1 /* 2 * net/dccp/options.c 3 * 4 * An implementation of the DCCP protocol 5 * Copyright (c) 2005 Aristeu Sergio Rozanski Filho <aris@cathedrallabs.org> 6 * Copyright (c) 2005 Arnaldo Carvalho de Melo <acme@ghostprotocols.net> 7 * Copyright (c) 2005 Ian McDonald <ian.mcdonald@jandi.co.nz> 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of the GNU General Public License 11 * as published by the Free Software Foundation; either version 12 * 2 of the License, or (at your option) any later version. 13 */ 14 #include <linux/dccp.h> 15 #include <linux/module.h> 16 #include <linux/types.h> 17 #include <asm/unaligned.h> 18 #include <linux/kernel.h> 19 #include <linux/skbuff.h> 20 21 #include "ackvec.h" 22 #include "ccid.h" 23 #include "dccp.h" 24 #include "feat.h" 25 26 int sysctl_dccp_feat_sequence_window = DCCPF_INITIAL_SEQUENCE_WINDOW; 27 int sysctl_dccp_feat_rx_ccid = DCCPF_INITIAL_CCID; 28 int sysctl_dccp_feat_tx_ccid = DCCPF_INITIAL_CCID; 29 int sysctl_dccp_feat_ack_ratio = DCCPF_INITIAL_ACK_RATIO; 30 int sysctl_dccp_feat_send_ack_vector = DCCPF_INITIAL_SEND_ACK_VECTOR; 31 int sysctl_dccp_feat_send_ndp_count = DCCPF_INITIAL_SEND_NDP_COUNT; 32 33 static u32 dccp_decode_value_var(const unsigned char *bf, const u8 len) 34 { 35 u32 value = 0; 36 37 if (len > 3) 38 value += *bf++ << 24; 39 if (len > 2) 40 value += *bf++ << 16; 41 if (len > 1) 42 value += *bf++ << 8; 43 if (len > 0) 44 value += *bf; 45 46 return value; 47 } 48 49 /** 50 * dccp_parse_options - Parse DCCP options present in @skb 51 * @sk: client|server|listening dccp socket (when @dreq != NULL) 52 * @dreq: request socket to use during connection setup, or NULL 53 */ 54 int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq, 55 struct sk_buff *skb) 56 { 57 struct dccp_sock *dp = dccp_sk(sk); 58 const struct dccp_hdr *dh = dccp_hdr(skb); 59 const u8 pkt_type = DCCP_SKB_CB(skb)->dccpd_type; 60 u64 ackno = DCCP_SKB_CB(skb)->dccpd_ack_seq; 61 unsigned char *options = (unsigned char *)dh + dccp_hdr_len(skb); 62 unsigned char *opt_ptr = options; 63 const unsigned char *opt_end = (unsigned char *)dh + 64 (dh->dccph_doff * 4); 65 struct dccp_options_received *opt_recv = &dp->dccps_options_received; 66 unsigned char opt, len; 67 unsigned char *value; 68 u32 elapsed_time; 69 __be32 opt_val; 70 int rc; 71 int mandatory = 0; 72 73 memset(opt_recv, 0, sizeof(*opt_recv)); 74 75 opt = len = 0; 76 while (opt_ptr != opt_end) { 77 opt = *opt_ptr++; 78 len = 0; 79 value = NULL; 80 81 /* Check if this isn't a single byte option */ 82 if (opt > DCCPO_MAX_RESERVED) { 83 if (opt_ptr == opt_end) 84 goto out_nonsensical_length; 85 86 len = *opt_ptr++; 87 if (len < 2) 88 goto out_nonsensical_length; 89 /* 90 * Remove the type and len fields, leaving 91 * just the value size 92 */ 93 len -= 2; 94 value = opt_ptr; 95 opt_ptr += len; 96 97 if (opt_ptr > opt_end) 98 goto out_nonsensical_length; 99 } 100 101 /* 102 * CCID-Specific Options (from RFC 4340, sec. 10.3): 103 * 104 * Option numbers 128 through 191 are for options sent from the 105 * HC-Sender to the HC-Receiver; option numbers 192 through 255 106 * are for options sent from the HC-Receiver to the HC-Sender. 107 * 108 * CCID-specific options are ignored during connection setup, as 109 * negotiation may still be in progress (see RFC 4340, 10.3). 110 * The same applies to Ack Vectors, as these depend on the CCID. 111 * 112 */ 113 if (dreq != NULL && (opt >= 128 || 114 opt == DCCPO_ACK_VECTOR_0 || opt == DCCPO_ACK_VECTOR_1)) 115 goto ignore_option; 116 117 switch (opt) { 118 case DCCPO_PADDING: 119 break; 120 case DCCPO_MANDATORY: 121 if (mandatory) 122 goto out_invalid_option; 123 if (pkt_type != DCCP_PKT_DATA) 124 mandatory = 1; 125 break; 126 case DCCPO_NDP_COUNT: 127 if (len > 6) 128 goto out_invalid_option; 129 130 opt_recv->dccpor_ndp = dccp_decode_value_var(value, len); 131 dccp_pr_debug("%s opt: NDP count=%llu\n", dccp_role(sk), 132 (unsigned long long)opt_recv->dccpor_ndp); 133 break; 134 case DCCPO_CHANGE_L: 135 /* fall through */ 136 case DCCPO_CHANGE_R: 137 if (pkt_type == DCCP_PKT_DATA) 138 break; 139 if (len < 2) 140 goto out_invalid_option; 141 rc = dccp_feat_change_recv(sk, opt, *value, value + 1, 142 len - 1); 143 /* 144 * When there is a change error, change_recv is 145 * responsible for dealing with it. i.e. reply with an 146 * empty confirm. 147 * If the change was mandatory, then we need to die. 148 */ 149 if (rc && mandatory) 150 goto out_invalid_option; 151 break; 152 case DCCPO_CONFIRM_L: 153 /* fall through */ 154 case DCCPO_CONFIRM_R: 155 if (pkt_type == DCCP_PKT_DATA) 156 break; 157 if (len < 2) /* FIXME this disallows empty confirm */ 158 goto out_invalid_option; 159 if (dccp_feat_confirm_recv(sk, opt, *value, 160 value + 1, len - 1)) 161 goto out_invalid_option; 162 break; 163 case DCCPO_ACK_VECTOR_0: 164 case DCCPO_ACK_VECTOR_1: 165 if (dccp_packet_without_ack(skb)) /* RFC 4340, 11.4 */ 166 break; 167 168 if (dccp_msk(sk)->dccpms_send_ack_vector && 169 dccp_ackvec_parse(sk, skb, &ackno, opt, value, len)) 170 goto out_invalid_option; 171 break; 172 case DCCPO_TIMESTAMP: 173 if (len != 4) 174 goto out_invalid_option; 175 /* 176 * RFC 4340 13.1: "The precise time corresponding to 177 * Timestamp Value zero is not specified". We use 178 * zero to indicate absence of a meaningful timestamp. 179 */ 180 opt_val = get_unaligned((__be32 *)value); 181 if (unlikely(opt_val == 0)) { 182 DCCP_WARN("Timestamp with zero value\n"); 183 break; 184 } 185 186 if (dreq != NULL) { 187 dreq->dreq_timestamp_echo = ntohl(opt_val); 188 dreq->dreq_timestamp_time = dccp_timestamp(); 189 } else { 190 opt_recv->dccpor_timestamp = 191 dp->dccps_timestamp_echo = ntohl(opt_val); 192 dp->dccps_timestamp_time = dccp_timestamp(); 193 } 194 dccp_pr_debug("%s rx opt: TIMESTAMP=%u, ackno=%llu\n", 195 dccp_role(sk), ntohl(opt_val), 196 (unsigned long long) 197 DCCP_SKB_CB(skb)->dccpd_ack_seq); 198 break; 199 case DCCPO_TIMESTAMP_ECHO: 200 if (len != 4 && len != 6 && len != 8) 201 goto out_invalid_option; 202 203 opt_val = get_unaligned((__be32 *)value); 204 opt_recv->dccpor_timestamp_echo = ntohl(opt_val); 205 206 dccp_pr_debug("%s rx opt: TIMESTAMP_ECHO=%u, len=%d, " 207 "ackno=%llu", dccp_role(sk), 208 opt_recv->dccpor_timestamp_echo, 209 len + 2, 210 (unsigned long long) 211 DCCP_SKB_CB(skb)->dccpd_ack_seq); 212 213 value += 4; 214 215 if (len == 4) { /* no elapsed time included */ 216 dccp_pr_debug_cat("\n"); 217 break; 218 } 219 220 if (len == 6) { /* 2-byte elapsed time */ 221 __be16 opt_val2 = get_unaligned((__be16 *)value); 222 elapsed_time = ntohs(opt_val2); 223 } else { /* 4-byte elapsed time */ 224 opt_val = get_unaligned((__be32 *)value); 225 elapsed_time = ntohl(opt_val); 226 } 227 228 dccp_pr_debug_cat(", ELAPSED_TIME=%u\n", elapsed_time); 229 230 /* Give precedence to the biggest ELAPSED_TIME */ 231 if (elapsed_time > opt_recv->dccpor_elapsed_time) 232 opt_recv->dccpor_elapsed_time = elapsed_time; 233 break; 234 case DCCPO_ELAPSED_TIME: 235 if (dccp_packet_without_ack(skb)) /* RFC 4340, 13.2 */ 236 break; 237 238 if (len == 2) { 239 __be16 opt_val2 = get_unaligned((__be16 *)value); 240 elapsed_time = ntohs(opt_val2); 241 } else if (len == 4) { 242 opt_val = get_unaligned((__be32 *)value); 243 elapsed_time = ntohl(opt_val); 244 } else { 245 goto out_invalid_option; 246 } 247 248 if (elapsed_time > opt_recv->dccpor_elapsed_time) 249 opt_recv->dccpor_elapsed_time = elapsed_time; 250 251 dccp_pr_debug("%s rx opt: ELAPSED_TIME=%d\n", 252 dccp_role(sk), elapsed_time); 253 break; 254 case 128 ... 191: { 255 const u16 idx = value - options; 256 257 if (ccid_hc_rx_parse_options(dp->dccps_hc_rx_ccid, sk, 258 opt, len, idx, 259 value) != 0) 260 goto out_invalid_option; 261 } 262 break; 263 case 192 ... 255: { 264 const u16 idx = value - options; 265 266 if (ccid_hc_tx_parse_options(dp->dccps_hc_tx_ccid, sk, 267 opt, len, idx, 268 value) != 0) 269 goto out_invalid_option; 270 } 271 break; 272 default: 273 DCCP_CRIT("DCCP(%p): option %d(len=%d) not " 274 "implemented, ignoring", sk, opt, len); 275 break; 276 } 277 ignore_option: 278 if (opt != DCCPO_MANDATORY) 279 mandatory = 0; 280 } 281 282 /* mandatory was the last byte in option list -> reset connection */ 283 if (mandatory) 284 goto out_invalid_option; 285 286 out_nonsensical_length: 287 /* RFC 4340, 5.8: ignore option and all remaining option space */ 288 return 0; 289 290 out_invalid_option: 291 DCCP_INC_STATS_BH(DCCP_MIB_INVALIDOPT); 292 DCCP_SKB_CB(skb)->dccpd_reset_code = DCCP_RESET_CODE_OPTION_ERROR; 293 DCCP_WARN("DCCP(%p): invalid option %d, len=%d", sk, opt, len); 294 DCCP_SKB_CB(skb)->dccpd_reset_data[0] = opt; 295 DCCP_SKB_CB(skb)->dccpd_reset_data[1] = len > 0 ? value[0] : 0; 296 DCCP_SKB_CB(skb)->dccpd_reset_data[2] = len > 1 ? value[1] : 0; 297 return -1; 298 } 299 300 EXPORT_SYMBOL_GPL(dccp_parse_options); 301 302 static void dccp_encode_value_var(const u32 value, unsigned char *to, 303 const unsigned int len) 304 { 305 if (len > 3) 306 *to++ = (value & 0xFF000000) >> 24; 307 if (len > 2) 308 *to++ = (value & 0xFF0000) >> 16; 309 if (len > 1) 310 *to++ = (value & 0xFF00) >> 8; 311 if (len > 0) 312 *to++ = (value & 0xFF); 313 } 314 315 static inline u8 dccp_ndp_len(const u64 ndp) 316 { 317 if (likely(ndp <= 0xFF)) 318 return 1; 319 return likely(ndp <= USHORT_MAX) ? 2 : (ndp <= UINT_MAX ? 4 : 6); 320 } 321 322 int dccp_insert_option(struct sock *sk, struct sk_buff *skb, 323 const unsigned char option, 324 const void *value, const unsigned char len) 325 { 326 unsigned char *to; 327 328 if (DCCP_SKB_CB(skb)->dccpd_opt_len + len + 2 > DCCP_MAX_OPT_LEN) 329 return -1; 330 331 DCCP_SKB_CB(skb)->dccpd_opt_len += len + 2; 332 333 to = skb_push(skb, len + 2); 334 *to++ = option; 335 *to++ = len + 2; 336 337 memcpy(to, value, len); 338 return 0; 339 } 340 341 EXPORT_SYMBOL_GPL(dccp_insert_option); 342 343 static int dccp_insert_option_ndp(struct sock *sk, struct sk_buff *skb) 344 { 345 struct dccp_sock *dp = dccp_sk(sk); 346 u64 ndp = dp->dccps_ndp_count; 347 348 if (dccp_non_data_packet(skb)) 349 ++dp->dccps_ndp_count; 350 else 351 dp->dccps_ndp_count = 0; 352 353 if (ndp > 0) { 354 unsigned char *ptr; 355 const int ndp_len = dccp_ndp_len(ndp); 356 const int len = ndp_len + 2; 357 358 if (DCCP_SKB_CB(skb)->dccpd_opt_len + len > DCCP_MAX_OPT_LEN) 359 return -1; 360 361 DCCP_SKB_CB(skb)->dccpd_opt_len += len; 362 363 ptr = skb_push(skb, len); 364 *ptr++ = DCCPO_NDP_COUNT; 365 *ptr++ = len; 366 dccp_encode_value_var(ndp, ptr, ndp_len); 367 } 368 369 return 0; 370 } 371 372 static inline int dccp_elapsed_time_len(const u32 elapsed_time) 373 { 374 return elapsed_time == 0 ? 0 : elapsed_time <= 0xFFFF ? 2 : 4; 375 } 376 377 int dccp_insert_option_elapsed_time(struct sock *sk, struct sk_buff *skb, 378 u32 elapsed_time) 379 { 380 const int elapsed_time_len = dccp_elapsed_time_len(elapsed_time); 381 const int len = 2 + elapsed_time_len; 382 unsigned char *to; 383 384 if (elapsed_time_len == 0) 385 return 0; 386 387 if (DCCP_SKB_CB(skb)->dccpd_opt_len + len > DCCP_MAX_OPT_LEN) 388 return -1; 389 390 DCCP_SKB_CB(skb)->dccpd_opt_len += len; 391 392 to = skb_push(skb, len); 393 *to++ = DCCPO_ELAPSED_TIME; 394 *to++ = len; 395 396 if (elapsed_time_len == 2) { 397 const __be16 var16 = htons((u16)elapsed_time); 398 memcpy(to, &var16, 2); 399 } else { 400 const __be32 var32 = htonl(elapsed_time); 401 memcpy(to, &var32, 4); 402 } 403 404 return 0; 405 } 406 407 EXPORT_SYMBOL_GPL(dccp_insert_option_elapsed_time); 408 409 int dccp_insert_option_timestamp(struct sock *sk, struct sk_buff *skb) 410 { 411 __be32 now = htonl(dccp_timestamp()); 412 /* yes this will overflow but that is the point as we want a 413 * 10 usec 32 bit timer which mean it wraps every 11.9 hours */ 414 415 return dccp_insert_option(sk, skb, DCCPO_TIMESTAMP, &now, sizeof(now)); 416 } 417 418 EXPORT_SYMBOL_GPL(dccp_insert_option_timestamp); 419 420 static int dccp_insert_option_timestamp_echo(struct dccp_sock *dp, 421 struct dccp_request_sock *dreq, 422 struct sk_buff *skb) 423 { 424 __be32 tstamp_echo; 425 unsigned char *to; 426 u32 elapsed_time, elapsed_time_len, len; 427 428 if (dreq != NULL) { 429 elapsed_time = dccp_timestamp() - dreq->dreq_timestamp_time; 430 tstamp_echo = htonl(dreq->dreq_timestamp_echo); 431 dreq->dreq_timestamp_echo = 0; 432 } else { 433 elapsed_time = dccp_timestamp() - dp->dccps_timestamp_time; 434 tstamp_echo = htonl(dp->dccps_timestamp_echo); 435 dp->dccps_timestamp_echo = 0; 436 } 437 438 elapsed_time_len = dccp_elapsed_time_len(elapsed_time); 439 len = 6 + elapsed_time_len; 440 441 if (DCCP_SKB_CB(skb)->dccpd_opt_len + len > DCCP_MAX_OPT_LEN) 442 return -1; 443 444 DCCP_SKB_CB(skb)->dccpd_opt_len += len; 445 446 to = skb_push(skb, len); 447 *to++ = DCCPO_TIMESTAMP_ECHO; 448 *to++ = len; 449 450 memcpy(to, &tstamp_echo, 4); 451 to += 4; 452 453 if (elapsed_time_len == 2) { 454 const __be16 var16 = htons((u16)elapsed_time); 455 memcpy(to, &var16, 2); 456 } else if (elapsed_time_len == 4) { 457 const __be32 var32 = htonl(elapsed_time); 458 memcpy(to, &var32, 4); 459 } 460 461 return 0; 462 } 463 464 static int dccp_insert_feat_opt(struct sk_buff *skb, u8 type, u8 feat, 465 u8 *val, u8 len) 466 { 467 u8 *to; 468 469 if (DCCP_SKB_CB(skb)->dccpd_opt_len + len + 3 > DCCP_MAX_OPT_LEN) { 470 DCCP_WARN("packet too small for feature %d option!\n", feat); 471 return -1; 472 } 473 474 DCCP_SKB_CB(skb)->dccpd_opt_len += len + 3; 475 476 to = skb_push(skb, len + 3); 477 *to++ = type; 478 *to++ = len + 3; 479 *to++ = feat; 480 481 if (len) 482 memcpy(to, val, len); 483 484 dccp_pr_debug("%s(%s (%d), ...), length %d\n", 485 dccp_feat_typename(type), 486 dccp_feat_name(feat), feat, len); 487 return 0; 488 } 489 490 static int dccp_insert_options_feat(struct sock *sk, struct sk_buff *skb) 491 { 492 struct dccp_sock *dp = dccp_sk(sk); 493 struct dccp_minisock *dmsk = dccp_msk(sk); 494 struct dccp_opt_pend *opt, *next; 495 int change = 0; 496 497 /* confirm any options [NN opts] */ 498 list_for_each_entry_safe(opt, next, &dmsk->dccpms_conf, dccpop_node) { 499 dccp_insert_feat_opt(skb, opt->dccpop_type, 500 opt->dccpop_feat, opt->dccpop_val, 501 opt->dccpop_len); 502 /* fear empty confirms */ 503 if (opt->dccpop_val) 504 kfree(opt->dccpop_val); 505 kfree(opt); 506 } 507 INIT_LIST_HEAD(&dmsk->dccpms_conf); 508 509 /* see which features we need to send */ 510 list_for_each_entry(opt, &dmsk->dccpms_pending, dccpop_node) { 511 /* see if we need to send any confirm */ 512 if (opt->dccpop_sc) { 513 dccp_insert_feat_opt(skb, opt->dccpop_type + 1, 514 opt->dccpop_feat, 515 opt->dccpop_sc->dccpoc_val, 516 opt->dccpop_sc->dccpoc_len); 517 518 BUG_ON(!opt->dccpop_sc->dccpoc_val); 519 kfree(opt->dccpop_sc->dccpoc_val); 520 kfree(opt->dccpop_sc); 521 opt->dccpop_sc = NULL; 522 } 523 524 /* any option not confirmed, re-send it */ 525 if (!opt->dccpop_conf) { 526 dccp_insert_feat_opt(skb, opt->dccpop_type, 527 opt->dccpop_feat, opt->dccpop_val, 528 opt->dccpop_len); 529 change++; 530 } 531 } 532 533 /* Retransmit timer. 534 * If this is the master listening sock, we don't set a timer on it. It 535 * should be fine because if the dude doesn't receive our RESPONSE 536 * [which will contain the CHANGE] he will send another REQUEST which 537 * will "retrnasmit" the change. 538 */ 539 if (change && dp->dccps_role != DCCP_ROLE_LISTEN) { 540 dccp_pr_debug("reset feat negotiation timer %p\n", sk); 541 542 /* XXX don't reset the timer on re-transmissions. I.e. reset it 543 * only when sending new stuff i guess. Currently the timer 544 * never backs off because on re-transmission it just resets it! 545 */ 546 inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, 547 inet_csk(sk)->icsk_rto, DCCP_RTO_MAX); 548 } 549 550 return 0; 551 } 552 553 /* The length of all options needs to be a multiple of 4 (5.8) */ 554 static void dccp_insert_option_padding(struct sk_buff *skb) 555 { 556 int padding = DCCP_SKB_CB(skb)->dccpd_opt_len % 4; 557 558 if (padding != 0) { 559 padding = 4 - padding; 560 memset(skb_push(skb, padding), 0, padding); 561 DCCP_SKB_CB(skb)->dccpd_opt_len += padding; 562 } 563 } 564 565 int dccp_insert_options(struct sock *sk, struct sk_buff *skb) 566 { 567 struct dccp_sock *dp = dccp_sk(sk); 568 struct dccp_minisock *dmsk = dccp_msk(sk); 569 570 DCCP_SKB_CB(skb)->dccpd_opt_len = 0; 571 572 if (dmsk->dccpms_send_ndp_count && 573 dccp_insert_option_ndp(sk, skb)) 574 return -1; 575 576 if (!dccp_packet_without_ack(skb)) { 577 if (dmsk->dccpms_send_ack_vector && 578 dccp_ackvec_pending(dp->dccps_hc_rx_ackvec) && 579 dccp_insert_option_ackvec(sk, skb)) 580 return -1; 581 } 582 583 if (dp->dccps_hc_rx_insert_options) { 584 if (ccid_hc_rx_insert_options(dp->dccps_hc_rx_ccid, sk, skb)) 585 return -1; 586 dp->dccps_hc_rx_insert_options = 0; 587 } 588 589 /* Feature negotiation */ 590 /* Data packets can't do feat negotiation */ 591 if (DCCP_SKB_CB(skb)->dccpd_type != DCCP_PKT_DATA && 592 DCCP_SKB_CB(skb)->dccpd_type != DCCP_PKT_DATAACK && 593 dccp_insert_options_feat(sk, skb)) 594 return -1; 595 596 /* 597 * Obtain RTT sample from Request/Response exchange. 598 * This is currently used in CCID 3 initialisation. 599 */ 600 if (DCCP_SKB_CB(skb)->dccpd_type == DCCP_PKT_REQUEST && 601 dccp_insert_option_timestamp(sk, skb)) 602 return -1; 603 604 if (dp->dccps_timestamp_echo != 0 && 605 dccp_insert_option_timestamp_echo(dp, NULL, skb)) 606 return -1; 607 608 dccp_insert_option_padding(skb); 609 return 0; 610 } 611 612 int dccp_insert_options_rsk(struct dccp_request_sock *dreq, struct sk_buff *skb) 613 { 614 DCCP_SKB_CB(skb)->dccpd_opt_len = 0; 615 616 if (dreq->dreq_timestamp_echo != 0 && 617 dccp_insert_option_timestamp_echo(NULL, dreq, skb)) 618 return -1; 619 620 dccp_insert_option_padding(skb); 621 return 0; 622 } 623