1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * net/dccp/feat.c
4 *
5 * Feature negotiation for the DCCP protocol (RFC 4340, section 6)
6 *
7 * Copyright (c) 2008 Gerrit Renker <gerrit@erg.abdn.ac.uk>
8 * Rewrote from scratch, some bits from earlier code by
9 * Copyright (c) 2005 Andrea Bittau <a.bittau@cs.ucl.ac.uk>
10 *
11 * ASSUMPTIONS
12 * -----------
13 * o Feature negotiation is coordinated with connection setup (as in TCP), wild
14 * changes of parameters of an established connection are not supported.
15 * o Changing non-negotiable (NN) values is supported in state OPEN/PARTOPEN.
16 * o All currently known SP features have 1-byte quantities. If in the future
17 * extensions of RFCs 4340..42 define features with item lengths larger than
18 * one byte, a feature-specific extension of the code will be required.
19 */
20 #include <linux/module.h>
21 #include <linux/slab.h>
22 #include "ccid.h"
23 #include "feat.h"
24
25 /* feature-specific sysctls - initialised to the defaults from RFC 4340, 6.4 */
26 unsigned long sysctl_dccp_sequence_window __read_mostly = 100;
27 int sysctl_dccp_rx_ccid __read_mostly = 2,
28 sysctl_dccp_tx_ccid __read_mostly = 2;
29
30 /*
31 * Feature activation handlers.
32 *
33 * These all use an u64 argument, to provide enough room for NN/SP features. At
34 * this stage the negotiated values have been checked to be within their range.
35 */
dccp_hdlr_ccid(struct sock * sk,u64 ccid,bool rx)36 static int dccp_hdlr_ccid(struct sock *sk, u64 ccid, bool rx)
37 {
38 struct dccp_sock *dp = dccp_sk(sk);
39 struct ccid *new_ccid = ccid_new(ccid, sk, rx);
40
41 if (new_ccid == NULL)
42 return -ENOMEM;
43
44 if (rx) {
45 ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
46 dp->dccps_hc_rx_ccid = new_ccid;
47 } else {
48 ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
49 dp->dccps_hc_tx_ccid = new_ccid;
50 }
51 return 0;
52 }
53
dccp_hdlr_seq_win(struct sock * sk,u64 seq_win,bool rx)54 static int dccp_hdlr_seq_win(struct sock *sk, u64 seq_win, bool rx)
55 {
56 struct dccp_sock *dp = dccp_sk(sk);
57
58 if (rx) {
59 dp->dccps_r_seq_win = seq_win;
60 /* propagate changes to update SWL/SWH */
61 dccp_update_gsr(sk, dp->dccps_gsr);
62 } else {
63 dp->dccps_l_seq_win = seq_win;
64 /* propagate changes to update AWL */
65 dccp_update_gss(sk, dp->dccps_gss);
66 }
67 return 0;
68 }
69
dccp_hdlr_ack_ratio(struct sock * sk,u64 ratio,bool rx)70 static int dccp_hdlr_ack_ratio(struct sock *sk, u64 ratio, bool rx)
71 {
72 if (rx)
73 dccp_sk(sk)->dccps_r_ack_ratio = ratio;
74 else
75 dccp_sk(sk)->dccps_l_ack_ratio = ratio;
76 return 0;
77 }
78
dccp_hdlr_ackvec(struct sock * sk,u64 enable,bool rx)79 static int dccp_hdlr_ackvec(struct sock *sk, u64 enable, bool rx)
80 {
81 struct dccp_sock *dp = dccp_sk(sk);
82
83 if (rx) {
84 if (enable && dp->dccps_hc_rx_ackvec == NULL) {
85 dp->dccps_hc_rx_ackvec = dccp_ackvec_alloc(gfp_any());
86 if (dp->dccps_hc_rx_ackvec == NULL)
87 return -ENOMEM;
88 } else if (!enable) {
89 dccp_ackvec_free(dp->dccps_hc_rx_ackvec);
90 dp->dccps_hc_rx_ackvec = NULL;
91 }
92 }
93 return 0;
94 }
95
dccp_hdlr_ndp(struct sock * sk,u64 enable,bool rx)96 static int dccp_hdlr_ndp(struct sock *sk, u64 enable, bool rx)
97 {
98 if (!rx)
99 dccp_sk(sk)->dccps_send_ndp_count = (enable > 0);
100 return 0;
101 }
102
103 /*
104 * Minimum Checksum Coverage is located at the RX side (9.2.1). This means that
105 * `rx' holds when the sending peer informs about his partial coverage via a
106 * ChangeR() option. In the other case, we are the sender and the receiver
107 * announces its coverage via ChangeL() options. The policy here is to honour
108 * such communication by enabling the corresponding partial coverage - but only
109 * if it has not been set manually before; the warning here means that all
110 * packets will be dropped.
111 */
dccp_hdlr_min_cscov(struct sock * sk,u64 cscov,bool rx)112 static int dccp_hdlr_min_cscov(struct sock *sk, u64 cscov, bool rx)
113 {
114 struct dccp_sock *dp = dccp_sk(sk);
115
116 if (rx)
117 dp->dccps_pcrlen = cscov;
118 else {
119 if (dp->dccps_pcslen == 0)
120 dp->dccps_pcslen = cscov;
121 else if (cscov > dp->dccps_pcslen)
122 DCCP_WARN("CsCov %u too small, peer requires >= %u\n",
123 dp->dccps_pcslen, (u8)cscov);
124 }
125 return 0;
126 }
127
128 static const struct {
129 u8 feat_num; /* DCCPF_xxx */
130 enum dccp_feat_type rxtx; /* RX or TX */
131 enum dccp_feat_type reconciliation; /* SP or NN */
132 u8 default_value; /* as in 6.4 */
133 int (*activation_hdlr)(struct sock *sk, u64 val, bool rx);
134 /*
135 * Lookup table for location and type of features (from RFC 4340/4342)
136 * +--------------------------+----+-----+----+----+---------+-----------+
137 * | Feature | Location | Reconc. | Initial | Section |
138 * | | RX | TX | SP | NN | Value | Reference |
139 * +--------------------------+----+-----+----+----+---------+-----------+
140 * | DCCPF_CCID | | X | X | | 2 | 10 |
141 * | DCCPF_SHORT_SEQNOS | | X | X | | 0 | 7.6.1 |
142 * | DCCPF_SEQUENCE_WINDOW | | X | | X | 100 | 7.5.2 |
143 * | DCCPF_ECN_INCAPABLE | X | | X | | 0 | 12.1 |
144 * | DCCPF_ACK_RATIO | | X | | X | 2 | 11.3 |
145 * | DCCPF_SEND_ACK_VECTOR | X | | X | | 0 | 11.5 |
146 * | DCCPF_SEND_NDP_COUNT | | X | X | | 0 | 7.7.2 |
147 * | DCCPF_MIN_CSUM_COVER | X | | X | | 0 | 9.2.1 |
148 * | DCCPF_DATA_CHECKSUM | X | | X | | 0 | 9.3.1 |
149 * | DCCPF_SEND_LEV_RATE | X | | X | | 0 | 4342/8.4 |
150 * +--------------------------+----+-----+----+----+---------+-----------+
151 */
152 } dccp_feat_table[] = {
153 { DCCPF_CCID, FEAT_AT_TX, FEAT_SP, 2, dccp_hdlr_ccid },
154 { DCCPF_SHORT_SEQNOS, FEAT_AT_TX, FEAT_SP, 0, NULL },
155 { DCCPF_SEQUENCE_WINDOW, FEAT_AT_TX, FEAT_NN, 100, dccp_hdlr_seq_win },
156 { DCCPF_ECN_INCAPABLE, FEAT_AT_RX, FEAT_SP, 0, NULL },
157 { DCCPF_ACK_RATIO, FEAT_AT_TX, FEAT_NN, 2, dccp_hdlr_ack_ratio},
158 { DCCPF_SEND_ACK_VECTOR, FEAT_AT_RX, FEAT_SP, 0, dccp_hdlr_ackvec },
159 { DCCPF_SEND_NDP_COUNT, FEAT_AT_TX, FEAT_SP, 0, dccp_hdlr_ndp },
160 { DCCPF_MIN_CSUM_COVER, FEAT_AT_RX, FEAT_SP, 0, dccp_hdlr_min_cscov},
161 { DCCPF_DATA_CHECKSUM, FEAT_AT_RX, FEAT_SP, 0, NULL },
162 { DCCPF_SEND_LEV_RATE, FEAT_AT_RX, FEAT_SP, 0, NULL },
163 };
164 #define DCCP_FEAT_SUPPORTED_MAX ARRAY_SIZE(dccp_feat_table)
165
166 /**
167 * dccp_feat_index - Hash function to map feature number into array position
168 * @feat_num: feature to hash, one of %dccp_feature_numbers
169 *
170 * Returns consecutive array index or -1 if the feature is not understood.
171 */
dccp_feat_index(u8 feat_num)172 static int dccp_feat_index(u8 feat_num)
173 {
174 /* The first 9 entries are occupied by the types from RFC 4340, 6.4 */
175 if (feat_num > DCCPF_RESERVED && feat_num <= DCCPF_DATA_CHECKSUM)
176 return feat_num - 1;
177
178 /*
179 * Other features: add cases for new feature types here after adding
180 * them to the above table.
181 */
182 switch (feat_num) {
183 case DCCPF_SEND_LEV_RATE:
184 return DCCP_FEAT_SUPPORTED_MAX - 1;
185 }
186 return -1;
187 }
188
dccp_feat_type(u8 feat_num)189 static u8 dccp_feat_type(u8 feat_num)
190 {
191 int idx = dccp_feat_index(feat_num);
192
193 if (idx < 0)
194 return FEAT_UNKNOWN;
195 return dccp_feat_table[idx].reconciliation;
196 }
197
dccp_feat_default_value(u8 feat_num)198 static int dccp_feat_default_value(u8 feat_num)
199 {
200 int idx = dccp_feat_index(feat_num);
201 /*
202 * There are no default values for unknown features, so encountering a
203 * negative index here indicates a serious problem somewhere else.
204 */
205 DCCP_BUG_ON(idx < 0);
206
207 return idx < 0 ? 0 : dccp_feat_table[idx].default_value;
208 }
209
210 /*
211 * Debugging and verbose-printing section
212 */
dccp_feat_fname(const u8 feat)213 static const char *dccp_feat_fname(const u8 feat)
214 {
215 static const char *const feature_names[] = {
216 [DCCPF_RESERVED] = "Reserved",
217 [DCCPF_CCID] = "CCID",
218 [DCCPF_SHORT_SEQNOS] = "Allow Short Seqnos",
219 [DCCPF_SEQUENCE_WINDOW] = "Sequence Window",
220 [DCCPF_ECN_INCAPABLE] = "ECN Incapable",
221 [DCCPF_ACK_RATIO] = "Ack Ratio",
222 [DCCPF_SEND_ACK_VECTOR] = "Send ACK Vector",
223 [DCCPF_SEND_NDP_COUNT] = "Send NDP Count",
224 [DCCPF_MIN_CSUM_COVER] = "Min. Csum Coverage",
225 [DCCPF_DATA_CHECKSUM] = "Send Data Checksum",
226 };
227 if (feat > DCCPF_DATA_CHECKSUM && feat < DCCPF_MIN_CCID_SPECIFIC)
228 return feature_names[DCCPF_RESERVED];
229
230 if (feat == DCCPF_SEND_LEV_RATE)
231 return "Send Loss Event Rate";
232 if (feat >= DCCPF_MIN_CCID_SPECIFIC)
233 return "CCID-specific";
234
235 return feature_names[feat];
236 }
237
238 static const char *const dccp_feat_sname[] = {
239 "DEFAULT", "INITIALISING", "CHANGING", "UNSTABLE", "STABLE",
240 };
241
242 #ifdef CONFIG_IP_DCCP_DEBUG
dccp_feat_oname(const u8 opt)243 static const char *dccp_feat_oname(const u8 opt)
244 {
245 switch (opt) {
246 case DCCPO_CHANGE_L: return "Change_L";
247 case DCCPO_CONFIRM_L: return "Confirm_L";
248 case DCCPO_CHANGE_R: return "Change_R";
249 case DCCPO_CONFIRM_R: return "Confirm_R";
250 }
251 return NULL;
252 }
253
dccp_feat_printval(u8 feat_num,dccp_feat_val const * val)254 static void dccp_feat_printval(u8 feat_num, dccp_feat_val const *val)
255 {
256 u8 i, type = dccp_feat_type(feat_num);
257
258 if (val == NULL || (type == FEAT_SP && val->sp.vec == NULL))
259 dccp_pr_debug_cat("(NULL)");
260 else if (type == FEAT_SP)
261 for (i = 0; i < val->sp.len; i++)
262 dccp_pr_debug_cat("%s%u", i ? " " : "", val->sp.vec[i]);
263 else if (type == FEAT_NN)
264 dccp_pr_debug_cat("%llu", (unsigned long long)val->nn);
265 else
266 dccp_pr_debug_cat("unknown type %u", type);
267 }
268
dccp_feat_printvals(u8 feat_num,u8 * list,u8 len)269 static void dccp_feat_printvals(u8 feat_num, u8 *list, u8 len)
270 {
271 u8 type = dccp_feat_type(feat_num);
272 dccp_feat_val fval = { .sp.vec = list, .sp.len = len };
273
274 if (type == FEAT_NN)
275 fval.nn = dccp_decode_value_var(list, len);
276 dccp_feat_printval(feat_num, &fval);
277 }
278
dccp_feat_print_entry(struct dccp_feat_entry const * entry)279 static void dccp_feat_print_entry(struct dccp_feat_entry const *entry)
280 {
281 dccp_debug(" * %s %s = ", entry->is_local ? "local" : "remote",
282 dccp_feat_fname(entry->feat_num));
283 dccp_feat_printval(entry->feat_num, &entry->val);
284 dccp_pr_debug_cat(", state=%s %s\n", dccp_feat_sname[entry->state],
285 entry->needs_confirm ? "(Confirm pending)" : "");
286 }
287
288 #define dccp_feat_print_opt(opt, feat, val, len, mandatory) do { \
289 dccp_pr_debug("%s(%s, ", dccp_feat_oname(opt), dccp_feat_fname(feat));\
290 dccp_feat_printvals(feat, val, len); \
291 dccp_pr_debug_cat(") %s\n", mandatory ? "!" : ""); } while (0)
292
293 #define dccp_feat_print_fnlist(fn_list) { \
294 const struct dccp_feat_entry *___entry; \
295 \
296 dccp_pr_debug("List Dump:\n"); \
297 list_for_each_entry(___entry, fn_list, node) \
298 dccp_feat_print_entry(___entry); \
299 }
300 #else /* ! CONFIG_IP_DCCP_DEBUG */
301 #define dccp_feat_print_opt(opt, feat, val, len, mandatory)
302 #define dccp_feat_print_fnlist(fn_list)
303 #endif
304
__dccp_feat_activate(struct sock * sk,const int idx,const bool is_local,dccp_feat_val const * fval)305 static int __dccp_feat_activate(struct sock *sk, const int idx,
306 const bool is_local, dccp_feat_val const *fval)
307 {
308 bool rx;
309 u64 val;
310
311 if (idx < 0 || idx >= DCCP_FEAT_SUPPORTED_MAX)
312 return -1;
313 if (dccp_feat_table[idx].activation_hdlr == NULL)
314 return 0;
315
316 if (fval == NULL) {
317 val = dccp_feat_table[idx].default_value;
318 } else if (dccp_feat_table[idx].reconciliation == FEAT_SP) {
319 if (fval->sp.vec == NULL) {
320 /*
321 * This can happen when an empty Confirm is sent
322 * for an SP (i.e. known) feature. In this case
323 * we would be using the default anyway.
324 */
325 DCCP_CRIT("Feature #%d undefined: using default", idx);
326 val = dccp_feat_table[idx].default_value;
327 } else {
328 val = fval->sp.vec[0];
329 }
330 } else {
331 val = fval->nn;
332 }
333
334 /* Location is RX if this is a local-RX or remote-TX feature */
335 rx = (is_local == (dccp_feat_table[idx].rxtx == FEAT_AT_RX));
336
337 dccp_debug(" -> activating %s %s, %sval=%llu\n", rx ? "RX" : "TX",
338 dccp_feat_fname(dccp_feat_table[idx].feat_num),
339 fval ? "" : "default ", (unsigned long long)val);
340
341 return dccp_feat_table[idx].activation_hdlr(sk, val, rx);
342 }
343
344 /**
345 * dccp_feat_activate - Activate feature value on socket
346 * @sk: fully connected DCCP socket (after handshake is complete)
347 * @feat_num: feature to activate, one of %dccp_feature_numbers
348 * @local: whether local (1) or remote (0) @feat_num is meant
349 * @fval: the value (SP or NN) to activate, or NULL to use the default value
350 *
351 * For general use this function is preferable over __dccp_feat_activate().
352 */
dccp_feat_activate(struct sock * sk,u8 feat_num,bool local,dccp_feat_val const * fval)353 static int dccp_feat_activate(struct sock *sk, u8 feat_num, bool local,
354 dccp_feat_val const *fval)
355 {
356 return __dccp_feat_activate(sk, dccp_feat_index(feat_num), local, fval);
357 }
358
359 /* Test for "Req'd" feature (RFC 4340, 6.4) */
dccp_feat_must_be_understood(u8 feat_num)360 static inline int dccp_feat_must_be_understood(u8 feat_num)
361 {
362 return feat_num == DCCPF_CCID || feat_num == DCCPF_SHORT_SEQNOS ||
363 feat_num == DCCPF_SEQUENCE_WINDOW;
364 }
365
366 /* copy constructor, fval must not already contain allocated memory */
dccp_feat_clone_sp_val(dccp_feat_val * fval,u8 const * val,u8 len)367 static int dccp_feat_clone_sp_val(dccp_feat_val *fval, u8 const *val, u8 len)
368 {
369 fval->sp.len = len;
370 if (fval->sp.len > 0) {
371 fval->sp.vec = kmemdup(val, len, gfp_any());
372 if (fval->sp.vec == NULL) {
373 fval->sp.len = 0;
374 return -ENOMEM;
375 }
376 }
377 return 0;
378 }
379
dccp_feat_val_destructor(u8 feat_num,dccp_feat_val * val)380 static void dccp_feat_val_destructor(u8 feat_num, dccp_feat_val *val)
381 {
382 if (unlikely(val == NULL))
383 return;
384 if (dccp_feat_type(feat_num) == FEAT_SP)
385 kfree(val->sp.vec);
386 memset(val, 0, sizeof(*val));
387 }
388
389 static struct dccp_feat_entry *
dccp_feat_clone_entry(struct dccp_feat_entry const * original)390 dccp_feat_clone_entry(struct dccp_feat_entry const *original)
391 {
392 struct dccp_feat_entry *new;
393 u8 type = dccp_feat_type(original->feat_num);
394
395 if (type == FEAT_UNKNOWN)
396 return NULL;
397
398 new = kmemdup(original, sizeof(struct dccp_feat_entry), gfp_any());
399 if (new == NULL)
400 return NULL;
401
402 if (type == FEAT_SP && dccp_feat_clone_sp_val(&new->val,
403 original->val.sp.vec,
404 original->val.sp.len)) {
405 kfree(new);
406 return NULL;
407 }
408 return new;
409 }
410
dccp_feat_entry_destructor(struct dccp_feat_entry * entry)411 static void dccp_feat_entry_destructor(struct dccp_feat_entry *entry)
412 {
413 if (entry != NULL) {
414 dccp_feat_val_destructor(entry->feat_num, &entry->val);
415 kfree(entry);
416 }
417 }
418
419 /*
420 * List management functions
421 *
422 * Feature negotiation lists rely on and maintain the following invariants:
423 * - each feat_num in the list is known, i.e. we know its type and default value
424 * - each feat_num/is_local combination is unique (old entries are overwritten)
425 * - SP values are always freshly allocated
426 * - list is sorted in increasing order of feature number (faster lookup)
427 */
dccp_feat_list_lookup(struct list_head * fn_list,u8 feat_num,bool is_local)428 static struct dccp_feat_entry *dccp_feat_list_lookup(struct list_head *fn_list,
429 u8 feat_num, bool is_local)
430 {
431 struct dccp_feat_entry *entry;
432
433 list_for_each_entry(entry, fn_list, node) {
434 if (entry->feat_num == feat_num && entry->is_local == is_local)
435 return entry;
436 else if (entry->feat_num > feat_num)
437 break;
438 }
439 return NULL;
440 }
441
442 /**
443 * dccp_feat_entry_new - Central list update routine (called by all others)
444 * @head: list to add to
445 * @feat: feature number
446 * @local: whether the local (1) or remote feature with number @feat is meant
447 *
448 * This is the only constructor and serves to ensure the above invariants.
449 */
450 static struct dccp_feat_entry *
dccp_feat_entry_new(struct list_head * head,u8 feat,bool local)451 dccp_feat_entry_new(struct list_head *head, u8 feat, bool local)
452 {
453 struct dccp_feat_entry *entry;
454
455 list_for_each_entry(entry, head, node)
456 if (entry->feat_num == feat && entry->is_local == local) {
457 dccp_feat_val_destructor(entry->feat_num, &entry->val);
458 return entry;
459 } else if (entry->feat_num > feat) {
460 head = &entry->node;
461 break;
462 }
463
464 entry = kmalloc(sizeof(*entry), gfp_any());
465 if (entry != NULL) {
466 entry->feat_num = feat;
467 entry->is_local = local;
468 list_add_tail(&entry->node, head);
469 }
470 return entry;
471 }
472
473 /**
474 * dccp_feat_push_change - Add/overwrite a Change option in the list
475 * @fn_list: feature-negotiation list to update
476 * @feat: one of %dccp_feature_numbers
477 * @local: whether local (1) or remote (0) @feat_num is meant
478 * @mandatory: whether to use Mandatory feature negotiation options
479 * @fval: pointer to NN/SP value to be inserted (will be copied)
480 */
dccp_feat_push_change(struct list_head * fn_list,u8 feat,u8 local,u8 mandatory,dccp_feat_val * fval)481 static int dccp_feat_push_change(struct list_head *fn_list, u8 feat, u8 local,
482 u8 mandatory, dccp_feat_val *fval)
483 {
484 struct dccp_feat_entry *new = dccp_feat_entry_new(fn_list, feat, local);
485
486 if (new == NULL)
487 return -ENOMEM;
488
489 new->feat_num = feat;
490 new->is_local = local;
491 new->state = FEAT_INITIALISING;
492 new->needs_confirm = false;
493 new->empty_confirm = false;
494 new->val = *fval;
495 new->needs_mandatory = mandatory;
496
497 return 0;
498 }
499
500 /**
501 * dccp_feat_push_confirm - Add a Confirm entry to the FN list
502 * @fn_list: feature-negotiation list to add to
503 * @feat: one of %dccp_feature_numbers
504 * @local: whether local (1) or remote (0) @feat_num is being confirmed
505 * @fval: pointer to NN/SP value to be inserted or NULL
506 *
507 * Returns 0 on success, a Reset code for further processing otherwise.
508 */
dccp_feat_push_confirm(struct list_head * fn_list,u8 feat,u8 local,dccp_feat_val * fval)509 static int dccp_feat_push_confirm(struct list_head *fn_list, u8 feat, u8 local,
510 dccp_feat_val *fval)
511 {
512 struct dccp_feat_entry *new = dccp_feat_entry_new(fn_list, feat, local);
513
514 if (new == NULL)
515 return DCCP_RESET_CODE_TOO_BUSY;
516
517 new->feat_num = feat;
518 new->is_local = local;
519 new->state = FEAT_STABLE; /* transition in 6.6.2 */
520 new->needs_confirm = true;
521 new->empty_confirm = (fval == NULL);
522 new->val.nn = 0; /* zeroes the whole structure */
523 if (!new->empty_confirm)
524 new->val = *fval;
525 new->needs_mandatory = false;
526
527 return 0;
528 }
529
dccp_push_empty_confirm(struct list_head * fn_list,u8 feat,u8 local)530 static int dccp_push_empty_confirm(struct list_head *fn_list, u8 feat, u8 local)
531 {
532 return dccp_feat_push_confirm(fn_list, feat, local, NULL);
533 }
534
dccp_feat_list_pop(struct dccp_feat_entry * entry)535 static inline void dccp_feat_list_pop(struct dccp_feat_entry *entry)
536 {
537 list_del(&entry->node);
538 dccp_feat_entry_destructor(entry);
539 }
540
dccp_feat_list_purge(struct list_head * fn_list)541 void dccp_feat_list_purge(struct list_head *fn_list)
542 {
543 struct dccp_feat_entry *entry, *next;
544
545 list_for_each_entry_safe(entry, next, fn_list, node)
546 dccp_feat_entry_destructor(entry);
547 INIT_LIST_HEAD(fn_list);
548 }
549 EXPORT_SYMBOL_GPL(dccp_feat_list_purge);
550
551 /* generate @to as full clone of @from - @to must not contain any nodes */
dccp_feat_clone_list(struct list_head const * from,struct list_head * to)552 int dccp_feat_clone_list(struct list_head const *from, struct list_head *to)
553 {
554 struct dccp_feat_entry *entry, *new;
555
556 INIT_LIST_HEAD(to);
557 list_for_each_entry(entry, from, node) {
558 new = dccp_feat_clone_entry(entry);
559 if (new == NULL)
560 goto cloning_failed;
561 list_add_tail(&new->node, to);
562 }
563 return 0;
564
565 cloning_failed:
566 dccp_feat_list_purge(to);
567 return -ENOMEM;
568 }
569
570 /**
571 * dccp_feat_valid_nn_length - Enforce length constraints on NN options
572 * @feat_num: feature to return length of, one of %dccp_feature_numbers
573 *
574 * Length is between 0 and %DCCP_OPTVAL_MAXLEN. Used for outgoing packets only,
575 * incoming options are accepted as long as their values are valid.
576 */
dccp_feat_valid_nn_length(u8 feat_num)577 static u8 dccp_feat_valid_nn_length(u8 feat_num)
578 {
579 if (feat_num == DCCPF_ACK_RATIO) /* RFC 4340, 11.3 and 6.6.8 */
580 return 2;
581 if (feat_num == DCCPF_SEQUENCE_WINDOW) /* RFC 4340, 7.5.2 and 6.5 */
582 return 6;
583 return 0;
584 }
585
dccp_feat_is_valid_nn_val(u8 feat_num,u64 val)586 static u8 dccp_feat_is_valid_nn_val(u8 feat_num, u64 val)
587 {
588 switch (feat_num) {
589 case DCCPF_ACK_RATIO:
590 return val <= DCCPF_ACK_RATIO_MAX;
591 case DCCPF_SEQUENCE_WINDOW:
592 return val >= DCCPF_SEQ_WMIN && val <= DCCPF_SEQ_WMAX;
593 }
594 return 0; /* feature unknown - so we can't tell */
595 }
596
597 /* check that SP values are within the ranges defined in RFC 4340 */
dccp_feat_is_valid_sp_val(u8 feat_num,u8 val)598 static u8 dccp_feat_is_valid_sp_val(u8 feat_num, u8 val)
599 {
600 switch (feat_num) {
601 case DCCPF_CCID:
602 return val == DCCPC_CCID2 || val == DCCPC_CCID3;
603 /* Type-check Boolean feature values: */
604 case DCCPF_SHORT_SEQNOS:
605 case DCCPF_ECN_INCAPABLE:
606 case DCCPF_SEND_ACK_VECTOR:
607 case DCCPF_SEND_NDP_COUNT:
608 case DCCPF_DATA_CHECKSUM:
609 case DCCPF_SEND_LEV_RATE:
610 return val < 2;
611 case DCCPF_MIN_CSUM_COVER:
612 return val < 16;
613 }
614 return 0; /* feature unknown */
615 }
616
dccp_feat_sp_list_ok(u8 feat_num,u8 const * sp_list,u8 sp_len)617 static u8 dccp_feat_sp_list_ok(u8 feat_num, u8 const *sp_list, u8 sp_len)
618 {
619 if (sp_list == NULL || sp_len < 1)
620 return 0;
621 while (sp_len--)
622 if (!dccp_feat_is_valid_sp_val(feat_num, *sp_list++))
623 return 0;
624 return 1;
625 }
626
627 /**
628 * dccp_feat_insert_opts - Generate FN options from current list state
629 * @skb: next sk_buff to be sent to the peer
630 * @dp: for client during handshake and general negotiation
631 * @dreq: used by the server only (all Changes/Confirms in LISTEN/RESPOND)
632 */
dccp_feat_insert_opts(struct dccp_sock * dp,struct dccp_request_sock * dreq,struct sk_buff * skb)633 int dccp_feat_insert_opts(struct dccp_sock *dp, struct dccp_request_sock *dreq,
634 struct sk_buff *skb)
635 {
636 struct list_head *fn = dreq ? &dreq->dreq_featneg : &dp->dccps_featneg;
637 struct dccp_feat_entry *pos, *next;
638 u8 opt, type, len, *ptr, nn_in_nbo[DCCP_OPTVAL_MAXLEN];
639 bool rpt;
640
641 /* put entries into @skb in the order they appear in the list */
642 list_for_each_entry_safe_reverse(pos, next, fn, node) {
643 opt = dccp_feat_genopt(pos);
644 type = dccp_feat_type(pos->feat_num);
645 rpt = false;
646
647 if (pos->empty_confirm) {
648 len = 0;
649 ptr = NULL;
650 } else {
651 if (type == FEAT_SP) {
652 len = pos->val.sp.len;
653 ptr = pos->val.sp.vec;
654 rpt = pos->needs_confirm;
655 } else if (type == FEAT_NN) {
656 len = dccp_feat_valid_nn_length(pos->feat_num);
657 ptr = nn_in_nbo;
658 dccp_encode_value_var(pos->val.nn, ptr, len);
659 } else {
660 DCCP_BUG("unknown feature %u", pos->feat_num);
661 return -1;
662 }
663 }
664 dccp_feat_print_opt(opt, pos->feat_num, ptr, len, 0);
665
666 if (dccp_insert_fn_opt(skb, opt, pos->feat_num, ptr, len, rpt))
667 return -1;
668 if (pos->needs_mandatory && dccp_insert_option_mandatory(skb))
669 return -1;
670
671 if (skb->sk->sk_state == DCCP_OPEN &&
672 (opt == DCCPO_CONFIRM_R || opt == DCCPO_CONFIRM_L)) {
673 /*
674 * Confirms don't get retransmitted (6.6.3) once the
675 * connection is in state OPEN
676 */
677 dccp_feat_list_pop(pos);
678 } else {
679 /*
680 * Enter CHANGING after transmitting the Change
681 * option (6.6.2).
682 */
683 if (pos->state == FEAT_INITIALISING)
684 pos->state = FEAT_CHANGING;
685 }
686 }
687 return 0;
688 }
689
690 /**
691 * __feat_register_nn - Register new NN value on socket
692 * @fn: feature-negotiation list to register with
693 * @feat: an NN feature from %dccp_feature_numbers
694 * @mandatory: use Mandatory option if 1
695 * @nn_val: value to register (restricted to 4 bytes)
696 *
697 * Note that NN features are local by definition (RFC 4340, 6.3.2).
698 */
__feat_register_nn(struct list_head * fn,u8 feat,u8 mandatory,u64 nn_val)699 static int __feat_register_nn(struct list_head *fn, u8 feat,
700 u8 mandatory, u64 nn_val)
701 {
702 dccp_feat_val fval = { .nn = nn_val };
703
704 if (dccp_feat_type(feat) != FEAT_NN ||
705 !dccp_feat_is_valid_nn_val(feat, nn_val))
706 return -EINVAL;
707
708 /* Don't bother with default values, they will be activated anyway. */
709 if (nn_val - (u64)dccp_feat_default_value(feat) == 0)
710 return 0;
711
712 return dccp_feat_push_change(fn, feat, 1, mandatory, &fval);
713 }
714
715 /**
716 * __feat_register_sp - Register new SP value/list on socket
717 * @fn: feature-negotiation list to register with
718 * @feat: an SP feature from %dccp_feature_numbers
719 * @is_local: whether the local (1) or the remote (0) @feat is meant
720 * @mandatory: use Mandatory option if 1
721 * @sp_val: SP value followed by optional preference list
722 * @sp_len: length of @sp_val in bytes
723 */
__feat_register_sp(struct list_head * fn,u8 feat,u8 is_local,u8 mandatory,u8 const * sp_val,u8 sp_len)724 static int __feat_register_sp(struct list_head *fn, u8 feat, u8 is_local,
725 u8 mandatory, u8 const *sp_val, u8 sp_len)
726 {
727 dccp_feat_val fval;
728
729 if (dccp_feat_type(feat) != FEAT_SP ||
730 !dccp_feat_sp_list_ok(feat, sp_val, sp_len))
731 return -EINVAL;
732
733 /* Avoid negotiating alien CCIDs by only advertising supported ones */
734 if (feat == DCCPF_CCID && !ccid_support_check(sp_val, sp_len))
735 return -EOPNOTSUPP;
736
737 if (dccp_feat_clone_sp_val(&fval, sp_val, sp_len))
738 return -ENOMEM;
739
740 if (dccp_feat_push_change(fn, feat, is_local, mandatory, &fval)) {
741 kfree(fval.sp.vec);
742 return -ENOMEM;
743 }
744
745 return 0;
746 }
747
748 /**
749 * dccp_feat_register_sp - Register requests to change SP feature values
750 * @sk: client or listening socket
751 * @feat: one of %dccp_feature_numbers
752 * @is_local: whether the local (1) or remote (0) @feat is meant
753 * @list: array of preferred values, in descending order of preference
754 * @len: length of @list in bytes
755 */
dccp_feat_register_sp(struct sock * sk,u8 feat,u8 is_local,u8 const * list,u8 len)756 int dccp_feat_register_sp(struct sock *sk, u8 feat, u8 is_local,
757 u8 const *list, u8 len)
758 { /* any changes must be registered before establishing the connection */
759 if (sk->sk_state != DCCP_CLOSED)
760 return -EISCONN;
761 if (dccp_feat_type(feat) != FEAT_SP)
762 return -EINVAL;
763 return __feat_register_sp(&dccp_sk(sk)->dccps_featneg, feat, is_local,
764 0, list, len);
765 }
766
767 /**
768 * dccp_feat_nn_get - Query current/pending value of NN feature
769 * @sk: DCCP socket of an established connection
770 * @feat: NN feature number from %dccp_feature_numbers
771 *
772 * For a known NN feature, returns value currently being negotiated, or
773 * current (confirmed) value if no negotiation is going on.
774 */
dccp_feat_nn_get(struct sock * sk,u8 feat)775 u64 dccp_feat_nn_get(struct sock *sk, u8 feat)
776 {
777 if (dccp_feat_type(feat) == FEAT_NN) {
778 struct dccp_sock *dp = dccp_sk(sk);
779 struct dccp_feat_entry *entry;
780
781 entry = dccp_feat_list_lookup(&dp->dccps_featneg, feat, 1);
782 if (entry != NULL)
783 return entry->val.nn;
784
785 switch (feat) {
786 case DCCPF_ACK_RATIO:
787 return dp->dccps_l_ack_ratio;
788 case DCCPF_SEQUENCE_WINDOW:
789 return dp->dccps_l_seq_win;
790 }
791 }
792 DCCP_BUG("attempt to look up unsupported feature %u", feat);
793 return 0;
794 }
795 EXPORT_SYMBOL_GPL(dccp_feat_nn_get);
796
797 /**
798 * dccp_feat_signal_nn_change - Update NN values for an established connection
799 * @sk: DCCP socket of an established connection
800 * @feat: NN feature number from %dccp_feature_numbers
801 * @nn_val: the new value to use
802 *
803 * This function is used to communicate NN updates out-of-band.
804 */
dccp_feat_signal_nn_change(struct sock * sk,u8 feat,u64 nn_val)805 int dccp_feat_signal_nn_change(struct sock *sk, u8 feat, u64 nn_val)
806 {
807 struct list_head *fn = &dccp_sk(sk)->dccps_featneg;
808 dccp_feat_val fval = { .nn = nn_val };
809 struct dccp_feat_entry *entry;
810
811 if (sk->sk_state != DCCP_OPEN && sk->sk_state != DCCP_PARTOPEN)
812 return 0;
813
814 if (dccp_feat_type(feat) != FEAT_NN ||
815 !dccp_feat_is_valid_nn_val(feat, nn_val))
816 return -EINVAL;
817
818 if (nn_val == dccp_feat_nn_get(sk, feat))
819 return 0; /* already set or negotiation under way */
820
821 entry = dccp_feat_list_lookup(fn, feat, 1);
822 if (entry != NULL) {
823 dccp_pr_debug("Clobbering existing NN entry %llu -> %llu\n",
824 (unsigned long long)entry->val.nn,
825 (unsigned long long)nn_val);
826 dccp_feat_list_pop(entry);
827 }
828
829 inet_csk_schedule_ack(sk);
830 return dccp_feat_push_change(fn, feat, 1, 0, &fval);
831 }
832 EXPORT_SYMBOL_GPL(dccp_feat_signal_nn_change);
833
834 /*
835 * Tracking features whose value depend on the choice of CCID
836 *
837 * This is designed with an extension in mind so that a list walk could be done
838 * before activating any features. However, the existing framework was found to
839 * work satisfactorily up until now, the automatic verification is left open.
840 * When adding new CCIDs, add a corresponding dependency table here.
841 */
dccp_feat_ccid_deps(u8 ccid,bool is_local)842 static const struct ccid_dependency *dccp_feat_ccid_deps(u8 ccid, bool is_local)
843 {
844 static const struct ccid_dependency ccid2_dependencies[2][2] = {
845 /*
846 * CCID2 mandates Ack Vectors (RFC 4341, 4.): as CCID is a TX
847 * feature and Send Ack Vector is an RX feature, `is_local'
848 * needs to be reversed.
849 */
850 { /* Dependencies of the receiver-side (remote) CCID2 */
851 {
852 .dependent_feat = DCCPF_SEND_ACK_VECTOR,
853 .is_local = true,
854 .is_mandatory = true,
855 .val = 1
856 },
857 { 0, 0, 0, 0 }
858 },
859 { /* Dependencies of the sender-side (local) CCID2 */
860 {
861 .dependent_feat = DCCPF_SEND_ACK_VECTOR,
862 .is_local = false,
863 .is_mandatory = true,
864 .val = 1
865 },
866 { 0, 0, 0, 0 }
867 }
868 };
869 static const struct ccid_dependency ccid3_dependencies[2][5] = {
870 { /*
871 * Dependencies of the receiver-side CCID3
872 */
873 { /* locally disable Ack Vectors */
874 .dependent_feat = DCCPF_SEND_ACK_VECTOR,
875 .is_local = true,
876 .is_mandatory = false,
877 .val = 0
878 },
879 { /* see below why Send Loss Event Rate is on */
880 .dependent_feat = DCCPF_SEND_LEV_RATE,
881 .is_local = true,
882 .is_mandatory = true,
883 .val = 1
884 },
885 { /* NDP Count is needed as per RFC 4342, 6.1.1 */
886 .dependent_feat = DCCPF_SEND_NDP_COUNT,
887 .is_local = false,
888 .is_mandatory = true,
889 .val = 1
890 },
891 { 0, 0, 0, 0 },
892 },
893 { /*
894 * CCID3 at the TX side: we request that the HC-receiver
895 * will not send Ack Vectors (they will be ignored, so
896 * Mandatory is not set); we enable Send Loss Event Rate
897 * (Mandatory since the implementation does not support
898 * the Loss Intervals option of RFC 4342, 8.6).
899 * The last two options are for peer's information only.
900 */
901 {
902 .dependent_feat = DCCPF_SEND_ACK_VECTOR,
903 .is_local = false,
904 .is_mandatory = false,
905 .val = 0
906 },
907 {
908 .dependent_feat = DCCPF_SEND_LEV_RATE,
909 .is_local = false,
910 .is_mandatory = true,
911 .val = 1
912 },
913 { /* this CCID does not support Ack Ratio */
914 .dependent_feat = DCCPF_ACK_RATIO,
915 .is_local = true,
916 .is_mandatory = false,
917 .val = 0
918 },
919 { /* tell receiver we are sending NDP counts */
920 .dependent_feat = DCCPF_SEND_NDP_COUNT,
921 .is_local = true,
922 .is_mandatory = false,
923 .val = 1
924 },
925 { 0, 0, 0, 0 }
926 }
927 };
928 switch (ccid) {
929 case DCCPC_CCID2:
930 return ccid2_dependencies[is_local];
931 case DCCPC_CCID3:
932 return ccid3_dependencies[is_local];
933 default:
934 return NULL;
935 }
936 }
937
938 /**
939 * dccp_feat_propagate_ccid - Resolve dependencies of features on choice of CCID
940 * @fn: feature-negotiation list to update
941 * @id: CCID number to track
942 * @is_local: whether TX CCID (1) or RX CCID (0) is meant
943 *
944 * This function needs to be called after registering all other features.
945 */
dccp_feat_propagate_ccid(struct list_head * fn,u8 id,bool is_local)946 static int dccp_feat_propagate_ccid(struct list_head *fn, u8 id, bool is_local)
947 {
948 const struct ccid_dependency *table = dccp_feat_ccid_deps(id, is_local);
949 int i, rc = (table == NULL);
950
951 for (i = 0; rc == 0 && table[i].dependent_feat != DCCPF_RESERVED; i++)
952 if (dccp_feat_type(table[i].dependent_feat) == FEAT_SP)
953 rc = __feat_register_sp(fn, table[i].dependent_feat,
954 table[i].is_local,
955 table[i].is_mandatory,
956 &table[i].val, 1);
957 else
958 rc = __feat_register_nn(fn, table[i].dependent_feat,
959 table[i].is_mandatory,
960 table[i].val);
961 return rc;
962 }
963
964 /**
965 * dccp_feat_finalise_settings - Finalise settings before starting negotiation
966 * @dp: client or listening socket (settings will be inherited)
967 *
968 * This is called after all registrations (socket initialisation, sysctls, and
969 * sockopt calls), and before sending the first packet containing Change options
970 * (ie. client-Request or server-Response), to ensure internal consistency.
971 */
dccp_feat_finalise_settings(struct dccp_sock * dp)972 int dccp_feat_finalise_settings(struct dccp_sock *dp)
973 {
974 struct list_head *fn = &dp->dccps_featneg;
975 struct dccp_feat_entry *entry;
976 int i = 2, ccids[2] = { -1, -1 };
977
978 /*
979 * Propagating CCIDs:
980 * 1) not useful to propagate CCID settings if this host advertises more
981 * than one CCID: the choice of CCID may still change - if this is
982 * the client, or if this is the server and the client sends
983 * singleton CCID values.
984 * 2) since is that propagate_ccid changes the list, we defer changing
985 * the sorted list until after the traversal.
986 */
987 list_for_each_entry(entry, fn, node)
988 if (entry->feat_num == DCCPF_CCID && entry->val.sp.len == 1)
989 ccids[entry->is_local] = entry->val.sp.vec[0];
990 while (i--)
991 if (ccids[i] > 0 && dccp_feat_propagate_ccid(fn, ccids[i], i))
992 return -1;
993 dccp_feat_print_fnlist(fn);
994 return 0;
995 }
996
997 /**
998 * dccp_feat_server_ccid_dependencies - Resolve CCID-dependent features
999 * @dreq: server socket to resolve
1000 *
1001 * It is the server which resolves the dependencies once the CCID has been
1002 * fully negotiated. If no CCID has been negotiated, it uses the default CCID.
1003 */
dccp_feat_server_ccid_dependencies(struct dccp_request_sock * dreq)1004 int dccp_feat_server_ccid_dependencies(struct dccp_request_sock *dreq)
1005 {
1006 struct list_head *fn = &dreq->dreq_featneg;
1007 struct dccp_feat_entry *entry;
1008 u8 is_local, ccid;
1009
1010 for (is_local = 0; is_local <= 1; is_local++) {
1011 entry = dccp_feat_list_lookup(fn, DCCPF_CCID, is_local);
1012
1013 if (entry != NULL && !entry->empty_confirm)
1014 ccid = entry->val.sp.vec[0];
1015 else
1016 ccid = dccp_feat_default_value(DCCPF_CCID);
1017
1018 if (dccp_feat_propagate_ccid(fn, ccid, is_local))
1019 return -1;
1020 }
1021 return 0;
1022 }
1023
1024 /* Select the first entry in @servlist that also occurs in @clilist (6.3.1) */
dccp_feat_preflist_match(u8 * servlist,u8 slen,u8 * clilist,u8 clen)1025 static int dccp_feat_preflist_match(u8 *servlist, u8 slen, u8 *clilist, u8 clen)
1026 {
1027 u8 c, s;
1028
1029 for (s = 0; s < slen; s++)
1030 for (c = 0; c < clen; c++)
1031 if (servlist[s] == clilist[c])
1032 return servlist[s];
1033 return -1;
1034 }
1035
1036 /**
1037 * dccp_feat_prefer - Move preferred entry to the start of array
1038 * @preferred_value: entry to move to start of array
1039 * @array: array of preferred entries
1040 * @array_len: size of the array
1041 *
1042 * Reorder the @array_len elements in @array so that @preferred_value comes
1043 * first. Returns >0 to indicate that @preferred_value does occur in @array.
1044 */
dccp_feat_prefer(u8 preferred_value,u8 * array,u8 array_len)1045 static u8 dccp_feat_prefer(u8 preferred_value, u8 *array, u8 array_len)
1046 {
1047 u8 i, does_occur = 0;
1048
1049 if (array != NULL) {
1050 for (i = 0; i < array_len; i++)
1051 if (array[i] == preferred_value) {
1052 array[i] = array[0];
1053 does_occur++;
1054 }
1055 if (does_occur)
1056 array[0] = preferred_value;
1057 }
1058 return does_occur;
1059 }
1060
1061 /**
1062 * dccp_feat_reconcile - Reconcile SP preference lists
1063 * @fv: SP list to reconcile into
1064 * @arr: received SP preference list
1065 * @len: length of @arr in bytes
1066 * @is_server: whether this side is the server (and @fv is the server's list)
1067 * @reorder: whether to reorder the list in @fv after reconciling with @arr
1068 * When successful, > 0 is returned and the reconciled list is in @fval.
1069 * A value of 0 means that negotiation failed (no shared entry).
1070 */
dccp_feat_reconcile(dccp_feat_val * fv,u8 * arr,u8 len,bool is_server,bool reorder)1071 static int dccp_feat_reconcile(dccp_feat_val *fv, u8 *arr, u8 len,
1072 bool is_server, bool reorder)
1073 {
1074 int rc;
1075
1076 if (!fv->sp.vec || !arr) {
1077 DCCP_CRIT("NULL feature value or array");
1078 return 0;
1079 }
1080
1081 if (is_server)
1082 rc = dccp_feat_preflist_match(fv->sp.vec, fv->sp.len, arr, len);
1083 else
1084 rc = dccp_feat_preflist_match(arr, len, fv->sp.vec, fv->sp.len);
1085
1086 if (!reorder)
1087 return rc;
1088 if (rc < 0)
1089 return 0;
1090
1091 /*
1092 * Reorder list: used for activating features and in dccp_insert_fn_opt.
1093 */
1094 return dccp_feat_prefer(rc, fv->sp.vec, fv->sp.len);
1095 }
1096
1097 /**
1098 * dccp_feat_change_recv - Process incoming ChangeL/R options
1099 * @fn: feature-negotiation list to update
1100 * @is_mandatory: whether the Change was preceded by a Mandatory option
1101 * @opt: %DCCPO_CHANGE_L or %DCCPO_CHANGE_R
1102 * @feat: one of %dccp_feature_numbers
1103 * @val: NN value or SP value/preference list
1104 * @len: length of @val in bytes
1105 * @server: whether this node is the server (1) or the client (0)
1106 */
dccp_feat_change_recv(struct list_head * fn,u8 is_mandatory,u8 opt,u8 feat,u8 * val,u8 len,const bool server)1107 static u8 dccp_feat_change_recv(struct list_head *fn, u8 is_mandatory, u8 opt,
1108 u8 feat, u8 *val, u8 len, const bool server)
1109 {
1110 u8 defval, type = dccp_feat_type(feat);
1111 const bool local = (opt == DCCPO_CHANGE_R);
1112 struct dccp_feat_entry *entry;
1113 dccp_feat_val fval;
1114
1115 if (len == 0 || type == FEAT_UNKNOWN) /* 6.1 and 6.6.8 */
1116 goto unknown_feature_or_value;
1117
1118 dccp_feat_print_opt(opt, feat, val, len, is_mandatory);
1119
1120 /*
1121 * Negotiation of NN features: Change R is invalid, so there is no
1122 * simultaneous negotiation; hence we do not look up in the list.
1123 */
1124 if (type == FEAT_NN) {
1125 if (local || len > sizeof(fval.nn))
1126 goto unknown_feature_or_value;
1127
1128 /* 6.3.2: "The feature remote MUST accept any valid value..." */
1129 fval.nn = dccp_decode_value_var(val, len);
1130 if (!dccp_feat_is_valid_nn_val(feat, fval.nn))
1131 goto unknown_feature_or_value;
1132
1133 return dccp_feat_push_confirm(fn, feat, local, &fval);
1134 }
1135
1136 /*
1137 * Unidirectional/simultaneous negotiation of SP features (6.3.1)
1138 */
1139 entry = dccp_feat_list_lookup(fn, feat, local);
1140 if (entry == NULL) {
1141 /*
1142 * No particular preferences have been registered. We deal with
1143 * this situation by assuming that all valid values are equally
1144 * acceptable, and apply the following checks:
1145 * - if the peer's list is a singleton, we accept a valid value;
1146 * - if we are the server, we first try to see if the peer (the
1147 * client) advertises the default value. If yes, we use it,
1148 * otherwise we accept the preferred value;
1149 * - else if we are the client, we use the first list element.
1150 */
1151 if (dccp_feat_clone_sp_val(&fval, val, 1))
1152 return DCCP_RESET_CODE_TOO_BUSY;
1153
1154 if (len > 1 && server) {
1155 defval = dccp_feat_default_value(feat);
1156 if (dccp_feat_preflist_match(&defval, 1, val, len) > -1)
1157 fval.sp.vec[0] = defval;
1158 } else if (!dccp_feat_is_valid_sp_val(feat, fval.sp.vec[0])) {
1159 kfree(fval.sp.vec);
1160 goto unknown_feature_or_value;
1161 }
1162
1163 /* Treat unsupported CCIDs like invalid values */
1164 if (feat == DCCPF_CCID && !ccid_support_check(fval.sp.vec, 1)) {
1165 kfree(fval.sp.vec);
1166 goto not_valid_or_not_known;
1167 }
1168
1169 if (dccp_feat_push_confirm(fn, feat, local, &fval)) {
1170 kfree(fval.sp.vec);
1171 return DCCP_RESET_CODE_TOO_BUSY;
1172 }
1173
1174 return 0;
1175 } else if (entry->state == FEAT_UNSTABLE) { /* 6.6.2 */
1176 return 0;
1177 }
1178
1179 if (dccp_feat_reconcile(&entry->val, val, len, server, true)) {
1180 entry->empty_confirm = false;
1181 } else if (is_mandatory) {
1182 return DCCP_RESET_CODE_MANDATORY_ERROR;
1183 } else if (entry->state == FEAT_INITIALISING) {
1184 /*
1185 * Failed simultaneous negotiation (server only): try to `save'
1186 * the connection by checking whether entry contains the default
1187 * value for @feat. If yes, send an empty Confirm to signal that
1188 * the received Change was not understood - which implies using
1189 * the default value.
1190 * If this also fails, we use Reset as the last resort.
1191 */
1192 WARN_ON(!server);
1193 defval = dccp_feat_default_value(feat);
1194 if (!dccp_feat_reconcile(&entry->val, &defval, 1, server, true))
1195 return DCCP_RESET_CODE_OPTION_ERROR;
1196 entry->empty_confirm = true;
1197 }
1198 entry->needs_confirm = true;
1199 entry->needs_mandatory = false;
1200 entry->state = FEAT_STABLE;
1201 return 0;
1202
1203 unknown_feature_or_value:
1204 if (!is_mandatory)
1205 return dccp_push_empty_confirm(fn, feat, local);
1206
1207 not_valid_or_not_known:
1208 return is_mandatory ? DCCP_RESET_CODE_MANDATORY_ERROR
1209 : DCCP_RESET_CODE_OPTION_ERROR;
1210 }
1211
1212 /**
1213 * dccp_feat_confirm_recv - Process received Confirm options
1214 * @fn: feature-negotiation list to update
1215 * @is_mandatory: whether @opt was preceded by a Mandatory option
1216 * @opt: %DCCPO_CONFIRM_L or %DCCPO_CONFIRM_R
1217 * @feat: one of %dccp_feature_numbers
1218 * @val: NN value or SP value/preference list
1219 * @len: length of @val in bytes
1220 * @server: whether this node is server (1) or client (0)
1221 */
dccp_feat_confirm_recv(struct list_head * fn,u8 is_mandatory,u8 opt,u8 feat,u8 * val,u8 len,const bool server)1222 static u8 dccp_feat_confirm_recv(struct list_head *fn, u8 is_mandatory, u8 opt,
1223 u8 feat, u8 *val, u8 len, const bool server)
1224 {
1225 u8 *plist, plen, type = dccp_feat_type(feat);
1226 const bool local = (opt == DCCPO_CONFIRM_R);
1227 struct dccp_feat_entry *entry = dccp_feat_list_lookup(fn, feat, local);
1228
1229 dccp_feat_print_opt(opt, feat, val, len, is_mandatory);
1230
1231 if (entry == NULL) { /* nothing queued: ignore or handle error */
1232 if (is_mandatory && type == FEAT_UNKNOWN)
1233 return DCCP_RESET_CODE_MANDATORY_ERROR;
1234
1235 if (!local && type == FEAT_NN) /* 6.3.2 */
1236 goto confirmation_failed;
1237 return 0;
1238 }
1239
1240 if (entry->state != FEAT_CHANGING) /* 6.6.2 */
1241 return 0;
1242
1243 if (len == 0) {
1244 if (dccp_feat_must_be_understood(feat)) /* 6.6.7 */
1245 goto confirmation_failed;
1246 /*
1247 * Empty Confirm during connection setup: this means reverting
1248 * to the `old' value, which in this case is the default. Since
1249 * we handle default values automatically when no other values
1250 * have been set, we revert to the old value by removing this
1251 * entry from the list.
1252 */
1253 dccp_feat_list_pop(entry);
1254 return 0;
1255 }
1256
1257 if (type == FEAT_NN) {
1258 if (len > sizeof(entry->val.nn))
1259 goto confirmation_failed;
1260
1261 if (entry->val.nn == dccp_decode_value_var(val, len))
1262 goto confirmation_succeeded;
1263
1264 DCCP_WARN("Bogus Confirm for non-existing value\n");
1265 goto confirmation_failed;
1266 }
1267
1268 /*
1269 * Parsing SP Confirms: the first element of @val is the preferred
1270 * SP value which the peer confirms, the remainder depends on @len.
1271 * Note that only the confirmed value need to be a valid SP value.
1272 */
1273 if (!dccp_feat_is_valid_sp_val(feat, *val))
1274 goto confirmation_failed;
1275
1276 if (len == 1) { /* peer didn't supply a preference list */
1277 plist = val;
1278 plen = len;
1279 } else { /* preferred value + preference list */
1280 plist = val + 1;
1281 plen = len - 1;
1282 }
1283
1284 /* Check whether the peer got the reconciliation right (6.6.8) */
1285 if (dccp_feat_reconcile(&entry->val, plist, plen, server, 0) != *val) {
1286 DCCP_WARN("Confirm selected the wrong value %u\n", *val);
1287 return DCCP_RESET_CODE_OPTION_ERROR;
1288 }
1289 entry->val.sp.vec[0] = *val;
1290
1291 confirmation_succeeded:
1292 entry->state = FEAT_STABLE;
1293 return 0;
1294
1295 confirmation_failed:
1296 DCCP_WARN("Confirmation failed\n");
1297 return is_mandatory ? DCCP_RESET_CODE_MANDATORY_ERROR
1298 : DCCP_RESET_CODE_OPTION_ERROR;
1299 }
1300
1301 /**
1302 * dccp_feat_handle_nn_established - Fast-path reception of NN options
1303 * @sk: socket of an established DCCP connection
1304 * @mandatory: whether @opt was preceded by a Mandatory option
1305 * @opt: %DCCPO_CHANGE_L | %DCCPO_CONFIRM_R (NN only)
1306 * @feat: NN number, one of %dccp_feature_numbers
1307 * @val: NN value
1308 * @len: length of @val in bytes
1309 *
1310 * This function combines the functionality of change_recv/confirm_recv, with
1311 * the following differences (reset codes are the same):
1312 * - cleanup after receiving the Confirm;
1313 * - values are directly activated after successful parsing;
1314 * - deliberately restricted to NN features.
1315 * The restriction to NN features is essential since SP features can have non-
1316 * predictable outcomes (depending on the remote configuration), and are inter-
1317 * dependent (CCIDs for instance cause further dependencies).
1318 */
dccp_feat_handle_nn_established(struct sock * sk,u8 mandatory,u8 opt,u8 feat,u8 * val,u8 len)1319 static u8 dccp_feat_handle_nn_established(struct sock *sk, u8 mandatory, u8 opt,
1320 u8 feat, u8 *val, u8 len)
1321 {
1322 struct list_head *fn = &dccp_sk(sk)->dccps_featneg;
1323 const bool local = (opt == DCCPO_CONFIRM_R);
1324 struct dccp_feat_entry *entry;
1325 u8 type = dccp_feat_type(feat);
1326 dccp_feat_val fval;
1327
1328 dccp_feat_print_opt(opt, feat, val, len, mandatory);
1329
1330 /* Ignore non-mandatory unknown and non-NN features */
1331 if (type == FEAT_UNKNOWN) {
1332 if (local && !mandatory)
1333 return 0;
1334 goto fast_path_unknown;
1335 } else if (type != FEAT_NN) {
1336 return 0;
1337 }
1338
1339 /*
1340 * We don't accept empty Confirms, since in fast-path feature
1341 * negotiation the values are enabled immediately after sending
1342 * the Change option.
1343 * Empty Changes on the other hand are invalid (RFC 4340, 6.1).
1344 */
1345 if (len == 0 || len > sizeof(fval.nn))
1346 goto fast_path_unknown;
1347
1348 if (opt == DCCPO_CHANGE_L) {
1349 fval.nn = dccp_decode_value_var(val, len);
1350 if (!dccp_feat_is_valid_nn_val(feat, fval.nn))
1351 goto fast_path_unknown;
1352
1353 if (dccp_feat_push_confirm(fn, feat, local, &fval) ||
1354 dccp_feat_activate(sk, feat, local, &fval))
1355 return DCCP_RESET_CODE_TOO_BUSY;
1356
1357 /* set the `Ack Pending' flag to piggyback a Confirm */
1358 inet_csk_schedule_ack(sk);
1359
1360 } else if (opt == DCCPO_CONFIRM_R) {
1361 entry = dccp_feat_list_lookup(fn, feat, local);
1362 if (entry == NULL || entry->state != FEAT_CHANGING)
1363 return 0;
1364
1365 fval.nn = dccp_decode_value_var(val, len);
1366 /*
1367 * Just ignore a value that doesn't match our current value.
1368 * If the option changes twice within two RTTs, then at least
1369 * one CONFIRM will be received for the old value after a
1370 * new CHANGE was sent.
1371 */
1372 if (fval.nn != entry->val.nn)
1373 return 0;
1374
1375 /* Only activate after receiving the Confirm option (6.6.1). */
1376 dccp_feat_activate(sk, feat, local, &fval);
1377
1378 /* It has been confirmed - so remove the entry */
1379 dccp_feat_list_pop(entry);
1380
1381 } else {
1382 DCCP_WARN("Received illegal option %u\n", opt);
1383 goto fast_path_failed;
1384 }
1385 return 0;
1386
1387 fast_path_unknown:
1388 if (!mandatory)
1389 return dccp_push_empty_confirm(fn, feat, local);
1390
1391 fast_path_failed:
1392 return mandatory ? DCCP_RESET_CODE_MANDATORY_ERROR
1393 : DCCP_RESET_CODE_OPTION_ERROR;
1394 }
1395
1396 /**
1397 * dccp_feat_parse_options - Process Feature-Negotiation Options
1398 * @sk: for general use and used by the client during connection setup
1399 * @dreq: used by the server during connection setup
1400 * @mandatory: whether @opt was preceded by a Mandatory option
1401 * @opt: %DCCPO_CHANGE_L | %DCCPO_CHANGE_R | %DCCPO_CONFIRM_L | %DCCPO_CONFIRM_R
1402 * @feat: one of %dccp_feature_numbers
1403 * @val: value contents of @opt
1404 * @len: length of @val in bytes
1405 *
1406 * Returns 0 on success, a Reset code for ending the connection otherwise.
1407 */
dccp_feat_parse_options(struct sock * sk,struct dccp_request_sock * dreq,u8 mandatory,u8 opt,u8 feat,u8 * val,u8 len)1408 int dccp_feat_parse_options(struct sock *sk, struct dccp_request_sock *dreq,
1409 u8 mandatory, u8 opt, u8 feat, u8 *val, u8 len)
1410 {
1411 struct dccp_sock *dp = dccp_sk(sk);
1412 struct list_head *fn = dreq ? &dreq->dreq_featneg : &dp->dccps_featneg;
1413 bool server = false;
1414
1415 switch (sk->sk_state) {
1416 /*
1417 * Negotiation during connection setup
1418 */
1419 case DCCP_LISTEN:
1420 server = true;
1421 fallthrough;
1422 case DCCP_REQUESTING:
1423 switch (opt) {
1424 case DCCPO_CHANGE_L:
1425 case DCCPO_CHANGE_R:
1426 return dccp_feat_change_recv(fn, mandatory, opt, feat,
1427 val, len, server);
1428 case DCCPO_CONFIRM_R:
1429 case DCCPO_CONFIRM_L:
1430 return dccp_feat_confirm_recv(fn, mandatory, opt, feat,
1431 val, len, server);
1432 }
1433 break;
1434 /*
1435 * Support for exchanging NN options on an established connection.
1436 */
1437 case DCCP_OPEN:
1438 case DCCP_PARTOPEN:
1439 return dccp_feat_handle_nn_established(sk, mandatory, opt, feat,
1440 val, len);
1441 }
1442 return 0; /* ignore FN options in all other states */
1443 }
1444
1445 /**
1446 * dccp_feat_init - Seed feature negotiation with host-specific defaults
1447 * @sk: Socket to initialize.
1448 *
1449 * This initialises global defaults, depending on the value of the sysctls.
1450 * These can later be overridden by registering changes via setsockopt calls.
1451 * The last link in the chain is finalise_settings, to make sure that between
1452 * here and the start of actual feature negotiation no inconsistencies enter.
1453 *
1454 * All features not appearing below use either defaults or are otherwise
1455 * later adjusted through dccp_feat_finalise_settings().
1456 */
dccp_feat_init(struct sock * sk)1457 int dccp_feat_init(struct sock *sk)
1458 {
1459 struct list_head *fn = &dccp_sk(sk)->dccps_featneg;
1460 u8 on = 1, off = 0;
1461 int rc;
1462 struct {
1463 u8 *val;
1464 u8 len;
1465 } tx, rx;
1466
1467 /* Non-negotiable (NN) features */
1468 rc = __feat_register_nn(fn, DCCPF_SEQUENCE_WINDOW, 0,
1469 sysctl_dccp_sequence_window);
1470 if (rc)
1471 return rc;
1472
1473 /* Server-priority (SP) features */
1474
1475 /* Advertise that short seqnos are not supported (7.6.1) */
1476 rc = __feat_register_sp(fn, DCCPF_SHORT_SEQNOS, true, true, &off, 1);
1477 if (rc)
1478 return rc;
1479
1480 /* RFC 4340 12.1: "If a DCCP is not ECN capable, ..." */
1481 rc = __feat_register_sp(fn, DCCPF_ECN_INCAPABLE, true, true, &on, 1);
1482 if (rc)
1483 return rc;
1484
1485 /*
1486 * We advertise the available list of CCIDs and reorder according to
1487 * preferences, to avoid failure resulting from negotiating different
1488 * singleton values (which always leads to failure).
1489 * These settings can still (later) be overridden via sockopts.
1490 */
1491 if (ccid_get_builtin_ccids(&tx.val, &tx.len))
1492 return -ENOBUFS;
1493 if (ccid_get_builtin_ccids(&rx.val, &rx.len)) {
1494 kfree(tx.val);
1495 return -ENOBUFS;
1496 }
1497
1498 if (!dccp_feat_prefer(sysctl_dccp_tx_ccid, tx.val, tx.len) ||
1499 !dccp_feat_prefer(sysctl_dccp_rx_ccid, rx.val, rx.len))
1500 goto free_ccid_lists;
1501
1502 rc = __feat_register_sp(fn, DCCPF_CCID, true, false, tx.val, tx.len);
1503 if (rc)
1504 goto free_ccid_lists;
1505
1506 rc = __feat_register_sp(fn, DCCPF_CCID, false, false, rx.val, rx.len);
1507
1508 free_ccid_lists:
1509 kfree(tx.val);
1510 kfree(rx.val);
1511 return rc;
1512 }
1513
dccp_feat_activate_values(struct sock * sk,struct list_head * fn_list)1514 int dccp_feat_activate_values(struct sock *sk, struct list_head *fn_list)
1515 {
1516 struct dccp_sock *dp = dccp_sk(sk);
1517 struct dccp_feat_entry *cur, *next;
1518 int idx;
1519 dccp_feat_val *fvals[DCCP_FEAT_SUPPORTED_MAX][2] = {
1520 [0 ... DCCP_FEAT_SUPPORTED_MAX-1] = { NULL, NULL }
1521 };
1522
1523 list_for_each_entry(cur, fn_list, node) {
1524 /*
1525 * An empty Confirm means that either an unknown feature type
1526 * or an invalid value was present. In the first case there is
1527 * nothing to activate, in the other the default value is used.
1528 */
1529 if (cur->empty_confirm)
1530 continue;
1531
1532 idx = dccp_feat_index(cur->feat_num);
1533 if (idx < 0) {
1534 DCCP_BUG("Unknown feature %u", cur->feat_num);
1535 goto activation_failed;
1536 }
1537 if (cur->state != FEAT_STABLE) {
1538 DCCP_CRIT("Negotiation of %s %s failed in state %s",
1539 cur->is_local ? "local" : "remote",
1540 dccp_feat_fname(cur->feat_num),
1541 dccp_feat_sname[cur->state]);
1542 goto activation_failed;
1543 }
1544 fvals[idx][cur->is_local] = &cur->val;
1545 }
1546
1547 /*
1548 * Activate in decreasing order of index, so that the CCIDs are always
1549 * activated as the last feature. This avoids the case where a CCID
1550 * relies on the initialisation of one or more features that it depends
1551 * on (e.g. Send NDP Count, Send Ack Vector, and Ack Ratio features).
1552 */
1553 for (idx = DCCP_FEAT_SUPPORTED_MAX; --idx >= 0;)
1554 if (__dccp_feat_activate(sk, idx, 0, fvals[idx][0]) ||
1555 __dccp_feat_activate(sk, idx, 1, fvals[idx][1])) {
1556 DCCP_CRIT("Could not activate %d", idx);
1557 goto activation_failed;
1558 }
1559
1560 /* Clean up Change options which have been confirmed already */
1561 list_for_each_entry_safe(cur, next, fn_list, node)
1562 if (!cur->needs_confirm)
1563 dccp_feat_list_pop(cur);
1564
1565 dccp_pr_debug("Activation OK\n");
1566 return 0;
1567
1568 activation_failed:
1569 /*
1570 * We clean up everything that may have been allocated, since
1571 * it is difficult to track at which stage negotiation failed.
1572 * This is ok, since all allocation functions below are robust
1573 * against NULL arguments.
1574 */
1575 ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
1576 ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
1577 dp->dccps_hc_rx_ccid = dp->dccps_hc_tx_ccid = NULL;
1578 dccp_ackvec_free(dp->dccps_hc_rx_ackvec);
1579 dp->dccps_hc_rx_ackvec = NULL;
1580 return -1;
1581 }
1582