sm_statefuns.c 188 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817281828192820282128222823282428252826282728282829283028312832283328342835283628372838283928402841284228432844284528462847284828492850285128522853285428552856285728582859286028612862286328642865286628672868286928702871287228732874287528762877287828792880288128822883288428852886288728882889289028912892289328942895289628972898289929002901290229032904290529062907290829092910291129122913291429152916291729182919292029212922292329242925292629272928292929302931293229332934293529362937293829392940294129422943294429452946294729482949295029512952295329542955295629572958295929602961296229632964296529662967296829692970297129722973297429752976297729782979298029812982298329842985298629872988298929902991299229932994299529962997299829993000300130023003300430053006300730083009301030113012301330143015301630173018301930203021302230233024302530263027302830293030303130323033303430353036303730383039304030413042304330443045304630473048304930503051305230533054305530563057305830593060306130623063306430653066306730683069307030713072307330743075307630773078307930803081308230833084308530863087308830893090309130923093309430953096309730983099310031013102310331043105310631073108310931103111311231133114311531163117311831193120312131223123312431253126312731283129313031313132313331343135313631373138313931403141314231433144314531463147314831493150315131523153315431553156315731583159316031613162316331643165316631673168316931703171317231733174317531763177317831793180318131823183318431853186318731883189319031913192319331943195319631973198319932003201320232033204320532063207320832093210321132123213321432153216321732183219322032213222322332243225322632273228322932303231323232333234323532363237323832393240324132423243324432453246324732483249325032513252325332543255325632573258325932603261326232633264326532663267326832693270327132723273327432753276327732783279328032813282328332843285328632873288328932903291329232933294329532963297329832993300330133023303330433053306330733083309331033113312331333143315331633173318331933203321332233233324332533263327332833293330333133323333333433353336333733383339334033413342334333443345334633473348334933503351335233533354335533563357335833593360336133623363336433653366336733683369337033713372337333743375337633773378337933803381338233833384338533863387338833893390339133923393339433953396339733983399340034013402340334043405340634073408340934103411341234133414341534163417341834193420342134223423342434253426342734283429343034313432343334343435343634373438343934403441344234433444344534463447344834493450345134523453345434553456345734583459346034613462346334643465346634673468346934703471347234733474347534763477347834793480348134823483348434853486348734883489349034913492349334943495349634973498349935003501350235033504350535063507350835093510351135123513351435153516351735183519352035213522352335243525352635273528352935303531353235333534353535363537353835393540354135423543354435453546354735483549355035513552355335543555355635573558355935603561356235633564356535663567356835693570357135723573357435753576357735783579358035813582358335843585358635873588358935903591359235933594359535963597359835993600360136023603360436053606360736083609361036113612361336143615361636173618361936203621362236233624362536263627362836293630363136323633363436353636363736383639364036413642364336443645364636473648364936503651365236533654365536563657365836593660366136623663366436653666366736683669367036713672367336743675367636773678367936803681368236833684368536863687368836893690369136923693369436953696369736983699370037013702370337043705370637073708370937103711371237133714371537163717371837193720372137223723372437253726372737283729373037313732373337343735373637373738373937403741374237433744374537463747374837493750375137523753375437553756375737583759376037613762376337643765376637673768376937703771377237733774377537763777377837793780378137823783378437853786378737883789379037913792379337943795379637973798379938003801380238033804380538063807380838093810381138123813381438153816381738183819382038213822382338243825382638273828382938303831383238333834383538363837383838393840384138423843384438453846384738483849385038513852385338543855385638573858385938603861386238633864386538663867386838693870387138723873387438753876387738783879388038813882388338843885388638873888388938903891389238933894389538963897389838993900390139023903390439053906390739083909391039113912391339143915391639173918391939203921392239233924392539263927392839293930393139323933393439353936393739383939394039413942394339443945394639473948394939503951395239533954395539563957395839593960396139623963396439653966396739683969397039713972397339743975397639773978397939803981398239833984398539863987398839893990399139923993399439953996399739983999400040014002400340044005400640074008400940104011401240134014401540164017401840194020402140224023402440254026402740284029403040314032403340344035403640374038403940404041404240434044404540464047404840494050405140524053405440554056405740584059406040614062406340644065406640674068406940704071407240734074407540764077407840794080408140824083408440854086408740884089409040914092409340944095409640974098409941004101410241034104410541064107410841094110411141124113411441154116411741184119412041214122412341244125412641274128412941304131413241334134413541364137413841394140414141424143414441454146414741484149415041514152415341544155415641574158415941604161416241634164416541664167416841694170417141724173417441754176417741784179418041814182418341844185418641874188418941904191419241934194419541964197419841994200420142024203420442054206420742084209421042114212421342144215421642174218421942204221422242234224422542264227422842294230423142324233423442354236423742384239424042414242424342444245424642474248424942504251425242534254425542564257425842594260426142624263426442654266426742684269427042714272427342744275427642774278427942804281428242834284428542864287428842894290429142924293429442954296429742984299430043014302430343044305430643074308430943104311431243134314431543164317431843194320432143224323432443254326432743284329433043314332433343344335433643374338433943404341434243434344434543464347434843494350435143524353435443554356435743584359436043614362436343644365436643674368436943704371437243734374437543764377437843794380438143824383438443854386438743884389439043914392439343944395439643974398439944004401440244034404440544064407440844094410441144124413441444154416441744184419442044214422442344244425442644274428442944304431443244334434443544364437443844394440444144424443444444454446444744484449445044514452445344544455445644574458445944604461446244634464446544664467446844694470447144724473447444754476447744784479448044814482448344844485448644874488448944904491449244934494449544964497449844994500450145024503450445054506450745084509451045114512451345144515451645174518451945204521452245234524452545264527452845294530453145324533453445354536453745384539454045414542454345444545454645474548454945504551455245534554455545564557455845594560456145624563456445654566456745684569457045714572457345744575457645774578457945804581458245834584458545864587458845894590459145924593459445954596459745984599460046014602460346044605460646074608460946104611461246134614461546164617461846194620462146224623462446254626462746284629463046314632463346344635463646374638463946404641464246434644464546464647464846494650465146524653465446554656465746584659466046614662466346644665466646674668466946704671467246734674467546764677467846794680468146824683468446854686468746884689469046914692469346944695469646974698469947004701470247034704470547064707470847094710471147124713471447154716471747184719472047214722472347244725472647274728472947304731473247334734473547364737473847394740474147424743474447454746474747484749475047514752475347544755475647574758475947604761476247634764476547664767476847694770477147724773477447754776477747784779478047814782478347844785478647874788478947904791479247934794479547964797479847994800480148024803480448054806480748084809481048114812481348144815481648174818481948204821482248234824482548264827482848294830483148324833483448354836483748384839484048414842484348444845484648474848484948504851485248534854485548564857485848594860486148624863486448654866486748684869487048714872487348744875487648774878487948804881488248834884488548864887488848894890489148924893489448954896489748984899490049014902490349044905490649074908490949104911491249134914491549164917491849194920492149224923492449254926492749284929493049314932493349344935493649374938493949404941494249434944494549464947494849494950495149524953495449554956495749584959496049614962496349644965496649674968496949704971497249734974497549764977497849794980498149824983498449854986498749884989499049914992499349944995499649974998499950005001500250035004500550065007500850095010501150125013501450155016501750185019502050215022502350245025502650275028502950305031503250335034503550365037503850395040504150425043504450455046504750485049505050515052505350545055505650575058505950605061506250635064506550665067506850695070507150725073507450755076507750785079508050815082508350845085508650875088508950905091509250935094509550965097509850995100510151025103510451055106510751085109511051115112511351145115511651175118511951205121512251235124512551265127512851295130513151325133513451355136513751385139514051415142514351445145514651475148514951505151515251535154515551565157515851595160516151625163516451655166516751685169517051715172517351745175517651775178517951805181518251835184518551865187518851895190519151925193519451955196519751985199520052015202520352045205520652075208520952105211521252135214521552165217521852195220522152225223522452255226522752285229523052315232523352345235523652375238523952405241524252435244524552465247524852495250525152525253525452555256525752585259526052615262526352645265526652675268526952705271527252735274527552765277527852795280528152825283528452855286528752885289529052915292529352945295529652975298529953005301530253035304530553065307530853095310531153125313531453155316531753185319532053215322532353245325532653275328532953305331533253335334533553365337533853395340534153425343534453455346534753485349535053515352535353545355535653575358535953605361536253635364536553665367536853695370537153725373537453755376537753785379538053815382538353845385538653875388538953905391539253935394539553965397539853995400540154025403540454055406540754085409541054115412541354145415541654175418541954205421542254235424542554265427542854295430543154325433543454355436543754385439544054415442544354445445544654475448544954505451545254535454545554565457545854595460546154625463546454655466546754685469547054715472547354745475547654775478547954805481548254835484548554865487548854895490549154925493549454955496549754985499550055015502550355045505550655075508550955105511551255135514551555165517551855195520552155225523552455255526552755285529553055315532553355345535553655375538553955405541554255435544554555465547554855495550555155525553555455555556555755585559556055615562556355645565556655675568556955705571557255735574557555765577557855795580558155825583558455855586558755885589559055915592559355945595559655975598559956005601560256035604560556065607560856095610561156125613561456155616561756185619562056215622562356245625562656275628562956305631563256335634563556365637563856395640564156425643564456455646564756485649565056515652565356545655565656575658565956605661566256635664566556665667566856695670567156725673567456755676567756785679568056815682568356845685568656875688568956905691569256935694569556965697569856995700570157025703570457055706570757085709571057115712571357145715571657175718571957205721572257235724572557265727572857295730573157325733573457355736573757385739574057415742574357445745574657475748574957505751575257535754575557565757575857595760576157625763576457655766576757685769577057715772577357745775577657775778577957805781578257835784578557865787578857895790579157925793579457955796579757985799580058015802580358045805580658075808580958105811581258135814581558165817581858195820582158225823582458255826582758285829583058315832583358345835583658375838583958405841584258435844584558465847584858495850585158525853585458555856585758585859586058615862586358645865586658675868586958705871587258735874587558765877587858795880588158825883588458855886588758885889589058915892589358945895589658975898589959005901590259035904590559065907590859095910591159125913591459155916591759185919592059215922592359245925592659275928592959305931593259335934593559365937593859395940594159425943594459455946594759485949595059515952595359545955595659575958595959605961596259635964596559665967596859695970597159725973597459755976597759785979598059815982598359845985598659875988598959905991599259935994599559965997599859996000600160026003600460056006600760086009601060116012601360146015601660176018601960206021602260236024
  1. /* SCTP kernel implementation
  2. * (C) Copyright IBM Corp. 2001, 2004
  3. * Copyright (c) 1999-2000 Cisco, Inc.
  4. * Copyright (c) 1999-2001 Motorola, Inc.
  5. * Copyright (c) 2001-2002 Intel Corp.
  6. * Copyright (c) 2002 Nokia Corp.
  7. *
  8. * This is part of the SCTP Linux Kernel Implementation.
  9. *
  10. * These are the state functions for the state machine.
  11. *
  12. * This SCTP implementation is free software;
  13. * you can redistribute it and/or modify it under the terms of
  14. * the GNU General Public License as published by
  15. * the Free Software Foundation; either version 2, or (at your option)
  16. * any later version.
  17. *
  18. * This SCTP implementation is distributed in the hope that it
  19. * will be useful, but WITHOUT ANY WARRANTY; without even the implied
  20. * ************************
  21. * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
  22. * See the GNU General Public License for more details.
  23. *
  24. * You should have received a copy of the GNU General Public License
  25. * along with GNU CC; see the file COPYING. If not, write to
  26. * the Free Software Foundation, 59 Temple Place - Suite 330,
  27. * Boston, MA 02111-1307, USA.
  28. *
  29. * Please send any bug reports or fixes you make to the
  30. * email address(es):
  31. * lksctp developers <lksctp-developers@lists.sourceforge.net>
  32. *
  33. * Or submit a bug report through the following website:
  34. * http://www.sf.net/projects/lksctp
  35. *
  36. * Written or modified by:
  37. * La Monte H.P. Yarroll <piggy@acm.org>
  38. * Karl Knutson <karl@athena.chicago.il.us>
  39. * Mathew Kotowsky <kotowsky@sctp.org>
  40. * Sridhar Samudrala <samudrala@us.ibm.com>
  41. * Jon Grimm <jgrimm@us.ibm.com>
  42. * Hui Huang <hui.huang@nokia.com>
  43. * Dajiang Zhang <dajiang.zhang@nokia.com>
  44. * Daisy Chang <daisyc@us.ibm.com>
  45. * Ardelle Fan <ardelle.fan@intel.com>
  46. * Ryan Layer <rmlayer@us.ibm.com>
  47. * Kevin Gao <kevin.gao@intel.com>
  48. *
  49. * Any bugs reported given to us we will try to fix... any fixes shared will
  50. * be incorporated into the next SCTP release.
  51. */
  52. #include <linux/types.h>
  53. #include <linux/kernel.h>
  54. #include <linux/ip.h>
  55. #include <linux/ipv6.h>
  56. #include <linux/net.h>
  57. #include <linux/inet.h>
  58. #include <net/sock.h>
  59. #include <net/inet_ecn.h>
  60. #include <linux/skbuff.h>
  61. #include <net/sctp/sctp.h>
  62. #include <net/sctp/sm.h>
  63. #include <net/sctp/structs.h>
  64. static struct sctp_packet *sctp_abort_pkt_new(const struct sctp_endpoint *ep,
  65. const struct sctp_association *asoc,
  66. struct sctp_chunk *chunk,
  67. const void *payload,
  68. size_t paylen);
  69. static int sctp_eat_data(const struct sctp_association *asoc,
  70. struct sctp_chunk *chunk,
  71. sctp_cmd_seq_t *commands);
  72. static struct sctp_packet *sctp_ootb_pkt_new(const struct sctp_association *asoc,
  73. const struct sctp_chunk *chunk);
  74. static void sctp_send_stale_cookie_err(const struct sctp_endpoint *ep,
  75. const struct sctp_association *asoc,
  76. const struct sctp_chunk *chunk,
  77. sctp_cmd_seq_t *commands,
  78. struct sctp_chunk *err_chunk);
  79. static sctp_disposition_t sctp_sf_do_5_2_6_stale(const struct sctp_endpoint *ep,
  80. const struct sctp_association *asoc,
  81. const sctp_subtype_t type,
  82. void *arg,
  83. sctp_cmd_seq_t *commands);
  84. static sctp_disposition_t sctp_sf_shut_8_4_5(const struct sctp_endpoint *ep,
  85. const struct sctp_association *asoc,
  86. const sctp_subtype_t type,
  87. void *arg,
  88. sctp_cmd_seq_t *commands);
  89. static sctp_disposition_t sctp_sf_tabort_8_4_8(const struct sctp_endpoint *ep,
  90. const struct sctp_association *asoc,
  91. const sctp_subtype_t type,
  92. void *arg,
  93. sctp_cmd_seq_t *commands);
  94. static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk);
  95. static sctp_disposition_t sctp_stop_t1_and_abort(sctp_cmd_seq_t *commands,
  96. __be16 error, int sk_err,
  97. const struct sctp_association *asoc,
  98. struct sctp_transport *transport);
  99. static sctp_disposition_t sctp_sf_abort_violation(
  100. const struct sctp_endpoint *ep,
  101. const struct sctp_association *asoc,
  102. void *arg,
  103. sctp_cmd_seq_t *commands,
  104. const __u8 *payload,
  105. const size_t paylen);
  106. static sctp_disposition_t sctp_sf_violation_chunklen(
  107. const struct sctp_endpoint *ep,
  108. const struct sctp_association *asoc,
  109. const sctp_subtype_t type,
  110. void *arg,
  111. sctp_cmd_seq_t *commands);
  112. static sctp_disposition_t sctp_sf_violation_paramlen(
  113. const struct sctp_endpoint *ep,
  114. const struct sctp_association *asoc,
  115. const sctp_subtype_t type,
  116. void *arg, void *ext,
  117. sctp_cmd_seq_t *commands);
  118. static sctp_disposition_t sctp_sf_violation_ctsn(
  119. const struct sctp_endpoint *ep,
  120. const struct sctp_association *asoc,
  121. const sctp_subtype_t type,
  122. void *arg,
  123. sctp_cmd_seq_t *commands);
  124. static sctp_disposition_t sctp_sf_violation_chunk(
  125. const struct sctp_endpoint *ep,
  126. const struct sctp_association *asoc,
  127. const sctp_subtype_t type,
  128. void *arg,
  129. sctp_cmd_seq_t *commands);
  130. static sctp_ierror_t sctp_sf_authenticate(const struct sctp_endpoint *ep,
  131. const struct sctp_association *asoc,
  132. const sctp_subtype_t type,
  133. struct sctp_chunk *chunk);
  134. static sctp_disposition_t __sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep,
  135. const struct sctp_association *asoc,
  136. const sctp_subtype_t type,
  137. void *arg,
  138. sctp_cmd_seq_t *commands);
  139. /* Small helper function that checks if the chunk length
  140. * is of the appropriate length. The 'required_length' argument
  141. * is set to be the size of a specific chunk we are testing.
  142. * Return Values: 1 = Valid length
  143. * 0 = Invalid length
  144. *
  145. */
  146. static inline int
  147. sctp_chunk_length_valid(struct sctp_chunk *chunk,
  148. __u16 required_length)
  149. {
  150. __u16 chunk_length = ntohs(chunk->chunk_hdr->length);
  151. if (unlikely(chunk_length < required_length))
  152. return 0;
  153. return 1;
  154. }
  155. /**********************************************************
  156. * These are the state functions for handling chunk events.
  157. **********************************************************/
  158. /*
  159. * Process the final SHUTDOWN COMPLETE.
  160. *
  161. * Section: 4 (C) (diagram), 9.2
  162. * Upon reception of the SHUTDOWN COMPLETE chunk the endpoint will verify
  163. * that it is in SHUTDOWN-ACK-SENT state, if it is not the chunk should be
  164. * discarded. If the endpoint is in the SHUTDOWN-ACK-SENT state the endpoint
  165. * should stop the T2-shutdown timer and remove all knowledge of the
  166. * association (and thus the association enters the CLOSED state).
  167. *
  168. * Verification Tag: 8.5.1(C), sctpimpguide 2.41.
  169. * C) Rules for packet carrying SHUTDOWN COMPLETE:
  170. * ...
  171. * - The receiver of a SHUTDOWN COMPLETE shall accept the packet
  172. * if the Verification Tag field of the packet matches its own tag and
  173. * the T bit is not set
  174. * OR
  175. * it is set to its peer's tag and the T bit is set in the Chunk
  176. * Flags.
  177. * Otherwise, the receiver MUST silently discard the packet
  178. * and take no further action. An endpoint MUST ignore the
  179. * SHUTDOWN COMPLETE if it is not in the SHUTDOWN-ACK-SENT state.
  180. *
  181. * Inputs
  182. * (endpoint, asoc, chunk)
  183. *
  184. * Outputs
  185. * (asoc, reply_msg, msg_up, timers, counters)
  186. *
  187. * The return value is the disposition of the chunk.
  188. */
  189. sctp_disposition_t sctp_sf_do_4_C(const struct sctp_endpoint *ep,
  190. const struct sctp_association *asoc,
  191. const sctp_subtype_t type,
  192. void *arg,
  193. sctp_cmd_seq_t *commands)
  194. {
  195. struct sctp_chunk *chunk = arg;
  196. struct sctp_ulpevent *ev;
  197. if (!sctp_vtag_verify_either(chunk, asoc))
  198. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  199. /* RFC 2960 6.10 Bundling
  200. *
  201. * An endpoint MUST NOT bundle INIT, INIT ACK or
  202. * SHUTDOWN COMPLETE with any other chunks.
  203. */
  204. if (!chunk->singleton)
  205. return sctp_sf_violation_chunk(ep, asoc, type, arg, commands);
  206. /* Make sure that the SHUTDOWN_COMPLETE chunk has a valid length. */
  207. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
  208. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  209. commands);
  210. /* RFC 2960 10.2 SCTP-to-ULP
  211. *
  212. * H) SHUTDOWN COMPLETE notification
  213. *
  214. * When SCTP completes the shutdown procedures (section 9.2) this
  215. * notification is passed to the upper layer.
  216. */
  217. ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_SHUTDOWN_COMP,
  218. 0, 0, 0, NULL, GFP_ATOMIC);
  219. if (ev)
  220. sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
  221. SCTP_ULPEVENT(ev));
  222. /* Upon reception of the SHUTDOWN COMPLETE chunk the endpoint
  223. * will verify that it is in SHUTDOWN-ACK-SENT state, if it is
  224. * not the chunk should be discarded. If the endpoint is in
  225. * the SHUTDOWN-ACK-SENT state the endpoint should stop the
  226. * T2-shutdown timer and remove all knowledge of the
  227. * association (and thus the association enters the CLOSED
  228. * state).
  229. */
  230. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  231. SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
  232. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  233. SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
  234. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  235. SCTP_STATE(SCTP_STATE_CLOSED));
  236. SCTP_INC_STATS(SCTP_MIB_SHUTDOWNS);
  237. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  238. sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
  239. return SCTP_DISPOSITION_DELETE_TCB;
  240. }
  241. /*
  242. * Respond to a normal INIT chunk.
  243. * We are the side that is being asked for an association.
  244. *
  245. * Section: 5.1 Normal Establishment of an Association, B
  246. * B) "Z" shall respond immediately with an INIT ACK chunk. The
  247. * destination IP address of the INIT ACK MUST be set to the source
  248. * IP address of the INIT to which this INIT ACK is responding. In
  249. * the response, besides filling in other parameters, "Z" must set the
  250. * Verification Tag field to Tag_A, and also provide its own
  251. * Verification Tag (Tag_Z) in the Initiate Tag field.
  252. *
  253. * Verification Tag: Must be 0.
  254. *
  255. * Inputs
  256. * (endpoint, asoc, chunk)
  257. *
  258. * Outputs
  259. * (asoc, reply_msg, msg_up, timers, counters)
  260. *
  261. * The return value is the disposition of the chunk.
  262. */
  263. sctp_disposition_t sctp_sf_do_5_1B_init(const struct sctp_endpoint *ep,
  264. const struct sctp_association *asoc,
  265. const sctp_subtype_t type,
  266. void *arg,
  267. sctp_cmd_seq_t *commands)
  268. {
  269. struct sctp_chunk *chunk = arg;
  270. struct sctp_chunk *repl;
  271. struct sctp_association *new_asoc;
  272. struct sctp_chunk *err_chunk;
  273. struct sctp_packet *packet;
  274. sctp_unrecognized_param_t *unk_param;
  275. int len;
  276. /* 6.10 Bundling
  277. * An endpoint MUST NOT bundle INIT, INIT ACK or
  278. * SHUTDOWN COMPLETE with any other chunks.
  279. *
  280. * IG Section 2.11.2
  281. * Furthermore, we require that the receiver of an INIT chunk MUST
  282. * enforce these rules by silently discarding an arriving packet
  283. * with an INIT chunk that is bundled with other chunks.
  284. */
  285. if (!chunk->singleton)
  286. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  287. /* If the packet is an OOTB packet which is temporarily on the
  288. * control endpoint, respond with an ABORT.
  289. */
  290. if (ep == sctp_sk((sctp_get_ctl_sock()))->ep) {
  291. SCTP_INC_STATS(SCTP_MIB_OUTOFBLUES);
  292. return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
  293. }
  294. /* 3.1 A packet containing an INIT chunk MUST have a zero Verification
  295. * Tag.
  296. */
  297. if (chunk->sctp_hdr->vtag != 0)
  298. return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
  299. /* Make sure that the INIT chunk has a valid length.
  300. * Normally, this would cause an ABORT with a Protocol Violation
  301. * error, but since we don't have an association, we'll
  302. * just discard the packet.
  303. */
  304. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_init_chunk_t)))
  305. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  306. /* Verify the INIT chunk before processing it. */
  307. err_chunk = NULL;
  308. if (!sctp_verify_init(asoc, chunk->chunk_hdr->type,
  309. (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
  310. &err_chunk)) {
  311. /* This chunk contains fatal error. It is to be discarded.
  312. * Send an ABORT, with causes if there is any.
  313. */
  314. if (err_chunk) {
  315. packet = sctp_abort_pkt_new(ep, asoc, arg,
  316. (__u8 *)(err_chunk->chunk_hdr) +
  317. sizeof(sctp_chunkhdr_t),
  318. ntohs(err_chunk->chunk_hdr->length) -
  319. sizeof(sctp_chunkhdr_t));
  320. sctp_chunk_free(err_chunk);
  321. if (packet) {
  322. sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
  323. SCTP_PACKET(packet));
  324. SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
  325. return SCTP_DISPOSITION_CONSUME;
  326. } else {
  327. return SCTP_DISPOSITION_NOMEM;
  328. }
  329. } else {
  330. return sctp_sf_tabort_8_4_8(ep, asoc, type, arg,
  331. commands);
  332. }
  333. }
  334. /* Grab the INIT header. */
  335. chunk->subh.init_hdr = (sctp_inithdr_t *)chunk->skb->data;
  336. /* Tag the variable length parameters. */
  337. chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(sctp_inithdr_t));
  338. new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC);
  339. if (!new_asoc)
  340. goto nomem;
  341. /* The call, sctp_process_init(), can fail on memory allocation. */
  342. if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
  343. sctp_source(chunk),
  344. (sctp_init_chunk_t *)chunk->chunk_hdr,
  345. GFP_ATOMIC))
  346. goto nomem_init;
  347. /* B) "Z" shall respond immediately with an INIT ACK chunk. */
  348. /* If there are errors need to be reported for unknown parameters,
  349. * make sure to reserve enough room in the INIT ACK for them.
  350. */
  351. len = 0;
  352. if (err_chunk)
  353. len = ntohs(err_chunk->chunk_hdr->length) -
  354. sizeof(sctp_chunkhdr_t);
  355. if (sctp_assoc_set_bind_addr_from_ep(new_asoc, GFP_ATOMIC) < 0)
  356. goto nomem_init;
  357. repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
  358. if (!repl)
  359. goto nomem_init;
  360. /* If there are errors need to be reported for unknown parameters,
  361. * include them in the outgoing INIT ACK as "Unrecognized parameter"
  362. * parameter.
  363. */
  364. if (err_chunk) {
  365. /* Get the "Unrecognized parameter" parameter(s) out of the
  366. * ERROR chunk generated by sctp_verify_init(). Since the
  367. * error cause code for "unknown parameter" and the
  368. * "Unrecognized parameter" type is the same, we can
  369. * construct the parameters in INIT ACK by copying the
  370. * ERROR causes over.
  371. */
  372. unk_param = (sctp_unrecognized_param_t *)
  373. ((__u8 *)(err_chunk->chunk_hdr) +
  374. sizeof(sctp_chunkhdr_t));
  375. /* Replace the cause code with the "Unrecognized parameter"
  376. * parameter type.
  377. */
  378. sctp_addto_chunk(repl, len, unk_param);
  379. sctp_chunk_free(err_chunk);
  380. }
  381. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
  382. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
  383. /*
  384. * Note: After sending out INIT ACK with the State Cookie parameter,
  385. * "Z" MUST NOT allocate any resources, nor keep any states for the
  386. * new association. Otherwise, "Z" will be vulnerable to resource
  387. * attacks.
  388. */
  389. sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
  390. return SCTP_DISPOSITION_DELETE_TCB;
  391. nomem_init:
  392. sctp_association_free(new_asoc);
  393. nomem:
  394. if (err_chunk)
  395. sctp_chunk_free(err_chunk);
  396. return SCTP_DISPOSITION_NOMEM;
  397. }
  398. /*
  399. * Respond to a normal INIT ACK chunk.
  400. * We are the side that is initiating the association.
  401. *
  402. * Section: 5.1 Normal Establishment of an Association, C
  403. * C) Upon reception of the INIT ACK from "Z", "A" shall stop the T1-init
  404. * timer and leave COOKIE-WAIT state. "A" shall then send the State
  405. * Cookie received in the INIT ACK chunk in a COOKIE ECHO chunk, start
  406. * the T1-cookie timer, and enter the COOKIE-ECHOED state.
  407. *
  408. * Note: The COOKIE ECHO chunk can be bundled with any pending outbound
  409. * DATA chunks, but it MUST be the first chunk in the packet and
  410. * until the COOKIE ACK is returned the sender MUST NOT send any
  411. * other packets to the peer.
  412. *
  413. * Verification Tag: 3.3.3
  414. * If the value of the Initiate Tag in a received INIT ACK chunk is
  415. * found to be 0, the receiver MUST treat it as an error and close the
  416. * association by transmitting an ABORT.
  417. *
  418. * Inputs
  419. * (endpoint, asoc, chunk)
  420. *
  421. * Outputs
  422. * (asoc, reply_msg, msg_up, timers, counters)
  423. *
  424. * The return value is the disposition of the chunk.
  425. */
  426. sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
  427. const struct sctp_association *asoc,
  428. const sctp_subtype_t type,
  429. void *arg,
  430. sctp_cmd_seq_t *commands)
  431. {
  432. struct sctp_chunk *chunk = arg;
  433. sctp_init_chunk_t *initchunk;
  434. struct sctp_chunk *err_chunk;
  435. struct sctp_packet *packet;
  436. if (!sctp_vtag_verify(chunk, asoc))
  437. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  438. /* 6.10 Bundling
  439. * An endpoint MUST NOT bundle INIT, INIT ACK or
  440. * SHUTDOWN COMPLETE with any other chunks.
  441. */
  442. if (!chunk->singleton)
  443. return sctp_sf_violation_chunk(ep, asoc, type, arg, commands);
  444. /* Make sure that the INIT-ACK chunk has a valid length */
  445. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_initack_chunk_t)))
  446. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  447. commands);
  448. /* Grab the INIT header. */
  449. chunk->subh.init_hdr = (sctp_inithdr_t *) chunk->skb->data;
  450. /* Verify the INIT chunk before processing it. */
  451. err_chunk = NULL;
  452. if (!sctp_verify_init(asoc, chunk->chunk_hdr->type,
  453. (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
  454. &err_chunk)) {
  455. sctp_error_t error = SCTP_ERROR_NO_RESOURCE;
  456. /* This chunk contains fatal error. It is to be discarded.
  457. * Send an ABORT, with causes. If there are no causes,
  458. * then there wasn't enough memory. Just terminate
  459. * the association.
  460. */
  461. if (err_chunk) {
  462. packet = sctp_abort_pkt_new(ep, asoc, arg,
  463. (__u8 *)(err_chunk->chunk_hdr) +
  464. sizeof(sctp_chunkhdr_t),
  465. ntohs(err_chunk->chunk_hdr->length) -
  466. sizeof(sctp_chunkhdr_t));
  467. sctp_chunk_free(err_chunk);
  468. if (packet) {
  469. sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
  470. SCTP_PACKET(packet));
  471. SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
  472. error = SCTP_ERROR_INV_PARAM;
  473. }
  474. }
  475. /* SCTP-AUTH, Section 6.3:
  476. * It should be noted that if the receiver wants to tear
  477. * down an association in an authenticated way only, the
  478. * handling of malformed packets should not result in
  479. * tearing down the association.
  480. *
  481. * This means that if we only want to abort associations
  482. * in an authenticated way (i.e AUTH+ABORT), then we
  483. * can't destroy this association just becuase the packet
  484. * was malformed.
  485. */
  486. if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
  487. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  488. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  489. return sctp_stop_t1_and_abort(commands, error, ECONNREFUSED,
  490. asoc, chunk->transport);
  491. }
  492. /* Tag the variable length parameters. Note that we never
  493. * convert the parameters in an INIT chunk.
  494. */
  495. chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(sctp_inithdr_t));
  496. initchunk = (sctp_init_chunk_t *) chunk->chunk_hdr;
  497. sctp_add_cmd_sf(commands, SCTP_CMD_PEER_INIT,
  498. SCTP_PEER_INIT(initchunk));
  499. /* Reset init error count upon receipt of INIT-ACK. */
  500. sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());
  501. /* 5.1 C) "A" shall stop the T1-init timer and leave
  502. * COOKIE-WAIT state. "A" shall then ... start the T1-cookie
  503. * timer, and enter the COOKIE-ECHOED state.
  504. */
  505. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  506. SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
  507. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
  508. SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
  509. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  510. SCTP_STATE(SCTP_STATE_COOKIE_ECHOED));
  511. /* SCTP-AUTH: genereate the assocition shared keys so that
  512. * we can potentially signe the COOKIE-ECHO.
  513. */
  514. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_SHKEY, SCTP_NULL());
  515. /* 5.1 C) "A" shall then send the State Cookie received in the
  516. * INIT ACK chunk in a COOKIE ECHO chunk, ...
  517. */
  518. /* If there is any errors to report, send the ERROR chunk generated
  519. * for unknown parameters as well.
  520. */
  521. sctp_add_cmd_sf(commands, SCTP_CMD_GEN_COOKIE_ECHO,
  522. SCTP_CHUNK(err_chunk));
  523. return SCTP_DISPOSITION_CONSUME;
  524. }
  525. /*
  526. * Respond to a normal COOKIE ECHO chunk.
  527. * We are the side that is being asked for an association.
  528. *
  529. * Section: 5.1 Normal Establishment of an Association, D
  530. * D) Upon reception of the COOKIE ECHO chunk, Endpoint "Z" will reply
  531. * with a COOKIE ACK chunk after building a TCB and moving to
  532. * the ESTABLISHED state. A COOKIE ACK chunk may be bundled with
  533. * any pending DATA chunks (and/or SACK chunks), but the COOKIE ACK
  534. * chunk MUST be the first chunk in the packet.
  535. *
  536. * IMPLEMENTATION NOTE: An implementation may choose to send the
  537. * Communication Up notification to the SCTP user upon reception
  538. * of a valid COOKIE ECHO chunk.
  539. *
  540. * Verification Tag: 8.5.1 Exceptions in Verification Tag Rules
  541. * D) Rules for packet carrying a COOKIE ECHO
  542. *
  543. * - When sending a COOKIE ECHO, the endpoint MUST use the value of the
  544. * Initial Tag received in the INIT ACK.
  545. *
  546. * - The receiver of a COOKIE ECHO follows the procedures in Section 5.
  547. *
  548. * Inputs
  549. * (endpoint, asoc, chunk)
  550. *
  551. * Outputs
  552. * (asoc, reply_msg, msg_up, timers, counters)
  553. *
  554. * The return value is the disposition of the chunk.
  555. */
  556. sctp_disposition_t sctp_sf_do_5_1D_ce(const struct sctp_endpoint *ep,
  557. const struct sctp_association *asoc,
  558. const sctp_subtype_t type, void *arg,
  559. sctp_cmd_seq_t *commands)
  560. {
  561. struct sctp_chunk *chunk = arg;
  562. struct sctp_association *new_asoc;
  563. sctp_init_chunk_t *peer_init;
  564. struct sctp_chunk *repl;
  565. struct sctp_ulpevent *ev, *ai_ev = NULL;
  566. int error = 0;
  567. struct sctp_chunk *err_chk_p;
  568. struct sock *sk;
  569. /* If the packet is an OOTB packet which is temporarily on the
  570. * control endpoint, respond with an ABORT.
  571. */
  572. if (ep == sctp_sk((sctp_get_ctl_sock()))->ep) {
  573. SCTP_INC_STATS(SCTP_MIB_OUTOFBLUES);
  574. return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
  575. }
  576. /* Make sure that the COOKIE_ECHO chunk has a valid length.
  577. * In this case, we check that we have enough for at least a
  578. * chunk header. More detailed verification is done
  579. * in sctp_unpack_cookie().
  580. */
  581. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
  582. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  583. /* If the endpoint is not listening or if the number of associations
  584. * on the TCP-style socket exceed the max backlog, respond with an
  585. * ABORT.
  586. */
  587. sk = ep->base.sk;
  588. if (!sctp_sstate(sk, LISTENING) ||
  589. (sctp_style(sk, TCP) && sk_acceptq_is_full(sk)))
  590. return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
  591. /* "Decode" the chunk. We have no optional parameters so we
  592. * are in good shape.
  593. */
  594. chunk->subh.cookie_hdr =
  595. (struct sctp_signed_cookie *)chunk->skb->data;
  596. if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
  597. sizeof(sctp_chunkhdr_t)))
  598. goto nomem;
  599. /* 5.1 D) Upon reception of the COOKIE ECHO chunk, Endpoint
  600. * "Z" will reply with a COOKIE ACK chunk after building a TCB
  601. * and moving to the ESTABLISHED state.
  602. */
  603. new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, &error,
  604. &err_chk_p);
  605. /* FIXME:
  606. * If the re-build failed, what is the proper error path
  607. * from here?
  608. *
  609. * [We should abort the association. --piggy]
  610. */
  611. if (!new_asoc) {
  612. /* FIXME: Several errors are possible. A bad cookie should
  613. * be silently discarded, but think about logging it too.
  614. */
  615. switch (error) {
  616. case -SCTP_IERROR_NOMEM:
  617. goto nomem;
  618. case -SCTP_IERROR_STALE_COOKIE:
  619. sctp_send_stale_cookie_err(ep, asoc, chunk, commands,
  620. err_chk_p);
  621. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  622. case -SCTP_IERROR_BAD_SIG:
  623. default:
  624. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  625. }
  626. }
  627. /* Delay state machine commands until later.
  628. *
  629. * Re-build the bind address for the association is done in
  630. * the sctp_unpack_cookie() already.
  631. */
  632. /* This is a brand-new association, so these are not yet side
  633. * effects--it is safe to run them here.
  634. */
  635. peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
  636. if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
  637. &chunk->subh.cookie_hdr->c.peer_addr,
  638. peer_init, GFP_ATOMIC))
  639. goto nomem_init;
  640. /* SCTP-AUTH: Now that we've populate required fields in
  641. * sctp_process_init, set up the assocaition shared keys as
  642. * necessary so that we can potentially authenticate the ACK
  643. */
  644. error = sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC);
  645. if (error)
  646. goto nomem_init;
  647. /* SCTP-AUTH: auth_chunk pointer is only set when the cookie-echo
  648. * is supposed to be authenticated and we have to do delayed
  649. * authentication. We've just recreated the association using
  650. * the information in the cookie and now it's much easier to
  651. * do the authentication.
  652. */
  653. if (chunk->auth_chunk) {
  654. struct sctp_chunk auth;
  655. sctp_ierror_t ret;
  656. /* set-up our fake chunk so that we can process it */
  657. auth.skb = chunk->auth_chunk;
  658. auth.asoc = chunk->asoc;
  659. auth.sctp_hdr = chunk->sctp_hdr;
  660. auth.chunk_hdr = (sctp_chunkhdr_t *)skb_push(chunk->auth_chunk,
  661. sizeof(sctp_chunkhdr_t));
  662. skb_pull(chunk->auth_chunk, sizeof(sctp_chunkhdr_t));
  663. auth.transport = chunk->transport;
  664. ret = sctp_sf_authenticate(ep, new_asoc, type, &auth);
  665. /* We can now safely free the auth_chunk clone */
  666. kfree_skb(chunk->auth_chunk);
  667. if (ret != SCTP_IERROR_NO_ERROR) {
  668. sctp_association_free(new_asoc);
  669. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  670. }
  671. }
  672. repl = sctp_make_cookie_ack(new_asoc, chunk);
  673. if (!repl)
  674. goto nomem_init;
  675. /* RFC 2960 5.1 Normal Establishment of an Association
  676. *
  677. * D) IMPLEMENTATION NOTE: An implementation may choose to
  678. * send the Communication Up notification to the SCTP user
  679. * upon reception of a valid COOKIE ECHO chunk.
  680. */
  681. ev = sctp_ulpevent_make_assoc_change(new_asoc, 0, SCTP_COMM_UP, 0,
  682. new_asoc->c.sinit_num_ostreams,
  683. new_asoc->c.sinit_max_instreams,
  684. NULL, GFP_ATOMIC);
  685. if (!ev)
  686. goto nomem_ev;
  687. /* Sockets API Draft Section 5.3.1.6
  688. * When a peer sends a Adaptation Layer Indication parameter , SCTP
  689. * delivers this notification to inform the application that of the
  690. * peers requested adaptation layer.
  691. */
  692. if (new_asoc->peer.adaptation_ind) {
  693. ai_ev = sctp_ulpevent_make_adaptation_indication(new_asoc,
  694. GFP_ATOMIC);
  695. if (!ai_ev)
  696. goto nomem_aiev;
  697. }
  698. /* Add all the state machine commands now since we've created
  699. * everything. This way we don't introduce memory corruptions
  700. * during side-effect processing and correclty count established
  701. * associations.
  702. */
  703. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
  704. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  705. SCTP_STATE(SCTP_STATE_ESTABLISHED));
  706. SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
  707. SCTP_INC_STATS(SCTP_MIB_PASSIVEESTABS);
  708. sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
  709. if (new_asoc->autoclose)
  710. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
  711. SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
  712. /* This will send the COOKIE ACK */
  713. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
  714. /* Queue the ASSOC_CHANGE event */
  715. sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
  716. /* Send up the Adaptation Layer Indication event */
  717. if (ai_ev)
  718. sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
  719. SCTP_ULPEVENT(ai_ev));
  720. return SCTP_DISPOSITION_CONSUME;
  721. nomem_aiev:
  722. sctp_ulpevent_free(ev);
  723. nomem_ev:
  724. sctp_chunk_free(repl);
  725. nomem_init:
  726. sctp_association_free(new_asoc);
  727. nomem:
  728. return SCTP_DISPOSITION_NOMEM;
  729. }
  730. /*
  731. * Respond to a normal COOKIE ACK chunk.
  732. * We are the side that is being asked for an association.
  733. *
  734. * RFC 2960 5.1 Normal Establishment of an Association
  735. *
  736. * E) Upon reception of the COOKIE ACK, endpoint "A" will move from the
  737. * COOKIE-ECHOED state to the ESTABLISHED state, stopping the T1-cookie
  738. * timer. It may also notify its ULP about the successful
  739. * establishment of the association with a Communication Up
  740. * notification (see Section 10).
  741. *
  742. * Verification Tag:
  743. * Inputs
  744. * (endpoint, asoc, chunk)
  745. *
  746. * Outputs
  747. * (asoc, reply_msg, msg_up, timers, counters)
  748. *
  749. * The return value is the disposition of the chunk.
  750. */
  751. sctp_disposition_t sctp_sf_do_5_1E_ca(const struct sctp_endpoint *ep,
  752. const struct sctp_association *asoc,
  753. const sctp_subtype_t type, void *arg,
  754. sctp_cmd_seq_t *commands)
  755. {
  756. struct sctp_chunk *chunk = arg;
  757. struct sctp_ulpevent *ev;
  758. if (!sctp_vtag_verify(chunk, asoc))
  759. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  760. /* Verify that the chunk length for the COOKIE-ACK is OK.
  761. * If we don't do this, any bundled chunks may be junked.
  762. */
  763. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
  764. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  765. commands);
  766. /* Reset init error count upon receipt of COOKIE-ACK,
  767. * to avoid problems with the managemement of this
  768. * counter in stale cookie situations when a transition back
  769. * from the COOKIE-ECHOED state to the COOKIE-WAIT
  770. * state is performed.
  771. */
  772. sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());
  773. /* RFC 2960 5.1 Normal Establishment of an Association
  774. *
  775. * E) Upon reception of the COOKIE ACK, endpoint "A" will move
  776. * from the COOKIE-ECHOED state to the ESTABLISHED state,
  777. * stopping the T1-cookie timer.
  778. */
  779. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  780. SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
  781. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  782. SCTP_STATE(SCTP_STATE_ESTABLISHED));
  783. SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
  784. SCTP_INC_STATS(SCTP_MIB_ACTIVEESTABS);
  785. sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
  786. if (asoc->autoclose)
  787. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
  788. SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
  789. /* It may also notify its ULP about the successful
  790. * establishment of the association with a Communication Up
  791. * notification (see Section 10).
  792. */
  793. ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_COMM_UP,
  794. 0, asoc->c.sinit_num_ostreams,
  795. asoc->c.sinit_max_instreams,
  796. NULL, GFP_ATOMIC);
  797. if (!ev)
  798. goto nomem;
  799. sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
  800. /* Sockets API Draft Section 5.3.1.6
  801. * When a peer sends a Adaptation Layer Indication parameter , SCTP
  802. * delivers this notification to inform the application that of the
  803. * peers requested adaptation layer.
  804. */
  805. if (asoc->peer.adaptation_ind) {
  806. ev = sctp_ulpevent_make_adaptation_indication(asoc, GFP_ATOMIC);
  807. if (!ev)
  808. goto nomem;
  809. sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
  810. SCTP_ULPEVENT(ev));
  811. }
  812. return SCTP_DISPOSITION_CONSUME;
  813. nomem:
  814. return SCTP_DISPOSITION_NOMEM;
  815. }
  816. /* Generate and sendout a heartbeat packet. */
  817. static sctp_disposition_t sctp_sf_heartbeat(const struct sctp_endpoint *ep,
  818. const struct sctp_association *asoc,
  819. const sctp_subtype_t type,
  820. void *arg,
  821. sctp_cmd_seq_t *commands)
  822. {
  823. struct sctp_transport *transport = (struct sctp_transport *) arg;
  824. struct sctp_chunk *reply;
  825. sctp_sender_hb_info_t hbinfo;
  826. size_t paylen = 0;
  827. hbinfo.param_hdr.type = SCTP_PARAM_HEARTBEAT_INFO;
  828. hbinfo.param_hdr.length = htons(sizeof(sctp_sender_hb_info_t));
  829. hbinfo.daddr = transport->ipaddr;
  830. hbinfo.sent_at = jiffies;
  831. hbinfo.hb_nonce = transport->hb_nonce;
  832. /* Send a heartbeat to our peer. */
  833. paylen = sizeof(sctp_sender_hb_info_t);
  834. reply = sctp_make_heartbeat(asoc, transport, &hbinfo, paylen);
  835. if (!reply)
  836. return SCTP_DISPOSITION_NOMEM;
  837. /* Set rto_pending indicating that an RTT measurement
  838. * is started with this heartbeat chunk.
  839. */
  840. sctp_add_cmd_sf(commands, SCTP_CMD_RTO_PENDING,
  841. SCTP_TRANSPORT(transport));
  842. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
  843. return SCTP_DISPOSITION_CONSUME;
  844. }
  845. /* Generate a HEARTBEAT packet on the given transport. */
  846. sctp_disposition_t sctp_sf_sendbeat_8_3(const struct sctp_endpoint *ep,
  847. const struct sctp_association *asoc,
  848. const sctp_subtype_t type,
  849. void *arg,
  850. sctp_cmd_seq_t *commands)
  851. {
  852. struct sctp_transport *transport = (struct sctp_transport *) arg;
  853. if (asoc->overall_error_count > asoc->max_retrans) {
  854. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  855. SCTP_ERROR(ETIMEDOUT));
  856. /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
  857. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
  858. SCTP_PERR(SCTP_ERROR_NO_ERROR));
  859. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  860. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  861. return SCTP_DISPOSITION_DELETE_TCB;
  862. }
  863. /* Section 3.3.5.
  864. * The Sender-specific Heartbeat Info field should normally include
  865. * information about the sender's current time when this HEARTBEAT
  866. * chunk is sent and the destination transport address to which this
  867. * HEARTBEAT is sent (see Section 8.3).
  868. */
  869. if (transport->param_flags & SPP_HB_ENABLE) {
  870. if (SCTP_DISPOSITION_NOMEM ==
  871. sctp_sf_heartbeat(ep, asoc, type, arg,
  872. commands))
  873. return SCTP_DISPOSITION_NOMEM;
  874. /* Set transport error counter and association error counter
  875. * when sending heartbeat.
  876. */
  877. sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_RESET,
  878. SCTP_TRANSPORT(transport));
  879. }
  880. sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMER_UPDATE,
  881. SCTP_TRANSPORT(transport));
  882. return SCTP_DISPOSITION_CONSUME;
  883. }
  884. /*
  885. * Process an heartbeat request.
  886. *
  887. * Section: 8.3 Path Heartbeat
  888. * The receiver of the HEARTBEAT should immediately respond with a
  889. * HEARTBEAT ACK that contains the Heartbeat Information field copied
  890. * from the received HEARTBEAT chunk.
  891. *
  892. * Verification Tag: 8.5 Verification Tag [Normal verification]
  893. * When receiving an SCTP packet, the endpoint MUST ensure that the
  894. * value in the Verification Tag field of the received SCTP packet
  895. * matches its own Tag. If the received Verification Tag value does not
  896. * match the receiver's own tag value, the receiver shall silently
  897. * discard the packet and shall not process it any further except for
  898. * those cases listed in Section 8.5.1 below.
  899. *
  900. * Inputs
  901. * (endpoint, asoc, chunk)
  902. *
  903. * Outputs
  904. * (asoc, reply_msg, msg_up, timers, counters)
  905. *
  906. * The return value is the disposition of the chunk.
  907. */
  908. sctp_disposition_t sctp_sf_beat_8_3(const struct sctp_endpoint *ep,
  909. const struct sctp_association *asoc,
  910. const sctp_subtype_t type,
  911. void *arg,
  912. sctp_cmd_seq_t *commands)
  913. {
  914. struct sctp_chunk *chunk = arg;
  915. struct sctp_chunk *reply;
  916. size_t paylen = 0;
  917. if (!sctp_vtag_verify(chunk, asoc))
  918. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  919. /* Make sure that the HEARTBEAT chunk has a valid length. */
  920. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_heartbeat_chunk_t)))
  921. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  922. commands);
  923. /* 8.3 The receiver of the HEARTBEAT should immediately
  924. * respond with a HEARTBEAT ACK that contains the Heartbeat
  925. * Information field copied from the received HEARTBEAT chunk.
  926. */
  927. chunk->subh.hb_hdr = (sctp_heartbeathdr_t *) chunk->skb->data;
  928. paylen = ntohs(chunk->chunk_hdr->length) - sizeof(sctp_chunkhdr_t);
  929. if (!pskb_pull(chunk->skb, paylen))
  930. goto nomem;
  931. reply = sctp_make_heartbeat_ack(asoc, chunk,
  932. chunk->subh.hb_hdr, paylen);
  933. if (!reply)
  934. goto nomem;
  935. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
  936. return SCTP_DISPOSITION_CONSUME;
  937. nomem:
  938. return SCTP_DISPOSITION_NOMEM;
  939. }
  940. /*
  941. * Process the returning HEARTBEAT ACK.
  942. *
  943. * Section: 8.3 Path Heartbeat
  944. * Upon the receipt of the HEARTBEAT ACK, the sender of the HEARTBEAT
  945. * should clear the error counter of the destination transport
  946. * address to which the HEARTBEAT was sent, and mark the destination
  947. * transport address as active if it is not so marked. The endpoint may
  948. * optionally report to the upper layer when an inactive destination
  949. * address is marked as active due to the reception of the latest
  950. * HEARTBEAT ACK. The receiver of the HEARTBEAT ACK must also
  951. * clear the association overall error count as well (as defined
  952. * in section 8.1).
  953. *
  954. * The receiver of the HEARTBEAT ACK should also perform an RTT
  955. * measurement for that destination transport address using the time
  956. * value carried in the HEARTBEAT ACK chunk.
  957. *
  958. * Verification Tag: 8.5 Verification Tag [Normal verification]
  959. *
  960. * Inputs
  961. * (endpoint, asoc, chunk)
  962. *
  963. * Outputs
  964. * (asoc, reply_msg, msg_up, timers, counters)
  965. *
  966. * The return value is the disposition of the chunk.
  967. */
  968. sctp_disposition_t sctp_sf_backbeat_8_3(const struct sctp_endpoint *ep,
  969. const struct sctp_association *asoc,
  970. const sctp_subtype_t type,
  971. void *arg,
  972. sctp_cmd_seq_t *commands)
  973. {
  974. struct sctp_chunk *chunk = arg;
  975. union sctp_addr from_addr;
  976. struct sctp_transport *link;
  977. sctp_sender_hb_info_t *hbinfo;
  978. unsigned long max_interval;
  979. if (!sctp_vtag_verify(chunk, asoc))
  980. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  981. /* Make sure that the HEARTBEAT-ACK chunk has a valid length. */
  982. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_heartbeat_chunk_t)))
  983. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  984. commands);
  985. hbinfo = (sctp_sender_hb_info_t *) chunk->skb->data;
  986. /* Make sure that the length of the parameter is what we expect */
  987. if (ntohs(hbinfo->param_hdr.length) !=
  988. sizeof(sctp_sender_hb_info_t)) {
  989. return SCTP_DISPOSITION_DISCARD;
  990. }
  991. from_addr = hbinfo->daddr;
  992. link = sctp_assoc_lookup_paddr(asoc, &from_addr);
  993. /* This should never happen, but lets log it if so. */
  994. if (unlikely(!link)) {
  995. if (from_addr.sa.sa_family == AF_INET6) {
  996. if (net_ratelimit())
  997. printk(KERN_WARNING
  998. "%s association %p could not find address %pI6\n",
  999. __func__,
  1000. asoc,
  1001. &from_addr.v6.sin6_addr);
  1002. } else {
  1003. if (net_ratelimit())
  1004. printk(KERN_WARNING
  1005. "%s association %p could not find address %pI4\n",
  1006. __func__,
  1007. asoc,
  1008. &from_addr.v4.sin_addr.s_addr);
  1009. }
  1010. return SCTP_DISPOSITION_DISCARD;
  1011. }
  1012. /* Validate the 64-bit random nonce. */
  1013. if (hbinfo->hb_nonce != link->hb_nonce)
  1014. return SCTP_DISPOSITION_DISCARD;
  1015. max_interval = link->hbinterval + link->rto;
  1016. /* Check if the timestamp looks valid. */
  1017. if (time_after(hbinfo->sent_at, jiffies) ||
  1018. time_after(jiffies, hbinfo->sent_at + max_interval)) {
  1019. SCTP_DEBUG_PRINTK("%s: HEARTBEAT ACK with invalid timestamp "
  1020. "received for transport: %p\n",
  1021. __func__, link);
  1022. return SCTP_DISPOSITION_DISCARD;
  1023. }
  1024. /* 8.3 Upon the receipt of the HEARTBEAT ACK, the sender of
  1025. * the HEARTBEAT should clear the error counter of the
  1026. * destination transport address to which the HEARTBEAT was
  1027. * sent and mark the destination transport address as active if
  1028. * it is not so marked.
  1029. */
  1030. sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_ON, SCTP_TRANSPORT(link));
  1031. return SCTP_DISPOSITION_CONSUME;
  1032. }
  1033. /* Helper function to send out an abort for the restart
  1034. * condition.
  1035. */
  1036. static int sctp_sf_send_restart_abort(union sctp_addr *ssa,
  1037. struct sctp_chunk *init,
  1038. sctp_cmd_seq_t *commands)
  1039. {
  1040. int len;
  1041. struct sctp_packet *pkt;
  1042. union sctp_addr_param *addrparm;
  1043. struct sctp_errhdr *errhdr;
  1044. struct sctp_endpoint *ep;
  1045. char buffer[sizeof(struct sctp_errhdr)+sizeof(union sctp_addr_param)];
  1046. struct sctp_af *af = sctp_get_af_specific(ssa->v4.sin_family);
  1047. /* Build the error on the stack. We are way to malloc crazy
  1048. * throughout the code today.
  1049. */
  1050. errhdr = (struct sctp_errhdr *)buffer;
  1051. addrparm = (union sctp_addr_param *)errhdr->variable;
  1052. /* Copy into a parm format. */
  1053. len = af->to_addr_param(ssa, addrparm);
  1054. len += sizeof(sctp_errhdr_t);
  1055. errhdr->cause = SCTP_ERROR_RESTART;
  1056. errhdr->length = htons(len);
  1057. /* Assign to the control socket. */
  1058. ep = sctp_sk((sctp_get_ctl_sock()))->ep;
  1059. /* Association is NULL since this may be a restart attack and we
  1060. * want to send back the attacker's vtag.
  1061. */
  1062. pkt = sctp_abort_pkt_new(ep, NULL, init, errhdr, len);
  1063. if (!pkt)
  1064. goto out;
  1065. sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT, SCTP_PACKET(pkt));
  1066. SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
  1067. /* Discard the rest of the inbound packet. */
  1068. sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
  1069. out:
  1070. /* Even if there is no memory, treat as a failure so
  1071. * the packet will get dropped.
  1072. */
  1073. return 0;
  1074. }
  1075. /* A restart is occurring, check to make sure no new addresses
  1076. * are being added as we may be under a takeover attack.
  1077. */
  1078. static int sctp_sf_check_restart_addrs(const struct sctp_association *new_asoc,
  1079. const struct sctp_association *asoc,
  1080. struct sctp_chunk *init,
  1081. sctp_cmd_seq_t *commands)
  1082. {
  1083. struct sctp_transport *new_addr, *addr;
  1084. int found;
  1085. /* Implementor's Guide - Sectin 5.2.2
  1086. * ...
  1087. * Before responding the endpoint MUST check to see if the
  1088. * unexpected INIT adds new addresses to the association. If new
  1089. * addresses are added to the association, the endpoint MUST respond
  1090. * with an ABORT..
  1091. */
  1092. /* Search through all current addresses and make sure
  1093. * we aren't adding any new ones.
  1094. */
  1095. new_addr = NULL;
  1096. found = 0;
  1097. list_for_each_entry(new_addr, &new_asoc->peer.transport_addr_list,
  1098. transports) {
  1099. found = 0;
  1100. list_for_each_entry(addr, &asoc->peer.transport_addr_list,
  1101. transports) {
  1102. if (sctp_cmp_addr_exact(&new_addr->ipaddr,
  1103. &addr->ipaddr)) {
  1104. found = 1;
  1105. break;
  1106. }
  1107. }
  1108. if (!found)
  1109. break;
  1110. }
  1111. /* If a new address was added, ABORT the sender. */
  1112. if (!found && new_addr) {
  1113. sctp_sf_send_restart_abort(&new_addr->ipaddr, init, commands);
  1114. }
  1115. /* Return success if all addresses were found. */
  1116. return found;
  1117. }
  1118. /* Populate the verification/tie tags based on overlapping INIT
  1119. * scenario.
  1120. *
  1121. * Note: Do not use in CLOSED or SHUTDOWN-ACK-SENT state.
  1122. */
  1123. static void sctp_tietags_populate(struct sctp_association *new_asoc,
  1124. const struct sctp_association *asoc)
  1125. {
  1126. switch (asoc->state) {
  1127. /* 5.2.1 INIT received in COOKIE-WAIT or COOKIE-ECHOED State */
  1128. case SCTP_STATE_COOKIE_WAIT:
  1129. new_asoc->c.my_vtag = asoc->c.my_vtag;
  1130. new_asoc->c.my_ttag = asoc->c.my_vtag;
  1131. new_asoc->c.peer_ttag = 0;
  1132. break;
  1133. case SCTP_STATE_COOKIE_ECHOED:
  1134. new_asoc->c.my_vtag = asoc->c.my_vtag;
  1135. new_asoc->c.my_ttag = asoc->c.my_vtag;
  1136. new_asoc->c.peer_ttag = asoc->c.peer_vtag;
  1137. break;
  1138. /* 5.2.2 Unexpected INIT in States Other than CLOSED, COOKIE-ECHOED,
  1139. * COOKIE-WAIT and SHUTDOWN-ACK-SENT
  1140. */
  1141. default:
  1142. new_asoc->c.my_ttag = asoc->c.my_vtag;
  1143. new_asoc->c.peer_ttag = asoc->c.peer_vtag;
  1144. break;
  1145. }
  1146. /* Other parameters for the endpoint SHOULD be copied from the
  1147. * existing parameters of the association (e.g. number of
  1148. * outbound streams) into the INIT ACK and cookie.
  1149. */
  1150. new_asoc->rwnd = asoc->rwnd;
  1151. new_asoc->c.sinit_num_ostreams = asoc->c.sinit_num_ostreams;
  1152. new_asoc->c.sinit_max_instreams = asoc->c.sinit_max_instreams;
  1153. new_asoc->c.initial_tsn = asoc->c.initial_tsn;
  1154. }
  1155. /*
  1156. * Compare vtag/tietag values to determine unexpected COOKIE-ECHO
  1157. * handling action.
  1158. *
  1159. * RFC 2960 5.2.4 Handle a COOKIE ECHO when a TCB exists.
  1160. *
  1161. * Returns value representing action to be taken. These action values
  1162. * correspond to Action/Description values in RFC 2960, Table 2.
  1163. */
  1164. static char sctp_tietags_compare(struct sctp_association *new_asoc,
  1165. const struct sctp_association *asoc)
  1166. {
  1167. /* In this case, the peer may have restarted. */
  1168. if ((asoc->c.my_vtag != new_asoc->c.my_vtag) &&
  1169. (asoc->c.peer_vtag != new_asoc->c.peer_vtag) &&
  1170. (asoc->c.my_vtag == new_asoc->c.my_ttag) &&
  1171. (asoc->c.peer_vtag == new_asoc->c.peer_ttag))
  1172. return 'A';
  1173. /* Collision case B. */
  1174. if ((asoc->c.my_vtag == new_asoc->c.my_vtag) &&
  1175. ((asoc->c.peer_vtag != new_asoc->c.peer_vtag) ||
  1176. (0 == asoc->c.peer_vtag))) {
  1177. return 'B';
  1178. }
  1179. /* Collision case D. */
  1180. if ((asoc->c.my_vtag == new_asoc->c.my_vtag) &&
  1181. (asoc->c.peer_vtag == new_asoc->c.peer_vtag))
  1182. return 'D';
  1183. /* Collision case C. */
  1184. if ((asoc->c.my_vtag != new_asoc->c.my_vtag) &&
  1185. (asoc->c.peer_vtag == new_asoc->c.peer_vtag) &&
  1186. (0 == new_asoc->c.my_ttag) &&
  1187. (0 == new_asoc->c.peer_ttag))
  1188. return 'C';
  1189. /* No match to any of the special cases; discard this packet. */
  1190. return 'E';
  1191. }
  1192. /* Common helper routine for both duplicate and simulataneous INIT
  1193. * chunk handling.
  1194. */
  1195. static sctp_disposition_t sctp_sf_do_unexpected_init(
  1196. const struct sctp_endpoint *ep,
  1197. const struct sctp_association *asoc,
  1198. const sctp_subtype_t type,
  1199. void *arg, sctp_cmd_seq_t *commands)
  1200. {
  1201. sctp_disposition_t retval;
  1202. struct sctp_chunk *chunk = arg;
  1203. struct sctp_chunk *repl;
  1204. struct sctp_association *new_asoc;
  1205. struct sctp_chunk *err_chunk;
  1206. struct sctp_packet *packet;
  1207. sctp_unrecognized_param_t *unk_param;
  1208. int len;
  1209. /* 6.10 Bundling
  1210. * An endpoint MUST NOT bundle INIT, INIT ACK or
  1211. * SHUTDOWN COMPLETE with any other chunks.
  1212. *
  1213. * IG Section 2.11.2
  1214. * Furthermore, we require that the receiver of an INIT chunk MUST
  1215. * enforce these rules by silently discarding an arriving packet
  1216. * with an INIT chunk that is bundled with other chunks.
  1217. */
  1218. if (!chunk->singleton)
  1219. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  1220. /* 3.1 A packet containing an INIT chunk MUST have a zero Verification
  1221. * Tag.
  1222. */
  1223. if (chunk->sctp_hdr->vtag != 0)
  1224. return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
  1225. /* Make sure that the INIT chunk has a valid length.
  1226. * In this case, we generate a protocol violation since we have
  1227. * an association established.
  1228. */
  1229. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_init_chunk_t)))
  1230. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  1231. commands);
  1232. /* Grab the INIT header. */
  1233. chunk->subh.init_hdr = (sctp_inithdr_t *) chunk->skb->data;
  1234. /* Tag the variable length parameters. */
  1235. chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(sctp_inithdr_t));
  1236. /* Verify the INIT chunk before processing it. */
  1237. err_chunk = NULL;
  1238. if (!sctp_verify_init(asoc, chunk->chunk_hdr->type,
  1239. (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
  1240. &err_chunk)) {
  1241. /* This chunk contains fatal error. It is to be discarded.
  1242. * Send an ABORT, with causes if there is any.
  1243. */
  1244. if (err_chunk) {
  1245. packet = sctp_abort_pkt_new(ep, asoc, arg,
  1246. (__u8 *)(err_chunk->chunk_hdr) +
  1247. sizeof(sctp_chunkhdr_t),
  1248. ntohs(err_chunk->chunk_hdr->length) -
  1249. sizeof(sctp_chunkhdr_t));
  1250. if (packet) {
  1251. sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
  1252. SCTP_PACKET(packet));
  1253. SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
  1254. retval = SCTP_DISPOSITION_CONSUME;
  1255. } else {
  1256. retval = SCTP_DISPOSITION_NOMEM;
  1257. }
  1258. goto cleanup;
  1259. } else {
  1260. return sctp_sf_tabort_8_4_8(ep, asoc, type, arg,
  1261. commands);
  1262. }
  1263. }
  1264. /*
  1265. * Other parameters for the endpoint SHOULD be copied from the
  1266. * existing parameters of the association (e.g. number of
  1267. * outbound streams) into the INIT ACK and cookie.
  1268. * FIXME: We are copying parameters from the endpoint not the
  1269. * association.
  1270. */
  1271. new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC);
  1272. if (!new_asoc)
  1273. goto nomem;
  1274. /* In the outbound INIT ACK the endpoint MUST copy its current
  1275. * Verification Tag and Peers Verification tag into a reserved
  1276. * place (local tie-tag and per tie-tag) within the state cookie.
  1277. */
  1278. if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
  1279. sctp_source(chunk),
  1280. (sctp_init_chunk_t *)chunk->chunk_hdr,
  1281. GFP_ATOMIC))
  1282. goto nomem;
  1283. /* Make sure no new addresses are being added during the
  1284. * restart. Do not do this check for COOKIE-WAIT state,
  1285. * since there are no peer addresses to check against.
  1286. * Upon return an ABORT will have been sent if needed.
  1287. */
  1288. if (!sctp_state(asoc, COOKIE_WAIT)) {
  1289. if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk,
  1290. commands)) {
  1291. retval = SCTP_DISPOSITION_CONSUME;
  1292. goto nomem_retval;
  1293. }
  1294. }
  1295. sctp_tietags_populate(new_asoc, asoc);
  1296. /* B) "Z" shall respond immediately with an INIT ACK chunk. */
  1297. /* If there are errors need to be reported for unknown parameters,
  1298. * make sure to reserve enough room in the INIT ACK for them.
  1299. */
  1300. len = 0;
  1301. if (err_chunk) {
  1302. len = ntohs(err_chunk->chunk_hdr->length) -
  1303. sizeof(sctp_chunkhdr_t);
  1304. }
  1305. if (sctp_assoc_set_bind_addr_from_ep(new_asoc, GFP_ATOMIC) < 0)
  1306. goto nomem;
  1307. repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
  1308. if (!repl)
  1309. goto nomem;
  1310. /* If there are errors need to be reported for unknown parameters,
  1311. * include them in the outgoing INIT ACK as "Unrecognized parameter"
  1312. * parameter.
  1313. */
  1314. if (err_chunk) {
  1315. /* Get the "Unrecognized parameter" parameter(s) out of the
  1316. * ERROR chunk generated by sctp_verify_init(). Since the
  1317. * error cause code for "unknown parameter" and the
  1318. * "Unrecognized parameter" type is the same, we can
  1319. * construct the parameters in INIT ACK by copying the
  1320. * ERROR causes over.
  1321. */
  1322. unk_param = (sctp_unrecognized_param_t *)
  1323. ((__u8 *)(err_chunk->chunk_hdr) +
  1324. sizeof(sctp_chunkhdr_t));
  1325. /* Replace the cause code with the "Unrecognized parameter"
  1326. * parameter type.
  1327. */
  1328. sctp_addto_chunk(repl, len, unk_param);
  1329. }
  1330. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
  1331. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
  1332. /*
  1333. * Note: After sending out INIT ACK with the State Cookie parameter,
  1334. * "Z" MUST NOT allocate any resources for this new association.
  1335. * Otherwise, "Z" will be vulnerable to resource attacks.
  1336. */
  1337. sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
  1338. retval = SCTP_DISPOSITION_CONSUME;
  1339. return retval;
  1340. nomem:
  1341. retval = SCTP_DISPOSITION_NOMEM;
  1342. nomem_retval:
  1343. if (new_asoc)
  1344. sctp_association_free(new_asoc);
  1345. cleanup:
  1346. if (err_chunk)
  1347. sctp_chunk_free(err_chunk);
  1348. return retval;
  1349. }
  1350. /*
  1351. * Handle simultanous INIT.
  1352. * This means we started an INIT and then we got an INIT request from
  1353. * our peer.
  1354. *
  1355. * Section: 5.2.1 INIT received in COOKIE-WAIT or COOKIE-ECHOED State (Item B)
  1356. * This usually indicates an initialization collision, i.e., each
  1357. * endpoint is attempting, at about the same time, to establish an
  1358. * association with the other endpoint.
  1359. *
  1360. * Upon receipt of an INIT in the COOKIE-WAIT or COOKIE-ECHOED state, an
  1361. * endpoint MUST respond with an INIT ACK using the same parameters it
  1362. * sent in its original INIT chunk (including its Verification Tag,
  1363. * unchanged). These original parameters are combined with those from the
  1364. * newly received INIT chunk. The endpoint shall also generate a State
  1365. * Cookie with the INIT ACK. The endpoint uses the parameters sent in its
  1366. * INIT to calculate the State Cookie.
  1367. *
  1368. * After that, the endpoint MUST NOT change its state, the T1-init
  1369. * timer shall be left running and the corresponding TCB MUST NOT be
  1370. * destroyed. The normal procedures for handling State Cookies when
  1371. * a TCB exists will resolve the duplicate INITs to a single association.
  1372. *
  1373. * For an endpoint that is in the COOKIE-ECHOED state it MUST populate
  1374. * its Tie-Tags with the Tag information of itself and its peer (see
  1375. * section 5.2.2 for a description of the Tie-Tags).
  1376. *
  1377. * Verification Tag: Not explicit, but an INIT can not have a valid
  1378. * verification tag, so we skip the check.
  1379. *
  1380. * Inputs
  1381. * (endpoint, asoc, chunk)
  1382. *
  1383. * Outputs
  1384. * (asoc, reply_msg, msg_up, timers, counters)
  1385. *
  1386. * The return value is the disposition of the chunk.
  1387. */
  1388. sctp_disposition_t sctp_sf_do_5_2_1_siminit(const struct sctp_endpoint *ep,
  1389. const struct sctp_association *asoc,
  1390. const sctp_subtype_t type,
  1391. void *arg,
  1392. sctp_cmd_seq_t *commands)
  1393. {
  1394. /* Call helper to do the real work for both simulataneous and
  1395. * duplicate INIT chunk handling.
  1396. */
  1397. return sctp_sf_do_unexpected_init(ep, asoc, type, arg, commands);
  1398. }
  1399. /*
  1400. * Handle duplicated INIT messages. These are usually delayed
  1401. * restransmissions.
  1402. *
  1403. * Section: 5.2.2 Unexpected INIT in States Other than CLOSED,
  1404. * COOKIE-ECHOED and COOKIE-WAIT
  1405. *
  1406. * Unless otherwise stated, upon reception of an unexpected INIT for
  1407. * this association, the endpoint shall generate an INIT ACK with a
  1408. * State Cookie. In the outbound INIT ACK the endpoint MUST copy its
  1409. * current Verification Tag and peer's Verification Tag into a reserved
  1410. * place within the state cookie. We shall refer to these locations as
  1411. * the Peer's-Tie-Tag and the Local-Tie-Tag. The outbound SCTP packet
  1412. * containing this INIT ACK MUST carry a Verification Tag value equal to
  1413. * the Initiation Tag found in the unexpected INIT. And the INIT ACK
  1414. * MUST contain a new Initiation Tag (randomly generated see Section
  1415. * 5.3.1). Other parameters for the endpoint SHOULD be copied from the
  1416. * existing parameters of the association (e.g. number of outbound
  1417. * streams) into the INIT ACK and cookie.
  1418. *
  1419. * After sending out the INIT ACK, the endpoint shall take no further
  1420. * actions, i.e., the existing association, including its current state,
  1421. * and the corresponding TCB MUST NOT be changed.
  1422. *
  1423. * Note: Only when a TCB exists and the association is not in a COOKIE-
  1424. * WAIT state are the Tie-Tags populated. For a normal association INIT
  1425. * (i.e. the endpoint is in a COOKIE-WAIT state), the Tie-Tags MUST be
  1426. * set to 0 (indicating that no previous TCB existed). The INIT ACK and
  1427. * State Cookie are populated as specified in section 5.2.1.
  1428. *
  1429. * Verification Tag: Not specified, but an INIT has no way of knowing
  1430. * what the verification tag could be, so we ignore it.
  1431. *
  1432. * Inputs
  1433. * (endpoint, asoc, chunk)
  1434. *
  1435. * Outputs
  1436. * (asoc, reply_msg, msg_up, timers, counters)
  1437. *
  1438. * The return value is the disposition of the chunk.
  1439. */
  1440. sctp_disposition_t sctp_sf_do_5_2_2_dupinit(const struct sctp_endpoint *ep,
  1441. const struct sctp_association *asoc,
  1442. const sctp_subtype_t type,
  1443. void *arg,
  1444. sctp_cmd_seq_t *commands)
  1445. {
  1446. /* Call helper to do the real work for both simulataneous and
  1447. * duplicate INIT chunk handling.
  1448. */
  1449. return sctp_sf_do_unexpected_init(ep, asoc, type, arg, commands);
  1450. }
  1451. /*
  1452. * Unexpected INIT-ACK handler.
  1453. *
  1454. * Section 5.2.3
  1455. * If an INIT ACK received by an endpoint in any state other than the
  1456. * COOKIE-WAIT state, the endpoint should discard the INIT ACK chunk.
  1457. * An unexpected INIT ACK usually indicates the processing of an old or
  1458. * duplicated INIT chunk.
  1459. */
  1460. sctp_disposition_t sctp_sf_do_5_2_3_initack(const struct sctp_endpoint *ep,
  1461. const struct sctp_association *asoc,
  1462. const sctp_subtype_t type,
  1463. void *arg, sctp_cmd_seq_t *commands)
  1464. {
  1465. /* Per the above section, we'll discard the chunk if we have an
  1466. * endpoint. If this is an OOTB INIT-ACK, treat it as such.
  1467. */
  1468. if (ep == sctp_sk((sctp_get_ctl_sock()))->ep)
  1469. return sctp_sf_ootb(ep, asoc, type, arg, commands);
  1470. else
  1471. return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
  1472. }
  1473. /* Unexpected COOKIE-ECHO handler for peer restart (Table 2, action 'A')
  1474. *
  1475. * Section 5.2.4
  1476. * A) In this case, the peer may have restarted.
  1477. */
  1478. static sctp_disposition_t sctp_sf_do_dupcook_a(const struct sctp_endpoint *ep,
  1479. const struct sctp_association *asoc,
  1480. struct sctp_chunk *chunk,
  1481. sctp_cmd_seq_t *commands,
  1482. struct sctp_association *new_asoc)
  1483. {
  1484. sctp_init_chunk_t *peer_init;
  1485. struct sctp_ulpevent *ev;
  1486. struct sctp_chunk *repl;
  1487. struct sctp_chunk *err;
  1488. sctp_disposition_t disposition;
  1489. /* new_asoc is a brand-new association, so these are not yet
  1490. * side effects--it is safe to run them here.
  1491. */
  1492. peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
  1493. if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
  1494. sctp_source(chunk), peer_init,
  1495. GFP_ATOMIC))
  1496. goto nomem;
  1497. /* Make sure no new addresses are being added during the
  1498. * restart. Though this is a pretty complicated attack
  1499. * since you'd have to get inside the cookie.
  1500. */
  1501. if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk, commands)) {
  1502. return SCTP_DISPOSITION_CONSUME;
  1503. }
  1504. /* If the endpoint is in the SHUTDOWN-ACK-SENT state and recognizes
  1505. * the peer has restarted (Action A), it MUST NOT setup a new
  1506. * association but instead resend the SHUTDOWN ACK and send an ERROR
  1507. * chunk with a "Cookie Received while Shutting Down" error cause to
  1508. * its peer.
  1509. */
  1510. if (sctp_state(asoc, SHUTDOWN_ACK_SENT)) {
  1511. disposition = sctp_sf_do_9_2_reshutack(ep, asoc,
  1512. SCTP_ST_CHUNK(chunk->chunk_hdr->type),
  1513. chunk, commands);
  1514. if (SCTP_DISPOSITION_NOMEM == disposition)
  1515. goto nomem;
  1516. err = sctp_make_op_error(asoc, chunk,
  1517. SCTP_ERROR_COOKIE_IN_SHUTDOWN,
  1518. NULL, 0);
  1519. if (err)
  1520. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
  1521. SCTP_CHUNK(err));
  1522. return SCTP_DISPOSITION_CONSUME;
  1523. }
  1524. /* For now, fail any unsent/unacked data. Consider the optional
  1525. * choice of resending of this data.
  1526. */
  1527. sctp_add_cmd_sf(commands, SCTP_CMD_PURGE_OUTQUEUE, SCTP_NULL());
  1528. repl = sctp_make_cookie_ack(new_asoc, chunk);
  1529. if (!repl)
  1530. goto nomem;
  1531. /* Report association restart to upper layer. */
  1532. ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_RESTART, 0,
  1533. new_asoc->c.sinit_num_ostreams,
  1534. new_asoc->c.sinit_max_instreams,
  1535. NULL, GFP_ATOMIC);
  1536. if (!ev)
  1537. goto nomem_ev;
  1538. /* Update the content of current association. */
  1539. sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
  1540. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
  1541. sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
  1542. return SCTP_DISPOSITION_CONSUME;
  1543. nomem_ev:
  1544. sctp_chunk_free(repl);
  1545. nomem:
  1546. return SCTP_DISPOSITION_NOMEM;
  1547. }
  1548. /* Unexpected COOKIE-ECHO handler for setup collision (Table 2, action 'B')
  1549. *
  1550. * Section 5.2.4
  1551. * B) In this case, both sides may be attempting to start an association
  1552. * at about the same time but the peer endpoint started its INIT
  1553. * after responding to the local endpoint's INIT
  1554. */
  1555. /* This case represents an initialization collision. */
  1556. static sctp_disposition_t sctp_sf_do_dupcook_b(const struct sctp_endpoint *ep,
  1557. const struct sctp_association *asoc,
  1558. struct sctp_chunk *chunk,
  1559. sctp_cmd_seq_t *commands,
  1560. struct sctp_association *new_asoc)
  1561. {
  1562. sctp_init_chunk_t *peer_init;
  1563. struct sctp_chunk *repl;
  1564. /* new_asoc is a brand-new association, so these are not yet
  1565. * side effects--it is safe to run them here.
  1566. */
  1567. peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
  1568. if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
  1569. sctp_source(chunk), peer_init,
  1570. GFP_ATOMIC))
  1571. goto nomem;
  1572. /* Update the content of current association. */
  1573. sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
  1574. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  1575. SCTP_STATE(SCTP_STATE_ESTABLISHED));
  1576. SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
  1577. sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
  1578. repl = sctp_make_cookie_ack(new_asoc, chunk);
  1579. if (!repl)
  1580. goto nomem;
  1581. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
  1582. /* RFC 2960 5.1 Normal Establishment of an Association
  1583. *
  1584. * D) IMPLEMENTATION NOTE: An implementation may choose to
  1585. * send the Communication Up notification to the SCTP user
  1586. * upon reception of a valid COOKIE ECHO chunk.
  1587. *
  1588. * Sadly, this needs to be implemented as a side-effect, because
  1589. * we are not guaranteed to have set the association id of the real
  1590. * association and so these notifications need to be delayed until
  1591. * the association id is allocated.
  1592. */
  1593. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_CHANGE, SCTP_U8(SCTP_COMM_UP));
  1594. /* Sockets API Draft Section 5.3.1.6
  1595. * When a peer sends a Adaptation Layer Indication parameter , SCTP
  1596. * delivers this notification to inform the application that of the
  1597. * peers requested adaptation layer.
  1598. *
  1599. * This also needs to be done as a side effect for the same reason as
  1600. * above.
  1601. */
  1602. if (asoc->peer.adaptation_ind)
  1603. sctp_add_cmd_sf(commands, SCTP_CMD_ADAPTATION_IND, SCTP_NULL());
  1604. return SCTP_DISPOSITION_CONSUME;
  1605. nomem:
  1606. return SCTP_DISPOSITION_NOMEM;
  1607. }
  1608. /* Unexpected COOKIE-ECHO handler for setup collision (Table 2, action 'C')
  1609. *
  1610. * Section 5.2.4
  1611. * C) In this case, the local endpoint's cookie has arrived late.
  1612. * Before it arrived, the local endpoint sent an INIT and received an
  1613. * INIT-ACK and finally sent a COOKIE ECHO with the peer's same tag
  1614. * but a new tag of its own.
  1615. */
  1616. /* This case represents an initialization collision. */
  1617. static sctp_disposition_t sctp_sf_do_dupcook_c(const struct sctp_endpoint *ep,
  1618. const struct sctp_association *asoc,
  1619. struct sctp_chunk *chunk,
  1620. sctp_cmd_seq_t *commands,
  1621. struct sctp_association *new_asoc)
  1622. {
  1623. /* The cookie should be silently discarded.
  1624. * The endpoint SHOULD NOT change states and should leave
  1625. * any timers running.
  1626. */
  1627. return SCTP_DISPOSITION_DISCARD;
  1628. }
  1629. /* Unexpected COOKIE-ECHO handler lost chunk (Table 2, action 'D')
  1630. *
  1631. * Section 5.2.4
  1632. *
  1633. * D) When both local and remote tags match the endpoint should always
  1634. * enter the ESTABLISHED state, if it has not already done so.
  1635. */
  1636. /* This case represents an initialization collision. */
  1637. static sctp_disposition_t sctp_sf_do_dupcook_d(const struct sctp_endpoint *ep,
  1638. const struct sctp_association *asoc,
  1639. struct sctp_chunk *chunk,
  1640. sctp_cmd_seq_t *commands,
  1641. struct sctp_association *new_asoc)
  1642. {
  1643. struct sctp_ulpevent *ev = NULL, *ai_ev = NULL;
  1644. struct sctp_chunk *repl;
  1645. /* Clarification from Implementor's Guide:
  1646. * D) When both local and remote tags match the endpoint should
  1647. * enter the ESTABLISHED state, if it is in the COOKIE-ECHOED state.
  1648. * It should stop any cookie timer that may be running and send
  1649. * a COOKIE ACK.
  1650. */
  1651. /* Don't accidentally move back into established state. */
  1652. if (asoc->state < SCTP_STATE_ESTABLISHED) {
  1653. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  1654. SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
  1655. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  1656. SCTP_STATE(SCTP_STATE_ESTABLISHED));
  1657. SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
  1658. sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START,
  1659. SCTP_NULL());
  1660. /* RFC 2960 5.1 Normal Establishment of an Association
  1661. *
  1662. * D) IMPLEMENTATION NOTE: An implementation may choose
  1663. * to send the Communication Up notification to the
  1664. * SCTP user upon reception of a valid COOKIE
  1665. * ECHO chunk.
  1666. */
  1667. ev = sctp_ulpevent_make_assoc_change(asoc, 0,
  1668. SCTP_COMM_UP, 0,
  1669. asoc->c.sinit_num_ostreams,
  1670. asoc->c.sinit_max_instreams,
  1671. NULL, GFP_ATOMIC);
  1672. if (!ev)
  1673. goto nomem;
  1674. /* Sockets API Draft Section 5.3.1.6
  1675. * When a peer sends a Adaptation Layer Indication parameter,
  1676. * SCTP delivers this notification to inform the application
  1677. * that of the peers requested adaptation layer.
  1678. */
  1679. if (asoc->peer.adaptation_ind) {
  1680. ai_ev = sctp_ulpevent_make_adaptation_indication(asoc,
  1681. GFP_ATOMIC);
  1682. if (!ai_ev)
  1683. goto nomem;
  1684. }
  1685. }
  1686. repl = sctp_make_cookie_ack(new_asoc, chunk);
  1687. if (!repl)
  1688. goto nomem;
  1689. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
  1690. if (ev)
  1691. sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
  1692. SCTP_ULPEVENT(ev));
  1693. if (ai_ev)
  1694. sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
  1695. SCTP_ULPEVENT(ai_ev));
  1696. return SCTP_DISPOSITION_CONSUME;
  1697. nomem:
  1698. if (ai_ev)
  1699. sctp_ulpevent_free(ai_ev);
  1700. if (ev)
  1701. sctp_ulpevent_free(ev);
  1702. return SCTP_DISPOSITION_NOMEM;
  1703. }
  1704. /*
  1705. * Handle a duplicate COOKIE-ECHO. This usually means a cookie-carrying
  1706. * chunk was retransmitted and then delayed in the network.
  1707. *
  1708. * Section: 5.2.4 Handle a COOKIE ECHO when a TCB exists
  1709. *
  1710. * Verification Tag: None. Do cookie validation.
  1711. *
  1712. * Inputs
  1713. * (endpoint, asoc, chunk)
  1714. *
  1715. * Outputs
  1716. * (asoc, reply_msg, msg_up, timers, counters)
  1717. *
  1718. * The return value is the disposition of the chunk.
  1719. */
  1720. sctp_disposition_t sctp_sf_do_5_2_4_dupcook(const struct sctp_endpoint *ep,
  1721. const struct sctp_association *asoc,
  1722. const sctp_subtype_t type,
  1723. void *arg,
  1724. sctp_cmd_seq_t *commands)
  1725. {
  1726. sctp_disposition_t retval;
  1727. struct sctp_chunk *chunk = arg;
  1728. struct sctp_association *new_asoc;
  1729. int error = 0;
  1730. char action;
  1731. struct sctp_chunk *err_chk_p;
  1732. /* Make sure that the chunk has a valid length from the protocol
  1733. * perspective. In this case check to make sure we have at least
  1734. * enough for the chunk header. Cookie length verification is
  1735. * done later.
  1736. */
  1737. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
  1738. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  1739. commands);
  1740. /* "Decode" the chunk. We have no optional parameters so we
  1741. * are in good shape.
  1742. */
  1743. chunk->subh.cookie_hdr = (struct sctp_signed_cookie *)chunk->skb->data;
  1744. if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
  1745. sizeof(sctp_chunkhdr_t)))
  1746. goto nomem;
  1747. /* In RFC 2960 5.2.4 3, if both Verification Tags in the State Cookie
  1748. * of a duplicate COOKIE ECHO match the Verification Tags of the
  1749. * current association, consider the State Cookie valid even if
  1750. * the lifespan is exceeded.
  1751. */
  1752. new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, &error,
  1753. &err_chk_p);
  1754. /* FIXME:
  1755. * If the re-build failed, what is the proper error path
  1756. * from here?
  1757. *
  1758. * [We should abort the association. --piggy]
  1759. */
  1760. if (!new_asoc) {
  1761. /* FIXME: Several errors are possible. A bad cookie should
  1762. * be silently discarded, but think about logging it too.
  1763. */
  1764. switch (error) {
  1765. case -SCTP_IERROR_NOMEM:
  1766. goto nomem;
  1767. case -SCTP_IERROR_STALE_COOKIE:
  1768. sctp_send_stale_cookie_err(ep, asoc, chunk, commands,
  1769. err_chk_p);
  1770. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  1771. case -SCTP_IERROR_BAD_SIG:
  1772. default:
  1773. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  1774. }
  1775. }
  1776. /* Compare the tie_tag in cookie with the verification tag of
  1777. * current association.
  1778. */
  1779. action = sctp_tietags_compare(new_asoc, asoc);
  1780. switch (action) {
  1781. case 'A': /* Association restart. */
  1782. retval = sctp_sf_do_dupcook_a(ep, asoc, chunk, commands,
  1783. new_asoc);
  1784. break;
  1785. case 'B': /* Collision case B. */
  1786. retval = sctp_sf_do_dupcook_b(ep, asoc, chunk, commands,
  1787. new_asoc);
  1788. break;
  1789. case 'C': /* Collision case C. */
  1790. retval = sctp_sf_do_dupcook_c(ep, asoc, chunk, commands,
  1791. new_asoc);
  1792. break;
  1793. case 'D': /* Collision case D. */
  1794. retval = sctp_sf_do_dupcook_d(ep, asoc, chunk, commands,
  1795. new_asoc);
  1796. break;
  1797. default: /* Discard packet for all others. */
  1798. retval = sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  1799. break;
  1800. }
  1801. /* Delete the tempory new association. */
  1802. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
  1803. sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
  1804. return retval;
  1805. nomem:
  1806. return SCTP_DISPOSITION_NOMEM;
  1807. }
  1808. /*
  1809. * Process an ABORT. (SHUTDOWN-PENDING state)
  1810. *
  1811. * See sctp_sf_do_9_1_abort().
  1812. */
  1813. sctp_disposition_t sctp_sf_shutdown_pending_abort(
  1814. const struct sctp_endpoint *ep,
  1815. const struct sctp_association *asoc,
  1816. const sctp_subtype_t type,
  1817. void *arg,
  1818. sctp_cmd_seq_t *commands)
  1819. {
  1820. struct sctp_chunk *chunk = arg;
  1821. if (!sctp_vtag_verify_either(chunk, asoc))
  1822. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  1823. /* Make sure that the ABORT chunk has a valid length.
  1824. * Since this is an ABORT chunk, we have to discard it
  1825. * because of the following text:
  1826. * RFC 2960, Section 3.3.7
  1827. * If an endpoint receives an ABORT with a format error or for an
  1828. * association that doesn't exist, it MUST silently discard it.
  1829. * Becasue the length is "invalid", we can't really discard just
  1830. * as we do not know its true length. So, to be safe, discard the
  1831. * packet.
  1832. */
  1833. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
  1834. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  1835. /* ADD-IP: Special case for ABORT chunks
  1836. * F4) One special consideration is that ABORT Chunks arriving
  1837. * destined to the IP address being deleted MUST be
  1838. * ignored (see Section 5.3.1 for further details).
  1839. */
  1840. if (SCTP_ADDR_DEL ==
  1841. sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
  1842. return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
  1843. return __sctp_sf_do_9_1_abort(ep, asoc, type, arg, commands);
  1844. }
  1845. /*
  1846. * Process an ABORT. (SHUTDOWN-SENT state)
  1847. *
  1848. * See sctp_sf_do_9_1_abort().
  1849. */
  1850. sctp_disposition_t sctp_sf_shutdown_sent_abort(const struct sctp_endpoint *ep,
  1851. const struct sctp_association *asoc,
  1852. const sctp_subtype_t type,
  1853. void *arg,
  1854. sctp_cmd_seq_t *commands)
  1855. {
  1856. struct sctp_chunk *chunk = arg;
  1857. if (!sctp_vtag_verify_either(chunk, asoc))
  1858. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  1859. /* Make sure that the ABORT chunk has a valid length.
  1860. * Since this is an ABORT chunk, we have to discard it
  1861. * because of the following text:
  1862. * RFC 2960, Section 3.3.7
  1863. * If an endpoint receives an ABORT with a format error or for an
  1864. * association that doesn't exist, it MUST silently discard it.
  1865. * Becasue the length is "invalid", we can't really discard just
  1866. * as we do not know its true length. So, to be safe, discard the
  1867. * packet.
  1868. */
  1869. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
  1870. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  1871. /* ADD-IP: Special case for ABORT chunks
  1872. * F4) One special consideration is that ABORT Chunks arriving
  1873. * destined to the IP address being deleted MUST be
  1874. * ignored (see Section 5.3.1 for further details).
  1875. */
  1876. if (SCTP_ADDR_DEL ==
  1877. sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
  1878. return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
  1879. /* Stop the T2-shutdown timer. */
  1880. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  1881. SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
  1882. /* Stop the T5-shutdown guard timer. */
  1883. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  1884. SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
  1885. return __sctp_sf_do_9_1_abort(ep, asoc, type, arg, commands);
  1886. }
  1887. /*
  1888. * Process an ABORT. (SHUTDOWN-ACK-SENT state)
  1889. *
  1890. * See sctp_sf_do_9_1_abort().
  1891. */
  1892. sctp_disposition_t sctp_sf_shutdown_ack_sent_abort(
  1893. const struct sctp_endpoint *ep,
  1894. const struct sctp_association *asoc,
  1895. const sctp_subtype_t type,
  1896. void *arg,
  1897. sctp_cmd_seq_t *commands)
  1898. {
  1899. /* The same T2 timer, so we should be able to use
  1900. * common function with the SHUTDOWN-SENT state.
  1901. */
  1902. return sctp_sf_shutdown_sent_abort(ep, asoc, type, arg, commands);
  1903. }
  1904. /*
  1905. * Handle an Error received in COOKIE_ECHOED state.
  1906. *
  1907. * Only handle the error type of stale COOKIE Error, the other errors will
  1908. * be ignored.
  1909. *
  1910. * Inputs
  1911. * (endpoint, asoc, chunk)
  1912. *
  1913. * Outputs
  1914. * (asoc, reply_msg, msg_up, timers, counters)
  1915. *
  1916. * The return value is the disposition of the chunk.
  1917. */
  1918. sctp_disposition_t sctp_sf_cookie_echoed_err(const struct sctp_endpoint *ep,
  1919. const struct sctp_association *asoc,
  1920. const sctp_subtype_t type,
  1921. void *arg,
  1922. sctp_cmd_seq_t *commands)
  1923. {
  1924. struct sctp_chunk *chunk = arg;
  1925. sctp_errhdr_t *err;
  1926. if (!sctp_vtag_verify(chunk, asoc))
  1927. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  1928. /* Make sure that the ERROR chunk has a valid length.
  1929. * The parameter walking depends on this as well.
  1930. */
  1931. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_operr_chunk_t)))
  1932. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  1933. commands);
  1934. /* Process the error here */
  1935. /* FUTURE FIXME: When PR-SCTP related and other optional
  1936. * parms are emitted, this will have to change to handle multiple
  1937. * errors.
  1938. */
  1939. sctp_walk_errors(err, chunk->chunk_hdr) {
  1940. if (SCTP_ERROR_STALE_COOKIE == err->cause)
  1941. return sctp_sf_do_5_2_6_stale(ep, asoc, type,
  1942. arg, commands);
  1943. }
  1944. /* It is possible to have malformed error causes, and that
  1945. * will cause us to end the walk early. However, since
  1946. * we are discarding the packet, there should be no adverse
  1947. * affects.
  1948. */
  1949. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  1950. }
  1951. /*
  1952. * Handle a Stale COOKIE Error
  1953. *
  1954. * Section: 5.2.6 Handle Stale COOKIE Error
  1955. * If the association is in the COOKIE-ECHOED state, the endpoint may elect
  1956. * one of the following three alternatives.
  1957. * ...
  1958. * 3) Send a new INIT chunk to the endpoint, adding a Cookie
  1959. * Preservative parameter requesting an extension to the lifetime of
  1960. * the State Cookie. When calculating the time extension, an
  1961. * implementation SHOULD use the RTT information measured based on the
  1962. * previous COOKIE ECHO / ERROR exchange, and should add no more
  1963. * than 1 second beyond the measured RTT, due to long State Cookie
  1964. * lifetimes making the endpoint more subject to a replay attack.
  1965. *
  1966. * Verification Tag: Not explicit, but safe to ignore.
  1967. *
  1968. * Inputs
  1969. * (endpoint, asoc, chunk)
  1970. *
  1971. * Outputs
  1972. * (asoc, reply_msg, msg_up, timers, counters)
  1973. *
  1974. * The return value is the disposition of the chunk.
  1975. */
  1976. static sctp_disposition_t sctp_sf_do_5_2_6_stale(const struct sctp_endpoint *ep,
  1977. const struct sctp_association *asoc,
  1978. const sctp_subtype_t type,
  1979. void *arg,
  1980. sctp_cmd_seq_t *commands)
  1981. {
  1982. struct sctp_chunk *chunk = arg;
  1983. time_t stale;
  1984. sctp_cookie_preserve_param_t bht;
  1985. sctp_errhdr_t *err;
  1986. struct sctp_chunk *reply;
  1987. struct sctp_bind_addr *bp;
  1988. int attempts = asoc->init_err_counter + 1;
  1989. if (attempts > asoc->max_init_attempts) {
  1990. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  1991. SCTP_ERROR(ETIMEDOUT));
  1992. sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
  1993. SCTP_PERR(SCTP_ERROR_STALE_COOKIE));
  1994. return SCTP_DISPOSITION_DELETE_TCB;
  1995. }
  1996. err = (sctp_errhdr_t *)(chunk->skb->data);
  1997. /* When calculating the time extension, an implementation
  1998. * SHOULD use the RTT information measured based on the
  1999. * previous COOKIE ECHO / ERROR exchange, and should add no
  2000. * more than 1 second beyond the measured RTT, due to long
  2001. * State Cookie lifetimes making the endpoint more subject to
  2002. * a replay attack.
  2003. * Measure of Staleness's unit is usec. (1/1000000 sec)
  2004. * Suggested Cookie Life-span Increment's unit is msec.
  2005. * (1/1000 sec)
  2006. * In general, if you use the suggested cookie life, the value
  2007. * found in the field of measure of staleness should be doubled
  2008. * to give ample time to retransmit the new cookie and thus
  2009. * yield a higher probability of success on the reattempt.
  2010. */
  2011. stale = ntohl(*(__be32 *)((u8 *)err + sizeof(sctp_errhdr_t)));
  2012. stale = (stale * 2) / 1000;
  2013. bht.param_hdr.type = SCTP_PARAM_COOKIE_PRESERVATIVE;
  2014. bht.param_hdr.length = htons(sizeof(bht));
  2015. bht.lifespan_increment = htonl(stale);
  2016. /* Build that new INIT chunk. */
  2017. bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
  2018. reply = sctp_make_init(asoc, bp, GFP_ATOMIC, sizeof(bht));
  2019. if (!reply)
  2020. goto nomem;
  2021. sctp_addto_chunk(reply, sizeof(bht), &bht);
  2022. /* Clear peer's init_tag cached in assoc as we are sending a new INIT */
  2023. sctp_add_cmd_sf(commands, SCTP_CMD_CLEAR_INIT_TAG, SCTP_NULL());
  2024. /* Stop pending T3-rtx and heartbeat timers */
  2025. sctp_add_cmd_sf(commands, SCTP_CMD_T3_RTX_TIMERS_STOP, SCTP_NULL());
  2026. sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
  2027. /* Delete non-primary peer ip addresses since we are transitioning
  2028. * back to the COOKIE-WAIT state
  2029. */
  2030. sctp_add_cmd_sf(commands, SCTP_CMD_DEL_NON_PRIMARY, SCTP_NULL());
  2031. /* If we've sent any data bundled with COOKIE-ECHO we will need to
  2032. * resend
  2033. */
  2034. sctp_add_cmd_sf(commands, SCTP_CMD_T1_RETRAN,
  2035. SCTP_TRANSPORT(asoc->peer.primary_path));
  2036. /* Cast away the const modifier, as we want to just
  2037. * rerun it through as a sideffect.
  2038. */
  2039. sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_INC, SCTP_NULL());
  2040. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  2041. SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
  2042. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  2043. SCTP_STATE(SCTP_STATE_COOKIE_WAIT));
  2044. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
  2045. SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
  2046. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
  2047. return SCTP_DISPOSITION_CONSUME;
  2048. nomem:
  2049. return SCTP_DISPOSITION_NOMEM;
  2050. }
  2051. /*
  2052. * Process an ABORT.
  2053. *
  2054. * Section: 9.1
  2055. * After checking the Verification Tag, the receiving endpoint shall
  2056. * remove the association from its record, and shall report the
  2057. * termination to its upper layer.
  2058. *
  2059. * Verification Tag: 8.5.1 Exceptions in Verification Tag Rules
  2060. * B) Rules for packet carrying ABORT:
  2061. *
  2062. * - The endpoint shall always fill in the Verification Tag field of the
  2063. * outbound packet with the destination endpoint's tag value if it
  2064. * is known.
  2065. *
  2066. * - If the ABORT is sent in response to an OOTB packet, the endpoint
  2067. * MUST follow the procedure described in Section 8.4.
  2068. *
  2069. * - The receiver MUST accept the packet if the Verification Tag
  2070. * matches either its own tag, OR the tag of its peer. Otherwise, the
  2071. * receiver MUST silently discard the packet and take no further
  2072. * action.
  2073. *
  2074. * Inputs
  2075. * (endpoint, asoc, chunk)
  2076. *
  2077. * Outputs
  2078. * (asoc, reply_msg, msg_up, timers, counters)
  2079. *
  2080. * The return value is the disposition of the chunk.
  2081. */
  2082. sctp_disposition_t sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep,
  2083. const struct sctp_association *asoc,
  2084. const sctp_subtype_t type,
  2085. void *arg,
  2086. sctp_cmd_seq_t *commands)
  2087. {
  2088. struct sctp_chunk *chunk = arg;
  2089. if (!sctp_vtag_verify_either(chunk, asoc))
  2090. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2091. /* Make sure that the ABORT chunk has a valid length.
  2092. * Since this is an ABORT chunk, we have to discard it
  2093. * because of the following text:
  2094. * RFC 2960, Section 3.3.7
  2095. * If an endpoint receives an ABORT with a format error or for an
  2096. * association that doesn't exist, it MUST silently discard it.
  2097. * Becasue the length is "invalid", we can't really discard just
  2098. * as we do not know its true length. So, to be safe, discard the
  2099. * packet.
  2100. */
  2101. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
  2102. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2103. /* ADD-IP: Special case for ABORT chunks
  2104. * F4) One special consideration is that ABORT Chunks arriving
  2105. * destined to the IP address being deleted MUST be
  2106. * ignored (see Section 5.3.1 for further details).
  2107. */
  2108. if (SCTP_ADDR_DEL ==
  2109. sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
  2110. return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
  2111. return __sctp_sf_do_9_1_abort(ep, asoc, type, arg, commands);
  2112. }
  2113. static sctp_disposition_t __sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep,
  2114. const struct sctp_association *asoc,
  2115. const sctp_subtype_t type,
  2116. void *arg,
  2117. sctp_cmd_seq_t *commands)
  2118. {
  2119. struct sctp_chunk *chunk = arg;
  2120. unsigned len;
  2121. __be16 error = SCTP_ERROR_NO_ERROR;
  2122. /* See if we have an error cause code in the chunk. */
  2123. len = ntohs(chunk->chunk_hdr->length);
  2124. if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
  2125. error = ((sctp_errhdr_t *)chunk->skb->data)->cause;
  2126. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(ECONNRESET));
  2127. /* ASSOC_FAILED will DELETE_TCB. */
  2128. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, SCTP_PERR(error));
  2129. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  2130. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  2131. return SCTP_DISPOSITION_ABORT;
  2132. }
  2133. /*
  2134. * Process an ABORT. (COOKIE-WAIT state)
  2135. *
  2136. * See sctp_sf_do_9_1_abort() above.
  2137. */
  2138. sctp_disposition_t sctp_sf_cookie_wait_abort(const struct sctp_endpoint *ep,
  2139. const struct sctp_association *asoc,
  2140. const sctp_subtype_t type,
  2141. void *arg,
  2142. sctp_cmd_seq_t *commands)
  2143. {
  2144. struct sctp_chunk *chunk = arg;
  2145. unsigned len;
  2146. __be16 error = SCTP_ERROR_NO_ERROR;
  2147. if (!sctp_vtag_verify_either(chunk, asoc))
  2148. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2149. /* Make sure that the ABORT chunk has a valid length.
  2150. * Since this is an ABORT chunk, we have to discard it
  2151. * because of the following text:
  2152. * RFC 2960, Section 3.3.7
  2153. * If an endpoint receives an ABORT with a format error or for an
  2154. * association that doesn't exist, it MUST silently discard it.
  2155. * Becasue the length is "invalid", we can't really discard just
  2156. * as we do not know its true length. So, to be safe, discard the
  2157. * packet.
  2158. */
  2159. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
  2160. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2161. /* See if we have an error cause code in the chunk. */
  2162. len = ntohs(chunk->chunk_hdr->length);
  2163. if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
  2164. error = ((sctp_errhdr_t *)chunk->skb->data)->cause;
  2165. return sctp_stop_t1_and_abort(commands, error, ECONNREFUSED, asoc,
  2166. chunk->transport);
  2167. }
  2168. /*
  2169. * Process an incoming ICMP as an ABORT. (COOKIE-WAIT state)
  2170. */
  2171. sctp_disposition_t sctp_sf_cookie_wait_icmp_abort(const struct sctp_endpoint *ep,
  2172. const struct sctp_association *asoc,
  2173. const sctp_subtype_t type,
  2174. void *arg,
  2175. sctp_cmd_seq_t *commands)
  2176. {
  2177. return sctp_stop_t1_and_abort(commands, SCTP_ERROR_NO_ERROR,
  2178. ENOPROTOOPT, asoc,
  2179. (struct sctp_transport *)arg);
  2180. }
  2181. /*
  2182. * Process an ABORT. (COOKIE-ECHOED state)
  2183. */
  2184. sctp_disposition_t sctp_sf_cookie_echoed_abort(const struct sctp_endpoint *ep,
  2185. const struct sctp_association *asoc,
  2186. const sctp_subtype_t type,
  2187. void *arg,
  2188. sctp_cmd_seq_t *commands)
  2189. {
  2190. /* There is a single T1 timer, so we should be able to use
  2191. * common function with the COOKIE-WAIT state.
  2192. */
  2193. return sctp_sf_cookie_wait_abort(ep, asoc, type, arg, commands);
  2194. }
  2195. /*
  2196. * Stop T1 timer and abort association with "INIT failed".
  2197. *
  2198. * This is common code called by several sctp_sf_*_abort() functions above.
  2199. */
  2200. static sctp_disposition_t sctp_stop_t1_and_abort(sctp_cmd_seq_t *commands,
  2201. __be16 error, int sk_err,
  2202. const struct sctp_association *asoc,
  2203. struct sctp_transport *transport)
  2204. {
  2205. SCTP_DEBUG_PRINTK("ABORT received (INIT).\n");
  2206. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  2207. SCTP_STATE(SCTP_STATE_CLOSED));
  2208. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  2209. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  2210. SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
  2211. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(sk_err));
  2212. /* CMD_INIT_FAILED will DELETE_TCB. */
  2213. sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
  2214. SCTP_PERR(error));
  2215. return SCTP_DISPOSITION_ABORT;
  2216. }
  2217. /*
  2218. * sctp_sf_do_9_2_shut
  2219. *
  2220. * Section: 9.2
  2221. * Upon the reception of the SHUTDOWN, the peer endpoint shall
  2222. * - enter the SHUTDOWN-RECEIVED state,
  2223. *
  2224. * - stop accepting new data from its SCTP user
  2225. *
  2226. * - verify, by checking the Cumulative TSN Ack field of the chunk,
  2227. * that all its outstanding DATA chunks have been received by the
  2228. * SHUTDOWN sender.
  2229. *
  2230. * Once an endpoint as reached the SHUTDOWN-RECEIVED state it MUST NOT
  2231. * send a SHUTDOWN in response to a ULP request. And should discard
  2232. * subsequent SHUTDOWN chunks.
  2233. *
  2234. * If there are still outstanding DATA chunks left, the SHUTDOWN
  2235. * receiver shall continue to follow normal data transmission
  2236. * procedures defined in Section 6 until all outstanding DATA chunks
  2237. * are acknowledged; however, the SHUTDOWN receiver MUST NOT accept
  2238. * new data from its SCTP user.
  2239. *
  2240. * Verification Tag: 8.5 Verification Tag [Normal verification]
  2241. *
  2242. * Inputs
  2243. * (endpoint, asoc, chunk)
  2244. *
  2245. * Outputs
  2246. * (asoc, reply_msg, msg_up, timers, counters)
  2247. *
  2248. * The return value is the disposition of the chunk.
  2249. */
  2250. sctp_disposition_t sctp_sf_do_9_2_shutdown(const struct sctp_endpoint *ep,
  2251. const struct sctp_association *asoc,
  2252. const sctp_subtype_t type,
  2253. void *arg,
  2254. sctp_cmd_seq_t *commands)
  2255. {
  2256. struct sctp_chunk *chunk = arg;
  2257. sctp_shutdownhdr_t *sdh;
  2258. sctp_disposition_t disposition;
  2259. struct sctp_ulpevent *ev;
  2260. __u32 ctsn;
  2261. if (!sctp_vtag_verify(chunk, asoc))
  2262. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2263. /* Make sure that the SHUTDOWN chunk has a valid length. */
  2264. if (!sctp_chunk_length_valid(chunk,
  2265. sizeof(struct sctp_shutdown_chunk_t)))
  2266. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  2267. commands);
  2268. /* Convert the elaborate header. */
  2269. sdh = (sctp_shutdownhdr_t *)chunk->skb->data;
  2270. skb_pull(chunk->skb, sizeof(sctp_shutdownhdr_t));
  2271. chunk->subh.shutdown_hdr = sdh;
  2272. ctsn = ntohl(sdh->cum_tsn_ack);
  2273. /* If Cumulative TSN Ack beyond the max tsn currently
  2274. * send, terminating the association and respond to the
  2275. * sender with an ABORT.
  2276. */
  2277. if (!TSN_lt(ctsn, asoc->next_tsn))
  2278. return sctp_sf_violation_ctsn(ep, asoc, type, arg, commands);
  2279. /* API 5.3.1.5 SCTP_SHUTDOWN_EVENT
  2280. * When a peer sends a SHUTDOWN, SCTP delivers this notification to
  2281. * inform the application that it should cease sending data.
  2282. */
  2283. ev = sctp_ulpevent_make_shutdown_event(asoc, 0, GFP_ATOMIC);
  2284. if (!ev) {
  2285. disposition = SCTP_DISPOSITION_NOMEM;
  2286. goto out;
  2287. }
  2288. sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
  2289. /* Upon the reception of the SHUTDOWN, the peer endpoint shall
  2290. * - enter the SHUTDOWN-RECEIVED state,
  2291. * - stop accepting new data from its SCTP user
  2292. *
  2293. * [This is implicit in the new state.]
  2294. */
  2295. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  2296. SCTP_STATE(SCTP_STATE_SHUTDOWN_RECEIVED));
  2297. disposition = SCTP_DISPOSITION_CONSUME;
  2298. if (sctp_outq_is_empty(&asoc->outqueue)) {
  2299. disposition = sctp_sf_do_9_2_shutdown_ack(ep, asoc, type,
  2300. arg, commands);
  2301. }
  2302. if (SCTP_DISPOSITION_NOMEM == disposition)
  2303. goto out;
  2304. /* - verify, by checking the Cumulative TSN Ack field of the
  2305. * chunk, that all its outstanding DATA chunks have been
  2306. * received by the SHUTDOWN sender.
  2307. */
  2308. sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_CTSN,
  2309. SCTP_BE32(chunk->subh.shutdown_hdr->cum_tsn_ack));
  2310. out:
  2311. return disposition;
  2312. }
  2313. /*
  2314. * sctp_sf_do_9_2_shut_ctsn
  2315. *
  2316. * Once an endpoint has reached the SHUTDOWN-RECEIVED state,
  2317. * it MUST NOT send a SHUTDOWN in response to a ULP request.
  2318. * The Cumulative TSN Ack of the received SHUTDOWN chunk
  2319. * MUST be processed.
  2320. */
  2321. sctp_disposition_t sctp_sf_do_9_2_shut_ctsn(const struct sctp_endpoint *ep,
  2322. const struct sctp_association *asoc,
  2323. const sctp_subtype_t type,
  2324. void *arg,
  2325. sctp_cmd_seq_t *commands)
  2326. {
  2327. struct sctp_chunk *chunk = arg;
  2328. sctp_shutdownhdr_t *sdh;
  2329. if (!sctp_vtag_verify(chunk, asoc))
  2330. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2331. /* Make sure that the SHUTDOWN chunk has a valid length. */
  2332. if (!sctp_chunk_length_valid(chunk,
  2333. sizeof(struct sctp_shutdown_chunk_t)))
  2334. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  2335. commands);
  2336. sdh = (sctp_shutdownhdr_t *)chunk->skb->data;
  2337. /* If Cumulative TSN Ack beyond the max tsn currently
  2338. * send, terminating the association and respond to the
  2339. * sender with an ABORT.
  2340. */
  2341. if (!TSN_lt(ntohl(sdh->cum_tsn_ack), asoc->next_tsn))
  2342. return sctp_sf_violation_ctsn(ep, asoc, type, arg, commands);
  2343. /* verify, by checking the Cumulative TSN Ack field of the
  2344. * chunk, that all its outstanding DATA chunks have been
  2345. * received by the SHUTDOWN sender.
  2346. */
  2347. sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_CTSN,
  2348. SCTP_BE32(sdh->cum_tsn_ack));
  2349. return SCTP_DISPOSITION_CONSUME;
  2350. }
  2351. /* RFC 2960 9.2
  2352. * If an endpoint is in SHUTDOWN-ACK-SENT state and receives an INIT chunk
  2353. * (e.g., if the SHUTDOWN COMPLETE was lost) with source and destination
  2354. * transport addresses (either in the IP addresses or in the INIT chunk)
  2355. * that belong to this association, it should discard the INIT chunk and
  2356. * retransmit the SHUTDOWN ACK chunk.
  2357. */
  2358. sctp_disposition_t sctp_sf_do_9_2_reshutack(const struct sctp_endpoint *ep,
  2359. const struct sctp_association *asoc,
  2360. const sctp_subtype_t type,
  2361. void *arg,
  2362. sctp_cmd_seq_t *commands)
  2363. {
  2364. struct sctp_chunk *chunk = (struct sctp_chunk *) arg;
  2365. struct sctp_chunk *reply;
  2366. /* Make sure that the chunk has a valid length */
  2367. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
  2368. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  2369. commands);
  2370. /* Since we are not going to really process this INIT, there
  2371. * is no point in verifying chunk boundries. Just generate
  2372. * the SHUTDOWN ACK.
  2373. */
  2374. reply = sctp_make_shutdown_ack(asoc, chunk);
  2375. if (NULL == reply)
  2376. goto nomem;
  2377. /* Set the transport for the SHUTDOWN ACK chunk and the timeout for
  2378. * the T2-SHUTDOWN timer.
  2379. */
  2380. sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
  2381. /* and restart the T2-shutdown timer. */
  2382. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
  2383. SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
  2384. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
  2385. return SCTP_DISPOSITION_CONSUME;
  2386. nomem:
  2387. return SCTP_DISPOSITION_NOMEM;
  2388. }
  2389. /*
  2390. * sctp_sf_do_ecn_cwr
  2391. *
  2392. * Section: Appendix A: Explicit Congestion Notification
  2393. *
  2394. * CWR:
  2395. *
  2396. * RFC 2481 details a specific bit for a sender to send in the header of
  2397. * its next outbound TCP segment to indicate to its peer that it has
  2398. * reduced its congestion window. This is termed the CWR bit. For
  2399. * SCTP the same indication is made by including the CWR chunk.
  2400. * This chunk contains one data element, i.e. the TSN number that
  2401. * was sent in the ECNE chunk. This element represents the lowest
  2402. * TSN number in the datagram that was originally marked with the
  2403. * CE bit.
  2404. *
  2405. * Verification Tag: 8.5 Verification Tag [Normal verification]
  2406. * Inputs
  2407. * (endpoint, asoc, chunk)
  2408. *
  2409. * Outputs
  2410. * (asoc, reply_msg, msg_up, timers, counters)
  2411. *
  2412. * The return value is the disposition of the chunk.
  2413. */
  2414. sctp_disposition_t sctp_sf_do_ecn_cwr(const struct sctp_endpoint *ep,
  2415. const struct sctp_association *asoc,
  2416. const sctp_subtype_t type,
  2417. void *arg,
  2418. sctp_cmd_seq_t *commands)
  2419. {
  2420. sctp_cwrhdr_t *cwr;
  2421. struct sctp_chunk *chunk = arg;
  2422. u32 lowest_tsn;
  2423. if (!sctp_vtag_verify(chunk, asoc))
  2424. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2425. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_ecne_chunk_t)))
  2426. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  2427. commands);
  2428. cwr = (sctp_cwrhdr_t *) chunk->skb->data;
  2429. skb_pull(chunk->skb, sizeof(sctp_cwrhdr_t));
  2430. lowest_tsn = ntohl(cwr->lowest_tsn);
  2431. /* Does this CWR ack the last sent congestion notification? */
  2432. if (TSN_lte(asoc->last_ecne_tsn, lowest_tsn)) {
  2433. /* Stop sending ECNE. */
  2434. sctp_add_cmd_sf(commands,
  2435. SCTP_CMD_ECN_CWR,
  2436. SCTP_U32(lowest_tsn));
  2437. }
  2438. return SCTP_DISPOSITION_CONSUME;
  2439. }
  2440. /*
  2441. * sctp_sf_do_ecne
  2442. *
  2443. * Section: Appendix A: Explicit Congestion Notification
  2444. *
  2445. * ECN-Echo
  2446. *
  2447. * RFC 2481 details a specific bit for a receiver to send back in its
  2448. * TCP acknowledgements to notify the sender of the Congestion
  2449. * Experienced (CE) bit having arrived from the network. For SCTP this
  2450. * same indication is made by including the ECNE chunk. This chunk
  2451. * contains one data element, i.e. the lowest TSN associated with the IP
  2452. * datagram marked with the CE bit.....
  2453. *
  2454. * Verification Tag: 8.5 Verification Tag [Normal verification]
  2455. * Inputs
  2456. * (endpoint, asoc, chunk)
  2457. *
  2458. * Outputs
  2459. * (asoc, reply_msg, msg_up, timers, counters)
  2460. *
  2461. * The return value is the disposition of the chunk.
  2462. */
  2463. sctp_disposition_t sctp_sf_do_ecne(const struct sctp_endpoint *ep,
  2464. const struct sctp_association *asoc,
  2465. const sctp_subtype_t type,
  2466. void *arg,
  2467. sctp_cmd_seq_t *commands)
  2468. {
  2469. sctp_ecnehdr_t *ecne;
  2470. struct sctp_chunk *chunk = arg;
  2471. if (!sctp_vtag_verify(chunk, asoc))
  2472. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2473. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_ecne_chunk_t)))
  2474. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  2475. commands);
  2476. ecne = (sctp_ecnehdr_t *) chunk->skb->data;
  2477. skb_pull(chunk->skb, sizeof(sctp_ecnehdr_t));
  2478. /* If this is a newer ECNE than the last CWR packet we sent out */
  2479. sctp_add_cmd_sf(commands, SCTP_CMD_ECN_ECNE,
  2480. SCTP_U32(ntohl(ecne->lowest_tsn)));
  2481. return SCTP_DISPOSITION_CONSUME;
  2482. }
  2483. /*
  2484. * Section: 6.2 Acknowledgement on Reception of DATA Chunks
  2485. *
  2486. * The SCTP endpoint MUST always acknowledge the reception of each valid
  2487. * DATA chunk.
  2488. *
  2489. * The guidelines on delayed acknowledgement algorithm specified in
  2490. * Section 4.2 of [RFC2581] SHOULD be followed. Specifically, an
  2491. * acknowledgement SHOULD be generated for at least every second packet
  2492. * (not every second DATA chunk) received, and SHOULD be generated within
  2493. * 200 ms of the arrival of any unacknowledged DATA chunk. In some
  2494. * situations it may be beneficial for an SCTP transmitter to be more
  2495. * conservative than the algorithms detailed in this document allow.
  2496. * However, an SCTP transmitter MUST NOT be more aggressive than the
  2497. * following algorithms allow.
  2498. *
  2499. * A SCTP receiver MUST NOT generate more than one SACK for every
  2500. * incoming packet, other than to update the offered window as the
  2501. * receiving application consumes new data.
  2502. *
  2503. * Verification Tag: 8.5 Verification Tag [Normal verification]
  2504. *
  2505. * Inputs
  2506. * (endpoint, asoc, chunk)
  2507. *
  2508. * Outputs
  2509. * (asoc, reply_msg, msg_up, timers, counters)
  2510. *
  2511. * The return value is the disposition of the chunk.
  2512. */
  2513. sctp_disposition_t sctp_sf_eat_data_6_2(const struct sctp_endpoint *ep,
  2514. const struct sctp_association *asoc,
  2515. const sctp_subtype_t type,
  2516. void *arg,
  2517. sctp_cmd_seq_t *commands)
  2518. {
  2519. struct sctp_chunk *chunk = arg;
  2520. int error;
  2521. if (!sctp_vtag_verify(chunk, asoc)) {
  2522. sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
  2523. SCTP_NULL());
  2524. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2525. }
  2526. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_data_chunk_t)))
  2527. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  2528. commands);
  2529. error = sctp_eat_data(asoc, chunk, commands );
  2530. switch (error) {
  2531. case SCTP_IERROR_NO_ERROR:
  2532. break;
  2533. case SCTP_IERROR_HIGH_TSN:
  2534. case SCTP_IERROR_BAD_STREAM:
  2535. SCTP_INC_STATS(SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
  2536. goto discard_noforce;
  2537. case SCTP_IERROR_DUP_TSN:
  2538. case SCTP_IERROR_IGNORE_TSN:
  2539. SCTP_INC_STATS(SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
  2540. goto discard_force;
  2541. case SCTP_IERROR_NO_DATA:
  2542. goto consume;
  2543. default:
  2544. BUG();
  2545. }
  2546. if (asoc->autoclose) {
  2547. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
  2548. SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
  2549. }
  2550. /* If this is the last chunk in a packet, we need to count it
  2551. * toward sack generation. Note that we need to SACK every
  2552. * OTHER packet containing data chunks, EVEN IF WE DISCARD
  2553. * THEM. We elect to NOT generate SACK's if the chunk fails
  2554. * the verification tag test.
  2555. *
  2556. * RFC 2960 6.2 Acknowledgement on Reception of DATA Chunks
  2557. *
  2558. * The SCTP endpoint MUST always acknowledge the reception of
  2559. * each valid DATA chunk.
  2560. *
  2561. * The guidelines on delayed acknowledgement algorithm
  2562. * specified in Section 4.2 of [RFC2581] SHOULD be followed.
  2563. * Specifically, an acknowledgement SHOULD be generated for at
  2564. * least every second packet (not every second DATA chunk)
  2565. * received, and SHOULD be generated within 200 ms of the
  2566. * arrival of any unacknowledged DATA chunk. In some
  2567. * situations it may be beneficial for an SCTP transmitter to
  2568. * be more conservative than the algorithms detailed in this
  2569. * document allow. However, an SCTP transmitter MUST NOT be
  2570. * more aggressive than the following algorithms allow.
  2571. */
  2572. if (chunk->end_of_packet)
  2573. sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_NOFORCE());
  2574. return SCTP_DISPOSITION_CONSUME;
  2575. discard_force:
  2576. /* RFC 2960 6.2 Acknowledgement on Reception of DATA Chunks
  2577. *
  2578. * When a packet arrives with duplicate DATA chunk(s) and with
  2579. * no new DATA chunk(s), the endpoint MUST immediately send a
  2580. * SACK with no delay. If a packet arrives with duplicate
  2581. * DATA chunk(s) bundled with new DATA chunks, the endpoint
  2582. * MAY immediately send a SACK. Normally receipt of duplicate
  2583. * DATA chunks will occur when the original SACK chunk was lost
  2584. * and the peer's RTO has expired. The duplicate TSN number(s)
  2585. * SHOULD be reported in the SACK as duplicate.
  2586. */
  2587. /* In our case, we split the MAY SACK advice up whether or not
  2588. * the last chunk is a duplicate.'
  2589. */
  2590. if (chunk->end_of_packet)
  2591. sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
  2592. return SCTP_DISPOSITION_DISCARD;
  2593. discard_noforce:
  2594. if (chunk->end_of_packet)
  2595. sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_NOFORCE());
  2596. return SCTP_DISPOSITION_DISCARD;
  2597. consume:
  2598. return SCTP_DISPOSITION_CONSUME;
  2599. }
  2600. /*
  2601. * sctp_sf_eat_data_fast_4_4
  2602. *
  2603. * Section: 4 (4)
  2604. * (4) In SHUTDOWN-SENT state the endpoint MUST acknowledge any received
  2605. * DATA chunks without delay.
  2606. *
  2607. * Verification Tag: 8.5 Verification Tag [Normal verification]
  2608. * Inputs
  2609. * (endpoint, asoc, chunk)
  2610. *
  2611. * Outputs
  2612. * (asoc, reply_msg, msg_up, timers, counters)
  2613. *
  2614. * The return value is the disposition of the chunk.
  2615. */
  2616. sctp_disposition_t sctp_sf_eat_data_fast_4_4(const struct sctp_endpoint *ep,
  2617. const struct sctp_association *asoc,
  2618. const sctp_subtype_t type,
  2619. void *arg,
  2620. sctp_cmd_seq_t *commands)
  2621. {
  2622. struct sctp_chunk *chunk = arg;
  2623. int error;
  2624. if (!sctp_vtag_verify(chunk, asoc)) {
  2625. sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
  2626. SCTP_NULL());
  2627. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2628. }
  2629. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_data_chunk_t)))
  2630. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  2631. commands);
  2632. error = sctp_eat_data(asoc, chunk, commands );
  2633. switch (error) {
  2634. case SCTP_IERROR_NO_ERROR:
  2635. case SCTP_IERROR_HIGH_TSN:
  2636. case SCTP_IERROR_DUP_TSN:
  2637. case SCTP_IERROR_IGNORE_TSN:
  2638. case SCTP_IERROR_BAD_STREAM:
  2639. break;
  2640. case SCTP_IERROR_NO_DATA:
  2641. goto consume;
  2642. default:
  2643. BUG();
  2644. }
  2645. /* Go a head and force a SACK, since we are shutting down. */
  2646. /* Implementor's Guide.
  2647. *
  2648. * While in SHUTDOWN-SENT state, the SHUTDOWN sender MUST immediately
  2649. * respond to each received packet containing one or more DATA chunk(s)
  2650. * with a SACK, a SHUTDOWN chunk, and restart the T2-shutdown timer
  2651. */
  2652. if (chunk->end_of_packet) {
  2653. /* We must delay the chunk creation since the cumulative
  2654. * TSN has not been updated yet.
  2655. */
  2656. sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SHUTDOWN, SCTP_NULL());
  2657. sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
  2658. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
  2659. SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
  2660. }
  2661. consume:
  2662. return SCTP_DISPOSITION_CONSUME;
  2663. }
  2664. /*
  2665. * Section: 6.2 Processing a Received SACK
  2666. * D) Any time a SACK arrives, the endpoint performs the following:
  2667. *
  2668. * i) If Cumulative TSN Ack is less than the Cumulative TSN Ack Point,
  2669. * then drop the SACK. Since Cumulative TSN Ack is monotonically
  2670. * increasing, a SACK whose Cumulative TSN Ack is less than the
  2671. * Cumulative TSN Ack Point indicates an out-of-order SACK.
  2672. *
  2673. * ii) Set rwnd equal to the newly received a_rwnd minus the number
  2674. * of bytes still outstanding after processing the Cumulative TSN Ack
  2675. * and the Gap Ack Blocks.
  2676. *
  2677. * iii) If the SACK is missing a TSN that was previously
  2678. * acknowledged via a Gap Ack Block (e.g., the data receiver
  2679. * reneged on the data), then mark the corresponding DATA chunk
  2680. * as available for retransmit: Mark it as missing for fast
  2681. * retransmit as described in Section 7.2.4 and if no retransmit
  2682. * timer is running for the destination address to which the DATA
  2683. * chunk was originally transmitted, then T3-rtx is started for
  2684. * that destination address.
  2685. *
  2686. * Verification Tag: 8.5 Verification Tag [Normal verification]
  2687. *
  2688. * Inputs
  2689. * (endpoint, asoc, chunk)
  2690. *
  2691. * Outputs
  2692. * (asoc, reply_msg, msg_up, timers, counters)
  2693. *
  2694. * The return value is the disposition of the chunk.
  2695. */
  2696. sctp_disposition_t sctp_sf_eat_sack_6_2(const struct sctp_endpoint *ep,
  2697. const struct sctp_association *asoc,
  2698. const sctp_subtype_t type,
  2699. void *arg,
  2700. sctp_cmd_seq_t *commands)
  2701. {
  2702. struct sctp_chunk *chunk = arg;
  2703. sctp_sackhdr_t *sackh;
  2704. __u32 ctsn;
  2705. if (!sctp_vtag_verify(chunk, asoc))
  2706. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2707. /* Make sure that the SACK chunk has a valid length. */
  2708. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_sack_chunk_t)))
  2709. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  2710. commands);
  2711. /* Pull the SACK chunk from the data buffer */
  2712. sackh = sctp_sm_pull_sack(chunk);
  2713. /* Was this a bogus SACK? */
  2714. if (!sackh)
  2715. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2716. chunk->subh.sack_hdr = sackh;
  2717. ctsn = ntohl(sackh->cum_tsn_ack);
  2718. /* i) If Cumulative TSN Ack is less than the Cumulative TSN
  2719. * Ack Point, then drop the SACK. Since Cumulative TSN
  2720. * Ack is monotonically increasing, a SACK whose
  2721. * Cumulative TSN Ack is less than the Cumulative TSN Ack
  2722. * Point indicates an out-of-order SACK.
  2723. */
  2724. if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
  2725. SCTP_DEBUG_PRINTK("ctsn %x\n", ctsn);
  2726. SCTP_DEBUG_PRINTK("ctsn_ack_point %x\n", asoc->ctsn_ack_point);
  2727. return SCTP_DISPOSITION_DISCARD;
  2728. }
  2729. /* If Cumulative TSN Ack beyond the max tsn currently
  2730. * send, terminating the association and respond to the
  2731. * sender with an ABORT.
  2732. */
  2733. if (!TSN_lt(ctsn, asoc->next_tsn))
  2734. return sctp_sf_violation_ctsn(ep, asoc, type, arg, commands);
  2735. /* Return this SACK for further processing. */
  2736. sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_SACK, SCTP_SACKH(sackh));
  2737. /* Note: We do the rest of the work on the PROCESS_SACK
  2738. * sideeffect.
  2739. */
  2740. return SCTP_DISPOSITION_CONSUME;
  2741. }
  2742. /*
  2743. * Generate an ABORT in response to a packet.
  2744. *
  2745. * Section: 8.4 Handle "Out of the blue" Packets, sctpimpguide 2.41
  2746. *
  2747. * 8) The receiver should respond to the sender of the OOTB packet with
  2748. * an ABORT. When sending the ABORT, the receiver of the OOTB packet
  2749. * MUST fill in the Verification Tag field of the outbound packet
  2750. * with the value found in the Verification Tag field of the OOTB
  2751. * packet and set the T-bit in the Chunk Flags to indicate that the
  2752. * Verification Tag is reflected. After sending this ABORT, the
  2753. * receiver of the OOTB packet shall discard the OOTB packet and take
  2754. * no further action.
  2755. *
  2756. * Verification Tag:
  2757. *
  2758. * The return value is the disposition of the chunk.
  2759. */
  2760. static sctp_disposition_t sctp_sf_tabort_8_4_8(const struct sctp_endpoint *ep,
  2761. const struct sctp_association *asoc,
  2762. const sctp_subtype_t type,
  2763. void *arg,
  2764. sctp_cmd_seq_t *commands)
  2765. {
  2766. struct sctp_packet *packet = NULL;
  2767. struct sctp_chunk *chunk = arg;
  2768. struct sctp_chunk *abort;
  2769. packet = sctp_ootb_pkt_new(asoc, chunk);
  2770. if (packet) {
  2771. /* Make an ABORT. The T bit will be set if the asoc
  2772. * is NULL.
  2773. */
  2774. abort = sctp_make_abort(asoc, chunk, 0);
  2775. if (!abort) {
  2776. sctp_ootb_pkt_free(packet);
  2777. return SCTP_DISPOSITION_NOMEM;
  2778. }
  2779. /* Reflect vtag if T-Bit is set */
  2780. if (sctp_test_T_bit(abort))
  2781. packet->vtag = ntohl(chunk->sctp_hdr->vtag);
  2782. /* Set the skb to the belonging sock for accounting. */
  2783. abort->skb->sk = ep->base.sk;
  2784. sctp_packet_append_chunk(packet, abort);
  2785. sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
  2786. SCTP_PACKET(packet));
  2787. SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
  2788. sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2789. return SCTP_DISPOSITION_CONSUME;
  2790. }
  2791. return SCTP_DISPOSITION_NOMEM;
  2792. }
  2793. /*
  2794. * Received an ERROR chunk from peer. Generate SCTP_REMOTE_ERROR
  2795. * event as ULP notification for each cause included in the chunk.
  2796. *
  2797. * API 5.3.1.3 - SCTP_REMOTE_ERROR
  2798. *
  2799. * The return value is the disposition of the chunk.
  2800. */
  2801. sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep,
  2802. const struct sctp_association *asoc,
  2803. const sctp_subtype_t type,
  2804. void *arg,
  2805. sctp_cmd_seq_t *commands)
  2806. {
  2807. struct sctp_chunk *chunk = arg;
  2808. struct sctp_ulpevent *ev;
  2809. if (!sctp_vtag_verify(chunk, asoc))
  2810. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2811. /* Make sure that the ERROR chunk has a valid length. */
  2812. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_operr_chunk_t)))
  2813. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  2814. commands);
  2815. while (chunk->chunk_end > chunk->skb->data) {
  2816. ev = sctp_ulpevent_make_remote_error(asoc, chunk, 0,
  2817. GFP_ATOMIC);
  2818. if (!ev)
  2819. goto nomem;
  2820. sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
  2821. SCTP_ULPEVENT(ev));
  2822. sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,
  2823. SCTP_CHUNK(chunk));
  2824. }
  2825. return SCTP_DISPOSITION_CONSUME;
  2826. nomem:
  2827. return SCTP_DISPOSITION_NOMEM;
  2828. }
  2829. /*
  2830. * Process an inbound SHUTDOWN ACK.
  2831. *
  2832. * From Section 9.2:
  2833. * Upon the receipt of the SHUTDOWN ACK, the SHUTDOWN sender shall
  2834. * stop the T2-shutdown timer, send a SHUTDOWN COMPLETE chunk to its
  2835. * peer, and remove all record of the association.
  2836. *
  2837. * The return value is the disposition.
  2838. */
  2839. sctp_disposition_t sctp_sf_do_9_2_final(const struct sctp_endpoint *ep,
  2840. const struct sctp_association *asoc,
  2841. const sctp_subtype_t type,
  2842. void *arg,
  2843. sctp_cmd_seq_t *commands)
  2844. {
  2845. struct sctp_chunk *chunk = arg;
  2846. struct sctp_chunk *reply;
  2847. struct sctp_ulpevent *ev;
  2848. if (!sctp_vtag_verify(chunk, asoc))
  2849. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2850. /* Make sure that the SHUTDOWN_ACK chunk has a valid length. */
  2851. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
  2852. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  2853. commands);
  2854. /* 10.2 H) SHUTDOWN COMPLETE notification
  2855. *
  2856. * When SCTP completes the shutdown procedures (section 9.2) this
  2857. * notification is passed to the upper layer.
  2858. */
  2859. ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_SHUTDOWN_COMP,
  2860. 0, 0, 0, NULL, GFP_ATOMIC);
  2861. if (!ev)
  2862. goto nomem;
  2863. /* ...send a SHUTDOWN COMPLETE chunk to its peer, */
  2864. reply = sctp_make_shutdown_complete(asoc, chunk);
  2865. if (!reply)
  2866. goto nomem_chunk;
  2867. /* Do all the commands now (after allocation), so that we
  2868. * have consistent state if memory allocation failes
  2869. */
  2870. sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
  2871. /* Upon the receipt of the SHUTDOWN ACK, the SHUTDOWN sender shall
  2872. * stop the T2-shutdown timer,
  2873. */
  2874. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  2875. SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
  2876. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  2877. SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
  2878. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  2879. SCTP_STATE(SCTP_STATE_CLOSED));
  2880. SCTP_INC_STATS(SCTP_MIB_SHUTDOWNS);
  2881. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  2882. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
  2883. /* ...and remove all record of the association. */
  2884. sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
  2885. return SCTP_DISPOSITION_DELETE_TCB;
  2886. nomem_chunk:
  2887. sctp_ulpevent_free(ev);
  2888. nomem:
  2889. return SCTP_DISPOSITION_NOMEM;
  2890. }
  2891. /*
  2892. * RFC 2960, 8.4 - Handle "Out of the blue" Packets, sctpimpguide 2.41.
  2893. *
  2894. * 5) If the packet contains a SHUTDOWN ACK chunk, the receiver should
  2895. * respond to the sender of the OOTB packet with a SHUTDOWN COMPLETE.
  2896. * When sending the SHUTDOWN COMPLETE, the receiver of the OOTB
  2897. * packet must fill in the Verification Tag field of the outbound
  2898. * packet with the Verification Tag received in the SHUTDOWN ACK and
  2899. * set the T-bit in the Chunk Flags to indicate that the Verification
  2900. * Tag is reflected.
  2901. *
  2902. * 8) The receiver should respond to the sender of the OOTB packet with
  2903. * an ABORT. When sending the ABORT, the receiver of the OOTB packet
  2904. * MUST fill in the Verification Tag field of the outbound packet
  2905. * with the value found in the Verification Tag field of the OOTB
  2906. * packet and set the T-bit in the Chunk Flags to indicate that the
  2907. * Verification Tag is reflected. After sending this ABORT, the
  2908. * receiver of the OOTB packet shall discard the OOTB packet and take
  2909. * no further action.
  2910. */
  2911. sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep,
  2912. const struct sctp_association *asoc,
  2913. const sctp_subtype_t type,
  2914. void *arg,
  2915. sctp_cmd_seq_t *commands)
  2916. {
  2917. struct sctp_chunk *chunk = arg;
  2918. struct sk_buff *skb = chunk->skb;
  2919. sctp_chunkhdr_t *ch;
  2920. __u8 *ch_end;
  2921. int ootb_shut_ack = 0;
  2922. SCTP_INC_STATS(SCTP_MIB_OUTOFBLUES);
  2923. ch = (sctp_chunkhdr_t *) chunk->chunk_hdr;
  2924. do {
  2925. /* Report violation if the chunk is less then minimal */
  2926. if (ntohs(ch->length) < sizeof(sctp_chunkhdr_t))
  2927. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  2928. commands);
  2929. /* Now that we know we at least have a chunk header,
  2930. * do things that are type appropriate.
  2931. */
  2932. if (SCTP_CID_SHUTDOWN_ACK == ch->type)
  2933. ootb_shut_ack = 1;
  2934. /* RFC 2960, Section 3.3.7
  2935. * Moreover, under any circumstances, an endpoint that
  2936. * receives an ABORT MUST NOT respond to that ABORT by
  2937. * sending an ABORT of its own.
  2938. */
  2939. if (SCTP_CID_ABORT == ch->type)
  2940. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  2941. /* Report violation if chunk len overflows */
  2942. ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length));
  2943. if (ch_end > skb_tail_pointer(skb))
  2944. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  2945. commands);
  2946. ch = (sctp_chunkhdr_t *) ch_end;
  2947. } while (ch_end < skb_tail_pointer(skb));
  2948. if (ootb_shut_ack)
  2949. return sctp_sf_shut_8_4_5(ep, asoc, type, arg, commands);
  2950. else
  2951. return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
  2952. }
  2953. /*
  2954. * Handle an "Out of the blue" SHUTDOWN ACK.
  2955. *
  2956. * Section: 8.4 5, sctpimpguide 2.41.
  2957. *
  2958. * 5) If the packet contains a SHUTDOWN ACK chunk, the receiver should
  2959. * respond to the sender of the OOTB packet with a SHUTDOWN COMPLETE.
  2960. * When sending the SHUTDOWN COMPLETE, the receiver of the OOTB
  2961. * packet must fill in the Verification Tag field of the outbound
  2962. * packet with the Verification Tag received in the SHUTDOWN ACK and
  2963. * set the T-bit in the Chunk Flags to indicate that the Verification
  2964. * Tag is reflected.
  2965. *
  2966. * Inputs
  2967. * (endpoint, asoc, type, arg, commands)
  2968. *
  2969. * Outputs
  2970. * (sctp_disposition_t)
  2971. *
  2972. * The return value is the disposition of the chunk.
  2973. */
  2974. static sctp_disposition_t sctp_sf_shut_8_4_5(const struct sctp_endpoint *ep,
  2975. const struct sctp_association *asoc,
  2976. const sctp_subtype_t type,
  2977. void *arg,
  2978. sctp_cmd_seq_t *commands)
  2979. {
  2980. struct sctp_packet *packet = NULL;
  2981. struct sctp_chunk *chunk = arg;
  2982. struct sctp_chunk *shut;
  2983. packet = sctp_ootb_pkt_new(asoc, chunk);
  2984. if (packet) {
  2985. /* Make an SHUTDOWN_COMPLETE.
  2986. * The T bit will be set if the asoc is NULL.
  2987. */
  2988. shut = sctp_make_shutdown_complete(asoc, chunk);
  2989. if (!shut) {
  2990. sctp_ootb_pkt_free(packet);
  2991. return SCTP_DISPOSITION_NOMEM;
  2992. }
  2993. /* Reflect vtag if T-Bit is set */
  2994. if (sctp_test_T_bit(shut))
  2995. packet->vtag = ntohl(chunk->sctp_hdr->vtag);
  2996. /* Set the skb to the belonging sock for accounting. */
  2997. shut->skb->sk = ep->base.sk;
  2998. sctp_packet_append_chunk(packet, shut);
  2999. sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
  3000. SCTP_PACKET(packet));
  3001. SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
  3002. /* If the chunk length is invalid, we don't want to process
  3003. * the reset of the packet.
  3004. */
  3005. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
  3006. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  3007. /* We need to discard the rest of the packet to prevent
  3008. * potential bomming attacks from additional bundled chunks.
  3009. * This is documented in SCTP Threats ID.
  3010. */
  3011. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  3012. }
  3013. return SCTP_DISPOSITION_NOMEM;
  3014. }
  3015. /*
  3016. * Handle SHUTDOWN ACK in COOKIE_ECHOED or COOKIE_WAIT state.
  3017. *
  3018. * Verification Tag: 8.5.1 E) Rules for packet carrying a SHUTDOWN ACK
  3019. * If the receiver is in COOKIE-ECHOED or COOKIE-WAIT state the
  3020. * procedures in section 8.4 SHOULD be followed, in other words it
  3021. * should be treated as an Out Of The Blue packet.
  3022. * [This means that we do NOT check the Verification Tag on these
  3023. * chunks. --piggy ]
  3024. *
  3025. */
  3026. sctp_disposition_t sctp_sf_do_8_5_1_E_sa(const struct sctp_endpoint *ep,
  3027. const struct sctp_association *asoc,
  3028. const sctp_subtype_t type,
  3029. void *arg,
  3030. sctp_cmd_seq_t *commands)
  3031. {
  3032. struct sctp_chunk *chunk = arg;
  3033. /* Make sure that the SHUTDOWN_ACK chunk has a valid length. */
  3034. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
  3035. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  3036. commands);
  3037. /* Although we do have an association in this case, it corresponds
  3038. * to a restarted association. So the packet is treated as an OOTB
  3039. * packet and the state function that handles OOTB SHUTDOWN_ACK is
  3040. * called with a NULL association.
  3041. */
  3042. SCTP_INC_STATS(SCTP_MIB_OUTOFBLUES);
  3043. return sctp_sf_shut_8_4_5(ep, NULL, type, arg, commands);
  3044. }
  3045. /* ADDIP Section 4.2 Upon reception of an ASCONF Chunk. */
  3046. sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep,
  3047. const struct sctp_association *asoc,
  3048. const sctp_subtype_t type, void *arg,
  3049. sctp_cmd_seq_t *commands)
  3050. {
  3051. struct sctp_chunk *chunk = arg;
  3052. struct sctp_chunk *asconf_ack = NULL;
  3053. struct sctp_paramhdr *err_param = NULL;
  3054. sctp_addiphdr_t *hdr;
  3055. union sctp_addr_param *addr_param;
  3056. __u32 serial;
  3057. int length;
  3058. if (!sctp_vtag_verify(chunk, asoc)) {
  3059. sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
  3060. SCTP_NULL());
  3061. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  3062. }
  3063. /* ADD-IP: Section 4.1.1
  3064. * This chunk MUST be sent in an authenticated way by using
  3065. * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk
  3066. * is received unauthenticated it MUST be silently discarded as
  3067. * described in [I-D.ietf-tsvwg-sctp-auth].
  3068. */
  3069. if (!sctp_addip_noauth && !chunk->auth)
  3070. return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
  3071. /* Make sure that the ASCONF ADDIP chunk has a valid length. */
  3072. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_addip_chunk_t)))
  3073. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  3074. commands);
  3075. hdr = (sctp_addiphdr_t *)chunk->skb->data;
  3076. serial = ntohl(hdr->serial);
  3077. addr_param = (union sctp_addr_param *)hdr->params;
  3078. length = ntohs(addr_param->p.length);
  3079. if (length < sizeof(sctp_paramhdr_t))
  3080. return sctp_sf_violation_paramlen(ep, asoc, type, arg,
  3081. (void *)addr_param, commands);
  3082. /* Verify the ASCONF chunk before processing it. */
  3083. if (!sctp_verify_asconf(asoc,
  3084. (sctp_paramhdr_t *)((void *)addr_param + length),
  3085. (void *)chunk->chunk_end,
  3086. &err_param))
  3087. return sctp_sf_violation_paramlen(ep, asoc, type, arg,
  3088. (void *)err_param, commands);
  3089. /* ADDIP 5.2 E1) Compare the value of the serial number to the value
  3090. * the endpoint stored in a new association variable
  3091. * 'Peer-Serial-Number'.
  3092. */
  3093. if (serial == asoc->peer.addip_serial + 1) {
  3094. /* If this is the first instance of ASCONF in the packet,
  3095. * we can clean our old ASCONF-ACKs.
  3096. */
  3097. if (!chunk->has_asconf)
  3098. sctp_assoc_clean_asconf_ack_cache(asoc);
  3099. /* ADDIP 5.2 E4) When the Sequence Number matches the next one
  3100. * expected, process the ASCONF as described below and after
  3101. * processing the ASCONF Chunk, append an ASCONF-ACK Chunk to
  3102. * the response packet and cache a copy of it (in the event it
  3103. * later needs to be retransmitted).
  3104. *
  3105. * Essentially, do V1-V5.
  3106. */
  3107. asconf_ack = sctp_process_asconf((struct sctp_association *)
  3108. asoc, chunk);
  3109. if (!asconf_ack)
  3110. return SCTP_DISPOSITION_NOMEM;
  3111. } else if (serial < asoc->peer.addip_serial + 1) {
  3112. /* ADDIP 5.2 E2)
  3113. * If the value found in the Sequence Number is less than the
  3114. * ('Peer- Sequence-Number' + 1), simply skip to the next
  3115. * ASCONF, and include in the outbound response packet
  3116. * any previously cached ASCONF-ACK response that was
  3117. * sent and saved that matches the Sequence Number of the
  3118. * ASCONF. Note: It is possible that no cached ASCONF-ACK
  3119. * Chunk exists. This will occur when an older ASCONF
  3120. * arrives out of order. In such a case, the receiver
  3121. * should skip the ASCONF Chunk and not include ASCONF-ACK
  3122. * Chunk for that chunk.
  3123. */
  3124. asconf_ack = sctp_assoc_lookup_asconf_ack(asoc, hdr->serial);
  3125. if (!asconf_ack)
  3126. return SCTP_DISPOSITION_DISCARD;
  3127. } else {
  3128. /* ADDIP 5.2 E5) Otherwise, the ASCONF Chunk is discarded since
  3129. * it must be either a stale packet or from an attacker.
  3130. */
  3131. return SCTP_DISPOSITION_DISCARD;
  3132. }
  3133. /* ADDIP 5.2 E6) The destination address of the SCTP packet
  3134. * containing the ASCONF-ACK Chunks MUST be the source address of
  3135. * the SCTP packet that held the ASCONF Chunks.
  3136. *
  3137. * To do this properly, we'll set the destination address of the chunk
  3138. * and at the transmit time, will try look up the transport to use.
  3139. * Since ASCONFs may be bundled, the correct transport may not be
  3140. * created untill we process the entire packet, thus this workaround.
  3141. */
  3142. asconf_ack->dest = chunk->source;
  3143. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(asconf_ack));
  3144. return SCTP_DISPOSITION_CONSUME;
  3145. }
  3146. /*
  3147. * ADDIP Section 4.3 General rules for address manipulation
  3148. * When building TLV parameters for the ASCONF Chunk that will add or
  3149. * delete IP addresses the D0 to D13 rules should be applied:
  3150. */
  3151. sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
  3152. const struct sctp_association *asoc,
  3153. const sctp_subtype_t type, void *arg,
  3154. sctp_cmd_seq_t *commands)
  3155. {
  3156. struct sctp_chunk *asconf_ack = arg;
  3157. struct sctp_chunk *last_asconf = asoc->addip_last_asconf;
  3158. struct sctp_chunk *abort;
  3159. struct sctp_paramhdr *err_param = NULL;
  3160. sctp_addiphdr_t *addip_hdr;
  3161. __u32 sent_serial, rcvd_serial;
  3162. if (!sctp_vtag_verify(asconf_ack, asoc)) {
  3163. sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
  3164. SCTP_NULL());
  3165. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  3166. }
  3167. /* ADD-IP, Section 4.1.2:
  3168. * This chunk MUST be sent in an authenticated way by using
  3169. * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk
  3170. * is received unauthenticated it MUST be silently discarded as
  3171. * described in [I-D.ietf-tsvwg-sctp-auth].
  3172. */
  3173. if (!sctp_addip_noauth && !asconf_ack->auth)
  3174. return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
  3175. /* Make sure that the ADDIP chunk has a valid length. */
  3176. if (!sctp_chunk_length_valid(asconf_ack, sizeof(sctp_addip_chunk_t)))
  3177. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  3178. commands);
  3179. addip_hdr = (sctp_addiphdr_t *)asconf_ack->skb->data;
  3180. rcvd_serial = ntohl(addip_hdr->serial);
  3181. /* Verify the ASCONF-ACK chunk before processing it. */
  3182. if (!sctp_verify_asconf(asoc,
  3183. (sctp_paramhdr_t *)addip_hdr->params,
  3184. (void *)asconf_ack->chunk_end,
  3185. &err_param))
  3186. return sctp_sf_violation_paramlen(ep, asoc, type, arg,
  3187. (void *)err_param, commands);
  3188. if (last_asconf) {
  3189. addip_hdr = (sctp_addiphdr_t *)last_asconf->subh.addip_hdr;
  3190. sent_serial = ntohl(addip_hdr->serial);
  3191. } else {
  3192. sent_serial = asoc->addip_serial - 1;
  3193. }
  3194. /* D0) If an endpoint receives an ASCONF-ACK that is greater than or
  3195. * equal to the next serial number to be used but no ASCONF chunk is
  3196. * outstanding the endpoint MUST ABORT the association. Note that a
  3197. * sequence number is greater than if it is no more than 2^^31-1
  3198. * larger than the current sequence number (using serial arithmetic).
  3199. */
  3200. if (ADDIP_SERIAL_gte(rcvd_serial, sent_serial + 1) &&
  3201. !(asoc->addip_last_asconf)) {
  3202. abort = sctp_make_abort(asoc, asconf_ack,
  3203. sizeof(sctp_errhdr_t));
  3204. if (abort) {
  3205. sctp_init_cause(abort, SCTP_ERROR_ASCONF_ACK, 0);
  3206. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
  3207. SCTP_CHUNK(abort));
  3208. }
  3209. /* We are going to ABORT, so we might as well stop
  3210. * processing the rest of the chunks in the packet.
  3211. */
  3212. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  3213. SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
  3214. sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
  3215. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  3216. SCTP_ERROR(ECONNABORTED));
  3217. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
  3218. SCTP_PERR(SCTP_ERROR_ASCONF_ACK));
  3219. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  3220. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  3221. return SCTP_DISPOSITION_ABORT;
  3222. }
  3223. if ((rcvd_serial == sent_serial) && asoc->addip_last_asconf) {
  3224. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  3225. SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
  3226. if (!sctp_process_asconf_ack((struct sctp_association *)asoc,
  3227. asconf_ack))
  3228. return SCTP_DISPOSITION_CONSUME;
  3229. abort = sctp_make_abort(asoc, asconf_ack,
  3230. sizeof(sctp_errhdr_t));
  3231. if (abort) {
  3232. sctp_init_cause(abort, SCTP_ERROR_RSRC_LOW, 0);
  3233. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
  3234. SCTP_CHUNK(abort));
  3235. }
  3236. /* We are going to ABORT, so we might as well stop
  3237. * processing the rest of the chunks in the packet.
  3238. */
  3239. sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
  3240. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  3241. SCTP_ERROR(ECONNABORTED));
  3242. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
  3243. SCTP_PERR(SCTP_ERROR_ASCONF_ACK));
  3244. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  3245. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  3246. return SCTP_DISPOSITION_ABORT;
  3247. }
  3248. return SCTP_DISPOSITION_DISCARD;
  3249. }
  3250. /*
  3251. * PR-SCTP Section 3.6 Receiver Side Implementation of PR-SCTP
  3252. *
  3253. * When a FORWARD TSN chunk arrives, the data receiver MUST first update
  3254. * its cumulative TSN point to the value carried in the FORWARD TSN
  3255. * chunk, and then MUST further advance its cumulative TSN point locally
  3256. * if possible.
  3257. * After the above processing, the data receiver MUST stop reporting any
  3258. * missing TSNs earlier than or equal to the new cumulative TSN point.
  3259. *
  3260. * Verification Tag: 8.5 Verification Tag [Normal verification]
  3261. *
  3262. * The return value is the disposition of the chunk.
  3263. */
  3264. sctp_disposition_t sctp_sf_eat_fwd_tsn(const struct sctp_endpoint *ep,
  3265. const struct sctp_association *asoc,
  3266. const sctp_subtype_t type,
  3267. void *arg,
  3268. sctp_cmd_seq_t *commands)
  3269. {
  3270. struct sctp_chunk *chunk = arg;
  3271. struct sctp_fwdtsn_hdr *fwdtsn_hdr;
  3272. struct sctp_fwdtsn_skip *skip;
  3273. __u16 len;
  3274. __u32 tsn;
  3275. if (!sctp_vtag_verify(chunk, asoc)) {
  3276. sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
  3277. SCTP_NULL());
  3278. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  3279. }
  3280. /* Make sure that the FORWARD_TSN chunk has valid length. */
  3281. if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_fwdtsn_chunk)))
  3282. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  3283. commands);
  3284. fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data;
  3285. chunk->subh.fwdtsn_hdr = fwdtsn_hdr;
  3286. len = ntohs(chunk->chunk_hdr->length);
  3287. len -= sizeof(struct sctp_chunkhdr);
  3288. skb_pull(chunk->skb, len);
  3289. tsn = ntohl(fwdtsn_hdr->new_cum_tsn);
  3290. SCTP_DEBUG_PRINTK("%s: TSN 0x%x.\n", __func__, tsn);
  3291. /* The TSN is too high--silently discard the chunk and count on it
  3292. * getting retransmitted later.
  3293. */
  3294. if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
  3295. goto discard_noforce;
  3296. /* Silently discard the chunk if stream-id is not valid */
  3297. sctp_walk_fwdtsn(skip, chunk) {
  3298. if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
  3299. goto discard_noforce;
  3300. }
  3301. sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
  3302. if (len > sizeof(struct sctp_fwdtsn_hdr))
  3303. sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
  3304. SCTP_CHUNK(chunk));
  3305. /* Count this as receiving DATA. */
  3306. if (asoc->autoclose) {
  3307. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
  3308. SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
  3309. }
  3310. /* FIXME: For now send a SACK, but DATA processing may
  3311. * send another.
  3312. */
  3313. sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_NOFORCE());
  3314. return SCTP_DISPOSITION_CONSUME;
  3315. discard_noforce:
  3316. return SCTP_DISPOSITION_DISCARD;
  3317. }
  3318. sctp_disposition_t sctp_sf_eat_fwd_tsn_fast(
  3319. const struct sctp_endpoint *ep,
  3320. const struct sctp_association *asoc,
  3321. const sctp_subtype_t type,
  3322. void *arg,
  3323. sctp_cmd_seq_t *commands)
  3324. {
  3325. struct sctp_chunk *chunk = arg;
  3326. struct sctp_fwdtsn_hdr *fwdtsn_hdr;
  3327. struct sctp_fwdtsn_skip *skip;
  3328. __u16 len;
  3329. __u32 tsn;
  3330. if (!sctp_vtag_verify(chunk, asoc)) {
  3331. sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
  3332. SCTP_NULL());
  3333. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  3334. }
  3335. /* Make sure that the FORWARD_TSN chunk has a valid length. */
  3336. if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_fwdtsn_chunk)))
  3337. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  3338. commands);
  3339. fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data;
  3340. chunk->subh.fwdtsn_hdr = fwdtsn_hdr;
  3341. len = ntohs(chunk->chunk_hdr->length);
  3342. len -= sizeof(struct sctp_chunkhdr);
  3343. skb_pull(chunk->skb, len);
  3344. tsn = ntohl(fwdtsn_hdr->new_cum_tsn);
  3345. SCTP_DEBUG_PRINTK("%s: TSN 0x%x.\n", __func__, tsn);
  3346. /* The TSN is too high--silently discard the chunk and count on it
  3347. * getting retransmitted later.
  3348. */
  3349. if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
  3350. goto gen_shutdown;
  3351. /* Silently discard the chunk if stream-id is not valid */
  3352. sctp_walk_fwdtsn(skip, chunk) {
  3353. if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
  3354. goto gen_shutdown;
  3355. }
  3356. sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
  3357. if (len > sizeof(struct sctp_fwdtsn_hdr))
  3358. sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
  3359. SCTP_CHUNK(chunk));
  3360. /* Go a head and force a SACK, since we are shutting down. */
  3361. gen_shutdown:
  3362. /* Implementor's Guide.
  3363. *
  3364. * While in SHUTDOWN-SENT state, the SHUTDOWN sender MUST immediately
  3365. * respond to each received packet containing one or more DATA chunk(s)
  3366. * with a SACK, a SHUTDOWN chunk, and restart the T2-shutdown timer
  3367. */
  3368. sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SHUTDOWN, SCTP_NULL());
  3369. sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
  3370. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
  3371. SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
  3372. return SCTP_DISPOSITION_CONSUME;
  3373. }
  3374. /*
  3375. * SCTP-AUTH Section 6.3 Receving authenticated chukns
  3376. *
  3377. * The receiver MUST use the HMAC algorithm indicated in the HMAC
  3378. * Identifier field. If this algorithm was not specified by the
  3379. * receiver in the HMAC-ALGO parameter in the INIT or INIT-ACK chunk
  3380. * during association setup, the AUTH chunk and all chunks after it MUST
  3381. * be discarded and an ERROR chunk SHOULD be sent with the error cause
  3382. * defined in Section 4.1.
  3383. *
  3384. * If an endpoint with no shared key receives a Shared Key Identifier
  3385. * other than 0, it MUST silently discard all authenticated chunks. If
  3386. * the endpoint has at least one endpoint pair shared key for the peer,
  3387. * it MUST use the key specified by the Shared Key Identifier if a
  3388. * key has been configured for that Shared Key Identifier. If no
  3389. * endpoint pair shared key has been configured for that Shared Key
  3390. * Identifier, all authenticated chunks MUST be silently discarded.
  3391. *
  3392. * Verification Tag: 8.5 Verification Tag [Normal verification]
  3393. *
  3394. * The return value is the disposition of the chunk.
  3395. */
  3396. static sctp_ierror_t sctp_sf_authenticate(const struct sctp_endpoint *ep,
  3397. const struct sctp_association *asoc,
  3398. const sctp_subtype_t type,
  3399. struct sctp_chunk *chunk)
  3400. {
  3401. struct sctp_authhdr *auth_hdr;
  3402. struct sctp_hmac *hmac;
  3403. unsigned int sig_len;
  3404. __u16 key_id;
  3405. __u8 *save_digest;
  3406. __u8 *digest;
  3407. /* Pull in the auth header, so we can do some more verification */
  3408. auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
  3409. chunk->subh.auth_hdr = auth_hdr;
  3410. skb_pull(chunk->skb, sizeof(struct sctp_authhdr));
  3411. /* Make sure that we suport the HMAC algorithm from the auth
  3412. * chunk.
  3413. */
  3414. if (!sctp_auth_asoc_verify_hmac_id(asoc, auth_hdr->hmac_id))
  3415. return SCTP_IERROR_AUTH_BAD_HMAC;
  3416. /* Make sure that the provided shared key identifier has been
  3417. * configured
  3418. */
  3419. key_id = ntohs(auth_hdr->shkey_id);
  3420. if (key_id != asoc->active_key_id && !sctp_auth_get_shkey(asoc, key_id))
  3421. return SCTP_IERROR_AUTH_BAD_KEYID;
  3422. /* Make sure that the length of the signature matches what
  3423. * we expect.
  3424. */
  3425. sig_len = ntohs(chunk->chunk_hdr->length) - sizeof(sctp_auth_chunk_t);
  3426. hmac = sctp_auth_get_hmac(ntohs(auth_hdr->hmac_id));
  3427. if (sig_len != hmac->hmac_len)
  3428. return SCTP_IERROR_PROTO_VIOLATION;
  3429. /* Now that we've done validation checks, we can compute and
  3430. * verify the hmac. The steps involved are:
  3431. * 1. Save the digest from the chunk.
  3432. * 2. Zero out the digest in the chunk.
  3433. * 3. Compute the new digest
  3434. * 4. Compare saved and new digests.
  3435. */
  3436. digest = auth_hdr->hmac;
  3437. skb_pull(chunk->skb, sig_len);
  3438. save_digest = kmemdup(digest, sig_len, GFP_ATOMIC);
  3439. if (!save_digest)
  3440. goto nomem;
  3441. memset(digest, 0, sig_len);
  3442. sctp_auth_calculate_hmac(asoc, chunk->skb,
  3443. (struct sctp_auth_chunk *)chunk->chunk_hdr,
  3444. GFP_ATOMIC);
  3445. /* Discard the packet if the digests do not match */
  3446. if (memcmp(save_digest, digest, sig_len)) {
  3447. kfree(save_digest);
  3448. return SCTP_IERROR_BAD_SIG;
  3449. }
  3450. kfree(save_digest);
  3451. chunk->auth = 1;
  3452. return SCTP_IERROR_NO_ERROR;
  3453. nomem:
  3454. return SCTP_IERROR_NOMEM;
  3455. }
  3456. sctp_disposition_t sctp_sf_eat_auth(const struct sctp_endpoint *ep,
  3457. const struct sctp_association *asoc,
  3458. const sctp_subtype_t type,
  3459. void *arg,
  3460. sctp_cmd_seq_t *commands)
  3461. {
  3462. struct sctp_authhdr *auth_hdr;
  3463. struct sctp_chunk *chunk = arg;
  3464. struct sctp_chunk *err_chunk;
  3465. sctp_ierror_t error;
  3466. /* Make sure that the peer has AUTH capable */
  3467. if (!asoc->peer.auth_capable)
  3468. return sctp_sf_unk_chunk(ep, asoc, type, arg, commands);
  3469. if (!sctp_vtag_verify(chunk, asoc)) {
  3470. sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
  3471. SCTP_NULL());
  3472. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  3473. }
  3474. /* Make sure that the AUTH chunk has valid length. */
  3475. if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_auth_chunk)))
  3476. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  3477. commands);
  3478. auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
  3479. error = sctp_sf_authenticate(ep, asoc, type, chunk);
  3480. switch (error) {
  3481. case SCTP_IERROR_AUTH_BAD_HMAC:
  3482. /* Generate the ERROR chunk and discard the rest
  3483. * of the packet
  3484. */
  3485. err_chunk = sctp_make_op_error(asoc, chunk,
  3486. SCTP_ERROR_UNSUP_HMAC,
  3487. &auth_hdr->hmac_id,
  3488. sizeof(__u16));
  3489. if (err_chunk) {
  3490. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
  3491. SCTP_CHUNK(err_chunk));
  3492. }
  3493. /* Fall Through */
  3494. case SCTP_IERROR_AUTH_BAD_KEYID:
  3495. case SCTP_IERROR_BAD_SIG:
  3496. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  3497. break;
  3498. case SCTP_IERROR_PROTO_VIOLATION:
  3499. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  3500. commands);
  3501. break;
  3502. case SCTP_IERROR_NOMEM:
  3503. return SCTP_DISPOSITION_NOMEM;
  3504. default:
  3505. break;
  3506. }
  3507. if (asoc->active_key_id != ntohs(auth_hdr->shkey_id)) {
  3508. struct sctp_ulpevent *ev;
  3509. ev = sctp_ulpevent_make_authkey(asoc, ntohs(auth_hdr->shkey_id),
  3510. SCTP_AUTH_NEWKEY, GFP_ATOMIC);
  3511. if (!ev)
  3512. return -ENOMEM;
  3513. sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
  3514. SCTP_ULPEVENT(ev));
  3515. }
  3516. return SCTP_DISPOSITION_CONSUME;
  3517. }
  3518. /*
  3519. * Process an unknown chunk.
  3520. *
  3521. * Section: 3.2. Also, 2.1 in the implementor's guide.
  3522. *
  3523. * Chunk Types are encoded such that the highest-order two bits specify
  3524. * the action that must be taken if the processing endpoint does not
  3525. * recognize the Chunk Type.
  3526. *
  3527. * 00 - Stop processing this SCTP packet and discard it, do not process
  3528. * any further chunks within it.
  3529. *
  3530. * 01 - Stop processing this SCTP packet and discard it, do not process
  3531. * any further chunks within it, and report the unrecognized
  3532. * chunk in an 'Unrecognized Chunk Type'.
  3533. *
  3534. * 10 - Skip this chunk and continue processing.
  3535. *
  3536. * 11 - Skip this chunk and continue processing, but report in an ERROR
  3537. * Chunk using the 'Unrecognized Chunk Type' cause of error.
  3538. *
  3539. * The return value is the disposition of the chunk.
  3540. */
  3541. sctp_disposition_t sctp_sf_unk_chunk(const struct sctp_endpoint *ep,
  3542. const struct sctp_association *asoc,
  3543. const sctp_subtype_t type,
  3544. void *arg,
  3545. sctp_cmd_seq_t *commands)
  3546. {
  3547. struct sctp_chunk *unk_chunk = arg;
  3548. struct sctp_chunk *err_chunk;
  3549. sctp_chunkhdr_t *hdr;
  3550. SCTP_DEBUG_PRINTK("Processing the unknown chunk id %d.\n", type.chunk);
  3551. if (!sctp_vtag_verify(unk_chunk, asoc))
  3552. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  3553. /* Make sure that the chunk has a valid length.
  3554. * Since we don't know the chunk type, we use a general
  3555. * chunkhdr structure to make a comparison.
  3556. */
  3557. if (!sctp_chunk_length_valid(unk_chunk, sizeof(sctp_chunkhdr_t)))
  3558. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  3559. commands);
  3560. switch (type.chunk & SCTP_CID_ACTION_MASK) {
  3561. case SCTP_CID_ACTION_DISCARD:
  3562. /* Discard the packet. */
  3563. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  3564. break;
  3565. case SCTP_CID_ACTION_DISCARD_ERR:
  3566. /* Generate an ERROR chunk as response. */
  3567. hdr = unk_chunk->chunk_hdr;
  3568. err_chunk = sctp_make_op_error(asoc, unk_chunk,
  3569. SCTP_ERROR_UNKNOWN_CHUNK, hdr,
  3570. WORD_ROUND(ntohs(hdr->length)));
  3571. if (err_chunk) {
  3572. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
  3573. SCTP_CHUNK(err_chunk));
  3574. }
  3575. /* Discard the packet. */
  3576. sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  3577. return SCTP_DISPOSITION_CONSUME;
  3578. break;
  3579. case SCTP_CID_ACTION_SKIP:
  3580. /* Skip the chunk. */
  3581. return SCTP_DISPOSITION_DISCARD;
  3582. break;
  3583. case SCTP_CID_ACTION_SKIP_ERR:
  3584. /* Generate an ERROR chunk as response. */
  3585. hdr = unk_chunk->chunk_hdr;
  3586. err_chunk = sctp_make_op_error(asoc, unk_chunk,
  3587. SCTP_ERROR_UNKNOWN_CHUNK, hdr,
  3588. WORD_ROUND(ntohs(hdr->length)));
  3589. if (err_chunk) {
  3590. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
  3591. SCTP_CHUNK(err_chunk));
  3592. }
  3593. /* Skip the chunk. */
  3594. return SCTP_DISPOSITION_CONSUME;
  3595. break;
  3596. default:
  3597. break;
  3598. }
  3599. return SCTP_DISPOSITION_DISCARD;
  3600. }
  3601. /*
  3602. * Discard the chunk.
  3603. *
  3604. * Section: 0.2, 5.2.3, 5.2.5, 5.2.6, 6.0, 8.4.6, 8.5.1c, 9.2
  3605. * [Too numerous to mention...]
  3606. * Verification Tag: No verification needed.
  3607. * Inputs
  3608. * (endpoint, asoc, chunk)
  3609. *
  3610. * Outputs
  3611. * (asoc, reply_msg, msg_up, timers, counters)
  3612. *
  3613. * The return value is the disposition of the chunk.
  3614. */
  3615. sctp_disposition_t sctp_sf_discard_chunk(const struct sctp_endpoint *ep,
  3616. const struct sctp_association *asoc,
  3617. const sctp_subtype_t type,
  3618. void *arg,
  3619. sctp_cmd_seq_t *commands)
  3620. {
  3621. struct sctp_chunk *chunk = arg;
  3622. /* Make sure that the chunk has a valid length.
  3623. * Since we don't know the chunk type, we use a general
  3624. * chunkhdr structure to make a comparison.
  3625. */
  3626. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
  3627. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  3628. commands);
  3629. SCTP_DEBUG_PRINTK("Chunk %d is discarded\n", type.chunk);
  3630. return SCTP_DISPOSITION_DISCARD;
  3631. }
  3632. /*
  3633. * Discard the whole packet.
  3634. *
  3635. * Section: 8.4 2)
  3636. *
  3637. * 2) If the OOTB packet contains an ABORT chunk, the receiver MUST
  3638. * silently discard the OOTB packet and take no further action.
  3639. *
  3640. * Verification Tag: No verification necessary
  3641. *
  3642. * Inputs
  3643. * (endpoint, asoc, chunk)
  3644. *
  3645. * Outputs
  3646. * (asoc, reply_msg, msg_up, timers, counters)
  3647. *
  3648. * The return value is the disposition of the chunk.
  3649. */
  3650. sctp_disposition_t sctp_sf_pdiscard(const struct sctp_endpoint *ep,
  3651. const struct sctp_association *asoc,
  3652. const sctp_subtype_t type,
  3653. void *arg,
  3654. sctp_cmd_seq_t *commands)
  3655. {
  3656. SCTP_INC_STATS(SCTP_MIB_IN_PKT_DISCARDS);
  3657. sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
  3658. return SCTP_DISPOSITION_CONSUME;
  3659. }
  3660. /*
  3661. * The other end is violating protocol.
  3662. *
  3663. * Section: Not specified
  3664. * Verification Tag: Not specified
  3665. * Inputs
  3666. * (endpoint, asoc, chunk)
  3667. *
  3668. * Outputs
  3669. * (asoc, reply_msg, msg_up, timers, counters)
  3670. *
  3671. * We simply tag the chunk as a violation. The state machine will log
  3672. * the violation and continue.
  3673. */
  3674. sctp_disposition_t sctp_sf_violation(const struct sctp_endpoint *ep,
  3675. const struct sctp_association *asoc,
  3676. const sctp_subtype_t type,
  3677. void *arg,
  3678. sctp_cmd_seq_t *commands)
  3679. {
  3680. struct sctp_chunk *chunk = arg;
  3681. /* Make sure that the chunk has a valid length. */
  3682. if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
  3683. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  3684. commands);
  3685. return SCTP_DISPOSITION_VIOLATION;
  3686. }
  3687. /*
  3688. * Common function to handle a protocol violation.
  3689. */
  3690. static sctp_disposition_t sctp_sf_abort_violation(
  3691. const struct sctp_endpoint *ep,
  3692. const struct sctp_association *asoc,
  3693. void *arg,
  3694. sctp_cmd_seq_t *commands,
  3695. const __u8 *payload,
  3696. const size_t paylen)
  3697. {
  3698. struct sctp_packet *packet = NULL;
  3699. struct sctp_chunk *chunk = arg;
  3700. struct sctp_chunk *abort = NULL;
  3701. /* SCTP-AUTH, Section 6.3:
  3702. * It should be noted that if the receiver wants to tear
  3703. * down an association in an authenticated way only, the
  3704. * handling of malformed packets should not result in
  3705. * tearing down the association.
  3706. *
  3707. * This means that if we only want to abort associations
  3708. * in an authenticated way (i.e AUTH+ABORT), then we
  3709. * can't destroy this association just becuase the packet
  3710. * was malformed.
  3711. */
  3712. if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
  3713. goto discard;
  3714. /* Make the abort chunk. */
  3715. abort = sctp_make_abort_violation(asoc, chunk, payload, paylen);
  3716. if (!abort)
  3717. goto nomem;
  3718. if (asoc) {
  3719. /* Treat INIT-ACK as a special case during COOKIE-WAIT. */
  3720. if (chunk->chunk_hdr->type == SCTP_CID_INIT_ACK &&
  3721. !asoc->peer.i.init_tag) {
  3722. sctp_initack_chunk_t *initack;
  3723. initack = (sctp_initack_chunk_t *)chunk->chunk_hdr;
  3724. if (!sctp_chunk_length_valid(chunk,
  3725. sizeof(sctp_initack_chunk_t)))
  3726. abort->chunk_hdr->flags |= SCTP_CHUNK_FLAG_T;
  3727. else {
  3728. unsigned int inittag;
  3729. inittag = ntohl(initack->init_hdr.init_tag);
  3730. sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_INITTAG,
  3731. SCTP_U32(inittag));
  3732. }
  3733. }
  3734. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
  3735. SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
  3736. if (asoc->state <= SCTP_STATE_COOKIE_ECHOED) {
  3737. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  3738. SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
  3739. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  3740. SCTP_ERROR(ECONNREFUSED));
  3741. sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
  3742. SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
  3743. } else {
  3744. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  3745. SCTP_ERROR(ECONNABORTED));
  3746. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
  3747. SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
  3748. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  3749. }
  3750. } else {
  3751. packet = sctp_ootb_pkt_new(asoc, chunk);
  3752. if (!packet)
  3753. goto nomem_pkt;
  3754. if (sctp_test_T_bit(abort))
  3755. packet->vtag = ntohl(chunk->sctp_hdr->vtag);
  3756. abort->skb->sk = ep->base.sk;
  3757. sctp_packet_append_chunk(packet, abort);
  3758. sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
  3759. SCTP_PACKET(packet));
  3760. SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
  3761. }
  3762. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  3763. discard:
  3764. sctp_sf_pdiscard(ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
  3765. return SCTP_DISPOSITION_ABORT;
  3766. nomem_pkt:
  3767. sctp_chunk_free(abort);
  3768. nomem:
  3769. return SCTP_DISPOSITION_NOMEM;
  3770. }
  3771. /*
  3772. * Handle a protocol violation when the chunk length is invalid.
  3773. * "Invalid" length is identified as smaller then the minimal length a
  3774. * given chunk can be. For example, a SACK chunk has invalid length
  3775. * if it's length is set to be smaller then the size of sctp_sack_chunk_t.
  3776. *
  3777. * We inform the other end by sending an ABORT with a Protocol Violation
  3778. * error code.
  3779. *
  3780. * Section: Not specified
  3781. * Verification Tag: Nothing to do
  3782. * Inputs
  3783. * (endpoint, asoc, chunk)
  3784. *
  3785. * Outputs
  3786. * (reply_msg, msg_up, counters)
  3787. *
  3788. * Generate an ABORT chunk and terminate the association.
  3789. */
  3790. static sctp_disposition_t sctp_sf_violation_chunklen(
  3791. const struct sctp_endpoint *ep,
  3792. const struct sctp_association *asoc,
  3793. const sctp_subtype_t type,
  3794. void *arg,
  3795. sctp_cmd_seq_t *commands)
  3796. {
  3797. static const char err_str[]="The following chunk had invalid length:";
  3798. return sctp_sf_abort_violation(ep, asoc, arg, commands, err_str,
  3799. sizeof(err_str));
  3800. }
  3801. /*
  3802. * Handle a protocol violation when the parameter length is invalid.
  3803. * "Invalid" length is identified as smaller then the minimal length a
  3804. * given parameter can be.
  3805. */
  3806. static sctp_disposition_t sctp_sf_violation_paramlen(
  3807. const struct sctp_endpoint *ep,
  3808. const struct sctp_association *asoc,
  3809. const sctp_subtype_t type,
  3810. void *arg, void *ext,
  3811. sctp_cmd_seq_t *commands)
  3812. {
  3813. struct sctp_chunk *chunk = arg;
  3814. struct sctp_paramhdr *param = ext;
  3815. struct sctp_chunk *abort = NULL;
  3816. if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
  3817. goto discard;
  3818. /* Make the abort chunk. */
  3819. abort = sctp_make_violation_paramlen(asoc, chunk, param);
  3820. if (!abort)
  3821. goto nomem;
  3822. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
  3823. SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
  3824. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  3825. SCTP_ERROR(ECONNABORTED));
  3826. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
  3827. SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
  3828. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  3829. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  3830. discard:
  3831. sctp_sf_pdiscard(ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
  3832. return SCTP_DISPOSITION_ABORT;
  3833. nomem:
  3834. return SCTP_DISPOSITION_NOMEM;
  3835. }
  3836. /* Handle a protocol violation when the peer trying to advance the
  3837. * cumulative tsn ack to a point beyond the max tsn currently sent.
  3838. *
  3839. * We inform the other end by sending an ABORT with a Protocol Violation
  3840. * error code.
  3841. */
  3842. static sctp_disposition_t sctp_sf_violation_ctsn(
  3843. const struct sctp_endpoint *ep,
  3844. const struct sctp_association *asoc,
  3845. const sctp_subtype_t type,
  3846. void *arg,
  3847. sctp_cmd_seq_t *commands)
  3848. {
  3849. static const char err_str[]="The cumulative tsn ack beyond the max tsn currently sent:";
  3850. return sctp_sf_abort_violation(ep, asoc, arg, commands, err_str,
  3851. sizeof(err_str));
  3852. }
  3853. /* Handle protocol violation of an invalid chunk bundling. For example,
  3854. * when we have an association and we recieve bundled INIT-ACK, or
  3855. * SHUDOWN-COMPLETE, our peer is clearly violationg the "MUST NOT bundle"
  3856. * statement from the specs. Additinally, there might be an attacker
  3857. * on the path and we may not want to continue this communication.
  3858. */
  3859. static sctp_disposition_t sctp_sf_violation_chunk(
  3860. const struct sctp_endpoint *ep,
  3861. const struct sctp_association *asoc,
  3862. const sctp_subtype_t type,
  3863. void *arg,
  3864. sctp_cmd_seq_t *commands)
  3865. {
  3866. static const char err_str[]="The following chunk violates protocol:";
  3867. if (!asoc)
  3868. return sctp_sf_violation(ep, asoc, type, arg, commands);
  3869. return sctp_sf_abort_violation(ep, asoc, arg, commands, err_str,
  3870. sizeof(err_str));
  3871. }
  3872. /***************************************************************************
  3873. * These are the state functions for handling primitive (Section 10) events.
  3874. ***************************************************************************/
  3875. /*
  3876. * sctp_sf_do_prm_asoc
  3877. *
  3878. * Section: 10.1 ULP-to-SCTP
  3879. * B) Associate
  3880. *
  3881. * Format: ASSOCIATE(local SCTP instance name, destination transport addr,
  3882. * outbound stream count)
  3883. * -> association id [,destination transport addr list] [,outbound stream
  3884. * count]
  3885. *
  3886. * This primitive allows the upper layer to initiate an association to a
  3887. * specific peer endpoint.
  3888. *
  3889. * The peer endpoint shall be specified by one of the transport addresses
  3890. * which defines the endpoint (see Section 1.4). If the local SCTP
  3891. * instance has not been initialized, the ASSOCIATE is considered an
  3892. * error.
  3893. * [This is not relevant for the kernel implementation since we do all
  3894. * initialization at boot time. It we hadn't initialized we wouldn't
  3895. * get anywhere near this code.]
  3896. *
  3897. * An association id, which is a local handle to the SCTP association,
  3898. * will be returned on successful establishment of the association. If
  3899. * SCTP is not able to open an SCTP association with the peer endpoint,
  3900. * an error is returned.
  3901. * [In the kernel implementation, the struct sctp_association needs to
  3902. * be created BEFORE causing this primitive to run.]
  3903. *
  3904. * Other association parameters may be returned, including the
  3905. * complete destination transport addresses of the peer as well as the
  3906. * outbound stream count of the local endpoint. One of the transport
  3907. * address from the returned destination addresses will be selected by
  3908. * the local endpoint as default primary path for sending SCTP packets
  3909. * to this peer. The returned "destination transport addr list" can
  3910. * be used by the ULP to change the default primary path or to force
  3911. * sending a packet to a specific transport address. [All of this
  3912. * stuff happens when the INIT ACK arrives. This is a NON-BLOCKING
  3913. * function.]
  3914. *
  3915. * Mandatory attributes:
  3916. *
  3917. * o local SCTP instance name - obtained from the INITIALIZE operation.
  3918. * [This is the argument asoc.]
  3919. * o destination transport addr - specified as one of the transport
  3920. * addresses of the peer endpoint with which the association is to be
  3921. * established.
  3922. * [This is asoc->peer.active_path.]
  3923. * o outbound stream count - the number of outbound streams the ULP
  3924. * would like to open towards this peer endpoint.
  3925. * [BUG: This is not currently implemented.]
  3926. * Optional attributes:
  3927. *
  3928. * None.
  3929. *
  3930. * The return value is a disposition.
  3931. */
  3932. sctp_disposition_t sctp_sf_do_prm_asoc(const struct sctp_endpoint *ep,
  3933. const struct sctp_association *asoc,
  3934. const sctp_subtype_t type,
  3935. void *arg,
  3936. sctp_cmd_seq_t *commands)
  3937. {
  3938. struct sctp_chunk *repl;
  3939. struct sctp_association* my_asoc;
  3940. /* The comment below says that we enter COOKIE-WAIT AFTER
  3941. * sending the INIT, but that doesn't actually work in our
  3942. * implementation...
  3943. */
  3944. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  3945. SCTP_STATE(SCTP_STATE_COOKIE_WAIT));
  3946. /* RFC 2960 5.1 Normal Establishment of an Association
  3947. *
  3948. * A) "A" first sends an INIT chunk to "Z". In the INIT, "A"
  3949. * must provide its Verification Tag (Tag_A) in the Initiate
  3950. * Tag field. Tag_A SHOULD be a random number in the range of
  3951. * 1 to 4294967295 (see 5.3.1 for Tag value selection). ...
  3952. */
  3953. repl = sctp_make_init(asoc, &asoc->base.bind_addr, GFP_ATOMIC, 0);
  3954. if (!repl)
  3955. goto nomem;
  3956. /* Cast away the const modifier, as we want to just
  3957. * rerun it through as a sideffect.
  3958. */
  3959. my_asoc = (struct sctp_association *)asoc;
  3960. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(my_asoc));
  3961. /* Choose transport for INIT. */
  3962. sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
  3963. SCTP_CHUNK(repl));
  3964. /* After sending the INIT, "A" starts the T1-init timer and
  3965. * enters the COOKIE-WAIT state.
  3966. */
  3967. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
  3968. SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
  3969. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
  3970. return SCTP_DISPOSITION_CONSUME;
  3971. nomem:
  3972. return SCTP_DISPOSITION_NOMEM;
  3973. }
  3974. /*
  3975. * Process the SEND primitive.
  3976. *
  3977. * Section: 10.1 ULP-to-SCTP
  3978. * E) Send
  3979. *
  3980. * Format: SEND(association id, buffer address, byte count [,context]
  3981. * [,stream id] [,life time] [,destination transport address]
  3982. * [,unorder flag] [,no-bundle flag] [,payload protocol-id] )
  3983. * -> result
  3984. *
  3985. * This is the main method to send user data via SCTP.
  3986. *
  3987. * Mandatory attributes:
  3988. *
  3989. * o association id - local handle to the SCTP association
  3990. *
  3991. * o buffer address - the location where the user message to be
  3992. * transmitted is stored;
  3993. *
  3994. * o byte count - The size of the user data in number of bytes;
  3995. *
  3996. * Optional attributes:
  3997. *
  3998. * o context - an optional 32 bit integer that will be carried in the
  3999. * sending failure notification to the ULP if the transportation of
  4000. * this User Message fails.
  4001. *
  4002. * o stream id - to indicate which stream to send the data on. If not
  4003. * specified, stream 0 will be used.
  4004. *
  4005. * o life time - specifies the life time of the user data. The user data
  4006. * will not be sent by SCTP after the life time expires. This
  4007. * parameter can be used to avoid efforts to transmit stale
  4008. * user messages. SCTP notifies the ULP if the data cannot be
  4009. * initiated to transport (i.e. sent to the destination via SCTP's
  4010. * send primitive) within the life time variable. However, the
  4011. * user data will be transmitted if SCTP has attempted to transmit a
  4012. * chunk before the life time expired.
  4013. *
  4014. * o destination transport address - specified as one of the destination
  4015. * transport addresses of the peer endpoint to which this packet
  4016. * should be sent. Whenever possible, SCTP should use this destination
  4017. * transport address for sending the packets, instead of the current
  4018. * primary path.
  4019. *
  4020. * o unorder flag - this flag, if present, indicates that the user
  4021. * would like the data delivered in an unordered fashion to the peer
  4022. * (i.e., the U flag is set to 1 on all DATA chunks carrying this
  4023. * message).
  4024. *
  4025. * o no-bundle flag - instructs SCTP not to bundle this user data with
  4026. * other outbound DATA chunks. SCTP MAY still bundle even when
  4027. * this flag is present, when faced with network congestion.
  4028. *
  4029. * o payload protocol-id - A 32 bit unsigned integer that is to be
  4030. * passed to the peer indicating the type of payload protocol data
  4031. * being transmitted. This value is passed as opaque data by SCTP.
  4032. *
  4033. * The return value is the disposition.
  4034. */
  4035. sctp_disposition_t sctp_sf_do_prm_send(const struct sctp_endpoint *ep,
  4036. const struct sctp_association *asoc,
  4037. const sctp_subtype_t type,
  4038. void *arg,
  4039. sctp_cmd_seq_t *commands)
  4040. {
  4041. struct sctp_chunk *chunk = arg;
  4042. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(chunk));
  4043. return SCTP_DISPOSITION_CONSUME;
  4044. }
  4045. /*
  4046. * Process the SHUTDOWN primitive.
  4047. *
  4048. * Section: 10.1:
  4049. * C) Shutdown
  4050. *
  4051. * Format: SHUTDOWN(association id)
  4052. * -> result
  4053. *
  4054. * Gracefully closes an association. Any locally queued user data
  4055. * will be delivered to the peer. The association will be terminated only
  4056. * after the peer acknowledges all the SCTP packets sent. A success code
  4057. * will be returned on successful termination of the association. If
  4058. * attempting to terminate the association results in a failure, an error
  4059. * code shall be returned.
  4060. *
  4061. * Mandatory attributes:
  4062. *
  4063. * o association id - local handle to the SCTP association
  4064. *
  4065. * Optional attributes:
  4066. *
  4067. * None.
  4068. *
  4069. * The return value is the disposition.
  4070. */
  4071. sctp_disposition_t sctp_sf_do_9_2_prm_shutdown(
  4072. const struct sctp_endpoint *ep,
  4073. const struct sctp_association *asoc,
  4074. const sctp_subtype_t type,
  4075. void *arg,
  4076. sctp_cmd_seq_t *commands)
  4077. {
  4078. int disposition;
  4079. /* From 9.2 Shutdown of an Association
  4080. * Upon receipt of the SHUTDOWN primitive from its upper
  4081. * layer, the endpoint enters SHUTDOWN-PENDING state and
  4082. * remains there until all outstanding data has been
  4083. * acknowledged by its peer. The endpoint accepts no new data
  4084. * from its upper layer, but retransmits data to the far end
  4085. * if necessary to fill gaps.
  4086. */
  4087. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  4088. SCTP_STATE(SCTP_STATE_SHUTDOWN_PENDING));
  4089. disposition = SCTP_DISPOSITION_CONSUME;
  4090. if (sctp_outq_is_empty(&asoc->outqueue)) {
  4091. disposition = sctp_sf_do_9_2_start_shutdown(ep, asoc, type,
  4092. arg, commands);
  4093. }
  4094. return disposition;
  4095. }
  4096. /*
  4097. * Process the ABORT primitive.
  4098. *
  4099. * Section: 10.1:
  4100. * C) Abort
  4101. *
  4102. * Format: Abort(association id [, cause code])
  4103. * -> result
  4104. *
  4105. * Ungracefully closes an association. Any locally queued user data
  4106. * will be discarded and an ABORT chunk is sent to the peer. A success code
  4107. * will be returned on successful abortion of the association. If
  4108. * attempting to abort the association results in a failure, an error
  4109. * code shall be returned.
  4110. *
  4111. * Mandatory attributes:
  4112. *
  4113. * o association id - local handle to the SCTP association
  4114. *
  4115. * Optional attributes:
  4116. *
  4117. * o cause code - reason of the abort to be passed to the peer
  4118. *
  4119. * None.
  4120. *
  4121. * The return value is the disposition.
  4122. */
  4123. sctp_disposition_t sctp_sf_do_9_1_prm_abort(
  4124. const struct sctp_endpoint *ep,
  4125. const struct sctp_association *asoc,
  4126. const sctp_subtype_t type,
  4127. void *arg,
  4128. sctp_cmd_seq_t *commands)
  4129. {
  4130. /* From 9.1 Abort of an Association
  4131. * Upon receipt of the ABORT primitive from its upper
  4132. * layer, the endpoint enters CLOSED state and
  4133. * discard all outstanding data has been
  4134. * acknowledged by its peer. The endpoint accepts no new data
  4135. * from its upper layer, but retransmits data to the far end
  4136. * if necessary to fill gaps.
  4137. */
  4138. struct sctp_chunk *abort = arg;
  4139. sctp_disposition_t retval;
  4140. retval = SCTP_DISPOSITION_CONSUME;
  4141. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
  4142. /* Even if we can't send the ABORT due to low memory delete the
  4143. * TCB. This is a departure from our typical NOMEM handling.
  4144. */
  4145. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  4146. SCTP_ERROR(ECONNABORTED));
  4147. /* Delete the established association. */
  4148. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
  4149. SCTP_PERR(SCTP_ERROR_USER_ABORT));
  4150. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  4151. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  4152. return retval;
  4153. }
  4154. /* We tried an illegal operation on an association which is closed. */
  4155. sctp_disposition_t sctp_sf_error_closed(const struct sctp_endpoint *ep,
  4156. const struct sctp_association *asoc,
  4157. const sctp_subtype_t type,
  4158. void *arg,
  4159. sctp_cmd_seq_t *commands)
  4160. {
  4161. sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_ERROR, SCTP_ERROR(-EINVAL));
  4162. return SCTP_DISPOSITION_CONSUME;
  4163. }
  4164. /* We tried an illegal operation on an association which is shutting
  4165. * down.
  4166. */
  4167. sctp_disposition_t sctp_sf_error_shutdown(const struct sctp_endpoint *ep,
  4168. const struct sctp_association *asoc,
  4169. const sctp_subtype_t type,
  4170. void *arg,
  4171. sctp_cmd_seq_t *commands)
  4172. {
  4173. sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_ERROR,
  4174. SCTP_ERROR(-ESHUTDOWN));
  4175. return SCTP_DISPOSITION_CONSUME;
  4176. }
  4177. /*
  4178. * sctp_cookie_wait_prm_shutdown
  4179. *
  4180. * Section: 4 Note: 2
  4181. * Verification Tag:
  4182. * Inputs
  4183. * (endpoint, asoc)
  4184. *
  4185. * The RFC does not explicitly address this issue, but is the route through the
  4186. * state table when someone issues a shutdown while in COOKIE_WAIT state.
  4187. *
  4188. * Outputs
  4189. * (timers)
  4190. */
  4191. sctp_disposition_t sctp_sf_cookie_wait_prm_shutdown(
  4192. const struct sctp_endpoint *ep,
  4193. const struct sctp_association *asoc,
  4194. const sctp_subtype_t type,
  4195. void *arg,
  4196. sctp_cmd_seq_t *commands)
  4197. {
  4198. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  4199. SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
  4200. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  4201. SCTP_STATE(SCTP_STATE_CLOSED));
  4202. SCTP_INC_STATS(SCTP_MIB_SHUTDOWNS);
  4203. sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
  4204. return SCTP_DISPOSITION_DELETE_TCB;
  4205. }
  4206. /*
  4207. * sctp_cookie_echoed_prm_shutdown
  4208. *
  4209. * Section: 4 Note: 2
  4210. * Verification Tag:
  4211. * Inputs
  4212. * (endpoint, asoc)
  4213. *
  4214. * The RFC does not explcitly address this issue, but is the route through the
  4215. * state table when someone issues a shutdown while in COOKIE_ECHOED state.
  4216. *
  4217. * Outputs
  4218. * (timers)
  4219. */
  4220. sctp_disposition_t sctp_sf_cookie_echoed_prm_shutdown(
  4221. const struct sctp_endpoint *ep,
  4222. const struct sctp_association *asoc,
  4223. const sctp_subtype_t type,
  4224. void *arg, sctp_cmd_seq_t *commands)
  4225. {
  4226. /* There is a single T1 timer, so we should be able to use
  4227. * common function with the COOKIE-WAIT state.
  4228. */
  4229. return sctp_sf_cookie_wait_prm_shutdown(ep, asoc, type, arg, commands);
  4230. }
  4231. /*
  4232. * sctp_sf_cookie_wait_prm_abort
  4233. *
  4234. * Section: 4 Note: 2
  4235. * Verification Tag:
  4236. * Inputs
  4237. * (endpoint, asoc)
  4238. *
  4239. * The RFC does not explicitly address this issue, but is the route through the
  4240. * state table when someone issues an abort while in COOKIE_WAIT state.
  4241. *
  4242. * Outputs
  4243. * (timers)
  4244. */
  4245. sctp_disposition_t sctp_sf_cookie_wait_prm_abort(
  4246. const struct sctp_endpoint *ep,
  4247. const struct sctp_association *asoc,
  4248. const sctp_subtype_t type,
  4249. void *arg,
  4250. sctp_cmd_seq_t *commands)
  4251. {
  4252. struct sctp_chunk *abort = arg;
  4253. sctp_disposition_t retval;
  4254. /* Stop T1-init timer */
  4255. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  4256. SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
  4257. retval = SCTP_DISPOSITION_CONSUME;
  4258. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
  4259. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  4260. SCTP_STATE(SCTP_STATE_CLOSED));
  4261. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  4262. /* Even if we can't send the ABORT due to low memory delete the
  4263. * TCB. This is a departure from our typical NOMEM handling.
  4264. */
  4265. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  4266. SCTP_ERROR(ECONNREFUSED));
  4267. /* Delete the established association. */
  4268. sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
  4269. SCTP_PERR(SCTP_ERROR_USER_ABORT));
  4270. return retval;
  4271. }
  4272. /*
  4273. * sctp_sf_cookie_echoed_prm_abort
  4274. *
  4275. * Section: 4 Note: 3
  4276. * Verification Tag:
  4277. * Inputs
  4278. * (endpoint, asoc)
  4279. *
  4280. * The RFC does not explcitly address this issue, but is the route through the
  4281. * state table when someone issues an abort while in COOKIE_ECHOED state.
  4282. *
  4283. * Outputs
  4284. * (timers)
  4285. */
  4286. sctp_disposition_t sctp_sf_cookie_echoed_prm_abort(
  4287. const struct sctp_endpoint *ep,
  4288. const struct sctp_association *asoc,
  4289. const sctp_subtype_t type,
  4290. void *arg,
  4291. sctp_cmd_seq_t *commands)
  4292. {
  4293. /* There is a single T1 timer, so we should be able to use
  4294. * common function with the COOKIE-WAIT state.
  4295. */
  4296. return sctp_sf_cookie_wait_prm_abort(ep, asoc, type, arg, commands);
  4297. }
  4298. /*
  4299. * sctp_sf_shutdown_pending_prm_abort
  4300. *
  4301. * Inputs
  4302. * (endpoint, asoc)
  4303. *
  4304. * The RFC does not explicitly address this issue, but is the route through the
  4305. * state table when someone issues an abort while in SHUTDOWN-PENDING state.
  4306. *
  4307. * Outputs
  4308. * (timers)
  4309. */
  4310. sctp_disposition_t sctp_sf_shutdown_pending_prm_abort(
  4311. const struct sctp_endpoint *ep,
  4312. const struct sctp_association *asoc,
  4313. const sctp_subtype_t type,
  4314. void *arg,
  4315. sctp_cmd_seq_t *commands)
  4316. {
  4317. /* Stop the T5-shutdown guard timer. */
  4318. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  4319. SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
  4320. return sctp_sf_do_9_1_prm_abort(ep, asoc, type, arg, commands);
  4321. }
  4322. /*
  4323. * sctp_sf_shutdown_sent_prm_abort
  4324. *
  4325. * Inputs
  4326. * (endpoint, asoc)
  4327. *
  4328. * The RFC does not explicitly address this issue, but is the route through the
  4329. * state table when someone issues an abort while in SHUTDOWN-SENT state.
  4330. *
  4331. * Outputs
  4332. * (timers)
  4333. */
  4334. sctp_disposition_t sctp_sf_shutdown_sent_prm_abort(
  4335. const struct sctp_endpoint *ep,
  4336. const struct sctp_association *asoc,
  4337. const sctp_subtype_t type,
  4338. void *arg,
  4339. sctp_cmd_seq_t *commands)
  4340. {
  4341. /* Stop the T2-shutdown timer. */
  4342. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  4343. SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
  4344. /* Stop the T5-shutdown guard timer. */
  4345. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  4346. SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
  4347. return sctp_sf_do_9_1_prm_abort(ep, asoc, type, arg, commands);
  4348. }
  4349. /*
  4350. * sctp_sf_cookie_echoed_prm_abort
  4351. *
  4352. * Inputs
  4353. * (endpoint, asoc)
  4354. *
  4355. * The RFC does not explcitly address this issue, but is the route through the
  4356. * state table when someone issues an abort while in COOKIE_ECHOED state.
  4357. *
  4358. * Outputs
  4359. * (timers)
  4360. */
  4361. sctp_disposition_t sctp_sf_shutdown_ack_sent_prm_abort(
  4362. const struct sctp_endpoint *ep,
  4363. const struct sctp_association *asoc,
  4364. const sctp_subtype_t type,
  4365. void *arg,
  4366. sctp_cmd_seq_t *commands)
  4367. {
  4368. /* The same T2 timer, so we should be able to use
  4369. * common function with the SHUTDOWN-SENT state.
  4370. */
  4371. return sctp_sf_shutdown_sent_prm_abort(ep, asoc, type, arg, commands);
  4372. }
  4373. /*
  4374. * Process the REQUESTHEARTBEAT primitive
  4375. *
  4376. * 10.1 ULP-to-SCTP
  4377. * J) Request Heartbeat
  4378. *
  4379. * Format: REQUESTHEARTBEAT(association id, destination transport address)
  4380. *
  4381. * -> result
  4382. *
  4383. * Instructs the local endpoint to perform a HeartBeat on the specified
  4384. * destination transport address of the given association. The returned
  4385. * result should indicate whether the transmission of the HEARTBEAT
  4386. * chunk to the destination address is successful.
  4387. *
  4388. * Mandatory attributes:
  4389. *
  4390. * o association id - local handle to the SCTP association
  4391. *
  4392. * o destination transport address - the transport address of the
  4393. * association on which a heartbeat should be issued.
  4394. */
  4395. sctp_disposition_t sctp_sf_do_prm_requestheartbeat(
  4396. const struct sctp_endpoint *ep,
  4397. const struct sctp_association *asoc,
  4398. const sctp_subtype_t type,
  4399. void *arg,
  4400. sctp_cmd_seq_t *commands)
  4401. {
  4402. if (SCTP_DISPOSITION_NOMEM == sctp_sf_heartbeat(ep, asoc, type,
  4403. (struct sctp_transport *)arg, commands))
  4404. return SCTP_DISPOSITION_NOMEM;
  4405. /*
  4406. * RFC 2960 (bis), section 8.3
  4407. *
  4408. * D) Request an on-demand HEARTBEAT on a specific destination
  4409. * transport address of a given association.
  4410. *
  4411. * The endpoint should increment the respective error counter of
  4412. * the destination transport address each time a HEARTBEAT is sent
  4413. * to that address and not acknowledged within one RTO.
  4414. *
  4415. */
  4416. sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_RESET,
  4417. SCTP_TRANSPORT(arg));
  4418. return SCTP_DISPOSITION_CONSUME;
  4419. }
  4420. /*
  4421. * ADDIP Section 4.1 ASCONF Chunk Procedures
  4422. * When an endpoint has an ASCONF signaled change to be sent to the
  4423. * remote endpoint it should do A1 to A9
  4424. */
  4425. sctp_disposition_t sctp_sf_do_prm_asconf(const struct sctp_endpoint *ep,
  4426. const struct sctp_association *asoc,
  4427. const sctp_subtype_t type,
  4428. void *arg,
  4429. sctp_cmd_seq_t *commands)
  4430. {
  4431. struct sctp_chunk *chunk = arg;
  4432. sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T4, SCTP_CHUNK(chunk));
  4433. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
  4434. SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
  4435. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(chunk));
  4436. return SCTP_DISPOSITION_CONSUME;
  4437. }
  4438. /*
  4439. * Ignore the primitive event
  4440. *
  4441. * The return value is the disposition of the primitive.
  4442. */
  4443. sctp_disposition_t sctp_sf_ignore_primitive(
  4444. const struct sctp_endpoint *ep,
  4445. const struct sctp_association *asoc,
  4446. const sctp_subtype_t type,
  4447. void *arg,
  4448. sctp_cmd_seq_t *commands)
  4449. {
  4450. SCTP_DEBUG_PRINTK("Primitive type %d is ignored.\n", type.primitive);
  4451. return SCTP_DISPOSITION_DISCARD;
  4452. }
  4453. /***************************************************************************
  4454. * These are the state functions for the OTHER events.
  4455. ***************************************************************************/
  4456. /*
  4457. * Start the shutdown negotiation.
  4458. *
  4459. * From Section 9.2:
  4460. * Once all its outstanding data has been acknowledged, the endpoint
  4461. * shall send a SHUTDOWN chunk to its peer including in the Cumulative
  4462. * TSN Ack field the last sequential TSN it has received from the peer.
  4463. * It shall then start the T2-shutdown timer and enter the SHUTDOWN-SENT
  4464. * state. If the timer expires, the endpoint must re-send the SHUTDOWN
  4465. * with the updated last sequential TSN received from its peer.
  4466. *
  4467. * The return value is the disposition.
  4468. */
  4469. sctp_disposition_t sctp_sf_do_9_2_start_shutdown(
  4470. const struct sctp_endpoint *ep,
  4471. const struct sctp_association *asoc,
  4472. const sctp_subtype_t type,
  4473. void *arg,
  4474. sctp_cmd_seq_t *commands)
  4475. {
  4476. struct sctp_chunk *reply;
  4477. /* Once all its outstanding data has been acknowledged, the
  4478. * endpoint shall send a SHUTDOWN chunk to its peer including
  4479. * in the Cumulative TSN Ack field the last sequential TSN it
  4480. * has received from the peer.
  4481. */
  4482. reply = sctp_make_shutdown(asoc, NULL);
  4483. if (!reply)
  4484. goto nomem;
  4485. /* Set the transport for the SHUTDOWN chunk and the timeout for the
  4486. * T2-shutdown timer.
  4487. */
  4488. sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
  4489. /* It shall then start the T2-shutdown timer */
  4490. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
  4491. SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
  4492. /* RFC 4960 Section 9.2
  4493. * The sender of the SHUTDOWN MAY also start an overall guard timer
  4494. * 'T5-shutdown-guard' to bound the overall time for shutdown sequence.
  4495. */
  4496. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
  4497. SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
  4498. if (asoc->autoclose)
  4499. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  4500. SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
  4501. /* and enter the SHUTDOWN-SENT state. */
  4502. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  4503. SCTP_STATE(SCTP_STATE_SHUTDOWN_SENT));
  4504. /* sctp-implguide 2.10 Issues with Heartbeating and failover
  4505. *
  4506. * HEARTBEAT ... is discontinued after sending either SHUTDOWN
  4507. * or SHUTDOWN-ACK.
  4508. */
  4509. sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
  4510. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
  4511. return SCTP_DISPOSITION_CONSUME;
  4512. nomem:
  4513. return SCTP_DISPOSITION_NOMEM;
  4514. }
  4515. /*
  4516. * Generate a SHUTDOWN ACK now that everything is SACK'd.
  4517. *
  4518. * From Section 9.2:
  4519. *
  4520. * If it has no more outstanding DATA chunks, the SHUTDOWN receiver
  4521. * shall send a SHUTDOWN ACK and start a T2-shutdown timer of its own,
  4522. * entering the SHUTDOWN-ACK-SENT state. If the timer expires, the
  4523. * endpoint must re-send the SHUTDOWN ACK.
  4524. *
  4525. * The return value is the disposition.
  4526. */
  4527. sctp_disposition_t sctp_sf_do_9_2_shutdown_ack(
  4528. const struct sctp_endpoint *ep,
  4529. const struct sctp_association *asoc,
  4530. const sctp_subtype_t type,
  4531. void *arg,
  4532. sctp_cmd_seq_t *commands)
  4533. {
  4534. struct sctp_chunk *chunk = (struct sctp_chunk *) arg;
  4535. struct sctp_chunk *reply;
  4536. /* There are 2 ways of getting here:
  4537. * 1) called in response to a SHUTDOWN chunk
  4538. * 2) called when SCTP_EVENT_NO_PENDING_TSN event is issued.
  4539. *
  4540. * For the case (2), the arg parameter is set to NULL. We need
  4541. * to check that we have a chunk before accessing it's fields.
  4542. */
  4543. if (chunk) {
  4544. if (!sctp_vtag_verify(chunk, asoc))
  4545. return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
  4546. /* Make sure that the SHUTDOWN chunk has a valid length. */
  4547. if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_shutdown_chunk_t)))
  4548. return sctp_sf_violation_chunklen(ep, asoc, type, arg,
  4549. commands);
  4550. }
  4551. /* If it has no more outstanding DATA chunks, the SHUTDOWN receiver
  4552. * shall send a SHUTDOWN ACK ...
  4553. */
  4554. reply = sctp_make_shutdown_ack(asoc, chunk);
  4555. if (!reply)
  4556. goto nomem;
  4557. /* Set the transport for the SHUTDOWN ACK chunk and the timeout for
  4558. * the T2-shutdown timer.
  4559. */
  4560. sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
  4561. /* and start/restart a T2-shutdown timer of its own, */
  4562. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
  4563. SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
  4564. if (asoc->autoclose)
  4565. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  4566. SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
  4567. /* Enter the SHUTDOWN-ACK-SENT state. */
  4568. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  4569. SCTP_STATE(SCTP_STATE_SHUTDOWN_ACK_SENT));
  4570. /* sctp-implguide 2.10 Issues with Heartbeating and failover
  4571. *
  4572. * HEARTBEAT ... is discontinued after sending either SHUTDOWN
  4573. * or SHUTDOWN-ACK.
  4574. */
  4575. sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
  4576. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
  4577. return SCTP_DISPOSITION_CONSUME;
  4578. nomem:
  4579. return SCTP_DISPOSITION_NOMEM;
  4580. }
  4581. /*
  4582. * Ignore the event defined as other
  4583. *
  4584. * The return value is the disposition of the event.
  4585. */
  4586. sctp_disposition_t sctp_sf_ignore_other(const struct sctp_endpoint *ep,
  4587. const struct sctp_association *asoc,
  4588. const sctp_subtype_t type,
  4589. void *arg,
  4590. sctp_cmd_seq_t *commands)
  4591. {
  4592. SCTP_DEBUG_PRINTK("The event other type %d is ignored\n", type.other);
  4593. return SCTP_DISPOSITION_DISCARD;
  4594. }
  4595. /************************************************************
  4596. * These are the state functions for handling timeout events.
  4597. ************************************************************/
  4598. /*
  4599. * RTX Timeout
  4600. *
  4601. * Section: 6.3.3 Handle T3-rtx Expiration
  4602. *
  4603. * Whenever the retransmission timer T3-rtx expires for a destination
  4604. * address, do the following:
  4605. * [See below]
  4606. *
  4607. * The return value is the disposition of the chunk.
  4608. */
  4609. sctp_disposition_t sctp_sf_do_6_3_3_rtx(const struct sctp_endpoint *ep,
  4610. const struct sctp_association *asoc,
  4611. const sctp_subtype_t type,
  4612. void *arg,
  4613. sctp_cmd_seq_t *commands)
  4614. {
  4615. struct sctp_transport *transport = arg;
  4616. SCTP_INC_STATS(SCTP_MIB_T3_RTX_EXPIREDS);
  4617. if (asoc->overall_error_count >= asoc->max_retrans) {
  4618. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  4619. SCTP_ERROR(ETIMEDOUT));
  4620. /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
  4621. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
  4622. SCTP_PERR(SCTP_ERROR_NO_ERROR));
  4623. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  4624. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  4625. return SCTP_DISPOSITION_DELETE_TCB;
  4626. }
  4627. /* E1) For the destination address for which the timer
  4628. * expires, adjust its ssthresh with rules defined in Section
  4629. * 7.2.3 and set the cwnd <- MTU.
  4630. */
  4631. /* E2) For the destination address for which the timer
  4632. * expires, set RTO <- RTO * 2 ("back off the timer"). The
  4633. * maximum value discussed in rule C7 above (RTO.max) may be
  4634. * used to provide an upper bound to this doubling operation.
  4635. */
  4636. /* E3) Determine how many of the earliest (i.e., lowest TSN)
  4637. * outstanding DATA chunks for the address for which the
  4638. * T3-rtx has expired will fit into a single packet, subject
  4639. * to the MTU constraint for the path corresponding to the
  4640. * destination transport address to which the retransmission
  4641. * is being sent (this may be different from the address for
  4642. * which the timer expires [see Section 6.4]). Call this
  4643. * value K. Bundle and retransmit those K DATA chunks in a
  4644. * single packet to the destination endpoint.
  4645. *
  4646. * Note: Any DATA chunks that were sent to the address for
  4647. * which the T3-rtx timer expired but did not fit in one MTU
  4648. * (rule E3 above), should be marked for retransmission and
  4649. * sent as soon as cwnd allows (normally when a SACK arrives).
  4650. */
  4651. /* Do some failure management (Section 8.2). */
  4652. sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE, SCTP_TRANSPORT(transport));
  4653. /* NB: Rules E4 and F1 are implicit in R1. */
  4654. sctp_add_cmd_sf(commands, SCTP_CMD_RETRAN, SCTP_TRANSPORT(transport));
  4655. return SCTP_DISPOSITION_CONSUME;
  4656. }
  4657. /*
  4658. * Generate delayed SACK on timeout
  4659. *
  4660. * Section: 6.2 Acknowledgement on Reception of DATA Chunks
  4661. *
  4662. * The guidelines on delayed acknowledgement algorithm specified in
  4663. * Section 4.2 of [RFC2581] SHOULD be followed. Specifically, an
  4664. * acknowledgement SHOULD be generated for at least every second packet
  4665. * (not every second DATA chunk) received, and SHOULD be generated
  4666. * within 200 ms of the arrival of any unacknowledged DATA chunk. In
  4667. * some situations it may be beneficial for an SCTP transmitter to be
  4668. * more conservative than the algorithms detailed in this document
  4669. * allow. However, an SCTP transmitter MUST NOT be more aggressive than
  4670. * the following algorithms allow.
  4671. */
  4672. sctp_disposition_t sctp_sf_do_6_2_sack(const struct sctp_endpoint *ep,
  4673. const struct sctp_association *asoc,
  4674. const sctp_subtype_t type,
  4675. void *arg,
  4676. sctp_cmd_seq_t *commands)
  4677. {
  4678. SCTP_INC_STATS(SCTP_MIB_DELAY_SACK_EXPIREDS);
  4679. sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
  4680. return SCTP_DISPOSITION_CONSUME;
  4681. }
  4682. /*
  4683. * sctp_sf_t1_init_timer_expire
  4684. *
  4685. * Section: 4 Note: 2
  4686. * Verification Tag:
  4687. * Inputs
  4688. * (endpoint, asoc)
  4689. *
  4690. * RFC 2960 Section 4 Notes
  4691. * 2) If the T1-init timer expires, the endpoint MUST retransmit INIT
  4692. * and re-start the T1-init timer without changing state. This MUST
  4693. * be repeated up to 'Max.Init.Retransmits' times. After that, the
  4694. * endpoint MUST abort the initialization process and report the
  4695. * error to SCTP user.
  4696. *
  4697. * Outputs
  4698. * (timers, events)
  4699. *
  4700. */
  4701. sctp_disposition_t sctp_sf_t1_init_timer_expire(const struct sctp_endpoint *ep,
  4702. const struct sctp_association *asoc,
  4703. const sctp_subtype_t type,
  4704. void *arg,
  4705. sctp_cmd_seq_t *commands)
  4706. {
  4707. struct sctp_chunk *repl = NULL;
  4708. struct sctp_bind_addr *bp;
  4709. int attempts = asoc->init_err_counter + 1;
  4710. SCTP_DEBUG_PRINTK("Timer T1 expired (INIT).\n");
  4711. SCTP_INC_STATS(SCTP_MIB_T1_INIT_EXPIREDS);
  4712. if (attempts <= asoc->max_init_attempts) {
  4713. bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
  4714. repl = sctp_make_init(asoc, bp, GFP_ATOMIC, 0);
  4715. if (!repl)
  4716. return SCTP_DISPOSITION_NOMEM;
  4717. /* Choose transport for INIT. */
  4718. sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
  4719. SCTP_CHUNK(repl));
  4720. /* Issue a sideeffect to do the needed accounting. */
  4721. sctp_add_cmd_sf(commands, SCTP_CMD_INIT_RESTART,
  4722. SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
  4723. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
  4724. } else {
  4725. SCTP_DEBUG_PRINTK("Giving up on INIT, attempts: %d"
  4726. " max_init_attempts: %d\n",
  4727. attempts, asoc->max_init_attempts);
  4728. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  4729. SCTP_ERROR(ETIMEDOUT));
  4730. sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
  4731. SCTP_PERR(SCTP_ERROR_NO_ERROR));
  4732. return SCTP_DISPOSITION_DELETE_TCB;
  4733. }
  4734. return SCTP_DISPOSITION_CONSUME;
  4735. }
  4736. /*
  4737. * sctp_sf_t1_cookie_timer_expire
  4738. *
  4739. * Section: 4 Note: 2
  4740. * Verification Tag:
  4741. * Inputs
  4742. * (endpoint, asoc)
  4743. *
  4744. * RFC 2960 Section 4 Notes
  4745. * 3) If the T1-cookie timer expires, the endpoint MUST retransmit
  4746. * COOKIE ECHO and re-start the T1-cookie timer without changing
  4747. * state. This MUST be repeated up to 'Max.Init.Retransmits' times.
  4748. * After that, the endpoint MUST abort the initialization process and
  4749. * report the error to SCTP user.
  4750. *
  4751. * Outputs
  4752. * (timers, events)
  4753. *
  4754. */
  4755. sctp_disposition_t sctp_sf_t1_cookie_timer_expire(const struct sctp_endpoint *ep,
  4756. const struct sctp_association *asoc,
  4757. const sctp_subtype_t type,
  4758. void *arg,
  4759. sctp_cmd_seq_t *commands)
  4760. {
  4761. struct sctp_chunk *repl = NULL;
  4762. int attempts = asoc->init_err_counter + 1;
  4763. SCTP_DEBUG_PRINTK("Timer T1 expired (COOKIE-ECHO).\n");
  4764. SCTP_INC_STATS(SCTP_MIB_T1_COOKIE_EXPIREDS);
  4765. if (attempts <= asoc->max_init_attempts) {
  4766. repl = sctp_make_cookie_echo(asoc, NULL);
  4767. if (!repl)
  4768. return SCTP_DISPOSITION_NOMEM;
  4769. sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
  4770. SCTP_CHUNK(repl));
  4771. /* Issue a sideeffect to do the needed accounting. */
  4772. sctp_add_cmd_sf(commands, SCTP_CMD_COOKIEECHO_RESTART,
  4773. SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
  4774. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
  4775. } else {
  4776. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  4777. SCTP_ERROR(ETIMEDOUT));
  4778. sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
  4779. SCTP_PERR(SCTP_ERROR_NO_ERROR));
  4780. return SCTP_DISPOSITION_DELETE_TCB;
  4781. }
  4782. return SCTP_DISPOSITION_CONSUME;
  4783. }
  4784. /* RFC2960 9.2 If the timer expires, the endpoint must re-send the SHUTDOWN
  4785. * with the updated last sequential TSN received from its peer.
  4786. *
  4787. * An endpoint should limit the number of retransmissions of the
  4788. * SHUTDOWN chunk to the protocol parameter 'Association.Max.Retrans'.
  4789. * If this threshold is exceeded the endpoint should destroy the TCB and
  4790. * MUST report the peer endpoint unreachable to the upper layer (and
  4791. * thus the association enters the CLOSED state). The reception of any
  4792. * packet from its peer (i.e. as the peer sends all of its queued DATA
  4793. * chunks) should clear the endpoint's retransmission count and restart
  4794. * the T2-Shutdown timer, giving its peer ample opportunity to transmit
  4795. * all of its queued DATA chunks that have not yet been sent.
  4796. */
  4797. sctp_disposition_t sctp_sf_t2_timer_expire(const struct sctp_endpoint *ep,
  4798. const struct sctp_association *asoc,
  4799. const sctp_subtype_t type,
  4800. void *arg,
  4801. sctp_cmd_seq_t *commands)
  4802. {
  4803. struct sctp_chunk *reply = NULL;
  4804. SCTP_DEBUG_PRINTK("Timer T2 expired.\n");
  4805. SCTP_INC_STATS(SCTP_MIB_T2_SHUTDOWN_EXPIREDS);
  4806. ((struct sctp_association *)asoc)->shutdown_retries++;
  4807. if (asoc->overall_error_count >= asoc->max_retrans) {
  4808. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  4809. SCTP_ERROR(ETIMEDOUT));
  4810. /* Note: CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
  4811. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
  4812. SCTP_PERR(SCTP_ERROR_NO_ERROR));
  4813. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  4814. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  4815. return SCTP_DISPOSITION_DELETE_TCB;
  4816. }
  4817. switch (asoc->state) {
  4818. case SCTP_STATE_SHUTDOWN_SENT:
  4819. reply = sctp_make_shutdown(asoc, NULL);
  4820. break;
  4821. case SCTP_STATE_SHUTDOWN_ACK_SENT:
  4822. reply = sctp_make_shutdown_ack(asoc, NULL);
  4823. break;
  4824. default:
  4825. BUG();
  4826. break;
  4827. }
  4828. if (!reply)
  4829. goto nomem;
  4830. /* Do some failure management (Section 8.2). */
  4831. sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE,
  4832. SCTP_TRANSPORT(asoc->shutdown_last_sent_to));
  4833. /* Set the transport for the SHUTDOWN/ACK chunk and the timeout for
  4834. * the T2-shutdown timer.
  4835. */
  4836. sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
  4837. /* Restart the T2-shutdown timer. */
  4838. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
  4839. SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
  4840. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
  4841. return SCTP_DISPOSITION_CONSUME;
  4842. nomem:
  4843. return SCTP_DISPOSITION_NOMEM;
  4844. }
  4845. /*
  4846. * ADDIP Section 4.1 ASCONF CHunk Procedures
  4847. * If the T4 RTO timer expires the endpoint should do B1 to B5
  4848. */
  4849. sctp_disposition_t sctp_sf_t4_timer_expire(
  4850. const struct sctp_endpoint *ep,
  4851. const struct sctp_association *asoc,
  4852. const sctp_subtype_t type,
  4853. void *arg,
  4854. sctp_cmd_seq_t *commands)
  4855. {
  4856. struct sctp_chunk *chunk = asoc->addip_last_asconf;
  4857. struct sctp_transport *transport = chunk->transport;
  4858. SCTP_INC_STATS(SCTP_MIB_T4_RTO_EXPIREDS);
  4859. /* ADDIP 4.1 B1) Increment the error counters and perform path failure
  4860. * detection on the appropriate destination address as defined in
  4861. * RFC2960 [5] section 8.1 and 8.2.
  4862. */
  4863. sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE, SCTP_TRANSPORT(transport));
  4864. /* Reconfig T4 timer and transport. */
  4865. sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T4, SCTP_CHUNK(chunk));
  4866. /* ADDIP 4.1 B2) Increment the association error counters and perform
  4867. * endpoint failure detection on the association as defined in
  4868. * RFC2960 [5] section 8.1 and 8.2.
  4869. * association error counter is incremented in SCTP_CMD_STRIKE.
  4870. */
  4871. if (asoc->overall_error_count >= asoc->max_retrans) {
  4872. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
  4873. SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
  4874. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  4875. SCTP_ERROR(ETIMEDOUT));
  4876. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
  4877. SCTP_PERR(SCTP_ERROR_NO_ERROR));
  4878. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  4879. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  4880. return SCTP_DISPOSITION_ABORT;
  4881. }
  4882. /* ADDIP 4.1 B3) Back-off the destination address RTO value to which
  4883. * the ASCONF chunk was sent by doubling the RTO timer value.
  4884. * This is done in SCTP_CMD_STRIKE.
  4885. */
  4886. /* ADDIP 4.1 B4) Re-transmit the ASCONF Chunk last sent and if possible
  4887. * choose an alternate destination address (please refer to RFC2960
  4888. * [5] section 6.4.1). An endpoint MUST NOT add new parameters to this
  4889. * chunk, it MUST be the same (including its serial number) as the last
  4890. * ASCONF sent.
  4891. */
  4892. sctp_chunk_hold(asoc->addip_last_asconf);
  4893. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
  4894. SCTP_CHUNK(asoc->addip_last_asconf));
  4895. /* ADDIP 4.1 B5) Restart the T-4 RTO timer. Note that if a different
  4896. * destination is selected, then the RTO used will be that of the new
  4897. * destination address.
  4898. */
  4899. sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
  4900. SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
  4901. return SCTP_DISPOSITION_CONSUME;
  4902. }
  4903. /* sctpimpguide-05 Section 2.12.2
  4904. * The sender of the SHUTDOWN MAY also start an overall guard timer
  4905. * 'T5-shutdown-guard' to bound the overall time for shutdown sequence.
  4906. * At the expiration of this timer the sender SHOULD abort the association
  4907. * by sending an ABORT chunk.
  4908. */
  4909. sctp_disposition_t sctp_sf_t5_timer_expire(const struct sctp_endpoint *ep,
  4910. const struct sctp_association *asoc,
  4911. const sctp_subtype_t type,
  4912. void *arg,
  4913. sctp_cmd_seq_t *commands)
  4914. {
  4915. struct sctp_chunk *reply = NULL;
  4916. SCTP_DEBUG_PRINTK("Timer T5 expired.\n");
  4917. SCTP_INC_STATS(SCTP_MIB_T5_SHUTDOWN_GUARD_EXPIREDS);
  4918. reply = sctp_make_abort(asoc, NULL, 0);
  4919. if (!reply)
  4920. goto nomem;
  4921. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
  4922. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  4923. SCTP_ERROR(ETIMEDOUT));
  4924. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
  4925. SCTP_PERR(SCTP_ERROR_NO_ERROR));
  4926. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  4927. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  4928. return SCTP_DISPOSITION_DELETE_TCB;
  4929. nomem:
  4930. return SCTP_DISPOSITION_NOMEM;
  4931. }
  4932. /* Handle expiration of AUTOCLOSE timer. When the autoclose timer expires,
  4933. * the association is automatically closed by starting the shutdown process.
  4934. * The work that needs to be done is same as when SHUTDOWN is initiated by
  4935. * the user. So this routine looks same as sctp_sf_do_9_2_prm_shutdown().
  4936. */
  4937. sctp_disposition_t sctp_sf_autoclose_timer_expire(
  4938. const struct sctp_endpoint *ep,
  4939. const struct sctp_association *asoc,
  4940. const sctp_subtype_t type,
  4941. void *arg,
  4942. sctp_cmd_seq_t *commands)
  4943. {
  4944. int disposition;
  4945. SCTP_INC_STATS(SCTP_MIB_AUTOCLOSE_EXPIREDS);
  4946. /* From 9.2 Shutdown of an Association
  4947. * Upon receipt of the SHUTDOWN primitive from its upper
  4948. * layer, the endpoint enters SHUTDOWN-PENDING state and
  4949. * remains there until all outstanding data has been
  4950. * acknowledged by its peer. The endpoint accepts no new data
  4951. * from its upper layer, but retransmits data to the far end
  4952. * if necessary to fill gaps.
  4953. */
  4954. sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
  4955. SCTP_STATE(SCTP_STATE_SHUTDOWN_PENDING));
  4956. disposition = SCTP_DISPOSITION_CONSUME;
  4957. if (sctp_outq_is_empty(&asoc->outqueue)) {
  4958. disposition = sctp_sf_do_9_2_start_shutdown(ep, asoc, type,
  4959. arg, commands);
  4960. }
  4961. return disposition;
  4962. }
  4963. /*****************************************************************************
  4964. * These are sa state functions which could apply to all types of events.
  4965. ****************************************************************************/
  4966. /*
  4967. * This table entry is not implemented.
  4968. *
  4969. * Inputs
  4970. * (endpoint, asoc, chunk)
  4971. *
  4972. * The return value is the disposition of the chunk.
  4973. */
  4974. sctp_disposition_t sctp_sf_not_impl(const struct sctp_endpoint *ep,
  4975. const struct sctp_association *asoc,
  4976. const sctp_subtype_t type,
  4977. void *arg,
  4978. sctp_cmd_seq_t *commands)
  4979. {
  4980. return SCTP_DISPOSITION_NOT_IMPL;
  4981. }
  4982. /*
  4983. * This table entry represents a bug.
  4984. *
  4985. * Inputs
  4986. * (endpoint, asoc, chunk)
  4987. *
  4988. * The return value is the disposition of the chunk.
  4989. */
  4990. sctp_disposition_t sctp_sf_bug(const struct sctp_endpoint *ep,
  4991. const struct sctp_association *asoc,
  4992. const sctp_subtype_t type,
  4993. void *arg,
  4994. sctp_cmd_seq_t *commands)
  4995. {
  4996. return SCTP_DISPOSITION_BUG;
  4997. }
  4998. /*
  4999. * This table entry represents the firing of a timer in the wrong state.
  5000. * Since timer deletion cannot be guaranteed a timer 'may' end up firing
  5001. * when the association is in the wrong state. This event should
  5002. * be ignored, so as to prevent any rearming of the timer.
  5003. *
  5004. * Inputs
  5005. * (endpoint, asoc, chunk)
  5006. *
  5007. * The return value is the disposition of the chunk.
  5008. */
  5009. sctp_disposition_t sctp_sf_timer_ignore(const struct sctp_endpoint *ep,
  5010. const struct sctp_association *asoc,
  5011. const sctp_subtype_t type,
  5012. void *arg,
  5013. sctp_cmd_seq_t *commands)
  5014. {
  5015. SCTP_DEBUG_PRINTK("Timer %d ignored.\n", type.chunk);
  5016. return SCTP_DISPOSITION_CONSUME;
  5017. }
  5018. /********************************************************************
  5019. * 2nd Level Abstractions
  5020. ********************************************************************/
  5021. /* Pull the SACK chunk based on the SACK header. */
  5022. static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk)
  5023. {
  5024. struct sctp_sackhdr *sack;
  5025. unsigned int len;
  5026. __u16 num_blocks;
  5027. __u16 num_dup_tsns;
  5028. /* Protect ourselves from reading too far into
  5029. * the skb from a bogus sender.
  5030. */
  5031. sack = (struct sctp_sackhdr *) chunk->skb->data;
  5032. num_blocks = ntohs(sack->num_gap_ack_blocks);
  5033. num_dup_tsns = ntohs(sack->num_dup_tsns);
  5034. len = sizeof(struct sctp_sackhdr);
  5035. len += (num_blocks + num_dup_tsns) * sizeof(__u32);
  5036. if (len > chunk->skb->len)
  5037. return NULL;
  5038. skb_pull(chunk->skb, len);
  5039. return sack;
  5040. }
  5041. /* Create an ABORT packet to be sent as a response, with the specified
  5042. * error causes.
  5043. */
  5044. static struct sctp_packet *sctp_abort_pkt_new(const struct sctp_endpoint *ep,
  5045. const struct sctp_association *asoc,
  5046. struct sctp_chunk *chunk,
  5047. const void *payload,
  5048. size_t paylen)
  5049. {
  5050. struct sctp_packet *packet;
  5051. struct sctp_chunk *abort;
  5052. packet = sctp_ootb_pkt_new(asoc, chunk);
  5053. if (packet) {
  5054. /* Make an ABORT.
  5055. * The T bit will be set if the asoc is NULL.
  5056. */
  5057. abort = sctp_make_abort(asoc, chunk, paylen);
  5058. if (!abort) {
  5059. sctp_ootb_pkt_free(packet);
  5060. return NULL;
  5061. }
  5062. /* Reflect vtag if T-Bit is set */
  5063. if (sctp_test_T_bit(abort))
  5064. packet->vtag = ntohl(chunk->sctp_hdr->vtag);
  5065. /* Add specified error causes, i.e., payload, to the
  5066. * end of the chunk.
  5067. */
  5068. sctp_addto_chunk(abort, paylen, payload);
  5069. /* Set the skb to the belonging sock for accounting. */
  5070. abort->skb->sk = ep->base.sk;
  5071. sctp_packet_append_chunk(packet, abort);
  5072. }
  5073. return packet;
  5074. }
  5075. /* Allocate a packet for responding in the OOTB conditions. */
  5076. static struct sctp_packet *sctp_ootb_pkt_new(const struct sctp_association *asoc,
  5077. const struct sctp_chunk *chunk)
  5078. {
  5079. struct sctp_packet *packet;
  5080. struct sctp_transport *transport;
  5081. __u16 sport;
  5082. __u16 dport;
  5083. __u32 vtag;
  5084. /* Get the source and destination port from the inbound packet. */
  5085. sport = ntohs(chunk->sctp_hdr->dest);
  5086. dport = ntohs(chunk->sctp_hdr->source);
  5087. /* The V-tag is going to be the same as the inbound packet if no
  5088. * association exists, otherwise, use the peer's vtag.
  5089. */
  5090. if (asoc) {
  5091. /* Special case the INIT-ACK as there is no peer's vtag
  5092. * yet.
  5093. */
  5094. switch(chunk->chunk_hdr->type) {
  5095. case SCTP_CID_INIT_ACK:
  5096. {
  5097. sctp_initack_chunk_t *initack;
  5098. initack = (sctp_initack_chunk_t *)chunk->chunk_hdr;
  5099. vtag = ntohl(initack->init_hdr.init_tag);
  5100. break;
  5101. }
  5102. default:
  5103. vtag = asoc->peer.i.init_tag;
  5104. break;
  5105. }
  5106. } else {
  5107. /* Special case the INIT and stale COOKIE_ECHO as there is no
  5108. * vtag yet.
  5109. */
  5110. switch(chunk->chunk_hdr->type) {
  5111. case SCTP_CID_INIT:
  5112. {
  5113. sctp_init_chunk_t *init;
  5114. init = (sctp_init_chunk_t *)chunk->chunk_hdr;
  5115. vtag = ntohl(init->init_hdr.init_tag);
  5116. break;
  5117. }
  5118. default:
  5119. vtag = ntohl(chunk->sctp_hdr->vtag);
  5120. break;
  5121. }
  5122. }
  5123. /* Make a transport for the bucket, Eliza... */
  5124. transport = sctp_transport_new(sctp_source(chunk), GFP_ATOMIC);
  5125. if (!transport)
  5126. goto nomem;
  5127. /* Cache a route for the transport with the chunk's destination as
  5128. * the source address.
  5129. */
  5130. sctp_transport_route(transport, (union sctp_addr *)&chunk->dest,
  5131. sctp_sk(sctp_get_ctl_sock()));
  5132. packet = sctp_packet_init(&transport->packet, transport, sport, dport);
  5133. packet = sctp_packet_config(packet, vtag, 0);
  5134. return packet;
  5135. nomem:
  5136. return NULL;
  5137. }
  5138. /* Free the packet allocated earlier for responding in the OOTB condition. */
  5139. void sctp_ootb_pkt_free(struct sctp_packet *packet)
  5140. {
  5141. sctp_transport_free(packet->transport);
  5142. }
  5143. /* Send a stale cookie error when a invalid COOKIE ECHO chunk is found */
  5144. static void sctp_send_stale_cookie_err(const struct sctp_endpoint *ep,
  5145. const struct sctp_association *asoc,
  5146. const struct sctp_chunk *chunk,
  5147. sctp_cmd_seq_t *commands,
  5148. struct sctp_chunk *err_chunk)
  5149. {
  5150. struct sctp_packet *packet;
  5151. if (err_chunk) {
  5152. packet = sctp_ootb_pkt_new(asoc, chunk);
  5153. if (packet) {
  5154. struct sctp_signed_cookie *cookie;
  5155. /* Override the OOTB vtag from the cookie. */
  5156. cookie = chunk->subh.cookie_hdr;
  5157. packet->vtag = cookie->c.peer_vtag;
  5158. /* Set the skb to the belonging sock for accounting. */
  5159. err_chunk->skb->sk = ep->base.sk;
  5160. sctp_packet_append_chunk(packet, err_chunk);
  5161. sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
  5162. SCTP_PACKET(packet));
  5163. SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
  5164. } else
  5165. sctp_chunk_free (err_chunk);
  5166. }
  5167. }
  5168. /* Process a data chunk */
  5169. static int sctp_eat_data(const struct sctp_association *asoc,
  5170. struct sctp_chunk *chunk,
  5171. sctp_cmd_seq_t *commands)
  5172. {
  5173. sctp_datahdr_t *data_hdr;
  5174. struct sctp_chunk *err;
  5175. size_t datalen;
  5176. sctp_verb_t deliver;
  5177. int tmp;
  5178. __u32 tsn;
  5179. struct sctp_tsnmap *map = (struct sctp_tsnmap *)&asoc->peer.tsn_map;
  5180. struct sock *sk = asoc->base.sk;
  5181. data_hdr = chunk->subh.data_hdr = (sctp_datahdr_t *)chunk->skb->data;
  5182. skb_pull(chunk->skb, sizeof(sctp_datahdr_t));
  5183. tsn = ntohl(data_hdr->tsn);
  5184. SCTP_DEBUG_PRINTK("eat_data: TSN 0x%x.\n", tsn);
  5185. /* ASSERT: Now skb->data is really the user data. */
  5186. /* Process ECN based congestion.
  5187. *
  5188. * Since the chunk structure is reused for all chunks within
  5189. * a packet, we use ecn_ce_done to track if we've already
  5190. * done CE processing for this packet.
  5191. *
  5192. * We need to do ECN processing even if we plan to discard the
  5193. * chunk later.
  5194. */
  5195. if (!chunk->ecn_ce_done) {
  5196. struct sctp_af *af;
  5197. chunk->ecn_ce_done = 1;
  5198. af = sctp_get_af_specific(
  5199. ipver2af(ip_hdr(chunk->skb)->version));
  5200. if (af && af->is_ce(chunk->skb) && asoc->peer.ecn_capable) {
  5201. /* Do real work as sideffect. */
  5202. sctp_add_cmd_sf(commands, SCTP_CMD_ECN_CE,
  5203. SCTP_U32(tsn));
  5204. }
  5205. }
  5206. tmp = sctp_tsnmap_check(&asoc->peer.tsn_map, tsn);
  5207. if (tmp < 0) {
  5208. /* The TSN is too high--silently discard the chunk and
  5209. * count on it getting retransmitted later.
  5210. */
  5211. return SCTP_IERROR_HIGH_TSN;
  5212. } else if (tmp > 0) {
  5213. /* This is a duplicate. Record it. */
  5214. sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_DUP, SCTP_U32(tsn));
  5215. return SCTP_IERROR_DUP_TSN;
  5216. }
  5217. /* This is a new TSN. */
  5218. /* Discard if there is no room in the receive window.
  5219. * Actually, allow a little bit of overflow (up to a MTU).
  5220. */
  5221. datalen = ntohs(chunk->chunk_hdr->length);
  5222. datalen -= sizeof(sctp_data_chunk_t);
  5223. deliver = SCTP_CMD_CHUNK_ULP;
  5224. /* Think about partial delivery. */
  5225. if ((datalen >= asoc->rwnd) && (!asoc->ulpq.pd_mode)) {
  5226. /* Even if we don't accept this chunk there is
  5227. * memory pressure.
  5228. */
  5229. sctp_add_cmd_sf(commands, SCTP_CMD_PART_DELIVER, SCTP_NULL());
  5230. }
  5231. /* Spill over rwnd a little bit. Note: While allowed, this spill over
  5232. * seems a bit troublesome in that frag_point varies based on
  5233. * PMTU. In cases, such as loopback, this might be a rather
  5234. * large spill over.
  5235. */
  5236. if ((!chunk->data_accepted) && (!asoc->rwnd || asoc->rwnd_over ||
  5237. (datalen > asoc->rwnd + asoc->frag_point))) {
  5238. /* If this is the next TSN, consider reneging to make
  5239. * room. Note: Playing nice with a confused sender. A
  5240. * malicious sender can still eat up all our buffer
  5241. * space and in the future we may want to detect and
  5242. * do more drastic reneging.
  5243. */
  5244. if (sctp_tsnmap_has_gap(map) &&
  5245. (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
  5246. SCTP_DEBUG_PRINTK("Reneging for tsn:%u\n", tsn);
  5247. deliver = SCTP_CMD_RENEGE;
  5248. } else {
  5249. SCTP_DEBUG_PRINTK("Discard tsn: %u len: %Zd, "
  5250. "rwnd: %d\n", tsn, datalen,
  5251. asoc->rwnd);
  5252. return SCTP_IERROR_IGNORE_TSN;
  5253. }
  5254. }
  5255. /*
  5256. * Also try to renege to limit our memory usage in the event that
  5257. * we are under memory pressure
  5258. * If we can't renege, don't worry about it, the sk_rmem_schedule
  5259. * in sctp_ulpevent_make_rcvmsg will drop the frame if we grow our
  5260. * memory usage too much
  5261. */
  5262. if (*sk->sk_prot_creator->memory_pressure) {
  5263. if (sctp_tsnmap_has_gap(map) &&
  5264. (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
  5265. SCTP_DEBUG_PRINTK("Under Pressure! Reneging for tsn:%u\n", tsn);
  5266. deliver = SCTP_CMD_RENEGE;
  5267. }
  5268. }
  5269. /*
  5270. * Section 3.3.10.9 No User Data (9)
  5271. *
  5272. * Cause of error
  5273. * ---------------
  5274. * No User Data: This error cause is returned to the originator of a
  5275. * DATA chunk if a received DATA chunk has no user data.
  5276. */
  5277. if (unlikely(0 == datalen)) {
  5278. err = sctp_make_abort_no_data(asoc, chunk, tsn);
  5279. if (err) {
  5280. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
  5281. SCTP_CHUNK(err));
  5282. }
  5283. /* We are going to ABORT, so we might as well stop
  5284. * processing the rest of the chunks in the packet.
  5285. */
  5286. sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
  5287. sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
  5288. SCTP_ERROR(ECONNABORTED));
  5289. sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
  5290. SCTP_PERR(SCTP_ERROR_NO_DATA));
  5291. SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
  5292. SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
  5293. return SCTP_IERROR_NO_DATA;
  5294. }
  5295. chunk->data_accepted = 1;
  5296. /* Note: Some chunks may get overcounted (if we drop) or overcounted
  5297. * if we renege and the chunk arrives again.
  5298. */
  5299. if (chunk->chunk_hdr->flags & SCTP_DATA_UNORDERED)
  5300. SCTP_INC_STATS(SCTP_MIB_INUNORDERCHUNKS);
  5301. else
  5302. SCTP_INC_STATS(SCTP_MIB_INORDERCHUNKS);
  5303. /* RFC 2960 6.5 Stream Identifier and Stream Sequence Number
  5304. *
  5305. * If an endpoint receive a DATA chunk with an invalid stream
  5306. * identifier, it shall acknowledge the reception of the DATA chunk
  5307. * following the normal procedure, immediately send an ERROR chunk
  5308. * with cause set to "Invalid Stream Identifier" (See Section 3.3.10)
  5309. * and discard the DATA chunk.
  5310. */
  5311. if (ntohs(data_hdr->stream) >= asoc->c.sinit_max_instreams) {
  5312. /* Mark tsn as received even though we drop it */
  5313. sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_TSN, SCTP_U32(tsn));
  5314. err = sctp_make_op_error(asoc, chunk, SCTP_ERROR_INV_STRM,
  5315. &data_hdr->stream,
  5316. sizeof(data_hdr->stream));
  5317. if (err)
  5318. sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
  5319. SCTP_CHUNK(err));
  5320. return SCTP_IERROR_BAD_STREAM;
  5321. }
  5322. /* Send the data up to the user. Note: Schedule the
  5323. * SCTP_CMD_CHUNK_ULP cmd before the SCTP_CMD_GEN_SACK, as the SACK
  5324. * chunk needs the updated rwnd.
  5325. */
  5326. sctp_add_cmd_sf(commands, deliver, SCTP_CHUNK(chunk));
  5327. return SCTP_IERROR_NO_ERROR;
  5328. }