulpevent *ev;
  2812. if (!sctp_vtag_verify(chunk, asoc))
  2813. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2814. /* Make sure that the SHUTDOWN_ACK chunk has a valid length. */
  2815. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
  2816. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  2817. commands);
  2818. /* 10.2 H) SHUTDOWN COMPLETE notification
  2819. *
  2820. * When SCTP completes the shutdown procedures (section 9.2) this
  2821. * notification is passed to the upper layer.
  2822. */
  2823. ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_SHUTDOWN_COMP,
  2824. 0, 0, 0, NULL, GFP_ATOMIC);
  2825. if (!ev)
  2826. goto nomem;
  2827. /* ...send a SHUTDOWN COMPLETE chunk to its peer, */
  2828. reply = sctp_make_shutdown_complete(asoc, chunk);
  2829. if (!reply)
  2830. goto nomem_chunk;
  2831. /* Do all the commands now (after allocation), so that we
  2832. * have consistent state if memory allocation failes
  2833. */
  2834. sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
  2835. /* Upon the receipt of the SHUTDOWN ACK, the SHUTDOWN sender shall
  2836. * stop the T2-shutdown timer,
  2837. */
  2838. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  2839. SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
  2840. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  2841. SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
  2842. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  2843. SCTP_STATE(SCTP_STATE_CLOSED));
  2844. SCTP_INC_STATS(SCTP_MIB_SHUTDOWNS);
  2845. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  2846. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
  2847. /* ...and remove all record of the association. */
  2848. sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
  2849. return SCTP_DISPOSITION_DELETE_TCB;
  2850. nomem_chunk:
  2851. sctp_ulpevent_free(ev);
  2852. nomem:
  2853. return SCTP_DISPOSITION_NOMEM;
  2854. }
  2855. /*
  2856. * RFC 2960, 8.4 - Handle "Out of the blue" Packets, sctpimpguide 2.41.
  2857. *
  2858. * 5) If the packet contains a SHUTDOWN ACK chunk, the receiver should
  2859. * respond to the sender of the OOTB packet with a SHUTDOWN COMPLETE.
  2860. * When sending the SHUTDOWN COMPLETE, the receiver of the OOTB
  2861. * packet must fill in the Verification Tag field of the outbound
  2862. * packet with the Verification Tag received in the SHUTDOWN ACK and
  2863. * set the T-bit in the Chunk Flags to indicate that the Verification
  2864. * Tag is reflected.
  2865. *
  2866. * 8) The receiver should respond to the sender of the OOTB packet with
  2867. * an ABORT. When sending the ABORT, the receiver of the OOTB packet
  2868. * MUST fill in the Verification Tag field of the outbound packet
  2869. * with the value found in the Verification Tag field of the OOTB
  2870. * packet and set the T-bit in the Chunk Flags to indicate that the
  2871. * Verification Tag is reflected. After sending this ABORT, the
  2872. * receiver of the OOTB packet shall discard the OOTB packet and take
  2873. * no further action.
  2874. */
  2875. sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep,
  2876. const struct sctp_association *asoc,
  2877. const sctp_subtype_t type,
  2878. void *arg,
  2879. sctp_cmd_seq_t *commands)
  2880. {
  2881. struct sctp_chunk *chunk = arg;
  2882. struct sk_buff *skb = chunk->skb;
  2883. sctp_chunkhdr_t *ch;
  2884. __u8 *ch_end;
  2885. int ootb_shut_ack = 0;
  2886. SCTP_INC_STATS(SCTP_MIB_OUTOFBLUES);
  2887. ch = (sctp_chunkhdr_t *) chunk->chunk_hdr;
  2888. do {
  2889. /* Report violation if the chunk is less then minimal */
  2890. if (ntohs(ch->length) < sizeof(sctp_chunkhdr_t))
  2891. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  2892. commands);
  2893. /* Now that we know we at least have a chunk header,
  2894. * do things that are type appropriate.
  2895. */
  2896. if (SCTP_CID_SHUTDOWN_ACK == ch->type)
  2897. ootb_shut_ack = 1;
  2898. /* RFC 2960, Section 3.3.7
  2899. * Moreover, under any circumstances, an endpoint that
  2900. * receives an ABORT MUST NOT respond to that ABORT by
  2901. * sending an ABORT of its own.
  2902. */
  2903. if (SCTP_CID_ABORT == ch->type)
  2904. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2905. /* Report violation if chunk len overflows */
  2906. ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length));
  2907. if (ch_end > skb_tail_pointer(skb))
  2908. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  2909. commands);
  2910. ch = (sctp_chunkhdr_t *) ch_end;
  2911. } while (ch_end < skb_tail_pointer(skb));
  2912. if (ootb_shut_ack)
  2913. return sctp_sf_shut_8_4_5(ep, asoc, type, arg, commands);
  2914. else
  2915. return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
  2916. }
  2917. /*
  2918. * Handle an "Out of the blue" SHUTDOWN ACK.
  2919. *
  2920. * Section: 8.4 5, sctpimpguide 2.41.
  2921. *
  2922. * 5) If the packet contains a SHUTDOWN ACK chunk, the receiver should
  2923. * respond to the sender of the OOTB packet with a SHUTDOWN COMPLETE.
  2924. * When sending the SHUTDOWN COMPLETE, the receiver of the OOTB
  2925. * packet must fill in the Verification Tag field of the outbound
  2926. * packet with the Verification Tag received in the SHUTDOWN ACK and
  2927. * set the T-bit in the Chunk Flags to indicate that the Verification
  2928. * Tag is reflected.
  2929. *
  2930. * Inputs
  2931. * (endpoint, asoc, type, arg, commands)
  2932. *
  2933. * Outputs
  2934. * (sctp_disposition_t)
  2935. *
  2936. * The return value is the disposition of the chunk.
  2937. */
  2938. static sctp_disposition_t sctp_sf_shut_8_4_5(const struct sctp_endpoint *ep,
  2939. const struct sctp_association *asoc,
  2940. const sctp_subtype_t type,
  2941. void *arg,
  2942. sctp_cmd_seq_t *commands)
  2943. {
  2944. struct sctp_packet *packet = NULL;
  2945. struct sctp_chunk *chunk = arg;
  2946. struct sctp_chunk *shut;
  2947. packet = sctp_ootb_pkt_new(asoc, chunk);
  2948. if (packet) {
  2949. /* Make an SHUTDOWN_COMPLETE.
  2950. * The T bit will be set if the asoc is NULL.
  2951. */
  2952. shut = sctp_make_shutdown_complete(asoc, chunk);
  2953. if (!shut) {
  2954. sctp_ootb_pkt_free(packet);
  2955. return SCTP_DISPOSITION_NOMEM;
  2956. }
  2957. /* Reflect vtag if T-Bit is set */
  2958. if (sctp_test_T_bit(shut))
  2959. packet->vtag = ntohl(chunk->sctp_hdr->vtag);
  2960. /* Set the skb to the belonging sock for accounting. */
  2961. shut->skb->sk = ep->base.sk;
  2962. sctp_packet_append_chunk(packet, shut);
  2963. sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
  2964. SCTP_PACKET(packet));
  2965. SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
  2966. /* If the chunk length is invalid, we don't want to process
  2967. * the reset of the packet.
  2968. */
  2969. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
  2970. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2971. /* We need to discard the rest of the packet to prevent
  2972. * potential bomming attacks from additional bundled chunks.
  2973. * This is documented in SCTP Threats ID.
  2974. */
  2975. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2976. }
  2977. return SCTP_DISPOSITION_NOMEM;
  2978. }
  2979. /*
  2980. * Handle SHUTDOWN ACK in COOKIE_ECHOED or COOKIE_WAIT state.
  2981. *
  2982. * Verification Tag: 8.5.1 E) Rules for packet carrying a SHUTDOWN ACK
  2983. * If the receiver is in COOKIE-ECHOED or COOKIE-WAIT state the
  2984. * procedures in section 8.4 SHOULD be followed, in other words it
  2985. * should be treated as an Out Of The Blue packet.
  2986. * [This means that we do NOT check the Verification Tag on these
  2987. * chunks. --piggy ]
  2988. *
  2989. */
  2990. sctp_disposition_t sctp_sf_do_8_5_1_E_sa(const struct sctp_endpoint *ep,
  2991. const struct sctp_association *asoc,
  2992. const sctp_subtype_t type,
  2993. void *arg,
  2994. sctp_cmd_seq_t *commands)
  2995. {
  2996. struct sctp_chunk *chunk = arg;
  2997. /* Make sure that the SHUTDOWN_ACK chunk has a valid length. */
  2998. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
  2999. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  3000. commands);
  3001. /* Although we do have an association in this case, it corresponds
  3002. * to a restarted association. So the packet is treated as an OOTB
  3003. * packet and the state function that handles OOTB SHUTDOWN_ACK is
  3004. * called with a NULL association.
  3005. */
  3006. SCTP_INC_STATS(SCTP_MIB_OUTOFBLUES);
  3007. return sctp_sf_shut_8_4_5(ep, NULL, type, arg, commands);
  3008. }
  3009. /* ADDIP Section 4.2 Upon reception of an ASCONF Chunk. */
  3010. sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep,
  3011. const struct sctp_association *asoc,
  3012. const sctp_subtype_t type, void *arg,
  3013. sctp_cmd_seq_t *commands)
  3014. {
  3015. struct sctp_chunk *chunk = arg;
  3016. struct sctp_chunk *asconf_ack = NULL;
  3017. struct sctp_paramhdr *err_param = NULL;
  3018. sctp_addiphdr_t *hdr;
  3019. union sctp_addr_param *addr_param;
  3020. __u32 serial;
  3021. int length;
  3022. if (!sctp_vtag_verify(chunk, asoc)) {
  3023. sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
  3024. SCTP_NULL());
  3025. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  3026. }
  3027. /* ADD-IP: Section 4.1.1
  3028. * This chunk MUST be sent in an authenticated way by using
  3029. * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk
  3030. * is received unauthenticated it MUST be silently discarded as
  3031. * described in [I-D.ietf-tsvwg-sctp-auth].
  3032. */
  3033. if (!sctp_addip_noauth && !chunk->auth)
  3034. return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
  3035. /* Make sure that the ASCONF ADDIP chunk has a valid length. */
  3036. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_addip_chunk_t)))
  3037. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  3038. commands);
  3039. hdr = (sctp_addiphdr_t *)chunk->skb->data;
  3040. serial = ntohl(hdr->serial);
  3041. addr_param = (union sctp_addr_param *)hdr->params;
  3042. length = ntohs(addr_param->p.length);
  3043. if (length < sizeof(sctp_paramhdr_t))
  3044. return sctp_sf_violation_paramlen(ep, asoc, type, arg,
  3045. (void *)addr_param, commands);
  3046. /* Verify the ASCONF chunk before processing it. */
  3047. if (!sctp_verify_asconf(asoc,
  3048. (sctp_paramhdr_t *)((void *)addr_param + length),
  3049. (void *)chunk->chunk_end,
  3050. &err_param))
  3051. return sctp_sf_violation_paramlen(ep, asoc, type, arg,
  3052. (void *)err_param, commands);
  3053. /* ADDIP 5.2 E1) Compare the value of the serial number to the value
  3054. * the endpoint stored in a new association variable
  3055. * 'Peer-Serial-Number'.
  3056. */
  3057. if (serial == asoc->peer.addip_serial + 1) {
  3058. /* If this is the first instance of ASCONF in the packet,
  3059. * we can clean our old ASCONF-ACKs.
  3060. */
  3061. if (!chunk->has_asconf)
  3062. sctp_assoc_clean_asconf_ack_cache(asoc);
  3063. /* ADDIP 5.2 E4) When the Sequence Number matches the next one
  3064. * expected, process the ASCONF as described below and after
  3065. * processing the ASCONF Chunk, append an ASCONF-ACK Chunk to
  3066. * the response packet and cache a copy of it (in the event it
  3067. * later needs to be retransmitted).
  3068. *
  3069. * Essentially, do V1-V5.
  3070. */
  3071. asconf_ack = sctp_process_asconf((struct sctp_association *)
  3072. asoc, chunk);
  3073. if (!asconf_ack)
  3074. return SCTP_DISPOSITION_NOMEM;
  3075. } else if (serial < asoc->peer.addip_serial + 1) {
  3076. /* ADDIP 5.2 E2)
  3077. * If the value found in the Sequence Number is less than the
  3078. * ('Peer- Sequence-Number' + 1), simply skip to the next
  3079. * ASCONF, and include in the outbound response packet
  3080. * any previously cached ASCONF-ACK response that was
  3081. * sent and saved that matches the Sequence Number of the
  3082. * ASCONF. Note: It is possible that no cached ASCONF-ACK
  3083. * Chunk exists. This will occur when an older ASCONF
  3084. * arrives out of order. In such a case, the receiver
  3085. * should skip the ASCONF Chunk and not include ASCONF-ACK
  3086. * Chunk for that chunk.
  3087. */
  3088. asconf_ack = sctp_assoc_lookup_asconf_ack(asoc, hdr->serial);
  3089. if (!asconf_ack)
  3090. return SCTP_DISPOSITION_DISCARD;
  3091. } else {
  3092. /* ADDIP 5.2 E5) Otherwise, the ASCONF Chunk is discarded since
  3093. * it must be either a stale packet or from an attacker.
  3094. */
  3095. return SCTP_DISPOSITION_DISCARD;
  3096. }
  3097. /* ADDIP 5.2 E6) The destination address of the SCTP packet
  3098. * containing the ASCONF-ACK Chunks MUST be the source address of
  3099. * the SCTP packet that held the ASCONF Chunks.
  3100. *
  3101. * To do this properly, we'll set the destination address of the chunk
  3102. * and at the transmit time, will try look up the transport to use.
  3103. * Since ASCONFs may be bundled, the correct transport may not be
  3104. * created untill we process the entire packet, thus this workaround.
  3105. */
  3106. asconf_ack->dest = chunk->source;
  3107. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(asconf_ack));
  3108. return SCTP_DISPOSITION_CONSUME;
  3109. }
  3110. /*
  3111. * ADDIP Section 4.3 General rules for address manipulation
  3112. * When building TLV parameters for the ASCONF Chunk that will add or
  3113. * delete IP addresses the D0 to D13 rules should be applied:
  3114. */
  3115. sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
  3116. const struct sctp_association *asoc,
  3117. const sctp_subtype_t type, void *arg,
  3118. sctp_cmd_seq_t *commands)
  3119. {
  3120. struct sctp_chunk *asconf_ack = arg;
  3121. struct sctp_chunk *last_asconf = asoc->addip_last_asconf;
  3122. struct sctp_chunk *abort;
  3123. struct sctp_paramhdr *err_param = NULL;
  3124. sctp_addiphdr_t *addip_hdr;
  3125. __u32 sent_serial, rcvd_serial;
  3126. if (!sctp_vtag_verify(asconf_ack, asoc)) {
  3127. sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
  3128. SCTP_NULL());
  3129. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  3130. }
  3131. /* ADD-IP, Section 4.1.2:
  3132. * This chunk MUST be sent in an authenticated way by using
  3133. * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk
  3134. * is received unauthenticated it MUST be silently discarded as
  3135. * described in [I-D.ietf-tsvwg-sctp-auth].
  3136. */
  3137. if (!sctp_addip_noauth && !asconf_ack->auth)
  3138. return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
  3139. /* Make sure that the ADDIP chunk has a valid length. */
  3140. if (!sctp_chunk_length_valid(asconf_ack, sizeof(sctp_addip_chunk_t)))
  3141. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  3142. commands);
  3143. addip_hdr = (sctp_addiphdr_t *)asconf_ack->skb->data;
  3144. rcvd_serial = ntohl(addip_hdr->serial);
  3145. /* Verify the ASCONF-ACK chunk before processing it. */
  3146. if (!sctp_verify_asconf(asoc,
  3147. (sctp_paramhdr_t *)addip_hdr->params,
  3148. (void *)asconf_ack->chunk_end,
  3149. &err_param))
  3150. return sctp_sf_violation_paramlen(ep, asoc, type, arg,
  3151. (void *)err_param, commands);
  3152. if (last_asconf) {
  3153. addip_hdr = (sctp_addiphdr_t *)last_asconf->subh.addip_hdr;
  3154. sent_serial = ntohl(addip_hdr->serial);
  3155. } else {
  3156. sent_serial = asoc->addip_serial - 1;
  3157. }
  3158. /* D0) If an endpoint receives an ASCONF-ACK that is greater than or
  3159. * equal to the next serial number to be used but no ASCONF chunk is
  3160. * outstanding the endpoint MUST ABORT the association. Note that a
  3161. * sequence number is greater than if it is no more than 2^^31-1
  3162. * larger than the current sequence number (using serial arithmetic).
  3163. */
  3164. if (ADDIP_SERIAL_gte(rcvd_serial, sent_serial + 1) &&
  3165. !(asoc->addip_last_asconf)) {
  3166. abort = sctp_make_abort(asoc, asconf_ack,
  3167. sizeof(sctp_errhdr_t));
  3168. if (abort) {
  3169. sctp_init_cause(abort, SCTP_ERROR_ASCONF_ACK, 0);
  3170. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
  3171. SCTP_CHUNK(abort));
  3172. }
  3173. /* We are going to ABORT, so we might as well stop
  3174. * processing the rest of the chunks in the packet.
  3175. */
  3176. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  3177. SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
  3178. sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
  3179. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  3180. SCTP_ERROR(ECONNABORTED));
  3181. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
  3182. SCTP_PERR(SCTP_ERROR_ASCONF_ACK));
  3183. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  3184. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  3185. return SCTP_DISPOSITION_ABORT;
  3186. }
  3187. if ((rcvd_serial == sent_serial) && asoc->addip_last_asconf) {
  3188. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  3189. SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
  3190. if (!sctp_process_asconf_ack((struct sctp_association *)asoc,
  3191. asconf_ack))
  3192. return SCTP_DISPOSITION_CONSUME;
  3193. abort = sctp_make_abort(asoc, asconf_ack,
  3194. sizeof(sctp_errhdr_t));
  3195. if (abort) {
  3196. sctp_init_cause(abort, SCTP_ERROR_RSRC_LOW, 0);
  3197. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
  3198. SCTP_CHUNK(abort));
  3199. }
  3200. /* We are going to ABORT, so we might as well stop
  3201. * processing the rest of the chunks in the packet.
  3202. */
  3203. sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
  3204. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  3205. SCTP_ERROR(ECONNABORTED));
  3206. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
  3207. SCTP_PERR(SCTP_ERROR_ASCONF_ACK));
  3208. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  3209. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  3210. return SCTP_DISPOSITION_ABORT;
  3211. }
  3212. return SCTP_DISPOSITION_DISCARD;
  3213. }
  3214. /*
  3215. * PR-SCTP Section 3.6 Receiver Side Implementation of PR-SCTP
  3216. *
  3217. * When a FORWARD TSN chunk arrives, the data receiver MUST first update
  3218. * its cumulative TSN point to the value carried in the FORWARD TSN
  3219. * chunk, and then MUST further advance its cumulative TSN point locally
  3220. * if possible.
  3221. * After the above processing, the data receiver MUST stop reporting any
  3222. * missing TSNs earlier than or equal to the new cumulative TSN point.
  3223. *
  3224. * Verification Tag: 8.5 Verification Tag [Normal verification]
  3225. *
  3226. * The return value is the disposition of the chunk.
  3227. */
  3228. sctp_disposition_t sctp_sf_eat_fwd_tsn(const struct sctp_endpoint *ep,
  3229. const struct sctp_association *asoc,
  3230. const sctp_subtype_t type,
  3231. void *arg,
  3232. sctp_cmd_seq_t *commands)
  3233. {
  3234. struct sctp_chunk *chunk = arg;
  3235. struct sctp_fwdtsn_hdr *fwdtsn_hdr;
  3236. __u16 len;
  3237. __u32 tsn;
  3238. if (!sctp_vtag_verify(chunk, asoc)) {
  3239. sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
  3240. SCTP_NULL());
  3241. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  3242. }
  3243. /* Make sure that the FORWARD_TSN chunk has valid length. */
  3244. if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_fwdtsn_chunk)))
  3245. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  3246. commands);
  3247. fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data;
  3248. chunk->subh.fwdtsn_hdr = fwdtsn_hdr;
  3249. len = ntohs(chunk->chunk_hdr->length);
  3250. len -= sizeof(struct sctp_chunkhdr);
  3251. skb_pull(chunk->skb, len);
  3252. tsn = ntohl(fwdtsn_hdr->new_cum_tsn);
  3253. SCTP_DEBUG_PRINTK("%s: TSN 0x%x.\n", __func__, tsn);
  3254. /* The TSN is too high--silently discard the chunk and count on it
  3255. * getting retransmitted later.
  3256. */
  3257. if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
  3258. goto discard_noforce;
  3259. sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
  3260. if (len > sizeof(struct sctp_fwdtsn_hdr))
  3261. sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
  3262. SCTP_CHUNK(chunk));
  3263. /* Count this as receiving DATA. */
  3264. if (asoc->autoclose) {
  3265. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
  3266. SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
  3267. }
  3268. /* FIXME: For now send a SACK, but DATA processing may
  3269. * send another.
  3270. */
  3271. sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_NOFORCE());
  3272. return SCTP_DISPOSITION_CONSUME;
  3273. discard_noforce:
  3274. return SCTP_DISPOSITION_DISCARD;
  3275. }
  3276. sctp_disposition_t sctp_sf_eat_fwd_tsn_fast(
  3277. const struct sctp_endpoint *ep,
  3278. const struct sctp_association *asoc,
  3279. const sctp_subtype_t type,
  3280. void *arg,
  3281. sctp_cmd_seq_t *commands)
  3282. {
  3283. struct sctp_chunk *chunk = arg;
  3284. struct sctp_fwdtsn_hdr *fwdtsn_hdr;
  3285. __u16 len;
  3286. __u32 tsn;
  3287. if (!sctp_vtag_verify(chunk, asoc)) {
  3288. sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
  3289. SCTP_NULL());
  3290. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  3291. }
  3292. /* Make sure that the FORWARD_TSN chunk has a valid length. */
  3293. if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_fwdtsn_chunk)))
  3294. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  3295. commands);
  3296. fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data;
  3297. chunk->subh.fwdtsn_hdr = fwdtsn_hdr;
  3298. len = ntohs(chunk->chunk_hdr->length);
  3299. len -= sizeof(struct sctp_chunkhdr);
  3300. skb_pull(chunk->skb, len);
  3301. tsn = ntohl(fwdtsn_hdr->new_cum_tsn);
  3302. SCTP_DEBUG_PRINTK("%s: TSN 0x%x.\n", __func__, tsn);
  3303. /* The TSN is too high--silently discard the chunk and count on it
  3304. * getting retransmitted later.
  3305. */
  3306. if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
  3307. goto gen_shutdown;
  3308. sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
  3309. if (len > sizeof(struct sctp_fwdtsn_hdr))
  3310. sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
  3311. SCTP_CHUNK(chunk));
  3312. /* Go a head and force a SACK, since we are shutting down. */
  3313. gen_shutdown:
  3314. /* Implementor's Guide.
  3315. *
  3316. * While in SHUTDOWN-SENT state, the SHUTDOWN sender MUST immediately
  3317. * respond to each received packet containing one or more DATA chunk(s)
  3318. * with a SACK, a SHUTDOWN chunk, and restart the T2-shutdown timer
  3319. */
  3320. sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SHUTDOWN, SCTP_NULL());
  3321. sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
  3322. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
  3323. SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
  3324. return SCTP_DISPOSITION_CONSUME;
  3325. }
  3326. /*
  3327. * SCTP-AUTH Section 6.3 Receving authenticated chukns
  3328. *
  3329. * The receiver MUST use the HMAC algorithm indicated in the HMAC
  3330. * Identifier field. If this algorithm was not specified by the
  3331. * receiver in the HMAC-ALGO parameter in the INIT or INIT-ACK chunk
  3332. * during association setup, the AUTH chunk and all chunks after it MUST
  3333. * be discarded and an ERROR chunk SHOULD be sent with the error cause
  3334. * defined in Section 4.1.
  3335. *
  3336. * If an endpoint with no shared key receives a Shared Key Identifier
  3337. * other than 0, it MUST silently discard all authenticated chunks. If
  3338. * the endpoint has at least one endpoint pair shared key for the peer,
  3339. * it MUST use the key specified by the Shared Key Identifier if a
  3340. * key has been configured for that Shared Key Identifier. If no
  3341. * endpoint pair shared key has been configured for that Shared Key
  3342. * Identifier, all authenticated chunks MUST be silently discarded.
  3343. *
  3344. * Verification Tag: 8.5 Verification Tag [Normal verification]
  3345. *
  3346. * The return value is the disposition of the chunk.
  3347. */
  3348. static sctp_ierror_t sctp_sf_authenticate(const struct sctp_endpoint *ep,
  3349. const struct sctp_association *asoc,
  3350. const sctp_subtype_t type,
  3351. struct sctp_chunk *chunk)
  3352. {
  3353. struct sctp_authhdr *auth_hdr;
  3354. struct sctp_hmac *hmac;
  3355. unsigned int sig_len;
  3356. __u16 key_id;
  3357. __u8 *save_digest;
  3358. __u8 *digest;
  3359. /* Pull in the auth header, so we can do some more verification */
  3360. auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
  3361. chunk->subh.auth_hdr = auth_hdr;
  3362. skb_pull(chunk->skb, sizeof(struct sctp_authhdr));
  3363. /* Make sure that we suport the HMAC algorithm from the auth
  3364. * chunk.
  3365. */
  3366. if (!sctp_auth_asoc_verify_hmac_id(asoc, auth_hdr->hmac_id))
  3367. return SCTP_IERROR_AUTH_BAD_HMAC;
  3368. /* Make sure that the provided shared key identifier has been
  3369. * configured
  3370. */
  3371. key_id = ntohs(auth_hdr->shkey_id);
  3372. if (key_id != asoc->active_key_id && !sctp_auth_get_shkey(asoc, key_id))
  3373. return SCTP_IERROR_AUTH_BAD_KEYID;
  3374. /* Make sure that the length of the signature matches what
  3375. * we expect.
  3376. */
  3377. sig_len = ntohs(chunk->chunk_hdr->length) - sizeof(sctp_auth_chunk_t);
  3378. hmac = sctp_auth_get_hmac(ntohs(auth_hdr->hmac_id));
  3379. if (sig_len != hmac->hmac_len)
  3380. return SCTP_IERROR_PROTO_VIOLATION;
  3381. /* Now that we've done validation checks, we can compute and
  3382. * verify the hmac. The steps involved are:
  3383. * 1. Save the digest from the chunk.
  3384. * 2. Zero out the digest in the chunk.
  3385. * 3. Compute the new digest
  3386. * 4. Compare saved and new digests.
  3387. */
  3388. digest = auth_hdr->hmac;
  3389. skb_pull(chunk->skb, sig_len);
  3390. save_digest = kmemdup(digest, sig_len, GFP_ATOMIC);
  3391. if (!save_digest)
  3392. goto nomem;
  3393. memset(digest, 0, sig_len);
  3394. sctp_auth_calculate_hmac(asoc, chunk->skb,
  3395. (struct sctp_auth_chunk *)chunk->chunk_hdr,
  3396. GFP_ATOMIC);
  3397. /* Discard the packet if the digests do not match */
  3398. if (memcmp(save_digest, digest, sig_len)) {
  3399. kfree(save_digest);
  3400. return SCTP_IERROR_BAD_SIG;
  3401. }
  3402. kfree(save_digest);
  3403. chunk->auth = 1;
  3404. return SCTP_IERROR_NO_ERROR;
  3405. nomem:
  3406. return SCTP_IERROR_NOMEM;
  3407. }
  3408. sctp_disposition_t sctp_sf_eat_auth(const struct sctp_endpoint *ep,
  3409. const struct sctp_association *asoc,
  3410. const sctp_subtype_t type,
  3411. void *arg,
  3412. sctp_cmd_seq_t *commands)
  3413. {
  3414. struct sctp_authhdr *auth_hdr;
  3415. struct sctp_chunk *chunk = arg;
  3416. struct sctp_chunk *err_chunk;
  3417. sctp_ierror_t error;
  3418. /* Make sure that the peer has AUTH capable */
  3419. if (!asoc->peer.auth_capable)
  3420. return sctp_sf_unk_chunk(ep, asoc, type, arg, commands);
  3421. if (!sctp_vtag_verify(chunk, asoc)) {
  3422. sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
  3423. SCTP_NULL());
  3424. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  3425. }
  3426. /* Make sure that the AUTH chunk has valid length. */
  3427. if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_auth_chunk)))
  3428. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  3429. commands);
  3430. auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
  3431. error = sctp_sf_authenticate(ep, asoc, type, chunk);
  3432. switch (error) {
  3433. case SCTP_IERROR_AUTH_BAD_HMAC:
  3434. /* Generate the ERROR chunk and discard the rest
  3435. * of the packet
  3436. */
  3437. err_chunk = sctp_make_op_error(asoc, chunk,
  3438. SCTP_ERROR_UNSUP_HMAC,
  3439. &auth_hdr->hmac_id,
  3440. sizeof(__u16));
  3441. if (err_chunk) {
  3442. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
  3443. SCTP_CHUNK(err_chunk));
  3444. }
  3445. /* Fall Through */
  3446. case SCTP_IERROR_AUTH_BAD_KEYID:
  3447. case SCTP_IERROR_BAD_SIG:
  3448. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  3449. break;
  3450. case SCTP_IERROR_PROTO_VIOLATION:
  3451. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  3452. commands);
  3453. break;
  3454. case SCTP_IERROR_NOMEM:
  3455. return SCTP_DISPOSITION_NOMEM;
  3456. default:
  3457. break;
  3458. }
  3459. if (asoc->active_key_id != ntohs(auth_hdr->shkey_id)) {
  3460. struct sctp_ulpevent *ev;
  3461. ev = sctp_ulpevent_make_authkey(asoc, ntohs(auth_hdr->shkey_id),
  3462. SCTP_AUTH_NEWKEY, GFP_ATOMIC);
  3463. if (!ev)
  3464. return -ENOMEM;
  3465. sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
  3466. SCTP_ULPEVENT(ev));
  3467. }
  3468. return SCTP_DISPOSITION_CONSUME;
  3469. }
  3470. /*
  3471. * Process an unknown chunk.
  3472. *
  3473. * Section: 3.2. Also, 2.1 in the implementor's guide.
  3474. *
  3475. * Chunk Types are encoded such that the highest-order two bits specify
  3476. * the action that must be taken if the processing endpoint does not
  3477. * recognize the Chunk Type.
  3478. *
  3479. * 00 - Stop processing this SCTP packet and discard it, do not process
  3480. * any further chunks within it.
  3481. *
  3482. * 01 - Stop processing this SCTP packet and discard it, do not process
  3483. * any further chunks within it, and report the unrecognized
  3484. * chunk in an 'Unrecognized Chunk Type'.
  3485. *
  3486. * 10 - Skip this chunk and continue processing.
  3487. *
  3488. * 11 - Skip this chunk and continue processing, but report in an ERROR
  3489. * Chunk using the 'Unrecognized Chunk Type' cause of error.
  3490. *
  3491. * The return value is the disposition of the chunk.
  3492. */
  3493. sctp_disposition_t sctp_sf_unk_chunk(const struct sctp_endpoint *ep,
  3494. const struct sctp_association *asoc,
  3495. const sctp_subtype_t type,
  3496. void *arg,
  3497. sctp_cmd_seq_t *commands)
  3498. {
  3499. struct sctp_chunk *unk_chunk = arg;
  3500. struct sctp_chunk *err_chunk;
  3501. sctp_chunkhdr_t *hdr;
  3502. SCTP_DEBUG_PRINTK("Processing the unknown chunk id %d.\n", type.chunk);
  3503. if (!sctp_vtag_verify(unk_chunk, asoc))
  3504. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  3505. /* Make sure that the chunk has a valid length.
  3506. * Since we don't know the chunk type, we use a general
  3507. * chunkhdr structure to make a comparison.
  3508. */
  3509. if (!sctp_chunk_length_valid(unk_chunk, sizeof(sctp_chunkhdr_t)))
  3510. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  3511. commands);
  3512. switch (type.chunk & SCTP_CID_ACTION_MASK) {
  3513. case SCTP_CID_ACTION_DISCARD:
  3514. /* Discard the packet. */
  3515. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  3516. break;
  3517. case SCTP_CID_ACTION_DISCARD_ERR:
  3518. /* Generate an ERROR chunk as response. */
  3519. hdr = unk_chunk->chunk_hdr;
  3520. err_chunk = sctp_make_op_error(asoc, unk_chunk,
  3521. SCTP_ERROR_UNKNOWN_CHUNK, hdr,
  3522. WORD_ROUND(ntohs(hdr->length)));
  3523. if (err_chunk) {
  3524. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
  3525. SCTP_CHUNK(err_chunk));
  3526. }
  3527. /* Discard the packet. */
  3528. sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  3529. return SCTP_DISPOSITION_CONSUME;
  3530. break;
  3531. case SCTP_CID_ACTION_SKIP:
  3532. /* Skip the chunk. */
  3533. return SCTP_DISPOSITION_DISCARD;
  3534. break;
  3535. case SCTP_CID_ACTION_SKIP_ERR:
  3536. /* Generate an ERROR chunk as response. */
  3537. hdr = unk_chunk->chunk_hdr;
  3538. err_chunk = sctp_make_op_error(asoc, unk_chunk,
  3539. SCTP_ERROR_UNKNOWN_CHUNK, hdr,
  3540. WORD_ROUND(ntohs(hdr->length)));
  3541. if (err_chunk) {
  3542. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
  3543. SCTP_CHUNK(err_chunk));
  3544. }
  3545. /* Skip the chunk. */
  3546. return SCTP_DISPOSITION_CONSUME;
  3547. break;
  3548. default:
  3549. break;
  3550. }
  3551. return SCTP_DISPOSITION_DISCARD;
  3552. }
  3553. /*
  3554. * Discard the chunk.
  3555. *
  3556. * Section: 0.2, 5.2.3, 5.2.5, 5.2.6, 6.0, 8.4.6, 8.5.1c, 9.2
  3557. * [Too numerous to mention...]
  3558. * Verification Tag: No verification needed.
  3559. * Inputs
  3560. * (endpoint, asoc, chunk)
  3561. *
  3562. * Outputs
  3563. * (asoc, reply_msg, msg_up, timers, counters)
  3564. *
  3565. * The return value is the disposition of the chunk.
  3566. */
  3567. sctp_disposition_t sctp_sf_discard_chunk(const struct sctp_endpoint *ep,
  3568. const struct sctp_association *asoc,
  3569. const sctp_subtype_t type,
  3570. void *arg,
  3571. sctp_cmd_seq_t *commands)
  3572. {
  3573. struct sctp_chunk *chunk = arg;
  3574. /* Make sure that the chunk has a valid length.
  3575. * Since we don't know the chunk type, we use a general
  3576. * chunkhdr structure to make a comparison.
  3577. */
  3578. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
  3579. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  3580. commands);
  3581. SCTP_DEBUG_PRINTK("Chunk %d is discarded\n", type.chunk);
  3582. return SCTP_DISPOSITION_DISCARD;
  3583. }
  3584. /*
  3585. * Discard the whole packet.
  3586. *
  3587. * Section: 8.4 2)
  3588. *
  3589. * 2) If the OOTB packet contains an ABORT chunk, the receiver MUST
  3590. * silently discard the OOTB packet and take no further action.
  3591. *
  3592. * Verification Tag: No verification necessary
  3593. *
  3594. * Inputs
  3595. * (endpoint, asoc, chunk)
  3596. *
  3597. * Outputs
  3598. * (asoc, reply_msg, msg_up, timers, counters)
  3599. *
  3600. * The return value is the disposition of the chunk.
  3601. */
  3602. sctp_disposition_t sctp_sf_pdiscard(const struct sctp_endpoint *ep,
  3603. const struct sctp_association *asoc,
  3604. const sctp_subtype_t type,
  3605. void *arg,
  3606. sctp_cmd_seq_t *commands)
  3607. {
  3608. SCTP_INC_STATS(SCTP_MIB_IN_PKT_DISCARDS);
  3609. sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
  3610. return SCTP_DISPOSITION_CONSUME;
  3611. }
  3612. /*
  3613. * The other end is violating protocol.
  3614. *
  3615. * Section: Not specified
  3616. * Verification Tag: Not specified
  3617. * Inputs
  3618. * (endpoint, asoc, chunk)
  3619. *
  3620. * Outputs
  3621. * (asoc, reply_msg, msg_up, timers, counters)
  3622. *
  3623. * We simply tag the chunk as a violation. The state machine will log
  3624. * the violation and continue.
  3625. */
  3626. sctp_disposition_t sctp_sf_violation(const struct sctp_endpoint *ep,
  3627. const struct sctp_association *asoc,
  3628. const sctp_subtype_t type,
  3629. void *arg,
  3630. sctp_cmd_seq_t *commands)
  3631. {
  3632. struct sctp_chunk *chunk = arg;
  3633. /* Make sure that the chunk has a valid length. */
  3634. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
  3635. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  3636. commands);
  3637. return SCTP_DISPOSITION_VIOLATION;
  3638. }
  3639. /*
  3640. * Common function to handle a protocol violation.
  3641. */
  3642. static sctp_disposition_t sctp_sf_abort_violation(
  3643. const struct sctp_endpoint *ep,
  3644. const struct sctp_association *asoc,
  3645. void *arg,
  3646. sctp_cmd_seq_t *commands,
  3647. const __u8 *payload,
  3648. const size_t paylen)
  3649. {
  3650. struct sctp_packet *packet = NULL;
  3651. struct sctp_chunk *chunk = arg;
  3652. struct sctp_chunk *abort = NULL;
  3653. /* SCTP-AUTH, Section 6.3:
  3654. * It should be noted that if the receiver wants to tear
  3655. * down an association in an authenticated way only, the
  3656. * handling of malformed packets should not result in
  3657. * tearing down the association.
  3658. *
  3659. * This means that if we only want to abort associations
  3660. * in an authenticated way (i.e AUTH+ABORT), then we
  3661. * can't destroy this association just becuase the packet
  3662. * was malformed.
  3663. */
  3664. if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
  3665. goto discard;
  3666. /* Make the abort chunk. */
  3667. abort = sctp_make_abort_violation(asoc, chunk, payload, paylen);
  3668. if (!abort)
  3669. goto nomem;
  3670. if (asoc) {
  3671. /* Treat INIT-ACK as a special case during COOKIE-WAIT. */
  3672. if (chunk->chunk_hdr->type == SCTP_CID_INIT_ACK &&
  3673. !asoc->peer.i.init_tag) {
  3674. sctp_initack_chunk_t *initack;
  3675. initack = (sctp_initack_chunk_t *)chunk->chunk_hdr;
  3676. if (!sctp_chunk_length_valid(chunk,
  3677. sizeof(sctp_initack_chunk_t)))
  3678. abort->chunk_hdr->flags |= SCTP_CHUNK_FLAG_T;
  3679. else {
  3680. unsigned int inittag;
  3681. inittag = ntohl(initack->init_hdr.init_tag);
  3682. sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_INITTAG,
  3683. SCTP_U32(inittag));
  3684. }
  3685. }
  3686. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
  3687. SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
  3688. if (asoc->state <= SCTP_STATE_COOKIE_ECHOED) {
  3689. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  3690. SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
  3691. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  3692. SCTP_ERROR(ECONNREFUSED));
  3693. sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
  3694. SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
  3695. } else {
  3696. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  3697. SCTP_ERROR(ECONNABORTED));
  3698. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
  3699. SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
  3700. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  3701. }
  3702. } else {
  3703. packet = sctp_ootb_pkt_new(asoc, chunk);
  3704. if (!packet)
  3705. goto nomem_pkt;
  3706. if (sctp_test_T_bit(abort))
  3707. packet->vtag = ntohl(chunk->sctp_hdr->vtag);
  3708. abort->skb->sk = ep->base.sk;
  3709. sctp_packet_append_chunk(packet, abort);
  3710. sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
  3711. SCTP_PACKET(packet));
  3712. SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
  3713. }
  3714. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  3715. discard:
  3716. sctp_sf_pdiscard(ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
  3717. return SCTP_DISPOSITION_ABORT;
  3718. nomem_pkt:
  3719. sctp_chunk_free(abort);
  3720. nomem:
  3721. return SCTP_DISPOSITION_NOMEM;
  3722. }
  3723. /*
  3724. * Handle a protocol violation when the chunk length is invalid.
  3725. * "Invalid" length is identified as smaller then the minimal length a
  3726. * given chunk can be. For example, a SACK chunk has invalid length
  3727. * if it's length is set to be smaller then the size of sctp_sack_chunk_t.
  3728. *
  3729. * We inform the other end by sending an ABORT with a Protocol Violation
  3730. * error code.
  3731. *
  3732. * Section: Not specified
  3733. * Verification Tag: Nothing to do
  3734. * Inputs
  3735. * (endpoint, asoc, chunk)
  3736. *
  3737. * Outputs
  3738. * (reply_msg, msg_up, counters)
  3739. *
  3740. * Generate an ABORT chunk and terminate the association.
  3741. */
  3742. static sctp_disposition_t sctp_sf_violation_chunklen(
  3743. const struct sctp_endpoint *ep,
  3744. const struct sctp_association *asoc,
  3745. const sctp_subtype_t type,
  3746. void *arg,
  3747. sctp_cmd_seq_t *commands)
  3748. {
  3749. static const char err_str[]="The following chunk had invalid length:";
  3750. return sctp_sf_abort_violation(ep, asoc, arg, commands, err_str,
  3751. sizeof(err_str));
  3752. }
  3753. /*
  3754. * Handle a protocol violation when the parameter length is invalid.
  3755. * "Invalid" length is identified as smaller then the minimal length a
  3756. * given parameter can be.
  3757. */
  3758. static sctp_disposition_t sctp_sf_violation_paramlen(
  3759. const struct sctp_endpoint *ep,
  3760. const struct sctp_association *asoc,
  3761. const sctp_subtype_t type,
  3762. void *arg, void *ext,
  3763. sctp_cmd_seq_t *commands)
  3764. {
  3765. struct sctp_chunk *chunk = arg;
  3766. struct sctp_paramhdr *param = ext;
  3767. struct sctp_chunk *abort = NULL;
  3768. if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
  3769. goto discard;
  3770. /* Make the abort chunk. */
  3771. abort = sctp_make_violation_paramlen(asoc, chunk, param);
  3772. if (!abort)
  3773. goto nomem;
  3774. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
  3775. SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
  3776. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  3777. SCTP_ERROR(ECONNABORTED));
  3778. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
  3779. SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
  3780. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  3781. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  3782. discard:
  3783. sctp_sf_pdiscard(ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
  3784. return SCTP_DISPOSITION_ABORT;
  3785. nomem:
  3786. return SCTP_DISPOSITION_NOMEM;
  3787. }
  3788. /* Handle a protocol violation when the peer trying to advance the
  3789. * cumulative tsn ack to a point beyond the max tsn currently sent.
  3790. *
  3791. * We inform the other end by sending an ABORT with a Protocol Violation
  3792. * error code.
  3793. */
  3794. static sctp_disposition_t sctp_sf_violation_ctsn(
  3795. const struct sctp_endpoint *ep,
  3796. const struct sctp_association *asoc,
  3797. const sctp_subtype_t type,
  3798. void *arg,
  3799. sctp_cmd_seq_t *commands)
  3800. {
  3801. static const char err_str[]="The cumulative tsn ack beyond the max tsn currently sent:";
  3802. return sctp_sf_abort_violation(ep, asoc, arg, commands, err_str,
  3803. sizeof(err_str));
  3804. }
  3805. /* Handle protocol violation of an invalid chunk bundling. For example,
  3806. * when we have an association and we recieve bundled INIT-ACK, or
  3807. * SHUDOWN-COMPLETE, our peer is clearly violationg the "MUST NOT bundle"
  3808. * statement from the specs. Additinally, there might be an attacker
  3809. * on the path and we may not want to continue this communication.
  3810. */
  3811. static sctp_disposition_t sctp_sf_violation_chunk(
  3812. const struct sctp_endpoint *ep,
  3813. const struct sctp_association *asoc,
  3814. const sctp_subtype_t type,
  3815. void *arg,
  3816. sctp_cmd_seq_t *commands)
  3817. {
  3818. static const char err_str[]="The following chunk violates protocol:";
  3819. if (!asoc)
  3820. return sctp_sf_violation(ep, asoc, type, arg, commands);
  3821. return sctp_sf_abort_violation(ep, asoc, arg, commands, err_str,
  3822. sizeof(err_str));
  3823. }
  3824. /***************************************************************************
  3825. * These are the state functions for handling primitive (Section 10) events.
  3826. ***************************************************************************/
  3827. /*
  3828. * sctp_sf_do_prm_asoc
  3829. *
  3830. * Section: 10.1 ULP-to-SCTP
  3831. * B) Associate
  3832. *
  3833. * Format: ASSOCIATE(local SCTP instance name, destination transport addr,
  3834. * outbound stream count)
  3835. * -> association id [,destination transport addr list] [,outbound stream
  3836. * count]
  3837. *
  3838. * This primitive allows the upper layer to initiate an association to a
  3839. * specific peer endpoint.
  3840. *
  3841. * The peer endpoint shall be specified by one of the transport addresses
  3842. * which defines the endpoint (see Section 1.4). If the local SCTP
  3843. * instance has not been initialized, the ASSOCIATE is considered an
  3844. * error.
  3845. * [This is not relevant for the kernel implementation since we do all
  3846. * initialization at boot time. It we hadn't initialized we wouldn't
  3847. * get anywhere near this code.]
  3848. *
  3849. * An association id, which is a local handle to the SCTP association,
  3850. * will be returned on successful establishment of the association. If
  3851. * SCTP is not able to open an SCTP association with the peer endpoint,
  3852. * an error is returned.
  3853. * [In the kernel implementation, the struct sctp_association needs to
  3854. * be created BEFORE causing this primitive to run.]
  3855. *
  3856. * Other association parameters may be returned, including the
  3857. * complete destination transport addresses of the peer as well as the
  3858. * outbound stream count of the local endpoint. One of the transport
  3859. * address from the returned destination addresses will be selected by
  3860. * the local endpoint as default primary path for sending SCTP packets
  3861. * to this peer. The returned "destination transport addr list" can
  3862. * be used by the ULP to change the default primary path or to force
  3863. * sending a packet to a specific transport address. [All of this
  3864. * stuff happens when the INIT ACK arrives. This is a NON-BLOCKING
  3865. * function.]
  3866. *
  3867. * Mandatory attributes:
  3868. *
  3869. * o local SCTP instance name - obtained from the INITIALIZE operation.
  3870. * [This is the argument asoc.]
  3871. * o destination transport addr - specified as one of the transport
  3872. * addresses of the peer endpoint with which the association is to be
  3873. * established.
  3874. * [This is asoc->peer.active_path.]
  3875. * o outbound stream count - the number of outbound streams the ULP
  3876. * would like to open towards this peer endpoint.
  3877. * [BUG: This is not currently implemented.]
  3878. * Optional attributes:
  3879. *
  3880. * None.
  3881. *
  3882. * The return value is a disposition.
  3883. */
  3884. sctp_disposition_t sctp_sf_do_prm_asoc(const struct sctp_endpoint *ep,
  3885. const struct sctp_association *asoc,
  3886. const sctp_subtype_t type,
  3887. void *arg,
  3888. sctp_cmd_seq_t *commands)
  3889. {
  3890. struct sctp_chunk *repl;
  3891. struct sctp_association* my_asoc;
  3892. /* The comment below says that we enter COOKIE-WAIT AFTER
  3893. * sending the INIT, but that doesn't actually work in our
  3894. * implementation...
  3895. */
  3896. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  3897. SCTP_STATE(SCTP_STATE_COOKIE_WAIT));
  3898. /* RFC 2960 5.1 Normal Establishment of an Association
  3899. *
  3900. * A) "A" first sends an INIT chunk to "Z". In the INIT, "A"
  3901. * must provide its Verification Tag (Tag_A) in the Initiate
  3902. * Tag field. Tag_A SHOULD be a random number in the range of
  3903. * 1 to 4294967295 (see 5.3.1 for Tag value selection). ...
  3904. */
  3905. repl = sctp_make_init(asoc, &asoc->base.bind_addr, GFP_ATOMIC, 0);
  3906. if (!repl)
  3907. goto nomem;
  3908. /* Cast away the const modifier, as we want to just
  3909. * rerun it through as a sideffect.
  3910. */
  3911. my_asoc = (struct sctp_association *)asoc;
  3912. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(my_asoc));
  3913. /* Choose transport for INIT. */
  3914. sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
  3915. SCTP_CHUNK(repl));
  3916. /* After sending the INIT, "A" starts the T1-init timer and
  3917. * enters the COOKIE-WAIT state.
  3918. */
  3919. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
  3920. SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
  3921. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
  3922. return SCTP_DISPOSITION_CONSUME;
  3923. nomem:
  3924. return SCTP_DISPOSITION_NOMEM;
  3925. }
  3926. /*
  3927. * Process the SEND primitive.
  3928. *
  3929. * Section: 10.1 ULP-to-SCTP
  3930. * E) Send
  3931. *
  3932. * Format: SEND(association id, buffer address, byte count [,context]
  3933. * [,stream id] [,life time] [,destination transport address]
  3934. * [,unorder flag] [,no-bundle flag] [,payload protocol-id] )
  3935. * -> result
  3936. *
  3937. * This is the main method to send user data via SCTP.
  3938. *
  3939. * Mandatory attributes:
  3940. *
  3941. * o association id - local handle to the SCTP association
  3942. *
  3943. * o buffer address - the location where the user message to be
  3944. * transmitted is stored;
  3945. *
  3946. * o byte count - The size of the user data in number of bytes;
  3947. *
  3948. * Optional attributes:
  3949. *
  3950. * o context - an optional 32 bit integer that will be carried in the
  3951. * sending failure notification to the ULP if the transportation of
  3952. * this User Message fails.
  3953. *
  3954. * o stream id - to indicate which stream to send the data on. If not
  3955. * specified, stream 0 will be used.
  3956. *
  3957. * o life time - specifies the life time of the user data. The user data
  3958. * will not be sent by SCTP after the life time expires. This
  3959. * parameter can be used to avoid efforts to transmit stale
  3960. * user messages. SCTP notifies the ULP if the data cannot be
  3961. * initiated to transport (i.e. sent to the destination via SCTP's
  3962. * send primitive) within the life time variable. However, the
  3963. * user data will be transmitted if SCTP has attempted to transmit a
  3964. * chunk before the life time expired.
  3965. *
  3966. * o destination transport address - specified as one of the destination
  3967. * transport addresses of the peer endpoint to which this packet
  3968. * should be sent. Whenever possible, SCTP should use this destination
  3969. * transport address for sending the packets, instead of the current
  3970. * primary path.
  3971. *
  3972. * o unorder flag - this flag, if present, indicates that the user
  3973. * would like the data delivered in an unordered fashion to the peer
  3974. * (i.e., the U flag is set to 1 on all DATA chunks carrying this
  3975. * message).
  3976. *
  3977. * o no-bundle flag - instructs SCTP not to bundle this user data with
  3978. * other outbound DATA chunks. SCTP MAY still bundle even when
  3979. * this flag is present, when faced with network congestion.
  3980. *
  3981. * o payload protocol-id - A 32 bit unsigned integer that is to be
  3982. * passed to the peer indicating the type of payload protocol data
  3983. * being transmitted. This value is passed as opaque data by SCTP.
  3984. *
  3985. * The return value is the disposition.
  3986. */
  3987. sctp_disposition_t sctp_sf_do_prm_send(const struct sctp_endpoint *ep,
  3988. const struct sctp_association *asoc,
  3989. const sctp_subtype_t type,
  3990. void *arg,
  3991. sctp_cmd_seq_t *commands)
  3992. {
  3993. struct sctp_chunk *chunk = arg;
  3994. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(chunk));
  3995. return SCTP_DISPOSITION_CONSUME;
  3996. }
  3997. /*
  3998. * Process the SHUTDOWN primitive.
  3999. *
  4000. * Section: 10.1:
  4001. * C) Shutdown
  4002. *
  4003. * Format: SHUTDOWN(association id)
  4004. * -> result
  4005. *
  4006. * Gracefully closes an association. Any locally queued user data
  4007. * will be delivered to the peer. The association will be terminated only
  4008. * after the peer acknowledges all the SCTP packets sent. A success code
  4009. * will be returned on successful termination of the association. If
  4010. * attempting to terminate the association results in a failure, an error
  4011. * code shall be returned.
  4012. *
  4013. * Mandatory attributes:
  4014. *
  4015. * o association id - local handle to the SCTP association
  4016. *
  4017. * Optional attributes:
  4018. *
  4019. * None.
  4020. *
  4021. * The return value is the disposition.
  4022. */
  4023. sctp_disposition_t sctp_sf_do_9_2_prm_shutdown(
  4024. const struct sctp_endpoint *ep,
  4025. const struct sctp_association *asoc,
  4026. const sctp_subtype_t type,
  4027. void *arg,
  4028. sctp_cmd_seq_t *commands)
  4029. {
  4030. int disposition;
  4031. /* From 9.2 Shutdown of an Association
  4032. * Upon receipt of the SHUTDOWN primitive from its upper
  4033. * layer, the endpoint enters SHUTDOWN-PENDING state and
  4034. * remains there until all outstanding data has been
  4035. * acknowledged by its peer. The endpoint accepts no new data
  4036. * from its upper layer, but retransmits data to the far end
  4037. * if necessary to fill gaps.
  4038. */
  4039. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  4040. SCTP_STATE(SCTP_STATE_SHUTDOWN_PENDING));
  4041. disposition = SCTP_DISPOSITION_CONSUME;
  4042. if (sctp_outq_is_empty(&asoc->outqueue)) {
  4043. disposition = sctp_sf_do_9_2_start_shutdown(ep, asoc, type,
  4044. arg, commands);
  4045. }
  4046. return disposition;
  4047. }
  4048. /*
  4049. * Process the ABORT primitive.
  4050. *
  4051. * Section: 10.1:
  4052. * C) Abort
  4053. *
  4054. * Format: Abort(association id [, cause code])
  4055. * -> result
  4056. *
  4057. * Ungracefully closes an association. Any locally queued user data
  4058. * will be discarded and an ABORT chunk is sent to the peer. A success code
  4059. * will be returned on successful abortion of the association. If
  4060. * attempting to abort the association results in a failure, an error
  4061. * code shall be returned.
  4062. *
  4063. * Mandatory attributes:
  4064. *
  4065. * o association id - local handle to the SCTP association
  4066. *
  4067. * Optional attributes:
  4068. *
  4069. * o cause code - reason of the abort to be passed to the peer
  4070. *
  4071. * None.
  4072. *
  4073. * The return value is the disposition.
  4074. */
  4075. sctp_disposition_t sctp_sf_do_9_1_prm_abort(
  4076. const struct sctp_endpoint *ep,
  4077. const struct sctp_association *asoc,
  4078. const sctp_subtype_t type,
  4079. void *arg,
  4080. sctp_cmd_seq_t *commands)
  4081. {
  4082. /* From 9.1 Abort of an Association
  4083. * Upon receipt of the ABORT primitive from its upper
  4084. * layer, the endpoint enters CLOSED state and
  4085. * discard all outstanding data has been
  4086. * acknowledged by its peer. The endpoint accepts no new data
  4087. * from its upper layer, but retransmits data to the far end
  4088. * if necessary to fill gaps.
  4089. */
  4090. struct sctp_chunk *abort = arg;
  4091. sctp_disposition_t retval;
  4092. retval = SCTP_DISPOSITION_CONSUME;
  4093. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
  4094. /* Even if we can't send the ABORT due to low memory delete the
  4095. * TCB. This is a departure from our typical NOMEM handling.
  4096. */
  4097. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  4098. SCTP_ERROR(ECONNABORTED));
  4099. /* Delete the established association. */
  4100. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
  4101. SCTP_PERR(SCTP_ERROR_USER_ABORT));
  4102. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  4103. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  4104. return retval;
  4105. }
  4106. /* We tried an illegal operation on an association which is closed. */
  4107. sctp_disposition_t sctp_sf_error_closed(const struct sctp_endpoint *ep,
  4108. const struct sctp_association *asoc,
  4109. const sctp_subtype_t type,
  4110. void *arg,
  4111. sctp_cmd_seq_t *commands)
  4112. {
  4113. sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_ERROR, SCTP_ERROR(-EINVAL));
  4114. return SCTP_DISPOSITION_CONSUME;
  4115. }
  4116. /* We tried an illegal operation on an association which is shutting
  4117. * down.
  4118. */
  4119. sctp_disposition_t sctp_sf_error_shutdown(const struct sctp_endpoint *ep,
  4120. const struct sctp_association *asoc,
  4121. const sctp_subtype_t type,
  4122. void *arg,
  4123. sctp_cmd_seq_t *commands)
  4124. {
  4125. sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_ERROR,
  4126. SCTP_ERROR(-ESHUTDOWN));
  4127. return SCTP_DISPOSITION_CONSUME;
  4128. }
  4129. /*
  4130. * sctp_cookie_wait_prm_shutdown
  4131. *
  4132. * Section: 4 Note: 2
  4133. * Verification Tag:
  4134. * Inputs
  4135. * (endpoint, asoc)
  4136. *
  4137. * The RFC does not explicitly address this issue, but is the route through the
  4138. * state table when someone issues a shutdown while in COOKIE_WAIT state.
  4139. *
  4140. * Outputs
  4141. * (timers)
  4142. */
  4143. sctp_disposition_t sctp_sf_cookie_wait_prm_shutdown(
  4144. const struct sctp_endpoint *ep,
  4145. const struct sctp_association *asoc,
  4146. const sctp_subtype_t type,
  4147. void *arg,
  4148. sctp_cmd_seq_t *commands)
  4149. {
  4150. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  4151. SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
  4152. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  4153. SCTP_STATE(SCTP_STATE_CLOSED));
  4154. SCTP_INC_STATS(SCTP_MIB_SHUTDOWNS);
  4155. sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
  4156. return SCTP_DISPOSITION_DELETE_TCB;
  4157. }
  4158. /*
  4159. * sctp_cookie_echoed_prm_shutdown
  4160. *
  4161. * Section: 4 Note: 2
  4162. * Verification Tag:
  4163. * Inputs
  4164. * (endpoint, asoc)
  4165. *
  4166. * The RFC does not explcitly address this issue, but is the route through the
  4167. * state table when someone issues a shutdown while in COOKIE_ECHOED state.
  4168. *
  4169. * Outputs
  4170. * (timers)
  4171. */
  4172. sctp_disposition_t sctp_sf_cookie_echoed_prm_shutdown(
  4173. const struct sctp_endpoint *ep,
  4174. const struct sctp_association *asoc,
  4175. const sctp_subtype_t type,
  4176. void *arg, sctp_cmd_seq_t *commands)
  4177. {
  4178. /* There is a single T1 timer, so we should be able to use
  4179. * common function with the COOKIE-WAIT state.
  4180. */
  4181. return sctp_sf_cookie_wait_prm_shutdown(ep, asoc, type, arg, commands);
  4182. }
  4183. /*
  4184. * sctp_sf_cookie_wait_prm_abort
  4185. *
  4186. * Section: 4 Note: 2
  4187. * Verification Tag:
  4188. * Inputs
  4189. * (endpoint, asoc)
  4190. *
  4191. * The RFC does not explicitly address this issue, but is the route through the
  4192. * state table when someone issues an abort while in COOKIE_WAIT state.
  4193. *
  4194. * Outputs
  4195. * (timers)
  4196. */
  4197. sctp_disposition_t sctp_sf_cookie_wait_prm_abort(
  4198. const struct sctp_endpoint *ep,
  4199. const struct sctp_association *asoc,
  4200. const sctp_subtype_t type,
  4201. void *arg,
  4202. sctp_cmd_seq_t *commands)
  4203. {
  4204. struct sctp_chunk *abort = arg;
  4205. sctp_disposition_t retval;
  4206. /* Stop T1-init timer */
  4207. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  4208. SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
  4209. retval = SCTP_DISPOSITION_CONSUME;
  4210. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
  4211. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  4212. SCTP_STATE(SCTP_STATE_CLOSED));
  4213. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  4214. /* Even if we can't send the ABORT due to low memory delete the
  4215. * TCB. This is a departure from our typical NOMEM handling.
  4216. */
  4217. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  4218. SCTP_ERROR(ECONNREFUSED));
  4219. /* Delete the established association. */
  4220. sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
  4221. SCTP_PERR(SCTP_ERROR_USER_ABORT));
  4222. return retval;
  4223. }
  4224. /*
  4225. * sctp_sf_cookie_echoed_prm_abort
  4226. *
  4227. * Section: 4 Note: 3
  4228. * Verification Tag:
  4229. * Inputs
  4230. * (endpoint, asoc)
  4231. *
  4232. * The RFC does not explcitly address this issue, but is the route through the
  4233. * state table when someone issues an abort while in COOKIE_ECHOED state.
  4234. *
  4235. * Outputs
  4236. * (timers)
  4237. */
  4238. sctp_disposition_t sctp_sf_cookie_echoed_prm_abort(
  4239. const struct sctp_endpoint *ep,
  4240. const struct sctp_association *asoc,
  4241. const sctp_subtype_t type,
  4242. void *arg,
  4243. sctp_cmd_seq_t *commands)
  4244. {
  4245. /* There is a single T1 timer, so we should be able to use
  4246. * common function with the COOKIE-WAIT state.
  4247. */
  4248. return sctp_sf_cookie_wait_prm_abort(ep, asoc, type, arg, commands);
  4249. }
  4250. /*
  4251. * sctp_sf_shutdown_pending_prm_abort
  4252. *
  4253. * Inputs
  4254. * (endpoint, asoc)
  4255. *
  4256. * The RFC does not explicitly address this issue, but is the route through the
  4257. * state table when someone issues an abort while in SHUTDOWN-PENDING state.
  4258. *
  4259. * Outputs
  4260. * (timers)
  4261. */
  4262. sctp_disposition_t sctp_sf_shutdown_pending_prm_abort(
  4263. const struct sctp_endpoint *ep,
  4264. const struct sctp_association *asoc,
  4265. const sctp_subtype_t type,
  4266. void *arg,
  4267. sctp_cmd_seq_t *commands)
  4268. {
  4269. /* Stop the T5-shutdown guard timer. */
  4270. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  4271. SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
  4272. return sctp_sf_do_9_1_prm_abort(ep, asoc, type, arg, commands);
  4273. }
  4274. /*
  4275. * sctp_sf_shutdown_sent_prm_abort
  4276. *
  4277. * Inputs
  4278. * (endpoint, asoc)
  4279. *
  4280. * The RFC does not explicitly address this issue, but is the route through the
  4281. * state table when someone issues an abort while in SHUTDOWN-SENT state.
  4282. *
  4283. * Outputs
  4284. * (timers)
  4285. */
  4286. sctp_disposition_t sctp_sf_shutdown_sent_prm_abort(
  4287. const struct sctp_endpoint *ep,
  4288. const struct sctp_association *asoc,
  4289. const sctp_subtype_t type,
  4290. void *arg,
  4291. sctp_cmd_seq_t *commands)
  4292. {
  4293. /* Stop the T2-shutdown timer. */
  4294. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  4295. SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
  4296. /* Stop the T5-shutdown guard timer. */
  4297. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  4298. SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
  4299. return sctp_sf_do_9_1_prm_abort(ep, asoc, type, arg, commands);
  4300. }
  4301. /*
  4302. * sctp_sf_cookie_echoed_prm_abort
  4303. *
  4304. * Inputs
  4305. * (endpoint, asoc)
  4306. *
  4307. * The RFC does not explcitly address this issue, but is the route through the
  4308. * state table when someone issues an abort while in COOKIE_ECHOED state.
  4309. *
  4310. * Outputs
  4311. * (timers)
  4312. */
  4313. sctp_disposition_t sctp_sf_shutdown_ack_sent_prm_abort(
  4314. const struct sctp_endpoint *ep,
  4315. const struct sctp_association *asoc,
  4316. const sctp_subtype_t type,
  4317. void *arg,
  4318. sctp_cmd_seq_t *commands)
  4319. {
  4320. /* The same T2 timer, so we should be able to use
  4321. * common function with the SHUTDOWN-SENT state.
  4322. */
  4323. return sctp_sf_shutdown_sent_prm_abort(ep, asoc, type, arg, commands);
  4324. }
  4325. /*
  4326. * Process the REQUESTHEARTBEAT primitive
  4327. *
  4328. * 10.1 ULP-to-SCTP
  4329. * J) Request Heartbeat
  4330. *
  4331. * Format: REQUESTHEARTBEAT(association id, destination transport address)
  4332. *
  4333. * -> result
  4334. *
  4335. * Instructs the local endpoint to perform a HeartBeat on the specified
  4336. * destination transport address of the given association. The returned
  4337. * result should indicate whether the transmission of the HEARTBEAT
  4338. * chunk to the destination address is successful.
  4339. *
  4340. * Mandatory attributes:
  4341. *
  4342. * o association id - local handle to the SCTP association
  4343. *
  4344. * o destination transport address - the transport address of the
  4345. * association on which a heartbeat should be issued.
  4346. */
  4347. sctp_disposition_t sctp_sf_do_prm_requestheartbeat(
  4348. const struct sctp_endpoint *ep,
  4349. const struct sctp_association *asoc,
  4350. const sctp_subtype_t type,
  4351. void *arg,
  4352. sctp_cmd_seq_t *commands)
  4353. {
  4354. if (SCTP_DISPOSITION_NOMEM == sctp_sf_heartbeat(ep, asoc, type,
  4355. (struct sctp_transport *)arg, commands))
  4356. return SCTP_DISPOSITION_NOMEM;
  4357. /*
  4358. * RFC 2960 (bis), section 8.3
  4359. *
  4360. * D) Request an on-demand HEARTBEAT on a specific destination
  4361. * transport address of a given association.
  4362. *
  4363. * The endpoint should increment the respective error counter of
  4364. * the destination transport address each time a HEARTBEAT is sent
  4365. * to that address and not acknowledged within one RTO.
  4366. *
  4367. */
  4368. sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_RESET,
  4369. SCTP_TRANSPORT(arg));
  4370. return SCTP_DISPOSITION_CONSUME;
  4371. }
  4372. /*
  4373. * ADDIP Section 4.1 ASCONF Chunk Procedures
  4374. * When an endpoint has an ASCONF signaled change to be sent to the
  4375. * remote endpoint it should do A1 to A9
  4376. */
  4377. sctp_disposition_t sctp_sf_do_prm_asconf(const struct sctp_endpoint *ep,
  4378. const struct sctp_association *asoc,
  4379. const sctp_subtype_t type,
  4380. void *arg,
  4381. sctp_cmd_seq_t *commands)
  4382. {
  4383. struct sctp_chunk *chunk = arg;
  4384. sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T4, SCTP_CHUNK(chunk));
  4385. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
  4386. SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
  4387. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(chunk));
  4388. return SCTP_DISPOSITION_CONSUME;
  4389. }
  4390. /*
  4391. * Ignore the primitive event
  4392. *
  4393. * The return value is the disposition of the primitive.
  4394. */
  4395. sctp_disposition_t sctp_sf_ignore_primitive(
  4396. const struct sctp_endpoint *ep,
  4397. const struct sctp_association *asoc,
  4398. const sctp_subtype_t type,
  4399. void *arg,
  4400. sctp_cmd_seq_t *commands)
  4401. {
  4402. SCTP_DEBUG_PRINTK("Primitive type %d is ignored.\n", type.primitive);
  4403. return SCTP_DISPOSITION_DISCARD;
  4404. }
  4405. /***************************************************************************
  4406. * These are the state functions for the OTHER events.
  4407. ***************************************************************************/
  4408. /*
  4409. * Start the shutdown negotiation.
  4410. *
  4411. * From Section 9.2:
  4412. * Once all its outstanding data has been acknowledged, the endpoint
  4413. * shall send a SHUTDOWN chunk to its peer including in the Cumulative
  4414. * TSN Ack field the last sequential TSN it has received from the peer.
  4415. * It shall then start the T2-shutdown timer and enter the SHUTDOWN-SENT
  4416. * state. If the timer expires, the endpoint must re-send the SHUTDOWN
  4417. * with the updated last sequential TSN received from its peer.
  4418. *
  4419. * The return value is the disposition.
  4420. */
  4421. sctp_disposition_t sctp_sf_do_9_2_start_shutdown(
  4422. const struct sctp_endpoint *ep,
  4423. const struct sctp_association *asoc,
  4424. const sctp_subtype_t type,
  4425. void *arg,
  4426. sctp_cmd_seq_t *commands)
  4427. {
  4428. struct sctp_chunk *reply;
  4429. /* Once all its outstanding data has been acknowledged, the
  4430. * endpoint shall send a SHUTDOWN chunk to its peer including
  4431. * in the Cumulative TSN Ack field the last sequential TSN it
  4432. * has received from the peer.
  4433. */
  4434. reply = sctp_make_shutdown(asoc, NULL);
  4435. if (!reply)
  4436. goto nomem;
  4437. /* Set the transport for the SHUTDOWN chunk and the timeout for the
  4438. * T2-shutdown timer.
  4439. */
  4440. sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
  4441. /* It shall then start the T2-shutdown timer */
  4442. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
  4443. SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
  4444. /* RFC 4960 Section 9.2
  4445. * The sender of the SHUTDOWN MAY also start an overall guard timer
  4446. * 'T5-shutdown-guard' to bound the overall time for shutdown sequence.
  4447. */
  4448. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
  4449. SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
  4450. if (asoc->autoclose)
  4451. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  4452. SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
  4453. /* and enter the SHUTDOWN-SENT state. */
  4454. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  4455. SCTP_STATE(SCTP_STATE_SHUTDOWN_SENT));
  4456. /* sctp-implguide 2.10 Issues with Heartbeating and failover
  4457. *
  4458. * HEARTBEAT ... is discontinued after sending either SHUTDOWN
  4459. * or SHUTDOWN-ACK.
  4460. */
  4461. sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
  4462. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
  4463. return SCTP_DISPOSITION_CONSUME;
  4464. nomem:
  4465. return SCTP_DISPOSITION_NOMEM;
  4466. }
  4467. /*
  4468. * Generate a SHUTDOWN ACK now that everything is SACK'd.
  4469. *
  4470. * From Section 9.2:
  4471. *
  4472. * If it has no more outstanding DATA chunks, the SHUTDOWN receiver
  4473. * shall send a SHUTDOWN ACK and start a T2-shutdown timer of its own,
  4474. * entering the SHUTDOWN-ACK-SENT state. If the timer expires, the
  4475. * endpoint must re-send the SHUTDOWN ACK.
  4476. *
  4477. * The return value is the disposition.
  4478. */
  4479. sctp_disposition_t sctp_sf_do_9_2_shutdown_ack(
  4480. const struct sctp_endpoint *ep,
  4481. const struct sctp_association *asoc,
  4482. const sctp_subtype_t type,
  4483. void *arg,
  4484. sctp_cmd_seq_t *commands)
  4485. {
  4486. struct sctp_chunk *chunk = (struct sctp_chunk *) arg;
  4487. struct sctp_chunk *reply;
  4488. /* There are 2 ways of getting here:
  4489. * 1) called in response to a SHUTDOWN chunk
  4490. * 2) called when SCTP_EVENT_NO_PENDING_TSN event is issued.
  4491. *
  4492. * For the case (2), the arg parameter is set to NULL. We need
  4493. * to check that we have a chunk before accessing it's fields.
  4494. */
  4495. if (chunk) {
  4496. if (!sctp_vtag_verify(chunk, asoc))
  4497. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  4498. /* Make sure that the SHUTDOWN chunk has a valid length. */
  4499. if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_shutdown_chunk_t)))
  4500. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  4501. commands);
  4502. }
  4503. /* If it has no more outstanding DATA chunks, the SHUTDOWN receiver
  4504. * shall send a SHUTDOWN ACK ...
  4505. */
  4506. reply = sctp_make_shutdown_ack(asoc, chunk);
  4507. if (!reply)
  4508. goto nomem;
  4509. /* Set the transport for the SHUTDOWN ACK chunk and the timeout for
  4510. * the T2-shutdown timer.
  4511. */
  4512. sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
  4513. /* and start/restart a T2-shutdown timer of its own, */
  4514. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
  4515. SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
  4516. if (asoc->autoclose)
  4517. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  4518. SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
  4519. /* Enter the SHUTDOWN-ACK-SENT state. */
  4520. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  4521. SCTP_STATE(SCTP_STATE_SHUTDOWN_ACK_SENT));
  4522. /* sctp-implguide 2.10 Issues with Heartbeating and failover
  4523. *
  4524. * HEARTBEAT ... is discontinued after sending either SHUTDOWN
  4525. * or SHUTDOWN-ACK.
  4526. */
  4527. sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
  4528. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
  4529. return SCTP_DISPOSITION_CONSUME;
  4530. nomem:
  4531. return SCTP_DISPOSITION_NOMEM;
  4532. }
  4533. /*
  4534. * Ignore the event defined as other
  4535. *
  4536. * The return value is the disposition of the event.
  4537. */
  4538. sctp_disposition_t sctp_sf_ignore_other(const struct sctp_endpoint *ep,
  4539. const struct sctp_association *asoc,
  4540. const sctp_subtype_t type,
  4541. void *arg,
  4542. sctp_cmd_seq_t *commands)
  4543. {
  4544. SCTP_DEBUG_PRINTK("The event other type %d is ignored\n", type.other);
  4545. return SCTP_DISPOSITION_DISCARD;
  4546. }
  4547. /************************************************************
  4548. * These are the state functions for handling timeout events.
  4549. ************************************************************/
  4550. /*
  4551. * RTX Timeout
  4552. *
  4553. * Section: 6.3.3 Handle T3-rtx Expiration
  4554. *
  4555. * Whenever the retransmission timer T3-rtx expires for a destination
  4556. * address, do the following:
  4557. * [See below]
  4558. *
  4559. * The return value is the disposition of the chunk.
  4560. */
  4561. sctp_disposition_t sctp_sf_do_6_3_3_rtx(const struct sctp_endpoint *ep,
  4562. const struct sctp_association *asoc,
  4563. const sctp_subtype_t type,
  4564. void *arg,
  4565. sctp_cmd_seq_t *commands)
  4566. {
  4567. struct sctp_transport *transport = arg;
  4568. SCTP_INC_STATS(SCTP_MIB_T3_RTX_EXPIREDS);
  4569. if (asoc->overall_error_count >= asoc->max_retrans) {
  4570. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  4571. SCTP_ERROR(ETIMEDOUT));
  4572. /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
  4573. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
  4574. SCTP_PERR(SCTP_ERROR_NO_ERROR));
  4575. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  4576. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  4577. return SCTP_DISPOSITION_DELETE_TCB;
  4578. }
  4579. /* E1) For the destination address for which the timer
  4580. * expires, adjust its ssthresh with rules defined in Section
  4581. * 7.2.3 and set the cwnd <- MTU.
  4582. */
  4583. /* E2) For the destination address for which the timer
  4584. * expires, set RTO <- RTO * 2 ("back off the timer"). The
  4585. * maximum value discussed in rule C7 above (RTO.max) may be
  4586. * used to provide an upper bound to this doubling operation.
  4587. */
  4588. /* E3) Determine how many of the earliest (i.e., lowest TSN)
  4589. * outstanding DATA chunks for the address for which the
  4590. * T3-rtx has expired will fit into a single packet, subject
  4591. * to the MTU constraint for the path corresponding to the
  4592. * destination transport address to which the retransmission
  4593. * is being sent (this may be different from the address for
  4594. * which the timer expires [see Section 6.4]). Call this
  4595. * value K. Bundle and retransmit those K DATA chunks in a
  4596. * single packet to the destination endpoint.
  4597. *
  4598. * Note: Any DATA chunks that were sent to the address for
  4599. * which the T3-rtx timer expired but did not fit in one MTU
  4600. * (rule E3 above), should be marked for retransmission and
  4601. * sent as soon as cwnd allows (normally when a SACK arrives).
  4602. */
  4603. /* Do some failure management (Section 8.2). */
  4604. sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE, SCTP_TRANSPORT(transport));
  4605. /* NB: Rules E4 and F1 are implicit in R1. */
  4606. sctp_add_cmd_sf(commands, SCTP_CMD_RETRAN, SCTP_TRANSPORT(transport));
  4607. return SCTP_DISPOSITION_CONSUME;
  4608. }
  4609. /*
  4610. * Generate delayed SACK on timeout
  4611. *
  4612. * Section: 6.2 Acknowledgement on Reception of DATA Chunks
  4613. *
  4614. * The guidelines on delayed acknowledgement algorithm specified in
  4615. * Section 4.2 of [RFC2581] SHOULD be followed. Specifically, an
  4616. * acknowledgement SHOULD be generated for at least every second packet
  4617. * (not every second DATA chunk) received, and SHOULD be generated
  4618. * within 200 ms of the arrival of any unacknowledged DATA chunk. In
  4619. * some situations it may be beneficial for an SCTP transmitter to be
  4620. * more conservative than the algorithms detailed in this document
  4621. * allow. However, an SCTP transmitter MUST NOT be more aggressive than
  4622. * the following algorithms allow.
  4623. */
  4624. sctp_disposition_t sctp_sf_do_6_2_sack(const struct sctp_endpoint *ep,
  4625. const struct sctp_association *asoc,
  4626. const sctp_subtype_t type,
  4627. void *arg,
  4628. sctp_cmd_seq_t *commands)
  4629. {
  4630. SCTP_INC_STATS(SCTP_MIB_DELAY_SACK_EXPIREDS);
  4631. sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
  4632. return SCTP_DISPOSITION_CONSUME;
  4633. }
  4634. /*
  4635. * sctp_sf_t1_init_timer_expire
  4636. *
  4637. * Section: 4 Note: 2
  4638. * Verification Tag:
  4639. * Inputs
  4640. * (endpoint, asoc)
  4641. *
  4642. * RFC 2960 Section 4 Notes
  4643. * 2) If the T1-init timer expires, the endpoint MUST retransmit INIT
  4644. * and re-start the T1-init timer without changing state. This MUST
  4645. * be repeated up to 'Max.Init.Retransmits' times. After that, the
  4646. * endpoint MUST abort the initialization process and report the
  4647. * error to SCTP user.
  4648. *
  4649. * Outputs
  4650. * (timers, events)
  4651. *
  4652. */
  4653. sctp_disposition_t sctp_sf_t1_init_timer_expire(const struct sctp_endpoint *ep,
  4654. const struct sctp_association *asoc,
  4655. const sctp_subtype_t type,
  4656. void *arg,
  4657. sctp_cmd_seq_t *commands)
  4658. {
  4659. struct sctp_chunk *repl = NULL;
  4660. struct sctp_bind_addr *bp;
  4661. int attempts = asoc->init_err_counter + 1;
  4662. SCTP_DEBUG_PRINTK("Timer T1 expired (INIT).\n");
  4663. SCTP_INC_STATS(SCTP_MIB_T1_INIT_EXPIREDS);
  4664. if (attempts <= asoc->max_init_attempts) {
  4665. bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
  4666. repl = sctp_make_init(asoc, bp, GFP_ATOMIC, 0);
  4667. if (!repl)
  4668. return SCTP_DISPOSITION_NOMEM;
  4669. /* Choose transport for INIT. */
  4670. sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
  4671. SCTP_CHUNK(repl));
  4672. /* Issue a sideeffect to do the needed accounting. */
  4673. sctp_add_cmd_sf(commands, SCTP_CMD_INIT_RESTART,
  4674. SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
  4675. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
  4676. } else {
  4677. SCTP_DEBUG_PRINTK("Giving up on INIT, attempts: %d"
  4678. " max_init_attempts: %d\n",
  4679. attempts, asoc->max_init_attempts);
  4680. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  4681. SCTP_ERROR(ETIMEDOUT));
  4682. sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
  4683. SCTP_PERR(SCTP_ERROR_NO_ERROR));
  4684. return SCTP_DISPOSITION_DELETE_TCB;
  4685. }
  4686. return SCTP_DISPOSITION_CONSUME;
  4687. }
  4688. /*
  4689. * sctp_sf_t1_cookie_timer_expire
  4690. *
  4691. * Section: 4 Note: 2
  4692. * Verification Tag:
  4693. * Inputs
  4694. * (endpoint, asoc)
  4695. *
  4696. * RFC 2960 Section 4 Notes
  4697. * 3) If the T1-cookie timer expires, the endpoint MUST retransmit
  4698. * COOKIE ECHO and re-start the T1-cookie timer without changing
  4699. * state. This MUST be repeated up to 'Max.Init.Retransmits' times.
  4700. * After that, the endpoint MUST abort the initialization process and
  4701. * report the error to SCTP user.
  4702. *
  4703. * Outputs
  4704. * (timers, events)
  4705. *
  4706. */
  4707. sctp_disposition_t sctp_sf_t1_cookie_timer_expire(const struct sctp_endpoint *ep,
  4708. const struct sctp_association *asoc,
  4709. const sctp_subtype_t type,
  4710. void *arg,
  4711. sctp_cmd_seq_t *commands)
  4712. {
  4713. struct sctp_chunk *repl = NULL;
  4714. int attempts = asoc->init_err_counter + 1;
  4715. SCTP_DEBUG_PRINTK("Timer T1 expired (COOKIE-ECHO).\n");
  4716. SCTP_INC_STATS(SCTP_MIB_T1_COOKIE_EXPIREDS);
  4717. if (attempts <= asoc->max_init_attempts) {
  4718. repl = sctp_make_cookie_echo(asoc, NULL);
  4719. if (!repl)
  4720. return SCTP_DISPOSITION_NOMEM;
  4721. sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
  4722. SCTP_CHUNK(repl));
  4723. /* Issue a sideeffect to do the needed accounting. */
  4724. sctp_add_cmd_sf(commands, SCTP_CMD_COOKIEECHO_RESTART,
  4725. SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
  4726. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
  4727. } else {
  4728. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  4729. SCTP_ERROR(ETIMEDOUT));
  4730. sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
  4731. SCTP_PERR(SCTP_ERROR_NO_ERROR));
  4732. return SCTP_DISPOSITION_DELETE_TCB;
  4733. }
  4734. return SCTP_DISPOSITION_CONSUME;
  4735. }
  4736. /* RFC2960 9.2 If the timer expires, the endpoint must re-send the SHUTDOWN
  4737. * with the updated last sequential TSN received from its peer.
  4738. *
  4739. * An endpoint should limit the number of retransmissions of the
  4740. * SHUTDOWN chunk to the protocol parameter 'Association.Max.Retrans'.
  4741. * If this threshold is exceeded the endpoint should destroy the TCB and
  4742. * MUST report the peer endpoint unreachable to the upper layer (and
  4743. * thus the association enters the CLOSED state). The reception of any
  4744. * packet from its peer (i.e. as the peer sends all of its queued DATA
  4745. * chunks) should clear the endpoint's retransmission count and restart
  4746. * the T2-Shutdown timer, giving its peer ample opportunity to transmit
  4747. * all of its queued DATA chunks that have not yet been sent.
  4748. */
  4749. sctp_disposition_t sctp_sf_t2_timer_expire(const struct sctp_endpoint *ep,
  4750. const struct sctp_association *asoc,
  4751. const sctp_subtype_t type,
  4752. void *arg,
  4753. sctp_cmd_seq_t *commands)
  4754. {
  4755. struct sctp_chunk *reply = NULL;
  4756. SCTP_DEBUG_PRINTK("Timer T2 expired.\n");
  4757. SCTP_INC_STATS(SCTP_MIB_T2_SHUTDOWN_EXPIREDS);
  4758. ((struct sctp_association *)asoc)->shutdown_retries++;
  4759. if (asoc->overall_error_count >= asoc->max_retrans) {
  4760. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  4761. SCTP_ERROR(ETIMEDOUT));
  4762. /* Note: CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
  4763. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
  4764. SCTP_PERR(SCTP_ERROR_NO_ERROR));
  4765. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  4766. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  4767. return SCTP_DISPOSITION_DELETE_TCB;
  4768. }
  4769. switch (asoc->state) {
  4770. case SCTP_STATE_SHUTDOWN_SENT:
  4771. reply = sctp_make_shutdown(asoc, NULL);
  4772. break;
  4773. case SCTP_STATE_SHUTDOWN_ACK_SENT:
  4774. reply = sctp_make_shutdown_ack(asoc, NULL);
  4775. break;
  4776. default:
  4777. BUG();
  4778. break;
  4779. }
  4780. if (!reply)
  4781. goto nomem;
  4782. /* Do some failure management (Section 8.2). */
  4783. sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE,
  4784. SCTP_TRANSPORT(asoc->shutdown_last_sent_to));
  4785. /* Set the transport for the SHUTDOWN/ACK chunk and the timeout for
  4786. * the T2-shutdown timer.
  4787. */
  4788. sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
  4789. /* Restart the T2-shutdown timer. */
  4790. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
  4791. SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
  4792. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
  4793. return SCTP_DISPOSITION_CONSUME;
  4794. nomem:
  4795. return SCTP_DISPOSITION_NOMEM;
  4796. }
  4797. /*
  4798. * ADDIP Section 4.1 ASCONF CHunk Procedures
  4799. * If the T4 RTO timer expires the endpoint should do B1 to B5
  4800. */
  4801. sctp_disposition_t sctp_sf_t4_timer_expire(
  4802. const struct sctp_endpoint *ep,
  4803. const struct sctp_association *asoc,
  4804. const sctp_subtype_t type,
  4805. void *arg,
  4806. sctp_cmd_seq_t *commands)
  4807. {
  4808. struct sctp_chunk *chunk = asoc->addip_last_asconf;
  4809. struct sctp_transport *transport = chunk->transport;
  4810. SCTP_INC_STATS(SCTP_MIB_T4_RTO_EXPIREDS);
  4811. /* ADDIP 4.1 B1) Increment the error counters and perform path failure
  4812. * detection on the appropriate destination address as defined in
  4813. * RFC2960 [5] section 8.1 and 8.2.
  4814. */
  4815. sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE, SCTP_TRANSPORT(transport));
  4816. /* Reconfig T4 timer and transport. */
  4817. sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T4, SCTP_CHUNK(chunk));
  4818. /* ADDIP 4.1 B2) Increment the association error counters and perform
  4819. * endpoint failure detection on the association as defined in
  4820. * RFC2960 [5] section 8.1 and 8.2.
  4821. * association error counter is incremented in SCTP_CMD_STRIKE.
  4822. */
  4823. if (asoc->overall_error_count >= asoc->max_retrans) {
  4824. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  4825. SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
  4826. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  4827. SCTP_ERROR(ETIMEDOUT));
  4828. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
  4829. SCTP_PERR(SCTP_ERROR_NO_ERROR));
  4830. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  4831. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  4832. return SCTP_DISPOSITION_ABORT;
  4833. }
  4834. /* ADDIP 4.1 B3) Back-off the destination address RTO value to which
  4835. * the ASCONF chunk was sent by doubling the RTO timer value.
  4836. * This is done in SCTP_CMD_STRIKE.
  4837. */
  4838. /* ADDIP 4.1 B4) Re-transmit the ASCONF Chunk last sent and if possible
  4839. * choose an alternate destination address (please refer to RFC2960
  4840. * [5] section 6.4.1). An endpoint MUST NOT add new parameters to this
  4841. * chunk, it MUST be the same (including its serial number) as the last
  4842. * ASCONF sent.
  4843. */
  4844. sctp_chunk_hold(asoc->addip_last_asconf);
  4845. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
  4846. SCTP_CHUNK(asoc->addip_last_asconf));
  4847. /* ADDIP 4.1 B5) Restart the T-4 RTO timer. Note that if a different
  4848. * destination is selected, then the RTO used will be that of the new
  4849. * destination address.
  4850. */
  4851. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
  4852. SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
  4853. return SCTP_DISPOSITION_CONSUME;
  4854. }
  4855. /* sctpimpguide-05 Section 2.12.2
  4856. * The sender of the SHUTDOWN MAY also start an overall guard timer
  4857. * 'T5-shutdown-guard' to bound the overall time for shutdown sequence.
  4858. * At the expiration of this timer the sender SHOULD abort the association
  4859. * by sending an ABORT chunk.
  4860. */
  4861. sctp_disposition_t sctp_sf_t5_timer_expire(const struct sctp_endpoint *ep,
  4862. const struct sctp_association *asoc,
  4863. const sctp_subtype_t type,
  4864. void *arg,
  4865. sctp_cmd_seq_t *commands)
  4866. {
  4867. struct sctp_chunk *reply = NULL;
  4868. SCTP_DEBUG_PRINTK("Timer T5 expired.\n");
  4869. SCTP_INC_STATS(SCTP_MIB_T5_SHUTDOWN_GUARD_EXPIREDS);
  4870. reply = sctp_make_abort(asoc, NULL, 0);
  4871. if (!reply)
  4872. goto nomem;
  4873. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
  4874. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  4875. SCTP_ERROR(ETIMEDOUT));
  4876. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
  4877. SCTP_PERR(SCTP_ERROR_NO_ERROR));
  4878. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  4879. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  4880. return SCTP_DISPOSITION_DELETE_TCB;
  4881. nomem:
  4882. return SCTP_DISPOSITION_NOMEM;
  4883. }
  4884. /* Handle expiration of AUTOCLOSE timer. When the autoclose timer expires,
  4885. * the association is automatically closed by starting the shutdown process.
  4886. * The work that needs to be done is same as when SHUTDOWN is initiated by
  4887. * the user. So this routine looks same as sctp_sf_do_9_2_prm_shutdown().
  4888. */
  4889. sctp_disposition_t sctp_sf_autoclose_timer_expire(
  4890. const struct sctp_endpoint *ep,
  4891. const struct sctp_association *asoc,
  4892. const sctp_subtype_t type,
  4893. void *arg,
  4894. sctp_cmd_seq_t *commands)
  4895. {
  4896. int disposition;
  4897. SCTP_INC_STATS(SCTP_MIB_AUTOCLOSE_EXPIREDS);
  4898. /* From 9.2 Shutdown of an Association
  4899. * Upon receipt of the SHUTDOWN primitive from its upper
  4900. * layer, the endpoint enters SHUTDOWN-PENDING state and
  4901. * remains there until all outstanding data has been
  4902. * acknowledged by its peer. The endpoint accepts no new data
  4903. * from its upper layer, but retransmits data to the far end
  4904. * if necessary to fill gaps.
  4905. */
  4906. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  4907. SCTP_STATE(SCTP_STATE_SHUTDOWN_PENDING));
  4908. disposition = SCTP_DISPOSITION_CONSUME;
  4909. if (sctp_outq_is_empty(&asoc->outqueue)) {
  4910. disposition = sctp_sf_do_9_2_start_shutdown(ep, asoc, type,
  4911. arg, commands);
  4912. }
  4913. return disposition;
  4914. }
  4915. /*****************************************************************************
  4916. * These are sa state functions which could apply to all types of events.
  4917. ****************************************************************************/
  4918. /*
  4919. * This table entry is not implemented.
  4920. *
  4921. * Inputs
  4922. * (endpoint, asoc, chunk)
  4923. *
  4924. * The return value is the disposition of the chunk.
  4925. */
  4926. sctp_disposition_t sctp_sf_not_impl(const struct sctp_endpoint *ep,
  4927. const struct sctp_association *asoc,
  4928. const sctp_subtype_t type,
  4929. void *arg,
  4930. sctp_cmd_seq_t *commands)
  4931. {
  4932. return SCTP_DISPOSITION_NOT_IMPL;
  4933. }
  4934. /*
  4935. * This table entry represents a bug.
  4936. *
  4937. * Inputs
  4938. * (endpoint, asoc, chunk)
  4939. *
  4940. * The return value is the disposition of the chunk.
  4941. */
  4942. sctp_disposition_t sctp_sf_bug(const struct sctp_endpoint *ep,
  4943. const struct sctp_association *asoc,
  4944. const sctp_subtype_t type,
  4945. void *arg,
  4946. sctp_cmd_seq_t *commands)
  4947. {
  4948. return SCTP_DISPOSITION_BUG;
  4949. }
  4950. /*
  4951. * This table entry represents the firing of a timer in the wrong state.
  4952. * Since timer deletion cannot be guaranteed a timer 'may' end up firing
  4953. * when the association is in the wrong state. This event should
  4954. * be ignored, so as to prevent any rearming of the timer.
  4955. *
  4956. * Inputs
  4957. * (endpoint, asoc, chunk)
  4958. *
  4959. * The return value is the disposition of the chunk.
  4960. */
  4961. sctp_disposition_t sctp_sf_timer_ignore(const struct sctp_endpoint *ep,
  4962. const struct sctp_association *asoc,
  4963. const sctp_subtype_t type,
  4964. void *arg,
  4965. sctp_cmd_seq_t *commands)
  4966. {
  4967. SCTP_DEBUG_PRINTK("Timer %d ignored.\n", type.chunk);
  4968. return SCTP_DISPOSITION_CONSUME;
  4969. }
  4970. /********************************************************************
  4971. * 2nd Level Abstractions
  4972. ********************************************************************/
  4973. /* Pull the SACK chunk based on the SACK header. */
  4974. static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk)
  4975. {
  4976. struct sctp_sackhdr *sack;
  4977. unsigned int len;
  4978. __u16 num_blocks;
  4979. __u16 num_dup_tsns;
  4980. /* Protect ourselves from reading too far into
  4981. * the skb from a bogus sender.
  4982. */
  4983. sack = (struct sctp_sackhdr *) chunk->skb->data;
  4984. num_blocks = ntohs(sack->num_gap_ack_blocks);
  4985. num_dup_tsns = ntohs(sack->num_dup_tsns);
  4986. len = sizeof(struct sctp_sackhdr);
  4987. len += (num_blocks + num_dup_tsns) * sizeof(__u32);
  4988. if (len > chunk->skb->len)
  4989. return NULL;
  4990. skb_pull(chunk->skb, len);
  4991. return sack;
  4992. }
  4993. /* Create an ABORT packet to be sent as a response, with the specified
  4994. * error causes.
  4995. */
  4996. static struct sctp_packet *sctp_abort_pkt_new(const struct sctp_endpoint *ep,
  4997. const struct sctp_association *asoc,
  4998. struct sctp_chunk *chunk,
  4999. const void *payload,
  5000. size_t paylen)
  5001. {
  5002. struct sctp_packet *packet;
  5003. struct sctp_chunk *abort;
  5004. packet = sctp_ootb_pkt_new(asoc, chunk);
  5005. if (packet) {
  5006. /* Make an ABORT.
  5007. * The T bit will be set if the asoc is NULL.
  5008. */
  5009. abort = sctp_make_abort(asoc, chunk, paylen);
  5010. if (!abort) {
  5011. sctp_ootb_pkt_free(packet);
  5012. return NULL;
  5013. }
  5014. /* Reflect vtag if T-Bit is set */
  5015. if (sctp_test_T_bit(abort))
  5016. packet->vtag = ntohl(chunk->sctp_hdr->vtag);
  5017. /* Add specified error causes, i.e., payload, to the
  5018. * end of the chunk.
  5019. */
  5020. sctp_addto_chunk(abort, paylen, payload);
  5021. /* Set the skb to the belonging sock for accounting. */
  5022. abort->skb->sk = ep->base.sk;
  5023. sctp_packet_append_chunk(packet, abort);
  5024. }
  5025. return packet;
  5026. }
  5027. /* Allocate a packet for responding in the OOTB conditions. */
  5028. static struct sctp_packet *sctp_ootb_pkt_new(const struct sctp_association *asoc,
  5029. const struct sctp_chunk *chunk)
  5030. {
  5031. struct sctp_packet *packet;
  5032. struct sctp_transport *transport;
  5033. __u16 sport;
  5034. __u16 dport;
  5035. __u32 vtag;
  5036. /* Get the source and destination port from the inbound packet. */
  5037. sport = ntohs(chunk->sctp_hdr->dest);
  5038. dport = ntohs(chunk->sctp_hdr->source);
  5039. /* The V-tag is going to be the same as the inbound packet if no
  5040. * association exists, otherwise, use the peer's vtag.
  5041. */
  5042. if (asoc) {
  5043. /* Special case the INIT-ACK as there is no peer's vtag
  5044. * yet.
  5045. */
  5046. switch(chunk->chunk_hdr->type) {
  5047. case SCTP_CID_INIT_ACK:
  5048. {
  5049. sctp_initack_chunk_t *initack;
  5050. initack = (sctp_initack_chunk_t *)chunk->chunk_hdr;
  5051. vtag = ntohl(initack->init_hdr.init_tag);
  5052. break;
  5053. }
  5054. default:
  5055. vtag = asoc->peer.i.init_tag;
  5056. break;
  5057. }
  5058. } else {
  5059. /* Special case the INIT and stale COOKIE_ECHO as there is no
  5060. * vtag yet.
  5061. */
  5062. switch(chunk->chunk_hdr->type) {
  5063. case SCTP_CID_INIT:
  5064. {
  5065. sctp_init_chunk_t *init;
  5066. init = (sctp_init_chunk_t *)chunk->chunk_hdr;
  5067. vtag = ntohl(init->init_hdr.init_tag);
  5068. break;
  5069. }
  5070. default:
  5071. vtag = ntohl(chunk->sctp_hdr->vtag);
  5072. break;
  5073. }
  5074. }
  5075. /* Make a transport for the bucket, Eliza... */
  5076. transport = sctp_transport_new(sctp_source(chunk), GFP_ATOMIC);
  5077. if (!transport)
  5078. goto nomem;
  5079. /* Cache a route for the transport with the chunk's destination as
  5080. * the source address.
  5081. */
  5082. sctp_transport_route(transport, (union sctp_addr *)&chunk->dest,
  5083. sctp_sk(sctp_get_ctl_sock()));
  5084. packet = sctp_packet_init(&transport->packet, transport, sport, dport);
  5085. packet = sctp_packet_config(packet, vtag, 0);
  5086. return packet;
  5087. nomem:
  5088. return NULL;
  5089. }
  5090. /* Free the packet allocated earlier for responding in the OOTB condition. */
  5091. void sctp_ootb_pkt_free(struct sctp_packet *packet)
  5092. {
  5093. sctp_transport_free(packet->transport);
  5094. }
  5095. /* Send a stale cookie error when a invalid COOKIE ECHO chunk is found */
  5096. static void sctp_send_stale_cookie_err(const struct sctp_endpoint *ep,
  5097. const struct sctp_association *asoc,
  5098. const struct sctp_chunk *chunk,
  5099. sctp_cmd_seq_t *commands,
  5100. struct sctp_chunk *err_chunk)
  5101. {
  5102. struct sctp_packet *packet;
  5103. if (err_chunk) {
  5104. packet = sctp_ootb_pkt_new(asoc, chunk);
  5105. if (packet) {
  5106. struct sctp_signed_cookie *cookie;
  5107. /* Override the OOTB vtag from the cookie. */
  5108. cookie = chunk->subh.cookie_hdr;
  5109. packet->vtag = cookie->c.peer_vtag;
  5110. /* Set the skb to the belonging sock for accounting. */
  5111. err_chunk->skb->sk = ep->base.sk;
  5112. sctp_packet_append_chunk(packet, err_chunk);
  5113. sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
  5114. SCTP_PACKET(packet));
  5115. SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
  5116. } else
  5117. sctp_chunk_free (err_chunk);
  5118. }
  5119. }
  5120. /* Process a data chunk */
  5121. static int sctp_eat_data(const struct sctp_association *asoc,
  5122. struct sctp_chunk *chunk,
  5123. sctp_cmd_seq_t *commands)
  5124. {
  5125. sctp_datahdr_t *data_hdr;
  5126. struct sctp_chunk *err;
  5127. size_t datalen;
  5128. sctp_verb_t deliver;
  5129. int tmp;
  5130. __u32 tsn;
  5131. struct sctp_tsnmap *map = (struct sctp_tsnmap *)&asoc->peer.tsn_map;
  5132. struct sock *sk = asoc->base.sk;
  5133. data_hdr = chunk->subh.data_hdr = (sctp_datahdr_t *)chunk->skb->data;
  5134. skb_pull(chunk->skb, sizeof(sctp_datahdr_t));
  5135. tsn = ntohl(data_hdr->tsn);
  5136. SCTP_DEBUG_PRINTK("eat_data: TSN 0x%x.\n", tsn);
  5137. /* ASSERT: Now skb->data is really the user data. */
  5138. /* Process ECN based congestion.
  5139. *
  5140. * Since the chunk structure is reused for all chunks within
  5141. * a packet, we use ecn_ce_done to track if we've already
  5142. * done CE processing for this packet.
  5143. *
  5144. * We need to do ECN processing even if we plan to discard the
  5145. * chunk later.
  5146. */
  5147. if (!chunk->ecn_ce_done) {
  5148. struct sctp_af *af;
  5149. chunk->ecn_ce_done = 1;
  5150. af = sctp_get_af_specific(
  5151. ipver2af(ip_hdr(chunk->skb)->version));
  5152. if (af && af->is_ce(chunk->skb) && asoc->peer.ecn_capable) {
  5153. /* Do real work as sideffect. */
  5154. sctp_add_cmd_sf(commands, SCTP_CMD_ECN_CE,
  5155. SCTP_U32(tsn));
  5156. }
  5157. }
  5158. tmp = sctp_tsnmap_check(&asoc->peer.tsn_map, tsn);
  5159. if (tmp < 0) {
  5160. /* The TSN is too high--silently discard the chunk and
  5161. * count on it getting retransmitted later.
  5162. */
  5163. return SCTP_IERROR_HIGH_TSN;
  5164. } else if (tmp > 0) {
  5165. /* This is a duplicate. Record it. */
  5166. sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_DUP, SCTP_U32(tsn));
  5167. return SCTP_IERROR_DUP_TSN;
  5168. }
  5169. /* This is a new TSN. */
  5170. /* Discard if there is no room in the receive window.
  5171. * Actually, allow a little bit of overflow (up to a MTU).
  5172. */
  5173. datalen = ntohs(chunk->chunk_hdr->length);
  5174. datalen -= sizeof(sctp_data_chunk_t);
  5175. deliver = SCTP_CMD_CHUNK_ULP;
  5176. /* Think about partial delivery. */
  5177. if ((datalen >= asoc->rwnd) && (!asoc->ulpq.pd_mode)) {
  5178. /* Even if we don't accept this chunk there is
  5179. * memory pressure.
  5180. */
  5181. sctp_add_cmd_sf(commands, SCTP_CMD_PART_DELIVER, SCTP_NULL());
  5182. }
  5183. /* Spill over rwnd a little bit. Note: While allowed, this spill over
  5184. * seems a bit troublesome in that frag_point varies based on
  5185. * PMTU. In cases, such as loopback, this might be a rather
  5186. * large spill over.
  5187. */
  5188. if ((!chunk->data_accepted) && (!asoc->rwnd || asoc->rwnd_over ||
  5189. (datalen > asoc->rwnd + asoc->frag_point))) {
  5190. /* If this is the next TSN, consider reneging to make
  5191. * room. Note: Playing nice with a confused sender. A
  5192. * malicious sender can still eat up all our buffer
  5193. * space and in the future we may want to detect and
  5194. * do more drastic reneging.
  5195. */
  5196. if (sctp_tsnmap_has_gap(map) &&
  5197. (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
  5198. SCTP_DEBUG_PRINTK("Reneging for tsn:%u\n", tsn);
  5199. deliver = SCTP_CMD_RENEGE;
  5200. } else {
  5201. SCTP_DEBUG_PRINTK("Discard tsn: %u len: %Zd, "
  5202. "rwnd: %d\n", tsn, datalen,
  5203. asoc->rwnd);
  5204. return SCTP_IERROR_IGNORE_TSN;
  5205. }
  5206. }
  5207. /*
  5208. * Also try to renege to limit our memory usage in the event that
  5209. * we are under memory pressure
  5210. * If we can't renege, don't worry about it, the sk_rmem_schedule
  5211. * in sctp_ulpevent_make_rcvmsg will drop the frame if we grow our
  5212. * memory usage too much
  5213. */
  5214. if (*sk->sk_prot_creator->memory_pressure) {
  5215. if (sctp_tsnmap_has_gap(map) &&
  5216. (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
  5217. SCTP_DEBUG_PRINTK("Under Pressure! Reneging for tsn:%u\n", tsn);
  5218. deliver = SCTP_CMD_RENEGE;
  5219. }
  5220. }
  5221. /*
  5222. * Section 3.3.10.9 No User Data (9)
  5223. *
  5224. * Cause of error
  5225. * ---------------
  5226. * No User Data: This error cause is returned to the originator of a
  5227. * DATA chunk if a received DATA chunk has no user data.
  5228. */
  5229. if (unlikely(0 == datalen)) {
  5230. err = sctp_make_abort_no_data(asoc, chunk, tsn);
  5231. if (err) {
  5232. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
  5233. SCTP_CHUNK(err));
  5234. }
  5235. /* We are going to ABORT, so we might as well stop
  5236. * processing the rest of the chunks in the packet.
  5237. */
  5238. sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
  5239. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  5240. SCTP_ERROR(ECONNABORTED));
  5241. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
  5242. SCTP_PERR(SCTP_ERROR_NO_DATA));
  5243. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  5244. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  5245. return SCTP_IERROR_NO_DATA;
  5246. }
  5247. chunk->data_accepted = 1;
  5248. /* Note: Some chunks may get overcounted (if we drop) or overcounted
  5249. * if we renege and the chunk arrives again.
  5250. */
  5251. if (chunk->chunk_hdr->flags & SCTP_DATA_UNORDERED)
  5252. SCTP_INC_STATS(SCTP_MIB_INUNORDERCHUNKS);
  5253. else
  5254. SCTP_INC_STATS(SCTP_MIB_INORDERCHUNKS);
  5255. /* RFC 2960 6.5 Stream Identifier and Stream Sequence Number
  5256. *
  5257. * If an endpoint receive a DATA chunk with an invalid stream
  5258. * identifier, it shall acknowledge the reception of the DATA chunk
  5259. * following the normal procedure, immediately send an ERROR chunk
  5260. * with cause set to "Invalid Stream Identifier" (See Section 3.3.10)
  5261. * and discard the DATA chunk.
  5262. */
  5263. if (ntohs(data_hdr->stream) >= asoc->c.sinit_max_instreams) {
  5264. /* Mark tsn as received even though we drop it */
  5265. sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_TSN, SCTP_U32(tsn));
  5266. err = sctp_make_op_error(asoc, chunk, SCTP_ERROR_INV_STRM,
  5267. &data_hdr->stream,
  5268. sizeof(data_hdr->stream));
  5269. if (err)
  5270. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
  5271. SCTP_CHUNK(err));
  5272. return SCTP_IERROR_BAD_STREAM;
  5273. }
  5274. /* Send the data up to the user. Note: Schedule the
  5275. * SCTP_CMD_CHUNK_ULP cmd before the SCTP_CMD_GEN_SACK, as the SACK
  5276. * chunk needs the updated rwnd.
  5277. */
  5278. sctp_add_cmd_sf(commands, deliver, SCTP_CHUNK(chunk));
  5279. return SCTP_IERROR_NO_ERROR;
  5280. }