1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* SCTP kernel implementation 3 * (C) Copyright IBM Corp. 2001, 2004 4 * Copyright (c) 1999-2000 Cisco, Inc. 5 * Copyright (c) 1999-2001 Motorola, Inc. 6 * Copyright (c) 2001-2002 Intel Corp. 7 * Copyright (c) 2002 Nokia Corp. 8 * 9 * This is part of the SCTP Linux Kernel Implementation. 10 * 11 * These are the state functions for the state machine. 12 * 13 * Please send any bug reports or fixes you make to the 14 * email address(es): 15 * lksctp developers <linux-sctp@vger.kernel.org> 16 * 17 * Written or modified by: 18 * La Monte H.P. Yarroll <piggy@acm.org> 19 * Karl Knutson <karl@athena.chicago.il.us> 20 * Mathew Kotowsky <kotowsky@sctp.org> 21 * Sridhar Samudrala <samudrala@us.ibm.com> 22 * Jon Grimm <jgrimm@us.ibm.com> 23 * Hui Huang <hui.huang@nokia.com> 24 * Dajiang Zhang <dajiang.zhang@nokia.com> 25 * Daisy Chang <daisyc@us.ibm.com> 26 * Ardelle Fan <ardelle.fan@intel.com> 27 * Ryan Layer <rmlayer@us.ibm.com> 28 * Kevin Gao <kevin.gao@intel.com> 29 */ 30 31 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 32 33 #include <crypto/utils.h> 34 #include <linux/types.h> 35 #include <linux/kernel.h> 36 #include <linux/ip.h> 37 #include <linux/ipv6.h> 38 #include <linux/net.h> 39 #include <linux/inet.h> 40 #include <linux/slab.h> 41 #include <net/sock.h> 42 #include <net/proto_memory.h> 43 #include <net/inet_ecn.h> 44 #include <linux/skbuff.h> 45 #include <net/sctp/sctp.h> 46 #include <net/sctp/sm.h> 47 #include <net/sctp/structs.h> 48 49 #define CREATE_TRACE_POINTS 50 #include <trace/events/sctp.h> 51 52 static struct sctp_packet *sctp_abort_pkt_new( 53 struct net *net, 54 const struct sctp_endpoint *ep, 55 const struct sctp_association *asoc, 56 struct sctp_chunk *chunk, 57 const void *payload, size_t paylen); 58 static int sctp_eat_data(const struct sctp_association *asoc, 59 struct sctp_chunk *chunk, 60 struct sctp_cmd_seq *commands); 61 static struct sctp_packet *sctp_ootb_pkt_new( 62 struct net *net, 63 const struct sctp_association *asoc, 64 const struct sctp_chunk *chunk); 65 static void sctp_send_stale_cookie_err(struct net *net, 66 const struct sctp_endpoint *ep, 67 const struct sctp_association *asoc, 68 const struct sctp_chunk *chunk, 69 struct sctp_cmd_seq *commands, 70 struct sctp_chunk *err_chunk); 71 static enum sctp_disposition sctp_sf_do_5_2_6_stale( 72 struct net *net, 73 const struct sctp_endpoint *ep, 74 const struct sctp_association *asoc, 75 const union sctp_subtype type, 76 void *arg, 77 struct sctp_cmd_seq *commands, 78 struct sctp_errhdr *err); 79 static enum sctp_disposition sctp_sf_shut_8_4_5( 80 struct net *net, 81 const struct sctp_endpoint *ep, 82 const struct sctp_association *asoc, 83 const union sctp_subtype type, 84 void *arg, 85 struct sctp_cmd_seq *commands); 86 static enum sctp_disposition sctp_sf_tabort_8_4_8( 87 struct net *net, 88 const struct sctp_endpoint *ep, 89 const struct sctp_association *asoc, 90 const union sctp_subtype type, 91 void *arg, 92 struct sctp_cmd_seq *commands); 93 static enum sctp_disposition sctp_sf_new_encap_port( 94 struct net *net, 95 const struct sctp_endpoint *ep, 96 const struct sctp_association *asoc, 97 const union sctp_subtype type, 98 void *arg, 99 struct sctp_cmd_seq *commands); 100 static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk); 101 102 static enum sctp_disposition sctp_stop_t1_and_abort( 103 struct net *net, 104 struct sctp_cmd_seq *commands, 105 __be16 error, int sk_err, 106 const struct sctp_association *asoc, 107 struct sctp_transport *transport); 108 109 static enum sctp_disposition sctp_sf_abort_violation( 110 struct net *net, 111 const struct sctp_endpoint *ep, 112 const struct sctp_association *asoc, 113 void *arg, 114 struct sctp_cmd_seq *commands, 115 const __u8 *payload, 116 const size_t paylen); 117 118 static enum sctp_disposition sctp_sf_violation_chunklen( 119 struct net *net, 120 const struct sctp_endpoint *ep, 121 const struct sctp_association *asoc, 122 const union sctp_subtype type, 123 void *arg, 124 struct sctp_cmd_seq *commands); 125 126 static enum sctp_disposition sctp_sf_violation_paramlen( 127 struct net *net, 128 const struct sctp_endpoint *ep, 129 const struct sctp_association *asoc, 130 const union sctp_subtype type, 131 void *arg, void *ext, 132 struct sctp_cmd_seq *commands); 133 134 static enum sctp_disposition sctp_sf_violation_ctsn( 135 struct net *net, 136 const struct sctp_endpoint *ep, 137 const struct sctp_association *asoc, 138 const union sctp_subtype type, 139 void *arg, 140 struct sctp_cmd_seq *commands); 141 142 static enum sctp_disposition sctp_sf_violation_chunk( 143 struct net *net, 144 const struct sctp_endpoint *ep, 145 const struct sctp_association *asoc, 146 const union sctp_subtype type, 147 void *arg, 148 struct sctp_cmd_seq *commands); 149 150 static enum sctp_ierror sctp_sf_authenticate( 151 const struct sctp_association *asoc, 152 struct sctp_chunk *chunk); 153 154 static enum sctp_disposition __sctp_sf_do_9_1_abort( 155 struct net *net, 156 const struct sctp_endpoint *ep, 157 const struct sctp_association *asoc, 158 const union sctp_subtype type, 159 void *arg, 160 struct sctp_cmd_seq *commands); 161 162 static enum sctp_disposition 163 __sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep, 164 const struct sctp_association *asoc, 165 const union sctp_subtype type, void *arg, 166 struct sctp_cmd_seq *commands); 167 168 /* Small helper function that checks if the chunk length 169 * is of the appropriate length. The 'required_length' argument 170 * is set to be the size of a specific chunk we are testing. 171 * Return Values: true = Valid length 172 * false = Invalid length 173 * 174 */ 175 static inline bool sctp_chunk_length_valid(struct sctp_chunk *chunk, 176 __u16 required_length) 177 { 178 __u16 chunk_length = ntohs(chunk->chunk_hdr->length); 179 180 /* Previously already marked? */ 181 if (unlikely(chunk->pdiscard)) 182 return false; 183 if (unlikely(chunk_length < required_length)) 184 return false; 185 186 return true; 187 } 188 189 /* Check for format error in an ABORT chunk */ 190 static inline bool sctp_err_chunk_valid(struct sctp_chunk *chunk) 191 { 192 struct sctp_errhdr *err; 193 194 sctp_walk_errors(err, chunk->chunk_hdr); 195 196 return (void *)err == (void *)chunk->chunk_end; 197 } 198 199 /********************************************************** 200 * These are the state functions for handling chunk events. 201 **********************************************************/ 202 203 /* 204 * Process the final SHUTDOWN COMPLETE. 205 * 206 * Section: 4 (C) (diagram), 9.2 207 * Upon reception of the SHUTDOWN COMPLETE chunk the endpoint will verify 208 * that it is in SHUTDOWN-ACK-SENT state, if it is not the chunk should be 209 * discarded. If the endpoint is in the SHUTDOWN-ACK-SENT state the endpoint 210 * should stop the T2-shutdown timer and remove all knowledge of the 211 * association (and thus the association enters the CLOSED state). 212 * 213 * Verification Tag: 8.5.1(C), sctpimpguide 2.41. 214 * C) Rules for packet carrying SHUTDOWN COMPLETE: 215 * ... 216 * - The receiver of a SHUTDOWN COMPLETE shall accept the packet 217 * if the Verification Tag field of the packet matches its own tag and 218 * the T bit is not set 219 * OR 220 * it is set to its peer's tag and the T bit is set in the Chunk 221 * Flags. 222 * Otherwise, the receiver MUST silently discard the packet 223 * and take no further action. An endpoint MUST ignore the 224 * SHUTDOWN COMPLETE if it is not in the SHUTDOWN-ACK-SENT state. 225 * 226 * Inputs 227 * (endpoint, asoc, chunk) 228 * 229 * Outputs 230 * (asoc, reply_msg, msg_up, timers, counters) 231 * 232 * The return value is the disposition of the chunk. 233 */ 234 enum sctp_disposition sctp_sf_do_4_C(struct net *net, 235 const struct sctp_endpoint *ep, 236 const struct sctp_association *asoc, 237 const union sctp_subtype type, 238 void *arg, struct sctp_cmd_seq *commands) 239 { 240 struct sctp_chunk *chunk = arg; 241 struct sctp_ulpevent *ev; 242 243 if (!sctp_vtag_verify_either(chunk, asoc)) 244 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 245 246 /* RFC 2960 6.10 Bundling 247 * 248 * An endpoint MUST NOT bundle INIT, INIT ACK or 249 * SHUTDOWN COMPLETE with any other chunks. 250 */ 251 if (!chunk->singleton) 252 return sctp_sf_violation_chunk(net, ep, asoc, type, arg, commands); 253 254 /* Make sure that the SHUTDOWN_COMPLETE chunk has a valid length. */ 255 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) 256 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 257 commands); 258 259 /* RFC 2960 10.2 SCTP-to-ULP 260 * 261 * H) SHUTDOWN COMPLETE notification 262 * 263 * When SCTP completes the shutdown procedures (section 9.2) this 264 * notification is passed to the upper layer. 265 */ 266 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_SHUTDOWN_COMP, 267 0, 0, 0, NULL, GFP_ATOMIC); 268 if (ev) 269 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, 270 SCTP_ULPEVENT(ev)); 271 272 /* Upon reception of the SHUTDOWN COMPLETE chunk the endpoint 273 * will verify that it is in SHUTDOWN-ACK-SENT state, if it is 274 * not the chunk should be discarded. If the endpoint is in 275 * the SHUTDOWN-ACK-SENT state the endpoint should stop the 276 * T2-shutdown timer and remove all knowledge of the 277 * association (and thus the association enters the CLOSED 278 * state). 279 */ 280 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, 281 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN)); 282 283 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, 284 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD)); 285 286 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE, 287 SCTP_STATE(SCTP_STATE_CLOSED)); 288 289 SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS); 290 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB); 291 292 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL()); 293 294 return SCTP_DISPOSITION_DELETE_TCB; 295 } 296 297 /* 298 * Respond to a normal INIT chunk. 299 * We are the side that is being asked for an association. 300 * 301 * Section: 5.1 Normal Establishment of an Association, B 302 * B) "Z" shall respond immediately with an INIT ACK chunk. The 303 * destination IP address of the INIT ACK MUST be set to the source 304 * IP address of the INIT to which this INIT ACK is responding. In 305 * the response, besides filling in other parameters, "Z" must set the 306 * Verification Tag field to Tag_A, and also provide its own 307 * Verification Tag (Tag_Z) in the Initiate Tag field. 308 * 309 * Verification Tag: Must be 0. 310 * 311 * Inputs 312 * (endpoint, asoc, chunk) 313 * 314 * Outputs 315 * (asoc, reply_msg, msg_up, timers, counters) 316 * 317 * The return value is the disposition of the chunk. 318 */ 319 enum sctp_disposition sctp_sf_do_5_1B_init(struct net *net, 320 const struct sctp_endpoint *ep, 321 const struct sctp_association *asoc, 322 const union sctp_subtype type, 323 void *arg, 324 struct sctp_cmd_seq *commands) 325 { 326 struct sctp_chunk *chunk = arg, *repl, *err_chunk; 327 struct sctp_unrecognized_param *unk_param; 328 struct sctp_association *new_asoc; 329 struct sctp_packet *packet; 330 int len; 331 332 /* 6.10 Bundling 333 * An endpoint MUST NOT bundle INIT, INIT ACK or 334 * SHUTDOWN COMPLETE with any other chunks. 335 * 336 * IG Section 2.11.2 337 * Furthermore, we require that the receiver of an INIT chunk MUST 338 * enforce these rules by silently discarding an arriving packet 339 * with an INIT chunk that is bundled with other chunks. 340 */ 341 if (!chunk->singleton) 342 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 343 344 /* Make sure that the INIT chunk has a valid length. 345 * Normally, this would cause an ABORT with a Protocol Violation 346 * error, but since we don't have an association, we'll 347 * just discard the packet. 348 */ 349 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk))) 350 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 351 352 /* If the packet is an OOTB packet which is temporarily on the 353 * control endpoint, respond with an ABORT. 354 */ 355 if (ep == sctp_sk(net->sctp.ctl_sock)->ep) { 356 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES); 357 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands); 358 } 359 360 /* 3.1 A packet containing an INIT chunk MUST have a zero Verification 361 * Tag. 362 */ 363 if (chunk->sctp_hdr->vtag != 0) 364 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands); 365 366 /* If the INIT is coming toward a closing socket, we'll send back 367 * and ABORT. Essentially, this catches the race of INIT being 368 * backloged to the socket at the same time as the user issues close(). 369 * Since the socket and all its associations are going away, we 370 * can treat this OOTB 371 */ 372 if (sctp_sstate(ep->base.sk, CLOSING)) 373 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands); 374 375 /* Verify the INIT chunk before processing it. */ 376 err_chunk = NULL; 377 if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type, 378 (struct sctp_init_chunk *)chunk->chunk_hdr, chunk, 379 &err_chunk)) { 380 /* This chunk contains fatal error. It is to be discarded. 381 * Send an ABORT, with causes if there is any. 382 */ 383 if (err_chunk) { 384 packet = sctp_abort_pkt_new(net, ep, asoc, arg, 385 (__u8 *)(err_chunk->chunk_hdr) + 386 sizeof(struct sctp_chunkhdr), 387 ntohs(err_chunk->chunk_hdr->length) - 388 sizeof(struct sctp_chunkhdr)); 389 390 sctp_chunk_free(err_chunk); 391 392 if (packet) { 393 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT, 394 SCTP_PACKET(packet)); 395 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS); 396 return SCTP_DISPOSITION_CONSUME; 397 } else { 398 return SCTP_DISPOSITION_NOMEM; 399 } 400 } else { 401 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, 402 commands); 403 } 404 } 405 406 /* Grab the INIT header. */ 407 chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data; 408 409 /* Tag the variable length parameters. */ 410 chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(struct sctp_inithdr)); 411 412 new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC); 413 if (!new_asoc) 414 goto nomem; 415 416 /* Update socket peer label if first association. */ 417 if (security_sctp_assoc_request(new_asoc, chunk->skb)) { 418 sctp_association_free(new_asoc); 419 if (err_chunk) 420 sctp_chunk_free(err_chunk); 421 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 422 } 423 424 if (sctp_assoc_set_bind_addr_from_ep(new_asoc, 425 sctp_scope(sctp_source(chunk)), 426 GFP_ATOMIC) < 0) 427 goto nomem_init; 428 429 /* The call, sctp_process_init(), can fail on memory allocation. */ 430 if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk), 431 (struct sctp_init_chunk *)chunk->chunk_hdr, 432 GFP_ATOMIC)) 433 goto nomem_init; 434 435 /* B) "Z" shall respond immediately with an INIT ACK chunk. */ 436 437 /* If there are errors need to be reported for unknown parameters, 438 * make sure to reserve enough room in the INIT ACK for them. 439 */ 440 len = 0; 441 if (err_chunk) 442 len = ntohs(err_chunk->chunk_hdr->length) - 443 sizeof(struct sctp_chunkhdr); 444 445 repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len); 446 if (!repl) 447 goto nomem_init; 448 449 /* If there are errors need to be reported for unknown parameters, 450 * include them in the outgoing INIT ACK as "Unrecognized parameter" 451 * parameter. 452 */ 453 if (err_chunk) { 454 /* Get the "Unrecognized parameter" parameter(s) out of the 455 * ERROR chunk generated by sctp_verify_init(). Since the 456 * error cause code for "unknown parameter" and the 457 * "Unrecognized parameter" type is the same, we can 458 * construct the parameters in INIT ACK by copying the 459 * ERROR causes over. 460 */ 461 unk_param = (struct sctp_unrecognized_param *) 462 ((__u8 *)(err_chunk->chunk_hdr) + 463 sizeof(struct sctp_chunkhdr)); 464 /* Replace the cause code with the "Unrecognized parameter" 465 * parameter type. 466 */ 467 sctp_addto_chunk(repl, len, unk_param); 468 sctp_chunk_free(err_chunk); 469 } 470 471 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc)); 472 473 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl)); 474 475 /* 476 * Note: After sending out INIT ACK with the State Cookie parameter, 477 * "Z" MUST NOT allocate any resources, nor keep any states for the 478 * new association. Otherwise, "Z" will be vulnerable to resource 479 * attacks. 480 */ 481 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL()); 482 483 return SCTP_DISPOSITION_DELETE_TCB; 484 485 nomem_init: 486 sctp_association_free(new_asoc); 487 nomem: 488 if (err_chunk) 489 sctp_chunk_free(err_chunk); 490 return SCTP_DISPOSITION_NOMEM; 491 } 492 493 /* 494 * Respond to a normal INIT ACK chunk. 495 * We are the side that is initiating the association. 496 * 497 * Section: 5.1 Normal Establishment of an Association, C 498 * C) Upon reception of the INIT ACK from "Z", "A" shall stop the T1-init 499 * timer and leave COOKIE-WAIT state. "A" shall then send the State 500 * Cookie received in the INIT ACK chunk in a COOKIE ECHO chunk, start 501 * the T1-cookie timer, and enter the COOKIE-ECHOED state. 502 * 503 * Note: The COOKIE ECHO chunk can be bundled with any pending outbound 504 * DATA chunks, but it MUST be the first chunk in the packet and 505 * until the COOKIE ACK is returned the sender MUST NOT send any 506 * other packets to the peer. 507 * 508 * Verification Tag: 3.3.3 509 * If the value of the Initiate Tag in a received INIT ACK chunk is 510 * found to be 0, the receiver MUST treat it as an error and close the 511 * association by transmitting an ABORT. 512 * 513 * Inputs 514 * (endpoint, asoc, chunk) 515 * 516 * Outputs 517 * (asoc, reply_msg, msg_up, timers, counters) 518 * 519 * The return value is the disposition of the chunk. 520 */ 521 enum sctp_disposition sctp_sf_do_5_1C_ack(struct net *net, 522 const struct sctp_endpoint *ep, 523 const struct sctp_association *asoc, 524 const union sctp_subtype type, 525 void *arg, 526 struct sctp_cmd_seq *commands) 527 { 528 struct sctp_init_chunk *initchunk; 529 struct sctp_chunk *chunk = arg; 530 struct sctp_chunk *err_chunk; 531 struct sctp_packet *packet; 532 533 if (!sctp_vtag_verify(chunk, asoc)) 534 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 535 536 /* 6.10 Bundling 537 * An endpoint MUST NOT bundle INIT, INIT ACK or 538 * SHUTDOWN COMPLETE with any other chunks. 539 */ 540 if (!chunk->singleton) 541 return sctp_sf_violation_chunk(net, ep, asoc, type, arg, commands); 542 543 /* Make sure that the INIT-ACK chunk has a valid length */ 544 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_initack_chunk))) 545 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 546 commands); 547 /* Grab the INIT header. */ 548 chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data; 549 550 /* Verify the INIT chunk before processing it. */ 551 err_chunk = NULL; 552 if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type, 553 (struct sctp_init_chunk *)chunk->chunk_hdr, chunk, 554 &err_chunk)) { 555 556 enum sctp_error error = SCTP_ERROR_NO_RESOURCE; 557 558 /* This chunk contains fatal error. It is to be discarded. 559 * Send an ABORT, with causes. If there are no causes, 560 * then there wasn't enough memory. Just terminate 561 * the association. 562 */ 563 if (err_chunk) { 564 packet = sctp_abort_pkt_new(net, ep, asoc, arg, 565 (__u8 *)(err_chunk->chunk_hdr) + 566 sizeof(struct sctp_chunkhdr), 567 ntohs(err_chunk->chunk_hdr->length) - 568 sizeof(struct sctp_chunkhdr)); 569 570 sctp_chunk_free(err_chunk); 571 572 if (packet) { 573 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT, 574 SCTP_PACKET(packet)); 575 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS); 576 error = SCTP_ERROR_INV_PARAM; 577 } 578 } 579 580 /* SCTP-AUTH, Section 6.3: 581 * It should be noted that if the receiver wants to tear 582 * down an association in an authenticated way only, the 583 * handling of malformed packets should not result in 584 * tearing down the association. 585 * 586 * This means that if we only want to abort associations 587 * in an authenticated way (i.e AUTH+ABORT), then we 588 * can't destroy this association just because the packet 589 * was malformed. 590 */ 591 if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc)) 592 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 593 594 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS); 595 return sctp_stop_t1_and_abort(net, commands, error, ECONNREFUSED, 596 asoc, chunk->transport); 597 } 598 599 /* Tag the variable length parameters. Note that we never 600 * convert the parameters in an INIT chunk. 601 */ 602 chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(struct sctp_inithdr)); 603 604 initchunk = (struct sctp_init_chunk *)chunk->chunk_hdr; 605 606 sctp_add_cmd_sf(commands, SCTP_CMD_PEER_INIT, 607 SCTP_PEER_INIT(initchunk)); 608 609 /* SCTP-AUTH: generate the association shared keys so that 610 * we can potentially sign the COOKIE-ECHO. 611 */ 612 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_SHKEY, SCTP_NULL()); 613 614 /* Reset init error count upon receipt of INIT-ACK. */ 615 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL()); 616 617 /* 5.1 C) "A" shall stop the T1-init timer and leave 618 * COOKIE-WAIT state. "A" shall then ... start the T1-cookie 619 * timer, and enter the COOKIE-ECHOED state. 620 */ 621 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, 622 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT)); 623 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START, 624 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE)); 625 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE, 626 SCTP_STATE(SCTP_STATE_COOKIE_ECHOED)); 627 628 /* 5.1 C) "A" shall then send the State Cookie received in the 629 * INIT ACK chunk in a COOKIE ECHO chunk, ... 630 */ 631 /* If there is any errors to report, send the ERROR chunk generated 632 * for unknown parameters as well. 633 */ 634 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_COOKIE_ECHO, 635 SCTP_CHUNK(err_chunk)); 636 637 return SCTP_DISPOSITION_CONSUME; 638 } 639 640 static bool sctp_auth_chunk_verify(struct net *net, struct sctp_chunk *chunk, 641 const struct sctp_association *asoc) 642 { 643 struct sctp_chunk auth; 644 645 if (!chunk->auth_chunk) 646 return !sctp_auth_recv_cid(chunk->chunk_hdr->type, asoc); 647 648 /* SCTP-AUTH: auth_chunk pointer is only set when the cookie-echo 649 * is supposed to be authenticated and we have to do delayed 650 * authentication. We've just recreated the association using 651 * the information in the cookie and now it's much easier to 652 * do the authentication. 653 */ 654 655 /* Make sure that we and the peer are AUTH capable */ 656 if (!net->sctp.auth_enable || !asoc->peer.auth_capable) 657 return false; 658 659 /* set-up our fake chunk so that we can process it */ 660 auth.skb = chunk->auth_chunk; 661 auth.asoc = chunk->asoc; 662 auth.sctp_hdr = chunk->sctp_hdr; 663 auth.chunk_hdr = (struct sctp_chunkhdr *) 664 skb_push(chunk->auth_chunk, 665 sizeof(struct sctp_chunkhdr)); 666 skb_pull(chunk->auth_chunk, sizeof(struct sctp_chunkhdr)); 667 auth.transport = chunk->transport; 668 669 return sctp_sf_authenticate(asoc, &auth) == SCTP_IERROR_NO_ERROR; 670 } 671 672 /* 673 * Respond to a normal COOKIE ECHO chunk. 674 * We are the side that is being asked for an association. 675 * 676 * Section: 5.1 Normal Establishment of an Association, D 677 * D) Upon reception of the COOKIE ECHO chunk, Endpoint "Z" will reply 678 * with a COOKIE ACK chunk after building a TCB and moving to 679 * the ESTABLISHED state. A COOKIE ACK chunk may be bundled with 680 * any pending DATA chunks (and/or SACK chunks), but the COOKIE ACK 681 * chunk MUST be the first chunk in the packet. 682 * 683 * IMPLEMENTATION NOTE: An implementation may choose to send the 684 * Communication Up notification to the SCTP user upon reception 685 * of a valid COOKIE ECHO chunk. 686 * 687 * Verification Tag: 8.5.1 Exceptions in Verification Tag Rules 688 * D) Rules for packet carrying a COOKIE ECHO 689 * 690 * - When sending a COOKIE ECHO, the endpoint MUST use the value of the 691 * Initial Tag received in the INIT ACK. 692 * 693 * - The receiver of a COOKIE ECHO follows the procedures in Section 5. 694 * 695 * Inputs 696 * (endpoint, asoc, chunk) 697 * 698 * Outputs 699 * (asoc, reply_msg, msg_up, timers, counters) 700 * 701 * The return value is the disposition of the chunk. 702 */ 703 enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net, 704 const struct sctp_endpoint *ep, 705 const struct sctp_association *asoc, 706 const union sctp_subtype type, 707 void *arg, 708 struct sctp_cmd_seq *commands) 709 { 710 struct sctp_ulpevent *ev, *ai_ev = NULL, *auth_ev = NULL; 711 struct sctp_chunk *err_chk_p = NULL; 712 struct sctp_association *new_asoc; 713 struct sctp_init_chunk *peer_init; 714 struct sctp_chunk *chunk = arg; 715 struct sctp_chunk *repl; 716 enum sctp_cid cid; 717 struct sock *sk; 718 int error = 0; 719 720 if (asoc && !sctp_vtag_verify(chunk, asoc)) 721 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 722 723 /* If the packet is an OOTB packet which is temporarily on the 724 * control endpoint, respond with an ABORT. 725 */ 726 if (ep == sctp_sk(net->sctp.ctl_sock)->ep) { 727 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES); 728 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands); 729 } 730 731 /* Make sure that the COOKIE_ECHO chunk has a valid length. 732 * In this case, we check that we have enough for at least a 733 * chunk header. More detailed verification is done 734 * in sctp_unpack_cookie(). 735 */ 736 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) 737 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 738 commands); 739 740 /* If the endpoint is not listening or if the number of associations 741 * on the TCP-style socket exceed the max backlog, respond with an 742 * ABORT. 743 */ 744 sk = ep->base.sk; 745 if (!sctp_sstate(sk, LISTENING) || 746 (sctp_style(sk, TCP) && sk_acceptq_is_full(sk))) 747 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands); 748 749 /* "Decode" the chunk. We have no optional parameters so we 750 * are in good shape. 751 */ 752 chunk->subh.cookie_hdr = 753 (struct sctp_signed_cookie *)chunk->skb->data; 754 if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) - 755 sizeof(struct sctp_chunkhdr))) 756 goto nomem; 757 758 /* 5.1 D) Upon reception of the COOKIE ECHO chunk, Endpoint 759 * "Z" will reply with a COOKIE ACK chunk after building a TCB 760 * and moving to the ESTABLISHED state. 761 */ 762 new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, &error, 763 &err_chk_p); 764 765 /* FIXME: 766 * If the re-build failed, what is the proper error path 767 * from here? 768 * 769 * [We should abort the association. --piggy] 770 */ 771 if (!new_asoc) { 772 /* FIXME: Several errors are possible. A bad cookie should 773 * be silently discarded, but think about logging it too. 774 */ 775 switch (error) { 776 case -SCTP_IERROR_NOMEM: 777 goto nomem; 778 779 case -SCTP_IERROR_STALE_COOKIE: 780 sctp_send_stale_cookie_err(net, ep, asoc, chunk, commands, 781 err_chk_p); 782 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 783 784 case -SCTP_IERROR_BAD_SIG: 785 default: 786 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 787 } 788 } 789 790 peer_init = (struct sctp_init_chunk *)(chunk->subh.cookie_hdr + 1); 791 cid = peer_init->chunk_hdr.type; 792 if (!sctp_sk(sk)->cookie_auth_enable && 793 !sctp_verify_init(net, ep, asoc, cid, peer_init, chunk, 794 &err_chk_p)) { 795 sctp_association_free(new_asoc); 796 if (err_chk_p) 797 sctp_chunk_free(err_chk_p); 798 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 799 } 800 if (err_chk_p) 801 sctp_chunk_free(err_chk_p); 802 803 if (security_sctp_assoc_request(new_asoc, chunk->head_skb ?: chunk->skb)) { 804 sctp_association_free(new_asoc); 805 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 806 } 807 808 /* Delay state machine commands until later. 809 * 810 * Re-build the bind address for the association is done in 811 * the sctp_unpack_cookie() already. 812 */ 813 /* This is a brand-new association, so these are not yet side 814 * effects--it is safe to run them here. 815 */ 816 if (!sctp_process_init(new_asoc, chunk, 817 &chunk->subh.cookie_hdr->c.peer_addr, 818 peer_init, GFP_ATOMIC)) 819 goto nomem_init; 820 821 /* SCTP-AUTH: Now that we've populate required fields in 822 * sctp_process_init, set up the association shared keys as 823 * necessary so that we can potentially authenticate the ACK 824 */ 825 error = sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC); 826 if (error) 827 goto nomem_init; 828 829 if (!sctp_auth_chunk_verify(net, chunk, new_asoc)) { 830 sctp_association_free(new_asoc); 831 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 832 } 833 834 repl = sctp_make_cookie_ack(new_asoc, chunk); 835 if (!repl) 836 goto nomem_init; 837 838 /* RFC 2960 5.1 Normal Establishment of an Association 839 * 840 * D) IMPLEMENTATION NOTE: An implementation may choose to 841 * send the Communication Up notification to the SCTP user 842 * upon reception of a valid COOKIE ECHO chunk. 843 */ 844 ev = sctp_ulpevent_make_assoc_change(new_asoc, 0, SCTP_COMM_UP, 0, 845 new_asoc->c.sinit_num_ostreams, 846 new_asoc->c.sinit_max_instreams, 847 NULL, GFP_ATOMIC); 848 if (!ev) 849 goto nomem_ev; 850 851 /* Sockets API Draft Section 5.3.1.6 852 * When a peer sends a Adaptation Layer Indication parameter , SCTP 853 * delivers this notification to inform the application that of the 854 * peers requested adaptation layer. 855 */ 856 if (new_asoc->peer.adaptation_ind) { 857 ai_ev = sctp_ulpevent_make_adaptation_indication(new_asoc, 858 GFP_ATOMIC); 859 if (!ai_ev) 860 goto nomem_aiev; 861 } 862 863 if (!new_asoc->peer.auth_capable) { 864 auth_ev = sctp_ulpevent_make_authkey(new_asoc, 0, 865 SCTP_AUTH_NO_AUTH, 866 GFP_ATOMIC); 867 if (!auth_ev) 868 goto nomem_authev; 869 } 870 871 /* Add all the state machine commands now since we've created 872 * everything. This way we don't introduce memory corruptions 873 * during side-effect processing and correctly count established 874 * associations. 875 */ 876 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc)); 877 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE, 878 SCTP_STATE(SCTP_STATE_ESTABLISHED)); 879 SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB); 880 SCTP_INC_STATS(net, SCTP_MIB_PASSIVEESTABS); 881 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL()); 882 883 if (new_asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) 884 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START, 885 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE)); 886 887 /* This will send the COOKIE ACK */ 888 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl)); 889 890 /* Queue the ASSOC_CHANGE event */ 891 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev)); 892 893 /* Send up the Adaptation Layer Indication event */ 894 if (ai_ev) 895 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, 896 SCTP_ULPEVENT(ai_ev)); 897 898 if (auth_ev) 899 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, 900 SCTP_ULPEVENT(auth_ev)); 901 902 return SCTP_DISPOSITION_CONSUME; 903 904 nomem_authev: 905 if (ai_ev) 906 sctp_ulpevent_free(ai_ev); 907 nomem_aiev: 908 sctp_ulpevent_free(ev); 909 nomem_ev: 910 sctp_chunk_free(repl); 911 nomem_init: 912 sctp_association_free(new_asoc); 913 nomem: 914 return SCTP_DISPOSITION_NOMEM; 915 } 916 917 /* 918 * Respond to a normal COOKIE ACK chunk. 919 * We are the side that is asking for an association. 920 * 921 * RFC 2960 5.1 Normal Establishment of an Association 922 * 923 * E) Upon reception of the COOKIE ACK, endpoint "A" will move from the 924 * COOKIE-ECHOED state to the ESTABLISHED state, stopping the T1-cookie 925 * timer. It may also notify its ULP about the successful 926 * establishment of the association with a Communication Up 927 * notification (see Section 10). 928 * 929 * Verification Tag: 930 * Inputs 931 * (endpoint, asoc, chunk) 932 * 933 * Outputs 934 * (asoc, reply_msg, msg_up, timers, counters) 935 * 936 * The return value is the disposition of the chunk. 937 */ 938 enum sctp_disposition sctp_sf_do_5_1E_ca(struct net *net, 939 const struct sctp_endpoint *ep, 940 const struct sctp_association *asoc, 941 const union sctp_subtype type, 942 void *arg, 943 struct sctp_cmd_seq *commands) 944 { 945 struct sctp_chunk *chunk = arg; 946 struct sctp_ulpevent *ev; 947 948 if (!sctp_vtag_verify(chunk, asoc)) 949 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 950 951 /* Set peer label for connection. */ 952 if (security_sctp_assoc_established((struct sctp_association *)asoc, 953 chunk->head_skb ?: chunk->skb)) 954 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 955 956 /* Verify that the chunk length for the COOKIE-ACK is OK. 957 * If we don't do this, any bundled chunks may be junked. 958 */ 959 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) 960 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 961 commands); 962 963 /* Reset init error count upon receipt of COOKIE-ACK, 964 * to avoid problems with the management of this 965 * counter in stale cookie situations when a transition back 966 * from the COOKIE-ECHOED state to the COOKIE-WAIT 967 * state is performed. 968 */ 969 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL()); 970 971 /* RFC 2960 5.1 Normal Establishment of an Association 972 * 973 * E) Upon reception of the COOKIE ACK, endpoint "A" will move 974 * from the COOKIE-ECHOED state to the ESTABLISHED state, 975 * stopping the T1-cookie timer. 976 */ 977 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, 978 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE)); 979 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE, 980 SCTP_STATE(SCTP_STATE_ESTABLISHED)); 981 SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB); 982 SCTP_INC_STATS(net, SCTP_MIB_ACTIVEESTABS); 983 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL()); 984 if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) 985 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START, 986 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE)); 987 988 /* It may also notify its ULP about the successful 989 * establishment of the association with a Communication Up 990 * notification (see Section 10). 991 */ 992 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_COMM_UP, 993 0, asoc->c.sinit_num_ostreams, 994 asoc->c.sinit_max_instreams, 995 NULL, GFP_ATOMIC); 996 997 if (!ev) 998 goto nomem; 999 1000 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev)); 1001 1002 /* Sockets API Draft Section 5.3.1.6 1003 * When a peer sends a Adaptation Layer Indication parameter , SCTP 1004 * delivers this notification to inform the application that of the 1005 * peers requested adaptation layer. 1006 */ 1007 if (asoc->peer.adaptation_ind) { 1008 ev = sctp_ulpevent_make_adaptation_indication(asoc, GFP_ATOMIC); 1009 if (!ev) 1010 goto nomem; 1011 1012 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, 1013 SCTP_ULPEVENT(ev)); 1014 } 1015 1016 if (!asoc->peer.auth_capable) { 1017 ev = sctp_ulpevent_make_authkey(asoc, 0, SCTP_AUTH_NO_AUTH, 1018 GFP_ATOMIC); 1019 if (!ev) 1020 goto nomem; 1021 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, 1022 SCTP_ULPEVENT(ev)); 1023 } 1024 1025 return SCTP_DISPOSITION_CONSUME; 1026 nomem: 1027 return SCTP_DISPOSITION_NOMEM; 1028 } 1029 1030 /* Generate and sendout a heartbeat packet. */ 1031 static enum sctp_disposition sctp_sf_heartbeat( 1032 const struct sctp_endpoint *ep, 1033 const struct sctp_association *asoc, 1034 const union sctp_subtype type, 1035 void *arg, 1036 struct sctp_cmd_seq *commands) 1037 { 1038 struct sctp_transport *transport = (struct sctp_transport *) arg; 1039 struct sctp_chunk *reply; 1040 1041 /* Send a heartbeat to our peer. */ 1042 reply = sctp_make_heartbeat(asoc, transport, 0); 1043 if (!reply) 1044 return SCTP_DISPOSITION_NOMEM; 1045 1046 /* Set rto_pending indicating that an RTT measurement 1047 * is started with this heartbeat chunk. 1048 */ 1049 sctp_add_cmd_sf(commands, SCTP_CMD_RTO_PENDING, 1050 SCTP_TRANSPORT(transport)); 1051 1052 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply)); 1053 return SCTP_DISPOSITION_CONSUME; 1054 } 1055 1056 /* Generate a HEARTBEAT packet on the given transport. */ 1057 enum sctp_disposition sctp_sf_sendbeat_8_3(struct net *net, 1058 const struct sctp_endpoint *ep, 1059 const struct sctp_association *asoc, 1060 const union sctp_subtype type, 1061 void *arg, 1062 struct sctp_cmd_seq *commands) 1063 { 1064 struct sctp_transport *transport = (struct sctp_transport *) arg; 1065 1066 if (asoc->overall_error_count >= asoc->max_retrans) { 1067 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, 1068 SCTP_ERROR(ETIMEDOUT)); 1069 /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */ 1070 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, 1071 SCTP_PERR(SCTP_ERROR_NO_ERROR)); 1072 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS); 1073 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB); 1074 return SCTP_DISPOSITION_DELETE_TCB; 1075 } 1076 1077 /* Section 3.3.5. 1078 * The Sender-specific Heartbeat Info field should normally include 1079 * information about the sender's current time when this HEARTBEAT 1080 * chunk is sent and the destination transport address to which this 1081 * HEARTBEAT is sent (see Section 8.3). 1082 */ 1083 1084 if (transport->param_flags & SPP_HB_ENABLE) { 1085 if (SCTP_DISPOSITION_NOMEM == 1086 sctp_sf_heartbeat(ep, asoc, type, arg, 1087 commands)) 1088 return SCTP_DISPOSITION_NOMEM; 1089 1090 /* Set transport error counter and association error counter 1091 * when sending heartbeat. 1092 */ 1093 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_HB_SENT, 1094 SCTP_TRANSPORT(transport)); 1095 } 1096 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_IDLE, 1097 SCTP_TRANSPORT(transport)); 1098 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMER_UPDATE, 1099 SCTP_TRANSPORT(transport)); 1100 1101 return SCTP_DISPOSITION_CONSUME; 1102 } 1103 1104 /* resend asoc strreset_chunk. */ 1105 enum sctp_disposition sctp_sf_send_reconf(struct net *net, 1106 const struct sctp_endpoint *ep, 1107 const struct sctp_association *asoc, 1108 const union sctp_subtype type, 1109 void *arg, 1110 struct sctp_cmd_seq *commands) 1111 { 1112 struct sctp_transport *transport = arg; 1113 1114 if (asoc->overall_error_count >= asoc->max_retrans) { 1115 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, 1116 SCTP_ERROR(ETIMEDOUT)); 1117 /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */ 1118 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, 1119 SCTP_PERR(SCTP_ERROR_NO_ERROR)); 1120 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS); 1121 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB); 1122 return SCTP_DISPOSITION_DELETE_TCB; 1123 } 1124 1125 sctp_chunk_hold(asoc->strreset_chunk); 1126 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, 1127 SCTP_CHUNK(asoc->strreset_chunk)); 1128 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE, SCTP_TRANSPORT(transport)); 1129 1130 return SCTP_DISPOSITION_CONSUME; 1131 } 1132 1133 /* send hb chunk with padding for PLPMUTD. */ 1134 enum sctp_disposition sctp_sf_send_probe(struct net *net, 1135 const struct sctp_endpoint *ep, 1136 const struct sctp_association *asoc, 1137 const union sctp_subtype type, 1138 void *arg, 1139 struct sctp_cmd_seq *commands) 1140 { 1141 struct sctp_transport *transport = (struct sctp_transport *)arg; 1142 struct sctp_chunk *reply; 1143 1144 if (!sctp_transport_pl_enabled(transport)) 1145 return SCTP_DISPOSITION_CONSUME; 1146 1147 sctp_transport_pl_send(transport); 1148 reply = sctp_make_heartbeat(asoc, transport, transport->pl.probe_size); 1149 if (!reply) 1150 return SCTP_DISPOSITION_NOMEM; 1151 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply)); 1152 sctp_add_cmd_sf(commands, SCTP_CMD_PROBE_TIMER_UPDATE, 1153 SCTP_TRANSPORT(transport)); 1154 1155 return SCTP_DISPOSITION_CONSUME; 1156 } 1157 1158 /* 1159 * Process an heartbeat request. 1160 * 1161 * Section: 8.3 Path Heartbeat 1162 * The receiver of the HEARTBEAT should immediately respond with a 1163 * HEARTBEAT ACK that contains the Heartbeat Information field copied 1164 * from the received HEARTBEAT chunk. 1165 * 1166 * Verification Tag: 8.5 Verification Tag [Normal verification] 1167 * When receiving an SCTP packet, the endpoint MUST ensure that the 1168 * value in the Verification Tag field of the received SCTP packet 1169 * matches its own Tag. If the received Verification Tag value does not 1170 * match the receiver's own tag value, the receiver shall silently 1171 * discard the packet and shall not process it any further except for 1172 * those cases listed in Section 8.5.1 below. 1173 * 1174 * Inputs 1175 * (endpoint, asoc, chunk) 1176 * 1177 * Outputs 1178 * (asoc, reply_msg, msg_up, timers, counters) 1179 * 1180 * The return value is the disposition of the chunk. 1181 */ 1182 enum sctp_disposition sctp_sf_beat_8_3(struct net *net, 1183 const struct sctp_endpoint *ep, 1184 const struct sctp_association *asoc, 1185 const union sctp_subtype type, 1186 void *arg, struct sctp_cmd_seq *commands) 1187 { 1188 struct sctp_paramhdr *param_hdr; 1189 struct sctp_chunk *chunk = arg; 1190 struct sctp_chunk *reply; 1191 size_t paylen = 0; 1192 1193 if (!sctp_vtag_verify(chunk, asoc)) 1194 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 1195 1196 /* Make sure that the HEARTBEAT chunk has a valid length. */ 1197 if (!sctp_chunk_length_valid(chunk, 1198 sizeof(struct sctp_heartbeat_chunk))) 1199 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 1200 commands); 1201 1202 /* 8.3 The receiver of the HEARTBEAT should immediately 1203 * respond with a HEARTBEAT ACK that contains the Heartbeat 1204 * Information field copied from the received HEARTBEAT chunk. 1205 */ 1206 chunk->subh.hb_hdr = (struct sctp_heartbeathdr *)chunk->skb->data; 1207 param_hdr = (struct sctp_paramhdr *)chunk->subh.hb_hdr; 1208 paylen = ntohs(chunk->chunk_hdr->length) - sizeof(struct sctp_chunkhdr); 1209 1210 if (ntohs(param_hdr->length) > paylen) 1211 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg, 1212 param_hdr, commands); 1213 1214 if (!pskb_pull(chunk->skb, paylen)) 1215 goto nomem; 1216 1217 reply = sctp_make_heartbeat_ack(asoc, chunk, param_hdr, paylen); 1218 if (!reply) 1219 goto nomem; 1220 1221 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply)); 1222 return SCTP_DISPOSITION_CONSUME; 1223 1224 nomem: 1225 return SCTP_DISPOSITION_NOMEM; 1226 } 1227 1228 /* 1229 * Process the returning HEARTBEAT ACK. 1230 * 1231 * Section: 8.3 Path Heartbeat 1232 * Upon the receipt of the HEARTBEAT ACK, the sender of the HEARTBEAT 1233 * should clear the error counter of the destination transport 1234 * address to which the HEARTBEAT was sent, and mark the destination 1235 * transport address as active if it is not so marked. The endpoint may 1236 * optionally report to the upper layer when an inactive destination 1237 * address is marked as active due to the reception of the latest 1238 * HEARTBEAT ACK. The receiver of the HEARTBEAT ACK must also 1239 * clear the association overall error count as well (as defined 1240 * in section 8.1). 1241 * 1242 * The receiver of the HEARTBEAT ACK should also perform an RTT 1243 * measurement for that destination transport address using the time 1244 * value carried in the HEARTBEAT ACK chunk. 1245 * 1246 * Verification Tag: 8.5 Verification Tag [Normal verification] 1247 * 1248 * Inputs 1249 * (endpoint, asoc, chunk) 1250 * 1251 * Outputs 1252 * (asoc, reply_msg, msg_up, timers, counters) 1253 * 1254 * The return value is the disposition of the chunk. 1255 */ 1256 enum sctp_disposition sctp_sf_backbeat_8_3(struct net *net, 1257 const struct sctp_endpoint *ep, 1258 const struct sctp_association *asoc, 1259 const union sctp_subtype type, 1260 void *arg, 1261 struct sctp_cmd_seq *commands) 1262 { 1263 struct sctp_sender_hb_info *hbinfo; 1264 struct sctp_chunk *chunk = arg; 1265 struct sctp_transport *link; 1266 unsigned long max_interval; 1267 union sctp_addr from_addr; 1268 1269 if (!sctp_vtag_verify(chunk, asoc)) 1270 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 1271 1272 /* Make sure that the HEARTBEAT-ACK chunk has a valid length. */ 1273 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr) + 1274 sizeof(*hbinfo))) 1275 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 1276 commands); 1277 1278 hbinfo = (struct sctp_sender_hb_info *)chunk->skb->data; 1279 /* Make sure that the length of the parameter is what we expect */ 1280 if (ntohs(hbinfo->param_hdr.length) != sizeof(*hbinfo)) 1281 return SCTP_DISPOSITION_DISCARD; 1282 1283 from_addr = hbinfo->daddr; 1284 link = sctp_assoc_lookup_paddr(asoc, &from_addr); 1285 1286 /* This should never happen, but lets log it if so. */ 1287 if (unlikely(!link)) { 1288 if (from_addr.sa.sa_family == AF_INET6) { 1289 net_warn_ratelimited("%s association %p could not find address %pI6\n", 1290 __func__, 1291 asoc, 1292 &from_addr.v6.sin6_addr); 1293 } else { 1294 net_warn_ratelimited("%s association %p could not find address %pI4\n", 1295 __func__, 1296 asoc, 1297 &from_addr.v4.sin_addr.s_addr); 1298 } 1299 return SCTP_DISPOSITION_DISCARD; 1300 } 1301 1302 /* Validate the 64-bit random nonce. */ 1303 if (hbinfo->hb_nonce != link->hb_nonce) 1304 return SCTP_DISPOSITION_DISCARD; 1305 1306 if (hbinfo->probe_size) { 1307 if (hbinfo->probe_size != link->pl.probe_size || 1308 !sctp_transport_pl_enabled(link)) 1309 return SCTP_DISPOSITION_DISCARD; 1310 1311 if (sctp_transport_pl_recv(link)) 1312 return SCTP_DISPOSITION_CONSUME; 1313 1314 return sctp_sf_send_probe(net, ep, asoc, type, link, commands); 1315 } 1316 1317 max_interval = link->hbinterval + link->rto; 1318 1319 /* Check if the timestamp looks valid. */ 1320 if (time_after(hbinfo->sent_at, jiffies) || 1321 time_after(jiffies, hbinfo->sent_at + max_interval)) { 1322 pr_debug("%s: HEARTBEAT ACK with invalid timestamp received " 1323 "for transport:%p\n", __func__, link); 1324 1325 return SCTP_DISPOSITION_DISCARD; 1326 } 1327 1328 /* 8.3 Upon the receipt of the HEARTBEAT ACK, the sender of 1329 * the HEARTBEAT should clear the error counter of the 1330 * destination transport address to which the HEARTBEAT was 1331 * sent and mark the destination transport address as active if 1332 * it is not so marked. 1333 */ 1334 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_ON, SCTP_TRANSPORT(link)); 1335 1336 return SCTP_DISPOSITION_CONSUME; 1337 } 1338 1339 /* Helper function to send out an abort for the restart 1340 * condition. 1341 */ 1342 static int sctp_sf_send_restart_abort(struct net *net, union sctp_addr *ssa, 1343 struct sctp_chunk *init, 1344 struct sctp_cmd_seq *commands) 1345 { 1346 struct sctp_af *af = sctp_get_af_specific(ssa->v4.sin_family); 1347 union sctp_addr_param *addrparm; 1348 struct sctp_errhdr *errhdr; 1349 char buffer[sizeof(*errhdr) + sizeof(*addrparm)]; 1350 struct sctp_endpoint *ep; 1351 struct sctp_packet *pkt; 1352 int len; 1353 1354 /* Build the error on the stack. We are way to malloc crazy 1355 * throughout the code today. 1356 */ 1357 errhdr = (struct sctp_errhdr *)buffer; 1358 addrparm = (union sctp_addr_param *)(errhdr + 1); 1359 1360 /* Copy into a parm format. */ 1361 len = af->to_addr_param(ssa, addrparm); 1362 len += sizeof(*errhdr); 1363 1364 errhdr->cause = SCTP_ERROR_RESTART; 1365 errhdr->length = htons(len); 1366 1367 /* Assign to the control socket. */ 1368 ep = sctp_sk(net->sctp.ctl_sock)->ep; 1369 1370 /* Association is NULL since this may be a restart attack and we 1371 * want to send back the attacker's vtag. 1372 */ 1373 pkt = sctp_abort_pkt_new(net, ep, NULL, init, errhdr, len); 1374 1375 if (!pkt) 1376 goto out; 1377 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT, SCTP_PACKET(pkt)); 1378 1379 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS); 1380 1381 /* Discard the rest of the inbound packet. */ 1382 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL()); 1383 1384 out: 1385 /* Even if there is no memory, treat as a failure so 1386 * the packet will get dropped. 1387 */ 1388 return 0; 1389 } 1390 1391 static bool list_has_sctp_addr(const struct list_head *list, 1392 union sctp_addr *ipaddr) 1393 { 1394 struct sctp_transport *addr; 1395 1396 list_for_each_entry(addr, list, transports) { 1397 if (sctp_cmp_addr_exact(ipaddr, &addr->ipaddr)) 1398 return true; 1399 } 1400 1401 return false; 1402 } 1403 /* A restart is occurring, check to make sure no new addresses 1404 * are being added as we may be under a takeover attack. 1405 */ 1406 static int sctp_sf_check_restart_addrs(const struct sctp_association *new_asoc, 1407 const struct sctp_association *asoc, 1408 struct sctp_chunk *init, 1409 struct sctp_cmd_seq *commands) 1410 { 1411 struct net *net = new_asoc->base.net; 1412 struct sctp_transport *new_addr; 1413 int ret = 1; 1414 1415 /* Implementor's Guide - Section 5.2.2 1416 * ... 1417 * Before responding the endpoint MUST check to see if the 1418 * unexpected INIT adds new addresses to the association. If new 1419 * addresses are added to the association, the endpoint MUST respond 1420 * with an ABORT.. 1421 */ 1422 1423 /* Search through all current addresses and make sure 1424 * we aren't adding any new ones. 1425 */ 1426 list_for_each_entry(new_addr, &new_asoc->peer.transport_addr_list, 1427 transports) { 1428 if (!list_has_sctp_addr(&asoc->peer.transport_addr_list, 1429 &new_addr->ipaddr)) { 1430 sctp_sf_send_restart_abort(net, &new_addr->ipaddr, init, 1431 commands); 1432 ret = 0; 1433 break; 1434 } 1435 } 1436 1437 /* Return success if all addresses were found. */ 1438 return ret; 1439 } 1440 1441 /* Populate the verification/tie tags based on overlapping INIT 1442 * scenario. 1443 * 1444 * Note: Do not use in CLOSED or SHUTDOWN-ACK-SENT state. 1445 */ 1446 static void sctp_tietags_populate(struct sctp_association *new_asoc, 1447 const struct sctp_association *asoc) 1448 { 1449 switch (asoc->state) { 1450 1451 /* 5.2.1 INIT received in COOKIE-WAIT or COOKIE-ECHOED State */ 1452 1453 case SCTP_STATE_COOKIE_WAIT: 1454 new_asoc->c.my_vtag = asoc->c.my_vtag; 1455 new_asoc->c.my_ttag = asoc->c.my_vtag; 1456 new_asoc->c.peer_ttag = 0; 1457 break; 1458 1459 case SCTP_STATE_COOKIE_ECHOED: 1460 new_asoc->c.my_vtag = asoc->c.my_vtag; 1461 new_asoc->c.my_ttag = asoc->c.my_vtag; 1462 new_asoc->c.peer_ttag = asoc->c.peer_vtag; 1463 break; 1464 1465 /* 5.2.2 Unexpected INIT in States Other than CLOSED, COOKIE-ECHOED, 1466 * COOKIE-WAIT and SHUTDOWN-ACK-SENT 1467 */ 1468 default: 1469 new_asoc->c.my_ttag = asoc->c.my_vtag; 1470 new_asoc->c.peer_ttag = asoc->c.peer_vtag; 1471 break; 1472 } 1473 1474 /* Other parameters for the endpoint SHOULD be copied from the 1475 * existing parameters of the association (e.g. number of 1476 * outbound streams) into the INIT ACK and cookie. 1477 */ 1478 new_asoc->rwnd = asoc->rwnd; 1479 new_asoc->c.sinit_num_ostreams = asoc->c.sinit_num_ostreams; 1480 new_asoc->c.sinit_max_instreams = asoc->c.sinit_max_instreams; 1481 new_asoc->c.initial_tsn = asoc->c.initial_tsn; 1482 } 1483 1484 /* 1485 * Compare vtag/tietag values to determine unexpected COOKIE-ECHO 1486 * handling action. 1487 * 1488 * RFC 2960 5.2.4 Handle a COOKIE ECHO when a TCB exists. 1489 * 1490 * Returns value representing action to be taken. These action values 1491 * correspond to Action/Description values in RFC 2960, Table 2. 1492 */ 1493 static char sctp_tietags_compare(struct sctp_association *new_asoc, 1494 const struct sctp_association *asoc) 1495 { 1496 /* In this case, the peer may have restarted. */ 1497 if ((asoc->c.my_vtag != new_asoc->c.my_vtag) && 1498 (asoc->c.peer_vtag != new_asoc->c.peer_vtag) && 1499 (asoc->c.my_vtag == new_asoc->c.my_ttag) && 1500 (asoc->c.peer_vtag == new_asoc->c.peer_ttag)) 1501 return 'A'; 1502 1503 /* Collision case B. */ 1504 if ((asoc->c.my_vtag == new_asoc->c.my_vtag) && 1505 ((asoc->c.peer_vtag != new_asoc->c.peer_vtag) || 1506 (0 == asoc->c.peer_vtag))) { 1507 return 'B'; 1508 } 1509 1510 /* Collision case D. */ 1511 if ((asoc->c.my_vtag == new_asoc->c.my_vtag) && 1512 (asoc->c.peer_vtag == new_asoc->c.peer_vtag)) 1513 return 'D'; 1514 1515 /* Collision case C. */ 1516 if ((asoc->c.my_vtag != new_asoc->c.my_vtag) && 1517 (asoc->c.peer_vtag == new_asoc->c.peer_vtag) && 1518 (0 == new_asoc->c.my_ttag) && 1519 (0 == new_asoc->c.peer_ttag)) 1520 return 'C'; 1521 1522 /* No match to any of the special cases; discard this packet. */ 1523 return 'E'; 1524 } 1525 1526 /* Common helper routine for both duplicate and simultaneous INIT 1527 * chunk handling. 1528 */ 1529 static enum sctp_disposition sctp_sf_do_unexpected_init( 1530 struct net *net, 1531 const struct sctp_endpoint *ep, 1532 const struct sctp_association *asoc, 1533 const union sctp_subtype type, 1534 void *arg, 1535 struct sctp_cmd_seq *commands) 1536 { 1537 struct sctp_chunk *chunk = arg, *repl, *err_chunk; 1538 struct sctp_unrecognized_param *unk_param; 1539 struct sctp_association *new_asoc; 1540 enum sctp_disposition retval; 1541 struct sctp_packet *packet; 1542 int len; 1543 1544 /* 6.10 Bundling 1545 * An endpoint MUST NOT bundle INIT, INIT ACK or 1546 * SHUTDOWN COMPLETE with any other chunks. 1547 * 1548 * IG Section 2.11.2 1549 * Furthermore, we require that the receiver of an INIT chunk MUST 1550 * enforce these rules by silently discarding an arriving packet 1551 * with an INIT chunk that is bundled with other chunks. 1552 */ 1553 if (!chunk->singleton) 1554 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 1555 1556 /* Make sure that the INIT chunk has a valid length. */ 1557 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk))) 1558 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 1559 1560 /* 3.1 A packet containing an INIT chunk MUST have a zero Verification 1561 * Tag. 1562 */ 1563 if (chunk->sctp_hdr->vtag != 0) 1564 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands); 1565 1566 if (SCTP_INPUT_CB(chunk->skb)->encap_port != chunk->transport->encap_port) 1567 return sctp_sf_new_encap_port(net, ep, asoc, type, arg, commands); 1568 1569 /* Grab the INIT header. */ 1570 chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data; 1571 1572 /* Tag the variable length parameters. */ 1573 chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(struct sctp_inithdr)); 1574 1575 if (asoc->state >= SCTP_STATE_ESTABLISHED) { 1576 /* Discard INIT matching peer vtag after handshake completion (stale INIT). */ 1577 if (ntohl(chunk->subh.init_hdr->init_tag) == asoc->peer.i.init_tag) 1578 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 1579 } 1580 1581 /* Verify the INIT chunk before processing it. */ 1582 err_chunk = NULL; 1583 if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type, 1584 (struct sctp_init_chunk *)chunk->chunk_hdr, chunk, 1585 &err_chunk)) { 1586 /* This chunk contains fatal error. It is to be discarded. 1587 * Send an ABORT, with causes if there is any. 1588 */ 1589 if (err_chunk) { 1590 packet = sctp_abort_pkt_new(net, ep, asoc, arg, 1591 (__u8 *)(err_chunk->chunk_hdr) + 1592 sizeof(struct sctp_chunkhdr), 1593 ntohs(err_chunk->chunk_hdr->length) - 1594 sizeof(struct sctp_chunkhdr)); 1595 1596 if (packet) { 1597 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT, 1598 SCTP_PACKET(packet)); 1599 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS); 1600 retval = SCTP_DISPOSITION_CONSUME; 1601 } else { 1602 retval = SCTP_DISPOSITION_NOMEM; 1603 } 1604 goto cleanup; 1605 } else { 1606 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, 1607 commands); 1608 } 1609 } 1610 1611 /* 1612 * Other parameters for the endpoint SHOULD be copied from the 1613 * existing parameters of the association (e.g. number of 1614 * outbound streams) into the INIT ACK and cookie. 1615 * FIXME: We are copying parameters from the endpoint not the 1616 * association. 1617 */ 1618 new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC); 1619 if (!new_asoc) 1620 goto nomem; 1621 1622 /* Update socket peer label if first association. */ 1623 if (security_sctp_assoc_request(new_asoc, chunk->skb)) { 1624 sctp_association_free(new_asoc); 1625 if (err_chunk) 1626 sctp_chunk_free(err_chunk); 1627 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 1628 } 1629 1630 if (sctp_assoc_set_bind_addr_from_ep(new_asoc, 1631 sctp_scope(sctp_source(chunk)), GFP_ATOMIC) < 0) 1632 goto nomem; 1633 1634 /* In the outbound INIT ACK the endpoint MUST copy its current 1635 * Verification Tag and Peers Verification tag into a reserved 1636 * place (local tie-tag and per tie-tag) within the state cookie. 1637 */ 1638 if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk), 1639 (struct sctp_init_chunk *)chunk->chunk_hdr, 1640 GFP_ATOMIC)) 1641 goto nomem; 1642 1643 /* Make sure no new addresses are being added during the 1644 * restart. Do not do this check for COOKIE-WAIT state, 1645 * since there are no peer addresses to check against. 1646 * Upon return an ABORT will have been sent if needed. 1647 */ 1648 if (!sctp_state(asoc, COOKIE_WAIT)) { 1649 if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk, 1650 commands)) { 1651 retval = SCTP_DISPOSITION_CONSUME; 1652 goto nomem_retval; 1653 } 1654 } 1655 1656 sctp_tietags_populate(new_asoc, asoc); 1657 1658 /* B) "Z" shall respond immediately with an INIT ACK chunk. */ 1659 1660 /* If there are errors need to be reported for unknown parameters, 1661 * make sure to reserve enough room in the INIT ACK for them. 1662 */ 1663 len = 0; 1664 if (err_chunk) { 1665 len = ntohs(err_chunk->chunk_hdr->length) - 1666 sizeof(struct sctp_chunkhdr); 1667 } 1668 1669 repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len); 1670 if (!repl) 1671 goto nomem; 1672 1673 /* If there are errors need to be reported for unknown parameters, 1674 * include them in the outgoing INIT ACK as "Unrecognized parameter" 1675 * parameter. 1676 */ 1677 if (err_chunk) { 1678 /* Get the "Unrecognized parameter" parameter(s) out of the 1679 * ERROR chunk generated by sctp_verify_init(). Since the 1680 * error cause code for "unknown parameter" and the 1681 * "Unrecognized parameter" type is the same, we can 1682 * construct the parameters in INIT ACK by copying the 1683 * ERROR causes over. 1684 */ 1685 unk_param = (struct sctp_unrecognized_param *) 1686 ((__u8 *)(err_chunk->chunk_hdr) + 1687 sizeof(struct sctp_chunkhdr)); 1688 /* Replace the cause code with the "Unrecognized parameter" 1689 * parameter type. 1690 */ 1691 sctp_addto_chunk(repl, len, unk_param); 1692 sctp_chunk_free(err_chunk); 1693 } 1694 1695 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc)); 1696 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl)); 1697 1698 /* 1699 * Note: After sending out INIT ACK with the State Cookie parameter, 1700 * "Z" MUST NOT allocate any resources for this new association. 1701 * Otherwise, "Z" will be vulnerable to resource attacks. 1702 */ 1703 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL()); 1704 retval = SCTP_DISPOSITION_CONSUME; 1705 1706 return retval; 1707 1708 nomem: 1709 retval = SCTP_DISPOSITION_NOMEM; 1710 nomem_retval: 1711 if (new_asoc) 1712 sctp_association_free(new_asoc); 1713 cleanup: 1714 if (err_chunk) 1715 sctp_chunk_free(err_chunk); 1716 return retval; 1717 } 1718 1719 /* 1720 * Handle simultaneous INIT. 1721 * This means we started an INIT and then we got an INIT request from 1722 * our peer. 1723 * 1724 * Section: 5.2.1 INIT received in COOKIE-WAIT or COOKIE-ECHOED State (Item B) 1725 * This usually indicates an initialization collision, i.e., each 1726 * endpoint is attempting, at about the same time, to establish an 1727 * association with the other endpoint. 1728 * 1729 * Upon receipt of an INIT in the COOKIE-WAIT or COOKIE-ECHOED state, an 1730 * endpoint MUST respond with an INIT ACK using the same parameters it 1731 * sent in its original INIT chunk (including its Verification Tag, 1732 * unchanged). These original parameters are combined with those from the 1733 * newly received INIT chunk. The endpoint shall also generate a State 1734 * Cookie with the INIT ACK. The endpoint uses the parameters sent in its 1735 * INIT to calculate the State Cookie. 1736 * 1737 * After that, the endpoint MUST NOT change its state, the T1-init 1738 * timer shall be left running and the corresponding TCB MUST NOT be 1739 * destroyed. The normal procedures for handling State Cookies when 1740 * a TCB exists will resolve the duplicate INITs to a single association. 1741 * 1742 * For an endpoint that is in the COOKIE-ECHOED state it MUST populate 1743 * its Tie-Tags with the Tag information of itself and its peer (see 1744 * section 5.2.2 for a description of the Tie-Tags). 1745 * 1746 * Verification Tag: Not explicit, but an INIT can not have a valid 1747 * verification tag, so we skip the check. 1748 * 1749 * Inputs 1750 * (endpoint, asoc, chunk) 1751 * 1752 * Outputs 1753 * (asoc, reply_msg, msg_up, timers, counters) 1754 * 1755 * The return value is the disposition of the chunk. 1756 */ 1757 enum sctp_disposition sctp_sf_do_5_2_1_siminit( 1758 struct net *net, 1759 const struct sctp_endpoint *ep, 1760 const struct sctp_association *asoc, 1761 const union sctp_subtype type, 1762 void *arg, 1763 struct sctp_cmd_seq *commands) 1764 { 1765 /* Call helper to do the real work for both simultaneous and 1766 * duplicate INIT chunk handling. 1767 */ 1768 return sctp_sf_do_unexpected_init(net, ep, asoc, type, arg, commands); 1769 } 1770 1771 /* 1772 * Handle duplicated INIT messages. These are usually delayed 1773 * restransmissions. 1774 * 1775 * Section: 5.2.2 Unexpected INIT in States Other than CLOSED, 1776 * COOKIE-ECHOED and COOKIE-WAIT 1777 * 1778 * Unless otherwise stated, upon reception of an unexpected INIT for 1779 * this association, the endpoint shall generate an INIT ACK with a 1780 * State Cookie. In the outbound INIT ACK the endpoint MUST copy its 1781 * current Verification Tag and peer's Verification Tag into a reserved 1782 * place within the state cookie. We shall refer to these locations as 1783 * the Peer's-Tie-Tag and the Local-Tie-Tag. The outbound SCTP packet 1784 * containing this INIT ACK MUST carry a Verification Tag value equal to 1785 * the Initiation Tag found in the unexpected INIT. And the INIT ACK 1786 * MUST contain a new Initiation Tag (randomly generated see Section 1787 * 5.3.1). Other parameters for the endpoint SHOULD be copied from the 1788 * existing parameters of the association (e.g. number of outbound 1789 * streams) into the INIT ACK and cookie. 1790 * 1791 * After sending out the INIT ACK, the endpoint shall take no further 1792 * actions, i.e., the existing association, including its current state, 1793 * and the corresponding TCB MUST NOT be changed. 1794 * 1795 * Note: Only when a TCB exists and the association is not in a COOKIE- 1796 * WAIT state are the Tie-Tags populated. For a normal association INIT 1797 * (i.e. the endpoint is in a COOKIE-WAIT state), the Tie-Tags MUST be 1798 * set to 0 (indicating that no previous TCB existed). The INIT ACK and 1799 * State Cookie are populated as specified in section 5.2.1. 1800 * 1801 * Verification Tag: Not specified, but an INIT has no way of knowing 1802 * what the verification tag could be, so we ignore it. 1803 * 1804 * Inputs 1805 * (endpoint, asoc, chunk) 1806 * 1807 * Outputs 1808 * (asoc, reply_msg, msg_up, timers, counters) 1809 * 1810 * The return value is the disposition of the chunk. 1811 */ 1812 enum sctp_disposition sctp_sf_do_5_2_2_dupinit( 1813 struct net *net, 1814 const struct sctp_endpoint *ep, 1815 const struct sctp_association *asoc, 1816 const union sctp_subtype type, 1817 void *arg, 1818 struct sctp_cmd_seq *commands) 1819 { 1820 /* Call helper to do the real work for both simultaneous and 1821 * duplicate INIT chunk handling. 1822 */ 1823 return sctp_sf_do_unexpected_init(net, ep, asoc, type, arg, commands); 1824 } 1825 1826 1827 /* 1828 * Unexpected INIT-ACK handler. 1829 * 1830 * Section 5.2.3 1831 * If an INIT ACK received by an endpoint in any state other than the 1832 * COOKIE-WAIT state, the endpoint should discard the INIT ACK chunk. 1833 * An unexpected INIT ACK usually indicates the processing of an old or 1834 * duplicated INIT chunk. 1835 */ 1836 enum sctp_disposition sctp_sf_do_5_2_3_initack( 1837 struct net *net, 1838 const struct sctp_endpoint *ep, 1839 const struct sctp_association *asoc, 1840 const union sctp_subtype type, 1841 void *arg, 1842 struct sctp_cmd_seq *commands) 1843 { 1844 /* Per the above section, we'll discard the chunk if we have an 1845 * endpoint. If this is an OOTB INIT-ACK, treat it as such. 1846 */ 1847 if (ep == sctp_sk(net->sctp.ctl_sock)->ep) 1848 return sctp_sf_ootb(net, ep, asoc, type, arg, commands); 1849 else 1850 return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands); 1851 } 1852 1853 static int sctp_sf_do_assoc_update(struct sctp_association *asoc, 1854 struct sctp_association *new, 1855 struct sctp_cmd_seq *cmds) 1856 { 1857 struct net *net = asoc->base.net; 1858 struct sctp_chunk *abort; 1859 1860 if (!sctp_assoc_update(asoc, new)) 1861 return 0; 1862 1863 abort = sctp_make_abort(asoc, NULL, sizeof(struct sctp_errhdr)); 1864 if (abort) { 1865 sctp_init_cause(abort, SCTP_ERROR_RSRC_LOW, 0); 1866 sctp_add_cmd_sf(cmds, SCTP_CMD_REPLY, SCTP_CHUNK(abort)); 1867 } 1868 sctp_add_cmd_sf(cmds, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(ECONNABORTED)); 1869 sctp_add_cmd_sf(cmds, SCTP_CMD_ASSOC_FAILED, 1870 SCTP_PERR(SCTP_ERROR_RSRC_LOW)); 1871 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS); 1872 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB); 1873 1874 return -ENOMEM; 1875 } 1876 1877 /* Unexpected COOKIE-ECHO handler for peer restart (Table 2, action 'A') 1878 * 1879 * Section 5.2.4 1880 * A) In this case, the peer may have restarted. 1881 */ 1882 static enum sctp_disposition sctp_sf_do_dupcook_a( 1883 struct net *net, 1884 const struct sctp_endpoint *ep, 1885 const struct sctp_association *asoc, 1886 struct sctp_chunk *chunk, 1887 struct sctp_cmd_seq *commands, 1888 struct sctp_association *new_asoc) 1889 { 1890 struct sctp_init_chunk *peer_init; 1891 enum sctp_disposition disposition; 1892 struct sctp_ulpevent *ev; 1893 struct sctp_chunk *repl; 1894 struct sctp_chunk *err; 1895 1896 /* new_asoc is a brand-new association, so these are not yet 1897 * side effects--it is safe to run them here. 1898 */ 1899 peer_init = (struct sctp_init_chunk *)(chunk->subh.cookie_hdr + 1); 1900 if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk), peer_init, 1901 GFP_ATOMIC)) 1902 goto nomem; 1903 1904 if (sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC)) 1905 goto nomem; 1906 1907 if (!sctp_auth_chunk_verify(net, chunk, new_asoc)) 1908 return SCTP_DISPOSITION_DISCARD; 1909 1910 /* Make sure no new addresses are being added during the 1911 * restart. Though this is a pretty complicated attack 1912 * since you'd have to get inside the cookie. 1913 */ 1914 if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk, commands)) 1915 return SCTP_DISPOSITION_CONSUME; 1916 1917 /* If the endpoint is in the SHUTDOWN-ACK-SENT state and recognizes 1918 * the peer has restarted (Action A), it MUST NOT setup a new 1919 * association but instead resend the SHUTDOWN ACK and send an ERROR 1920 * chunk with a "Cookie Received while Shutting Down" error cause to 1921 * its peer. 1922 */ 1923 if (sctp_state(asoc, SHUTDOWN_ACK_SENT)) { 1924 disposition = __sctp_sf_do_9_2_reshutack(net, ep, asoc, 1925 SCTP_ST_CHUNK(chunk->chunk_hdr->type), 1926 chunk, commands); 1927 if (SCTP_DISPOSITION_NOMEM == disposition) 1928 goto nomem; 1929 1930 err = sctp_make_op_error(asoc, chunk, 1931 SCTP_ERROR_COOKIE_IN_SHUTDOWN, 1932 NULL, 0, 0); 1933 if (err) 1934 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, 1935 SCTP_CHUNK(err)); 1936 1937 return SCTP_DISPOSITION_CONSUME; 1938 } 1939 1940 /* For now, stop pending T3-rtx and SACK timers, fail any unsent/unacked 1941 * data. Consider the optional choice of resending of this data. 1942 */ 1943 sctp_add_cmd_sf(commands, SCTP_CMD_T3_RTX_TIMERS_STOP, SCTP_NULL()); 1944 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, 1945 SCTP_TO(SCTP_EVENT_TIMEOUT_SACK)); 1946 sctp_add_cmd_sf(commands, SCTP_CMD_PURGE_OUTQUEUE, SCTP_NULL()); 1947 1948 /* Stop pending T4-rto timer, teardown ASCONF queue, ASCONF-ACK queue 1949 * and ASCONF-ACK cache. 1950 */ 1951 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, 1952 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO)); 1953 sctp_add_cmd_sf(commands, SCTP_CMD_PURGE_ASCONF_QUEUE, SCTP_NULL()); 1954 1955 /* Update the content of current association. */ 1956 if (sctp_sf_do_assoc_update((struct sctp_association *)asoc, new_asoc, commands)) 1957 goto nomem; 1958 1959 repl = sctp_make_cookie_ack(asoc, chunk); 1960 if (!repl) 1961 goto nomem; 1962 1963 /* Report association restart to upper layer. */ 1964 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_RESTART, 0, 1965 asoc->c.sinit_num_ostreams, 1966 asoc->c.sinit_max_instreams, 1967 NULL, GFP_ATOMIC); 1968 if (!ev) 1969 goto nomem_ev; 1970 1971 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev)); 1972 if ((sctp_state(asoc, SHUTDOWN_PENDING) || 1973 sctp_state(asoc, SHUTDOWN_SENT)) && 1974 (sctp_sstate(asoc->base.sk, CLOSING) || 1975 sock_flag(asoc->base.sk, SOCK_DEAD))) { 1976 /* If the socket has been closed by user, don't 1977 * transition to ESTABLISHED. Instead trigger SHUTDOWN 1978 * bundled with COOKIE_ACK. 1979 */ 1980 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl)); 1981 return sctp_sf_do_9_2_start_shutdown(net, ep, asoc, 1982 SCTP_ST_CHUNK(0), repl, 1983 commands); 1984 } else { 1985 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE, 1986 SCTP_STATE(SCTP_STATE_ESTABLISHED)); 1987 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl)); 1988 } 1989 return SCTP_DISPOSITION_CONSUME; 1990 1991 nomem_ev: 1992 sctp_chunk_free(repl); 1993 nomem: 1994 return SCTP_DISPOSITION_NOMEM; 1995 } 1996 1997 /* Unexpected COOKIE-ECHO handler for setup collision (Table 2, action 'B') 1998 * 1999 * Section 5.2.4 2000 * B) In this case, both sides may be attempting to start an association 2001 * at about the same time but the peer endpoint started its INIT 2002 * after responding to the local endpoint's INIT 2003 */ 2004 /* This case represents an initialization collision. */ 2005 static enum sctp_disposition sctp_sf_do_dupcook_b( 2006 struct net *net, 2007 const struct sctp_endpoint *ep, 2008 const struct sctp_association *asoc, 2009 struct sctp_chunk *chunk, 2010 struct sctp_cmd_seq *commands, 2011 struct sctp_association *new_asoc) 2012 { 2013 struct sctp_init_chunk *peer_init; 2014 struct sctp_chunk *repl; 2015 2016 /* new_asoc is a brand-new association, so these are not yet 2017 * side effects--it is safe to run them here. 2018 */ 2019 peer_init = (struct sctp_init_chunk *)(chunk->subh.cookie_hdr + 1); 2020 if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk), peer_init, 2021 GFP_ATOMIC)) 2022 goto nomem; 2023 2024 if (sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC)) 2025 goto nomem; 2026 2027 if (!sctp_auth_chunk_verify(net, chunk, new_asoc)) 2028 return SCTP_DISPOSITION_DISCARD; 2029 2030 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE, 2031 SCTP_STATE(SCTP_STATE_ESTABLISHED)); 2032 if (asoc->state < SCTP_STATE_ESTABLISHED) 2033 SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB); 2034 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL()); 2035 2036 /* Update the content of current association. */ 2037 if (sctp_sf_do_assoc_update((struct sctp_association *)asoc, new_asoc, commands)) 2038 goto nomem; 2039 2040 repl = sctp_make_cookie_ack(asoc, chunk); 2041 if (!repl) 2042 goto nomem; 2043 2044 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl)); 2045 2046 /* RFC 2960 5.1 Normal Establishment of an Association 2047 * 2048 * D) IMPLEMENTATION NOTE: An implementation may choose to 2049 * send the Communication Up notification to the SCTP user 2050 * upon reception of a valid COOKIE ECHO chunk. 2051 * 2052 * Sadly, this needs to be implemented as a side-effect, because 2053 * we are not guaranteed to have set the association id of the real 2054 * association and so these notifications need to be delayed until 2055 * the association id is allocated. 2056 */ 2057 2058 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_CHANGE, SCTP_U8(SCTP_COMM_UP)); 2059 2060 /* Sockets API Draft Section 5.3.1.6 2061 * When a peer sends a Adaptation Layer Indication parameter , SCTP 2062 * delivers this notification to inform the application that of the 2063 * peers requested adaptation layer. 2064 * 2065 * This also needs to be done as a side effect for the same reason as 2066 * above. 2067 */ 2068 if (asoc->peer.adaptation_ind) 2069 sctp_add_cmd_sf(commands, SCTP_CMD_ADAPTATION_IND, SCTP_NULL()); 2070 2071 if (!asoc->peer.auth_capable) 2072 sctp_add_cmd_sf(commands, SCTP_CMD_PEER_NO_AUTH, SCTP_NULL()); 2073 2074 return SCTP_DISPOSITION_CONSUME; 2075 2076 nomem: 2077 return SCTP_DISPOSITION_NOMEM; 2078 } 2079 2080 /* Unexpected COOKIE-ECHO handler for setup collision (Table 2, action 'C') 2081 * 2082 * Section 5.2.4 2083 * C) In this case, the local endpoint's cookie has arrived late. 2084 * Before it arrived, the local endpoint sent an INIT and received an 2085 * INIT-ACK and finally sent a COOKIE ECHO with the peer's same tag 2086 * but a new tag of its own. 2087 */ 2088 /* This case represents an initialization collision. */ 2089 static enum sctp_disposition sctp_sf_do_dupcook_c( 2090 struct net *net, 2091 const struct sctp_endpoint *ep, 2092 const struct sctp_association *asoc, 2093 struct sctp_chunk *chunk, 2094 struct sctp_cmd_seq *commands, 2095 struct sctp_association *new_asoc) 2096 { 2097 /* The cookie should be silently discarded. 2098 * The endpoint SHOULD NOT change states and should leave 2099 * any timers running. 2100 */ 2101 return SCTP_DISPOSITION_DISCARD; 2102 } 2103 2104 /* Unexpected COOKIE-ECHO handler lost chunk (Table 2, action 'D') 2105 * 2106 * Section 5.2.4 2107 * 2108 * D) When both local and remote tags match the endpoint should always 2109 * enter the ESTABLISHED state, if it has not already done so. 2110 */ 2111 /* This case represents an initialization collision. */ 2112 static enum sctp_disposition sctp_sf_do_dupcook_d( 2113 struct net *net, 2114 const struct sctp_endpoint *ep, 2115 const struct sctp_association *asoc, 2116 struct sctp_chunk *chunk, 2117 struct sctp_cmd_seq *commands, 2118 struct sctp_association *new_asoc) 2119 { 2120 struct sctp_ulpevent *ev = NULL, *ai_ev = NULL, *auth_ev = NULL; 2121 struct sctp_chunk *repl; 2122 2123 /* Clarification from Implementor's Guide: 2124 * D) When both local and remote tags match the endpoint should 2125 * enter the ESTABLISHED state, if it is in the COOKIE-ECHOED state. 2126 * It should stop any cookie timer that may be running and send 2127 * a COOKIE ACK. 2128 */ 2129 2130 if (!sctp_auth_chunk_verify(net, chunk, asoc)) 2131 return SCTP_DISPOSITION_DISCARD; 2132 2133 /* Don't accidentally move back into established state. */ 2134 if (asoc->state < SCTP_STATE_ESTABLISHED) { 2135 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, 2136 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE)); 2137 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE, 2138 SCTP_STATE(SCTP_STATE_ESTABLISHED)); 2139 SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB); 2140 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, 2141 SCTP_NULL()); 2142 2143 /* RFC 2960 5.1 Normal Establishment of an Association 2144 * 2145 * D) IMPLEMENTATION NOTE: An implementation may choose 2146 * to send the Communication Up notification to the 2147 * SCTP user upon reception of a valid COOKIE 2148 * ECHO chunk. 2149 */ 2150 ev = sctp_ulpevent_make_assoc_change(asoc, 0, 2151 SCTP_COMM_UP, 0, 2152 asoc->c.sinit_num_ostreams, 2153 asoc->c.sinit_max_instreams, 2154 NULL, GFP_ATOMIC); 2155 if (!ev) 2156 goto nomem; 2157 2158 /* Sockets API Draft Section 5.3.1.6 2159 * When a peer sends a Adaptation Layer Indication parameter, 2160 * SCTP delivers this notification to inform the application 2161 * that of the peers requested adaptation layer. 2162 */ 2163 if (asoc->peer.adaptation_ind) { 2164 ai_ev = sctp_ulpevent_make_adaptation_indication(asoc, 2165 GFP_ATOMIC); 2166 if (!ai_ev) 2167 goto nomem; 2168 2169 } 2170 2171 if (!asoc->peer.auth_capable) { 2172 auth_ev = sctp_ulpevent_make_authkey(asoc, 0, 2173 SCTP_AUTH_NO_AUTH, 2174 GFP_ATOMIC); 2175 if (!auth_ev) 2176 goto nomem; 2177 } 2178 } 2179 2180 repl = sctp_make_cookie_ack(asoc, chunk); 2181 if (!repl) 2182 goto nomem; 2183 2184 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl)); 2185 2186 if (ev) 2187 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, 2188 SCTP_ULPEVENT(ev)); 2189 if (ai_ev) 2190 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, 2191 SCTP_ULPEVENT(ai_ev)); 2192 if (auth_ev) 2193 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, 2194 SCTP_ULPEVENT(auth_ev)); 2195 2196 return SCTP_DISPOSITION_CONSUME; 2197 2198 nomem: 2199 if (auth_ev) 2200 sctp_ulpevent_free(auth_ev); 2201 if (ai_ev) 2202 sctp_ulpevent_free(ai_ev); 2203 if (ev) 2204 sctp_ulpevent_free(ev); 2205 return SCTP_DISPOSITION_NOMEM; 2206 } 2207 2208 /* 2209 * Handle a duplicate COOKIE-ECHO. This usually means a cookie-carrying 2210 * chunk was retransmitted and then delayed in the network. 2211 * 2212 * Section: 5.2.4 Handle a COOKIE ECHO when a TCB exists 2213 * 2214 * Verification Tag: None. Do cookie validation. 2215 * 2216 * Inputs 2217 * (endpoint, asoc, chunk) 2218 * 2219 * Outputs 2220 * (asoc, reply_msg, msg_up, timers, counters) 2221 * 2222 * The return value is the disposition of the chunk. 2223 */ 2224 enum sctp_disposition sctp_sf_do_5_2_4_dupcook( 2225 struct net *net, 2226 const struct sctp_endpoint *ep, 2227 const struct sctp_association *asoc, 2228 const union sctp_subtype type, 2229 void *arg, 2230 struct sctp_cmd_seq *commands) 2231 { 2232 struct sctp_chunk *err_chk_p = NULL; 2233 struct sctp_association *new_asoc; 2234 struct sctp_init_chunk *peer_init; 2235 struct sctp_chunk *chunk = arg; 2236 enum sctp_disposition retval; 2237 enum sctp_cid cid; 2238 int error = 0; 2239 char action; 2240 2241 /* Make sure that the chunk has a valid length from the protocol 2242 * perspective. In this case check to make sure we have at least 2243 * enough for the chunk header. Cookie length verification is 2244 * done later. 2245 */ 2246 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) { 2247 if (!sctp_vtag_verify(chunk, asoc)) 2248 asoc = NULL; 2249 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, commands); 2250 } 2251 2252 /* "Decode" the chunk. We have no optional parameters so we 2253 * are in good shape. 2254 */ 2255 chunk->subh.cookie_hdr = (struct sctp_signed_cookie *)chunk->skb->data; 2256 if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) - 2257 sizeof(struct sctp_chunkhdr))) 2258 goto nomem; 2259 2260 /* In RFC 2960 5.2.4 3, if both Verification Tags in the State Cookie 2261 * of a duplicate COOKIE ECHO match the Verification Tags of the 2262 * current association, consider the State Cookie valid even if 2263 * the lifespan is exceeded. 2264 */ 2265 new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, &error, 2266 &err_chk_p); 2267 2268 /* FIXME: 2269 * If the re-build failed, what is the proper error path 2270 * from here? 2271 * 2272 * [We should abort the association. --piggy] 2273 */ 2274 if (!new_asoc) { 2275 /* FIXME: Several errors are possible. A bad cookie should 2276 * be silently discarded, but think about logging it too. 2277 */ 2278 switch (error) { 2279 case -SCTP_IERROR_NOMEM: 2280 goto nomem; 2281 2282 case -SCTP_IERROR_STALE_COOKIE: 2283 sctp_send_stale_cookie_err(net, ep, asoc, chunk, commands, 2284 err_chk_p); 2285 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 2286 case -SCTP_IERROR_BAD_SIG: 2287 default: 2288 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 2289 } 2290 } 2291 2292 /* Set temp so that it won't be added into hashtable */ 2293 new_asoc->temp = 1; 2294 2295 /* Compare the tie_tag in cookie with the verification tag of 2296 * current association. 2297 */ 2298 action = sctp_tietags_compare(new_asoc, asoc); 2299 2300 /* In cases C and E the association doesn't enter the ESTABLISHED 2301 * state, so there is no need to call security_sctp_assoc_request(). 2302 */ 2303 switch (action) { 2304 case 'A': /* Association restart. */ 2305 case 'B': /* Collision case B. */ 2306 peer_init = (struct sctp_init_chunk *) 2307 (chunk->subh.cookie_hdr + 1); 2308 cid = peer_init->chunk_hdr.type; 2309 if (!sctp_sk(ep->base.sk)->cookie_auth_enable && 2310 !sctp_verify_init(net, ep, asoc, cid, peer_init, chunk, 2311 &err_chk_p)) { 2312 sctp_association_free(new_asoc); 2313 if (err_chk_p) 2314 sctp_chunk_free(err_chk_p); 2315 return sctp_sf_pdiscard(net, ep, asoc, type, arg, 2316 commands); 2317 } 2318 if (err_chk_p) 2319 sctp_chunk_free(err_chk_p); 2320 fallthrough; 2321 case 'D': /* Collision case D. */ 2322 /* Update socket peer label if first association. */ 2323 if (security_sctp_assoc_request((struct sctp_association *)asoc, 2324 chunk->head_skb ?: chunk->skb)) { 2325 sctp_association_free(new_asoc); 2326 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 2327 } 2328 break; 2329 } 2330 2331 switch (action) { 2332 case 'A': /* Association restart. */ 2333 retval = sctp_sf_do_dupcook_a(net, ep, asoc, chunk, commands, 2334 new_asoc); 2335 break; 2336 2337 case 'B': /* Collision case B. */ 2338 retval = sctp_sf_do_dupcook_b(net, ep, asoc, chunk, commands, 2339 new_asoc); 2340 break; 2341 2342 case 'C': /* Collision case C. */ 2343 retval = sctp_sf_do_dupcook_c(net, ep, asoc, chunk, commands, 2344 new_asoc); 2345 break; 2346 2347 case 'D': /* Collision case D. */ 2348 retval = sctp_sf_do_dupcook_d(net, ep, asoc, chunk, commands, 2349 new_asoc); 2350 break; 2351 2352 default: /* Discard packet for all others. */ 2353 retval = sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 2354 break; 2355 } 2356 2357 /* Delete the temporary new association. */ 2358 sctp_add_cmd_sf(commands, SCTP_CMD_SET_ASOC, SCTP_ASOC(new_asoc)); 2359 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL()); 2360 2361 /* Restore association pointer to provide SCTP command interpreter 2362 * with a valid context in case it needs to manipulate 2363 * the queues */ 2364 sctp_add_cmd_sf(commands, SCTP_CMD_SET_ASOC, 2365 SCTP_ASOC((struct sctp_association *)asoc)); 2366 2367 return retval; 2368 2369 nomem: 2370 return SCTP_DISPOSITION_NOMEM; 2371 } 2372 2373 /* 2374 * Process an ABORT. (SHUTDOWN-PENDING state) 2375 * 2376 * See sctp_sf_do_9_1_abort(). 2377 */ 2378 enum sctp_disposition sctp_sf_shutdown_pending_abort( 2379 struct net *net, 2380 const struct sctp_endpoint *ep, 2381 const struct sctp_association *asoc, 2382 const union sctp_subtype type, 2383 void *arg, 2384 struct sctp_cmd_seq *commands) 2385 { 2386 struct sctp_chunk *chunk = arg; 2387 2388 if (!sctp_vtag_verify_either(chunk, asoc)) 2389 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 2390 2391 /* Make sure that the ABORT chunk has a valid length. 2392 * Since this is an ABORT chunk, we have to discard it 2393 * because of the following text: 2394 * RFC 2960, Section 3.3.7 2395 * If an endpoint receives an ABORT with a format error or for an 2396 * association that doesn't exist, it MUST silently discard it. 2397 * Because the length is "invalid", we can't really discard just 2398 * as we do not know its true length. So, to be safe, discard the 2399 * packet. 2400 */ 2401 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_abort_chunk))) 2402 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 2403 2404 /* ADD-IP: Special case for ABORT chunks 2405 * F4) One special consideration is that ABORT Chunks arriving 2406 * destined to the IP address being deleted MUST be 2407 * ignored (see Section 5.3.1 for further details). 2408 */ 2409 if (SCTP_ADDR_DEL == 2410 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest)) 2411 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 2412 2413 if (!sctp_err_chunk_valid(chunk)) 2414 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 2415 2416 return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands); 2417 } 2418 2419 /* 2420 * Process an ABORT. (SHUTDOWN-SENT state) 2421 * 2422 * See sctp_sf_do_9_1_abort(). 2423 */ 2424 enum sctp_disposition sctp_sf_shutdown_sent_abort( 2425 struct net *net, 2426 const struct sctp_endpoint *ep, 2427 const struct sctp_association *asoc, 2428 const union sctp_subtype type, 2429 void *arg, 2430 struct sctp_cmd_seq *commands) 2431 { 2432 struct sctp_chunk *chunk = arg; 2433 2434 if (!sctp_vtag_verify_either(chunk, asoc)) 2435 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 2436 2437 /* Make sure that the ABORT chunk has a valid length. 2438 * Since this is an ABORT chunk, we have to discard it 2439 * because of the following text: 2440 * RFC 2960, Section 3.3.7 2441 * If an endpoint receives an ABORT with a format error or for an 2442 * association that doesn't exist, it MUST silently discard it. 2443 * Because the length is "invalid", we can't really discard just 2444 * as we do not know its true length. So, to be safe, discard the 2445 * packet. 2446 */ 2447 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_abort_chunk))) 2448 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 2449 2450 /* ADD-IP: Special case for ABORT chunks 2451 * F4) One special consideration is that ABORT Chunks arriving 2452 * destined to the IP address being deleted MUST be 2453 * ignored (see Section 5.3.1 for further details). 2454 */ 2455 if (SCTP_ADDR_DEL == 2456 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest)) 2457 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 2458 2459 if (!sctp_err_chunk_valid(chunk)) 2460 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 2461 2462 /* Stop the T2-shutdown timer. */ 2463 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, 2464 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN)); 2465 2466 /* Stop the T5-shutdown guard timer. */ 2467 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, 2468 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD)); 2469 2470 return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands); 2471 } 2472 2473 /* 2474 * Process an ABORT. (SHUTDOWN-ACK-SENT state) 2475 * 2476 * See sctp_sf_do_9_1_abort(). 2477 */ 2478 enum sctp_disposition sctp_sf_shutdown_ack_sent_abort( 2479 struct net *net, 2480 const struct sctp_endpoint *ep, 2481 const struct sctp_association *asoc, 2482 const union sctp_subtype type, 2483 void *arg, 2484 struct sctp_cmd_seq *commands) 2485 { 2486 /* The same T2 timer, so we should be able to use 2487 * common function with the SHUTDOWN-SENT state. 2488 */ 2489 return sctp_sf_shutdown_sent_abort(net, ep, asoc, type, arg, commands); 2490 } 2491 2492 /* 2493 * Handle an Error received in COOKIE_ECHOED state. 2494 * 2495 * Only handle the error type of stale COOKIE Error, the other errors will 2496 * be ignored. 2497 * 2498 * Inputs 2499 * (endpoint, asoc, chunk) 2500 * 2501 * Outputs 2502 * (asoc, reply_msg, msg_up, timers, counters) 2503 * 2504 * The return value is the disposition of the chunk. 2505 */ 2506 enum sctp_disposition sctp_sf_cookie_echoed_err( 2507 struct net *net, 2508 const struct sctp_endpoint *ep, 2509 const struct sctp_association *asoc, 2510 const union sctp_subtype type, 2511 void *arg, 2512 struct sctp_cmd_seq *commands) 2513 { 2514 struct sctp_chunk *chunk = arg; 2515 struct sctp_errhdr *err; 2516 2517 if (!sctp_vtag_verify(chunk, asoc)) 2518 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 2519 2520 /* Make sure that the ERROR chunk has a valid length. 2521 * The parameter walking depends on this as well. 2522 */ 2523 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_operr_chunk))) 2524 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 2525 commands); 2526 2527 /* Process the error here */ 2528 /* FUTURE FIXME: When PR-SCTP related and other optional 2529 * parms are emitted, this will have to change to handle multiple 2530 * errors. 2531 */ 2532 sctp_walk_errors(err, chunk->chunk_hdr) { 2533 if (err->cause != SCTP_ERROR_STALE_COOKIE) 2534 continue; 2535 /* The staleness is only meaningful if the cause is long 2536 * enough to hold it; a shorter one is malformed. 2537 */ 2538 if (ntohs(err->length) < sizeof(*err) + sizeof(__be32)) 2539 break; 2540 return sctp_sf_do_5_2_6_stale(net, ep, asoc, type, 2541 arg, commands, err); 2542 } 2543 2544 /* It is possible to have malformed error causes, and that 2545 * will cause us to end the walk early. However, since 2546 * we are discarding the packet, there should be no adverse 2547 * affects. 2548 */ 2549 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 2550 } 2551 2552 /* 2553 * Handle a Stale COOKIE Error 2554 * 2555 * Section: 5.2.6 Handle Stale COOKIE Error 2556 * If the association is in the COOKIE-ECHOED state, the endpoint may elect 2557 * one of the following three alternatives. 2558 * ... 2559 * 3) Send a new INIT chunk to the endpoint, adding a Cookie 2560 * Preservative parameter requesting an extension to the lifetime of 2561 * the State Cookie. When calculating the time extension, an 2562 * implementation SHOULD use the RTT information measured based on the 2563 * previous COOKIE ECHO / ERROR exchange, and should add no more 2564 * than 1 second beyond the measured RTT, due to long State Cookie 2565 * lifetimes making the endpoint more subject to a replay attack. 2566 * 2567 * Verification Tag: Not explicit, but safe to ignore. 2568 * 2569 * Inputs 2570 * (endpoint, asoc, chunk) 2571 * 2572 * Outputs 2573 * (asoc, reply_msg, msg_up, timers, counters) 2574 * 2575 * The return value is the disposition of the chunk. 2576 */ 2577 static enum sctp_disposition sctp_sf_do_5_2_6_stale( 2578 struct net *net, 2579 const struct sctp_endpoint *ep, 2580 const struct sctp_association *asoc, 2581 const union sctp_subtype type, 2582 void *arg, 2583 struct sctp_cmd_seq *commands, 2584 struct sctp_errhdr *err) 2585 { 2586 int attempts = asoc->init_err_counter + 1; 2587 struct sctp_cookie_preserve_param bht; 2588 struct sctp_bind_addr *bp; 2589 struct sctp_chunk *reply; 2590 u32 stale; 2591 2592 if (attempts > asoc->max_init_attempts) { 2593 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, 2594 SCTP_ERROR(ETIMEDOUT)); 2595 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED, 2596 SCTP_PERR(SCTP_ERROR_STALE_COOKIE)); 2597 return SCTP_DISPOSITION_DELETE_TCB; 2598 } 2599 2600 /* When calculating the time extension, an implementation 2601 * SHOULD use the RTT information measured based on the 2602 * previous COOKIE ECHO / ERROR exchange, and should add no 2603 * more than 1 second beyond the measured RTT, due to long 2604 * State Cookie lifetimes making the endpoint more subject to 2605 * a replay attack. 2606 * Measure of Staleness's unit is usec. (1/1000000 sec) 2607 * Suggested Cookie Life-span Increment's unit is msec. 2608 * (1/1000 sec) 2609 * In general, if you use the suggested cookie life, the value 2610 * found in the field of measure of staleness should be doubled 2611 * to give ample time to retransmit the new cookie and thus 2612 * yield a higher probability of success on the reattempt. 2613 */ 2614 stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err))); 2615 stale = (stale * 2) / 1000; 2616 2617 bht.param_hdr.type = SCTP_PARAM_COOKIE_PRESERVATIVE; 2618 bht.param_hdr.length = htons(sizeof(bht)); 2619 bht.lifespan_increment = htonl(stale); 2620 2621 /* Build that new INIT chunk. */ 2622 bp = (struct sctp_bind_addr *) &asoc->base.bind_addr; 2623 reply = sctp_make_init(asoc, bp, GFP_ATOMIC, sizeof(bht)); 2624 if (!reply) 2625 goto nomem; 2626 2627 sctp_addto_chunk(reply, sizeof(bht), &bht); 2628 2629 /* Clear peer's init_tag cached in assoc as we are sending a new INIT */ 2630 sctp_add_cmd_sf(commands, SCTP_CMD_CLEAR_INIT_TAG, SCTP_NULL()); 2631 2632 /* Stop pending T3-rtx and heartbeat timers */ 2633 sctp_add_cmd_sf(commands, SCTP_CMD_T3_RTX_TIMERS_STOP, SCTP_NULL()); 2634 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL()); 2635 2636 /* Delete non-primary peer ip addresses since we are transitioning 2637 * back to the COOKIE-WAIT state 2638 */ 2639 sctp_add_cmd_sf(commands, SCTP_CMD_DEL_NON_PRIMARY, SCTP_NULL()); 2640 2641 sctp_add_cmd_sf(commands, SCTP_CMD_PURGE_OUTQUEUE, SCTP_NULL()); 2642 2643 /* Cast away the const modifier, as we want to just 2644 * rerun it through as a sideffect. 2645 */ 2646 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_INC, SCTP_NULL()); 2647 2648 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, 2649 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE)); 2650 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE, 2651 SCTP_STATE(SCTP_STATE_COOKIE_WAIT)); 2652 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START, 2653 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT)); 2654 2655 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply)); 2656 2657 return SCTP_DISPOSITION_CONSUME; 2658 2659 nomem: 2660 return SCTP_DISPOSITION_NOMEM; 2661 } 2662 2663 /* 2664 * Process an ABORT. 2665 * 2666 * Section: 9.1 2667 * After checking the Verification Tag, the receiving endpoint shall 2668 * remove the association from its record, and shall report the 2669 * termination to its upper layer. 2670 * 2671 * Verification Tag: 8.5.1 Exceptions in Verification Tag Rules 2672 * B) Rules for packet carrying ABORT: 2673 * 2674 * - The endpoint shall always fill in the Verification Tag field of the 2675 * outbound packet with the destination endpoint's tag value if it 2676 * is known. 2677 * 2678 * - If the ABORT is sent in response to an OOTB packet, the endpoint 2679 * MUST follow the procedure described in Section 8.4. 2680 * 2681 * - The receiver MUST accept the packet if the Verification Tag 2682 * matches either its own tag, OR the tag of its peer. Otherwise, the 2683 * receiver MUST silently discard the packet and take no further 2684 * action. 2685 * 2686 * Inputs 2687 * (endpoint, asoc, chunk) 2688 * 2689 * Outputs 2690 * (asoc, reply_msg, msg_up, timers, counters) 2691 * 2692 * The return value is the disposition of the chunk. 2693 */ 2694 enum sctp_disposition sctp_sf_do_9_1_abort( 2695 struct net *net, 2696 const struct sctp_endpoint *ep, 2697 const struct sctp_association *asoc, 2698 const union sctp_subtype type, 2699 void *arg, 2700 struct sctp_cmd_seq *commands) 2701 { 2702 struct sctp_chunk *chunk = arg; 2703 2704 if (!sctp_vtag_verify_either(chunk, asoc)) 2705 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 2706 2707 /* Make sure that the ABORT chunk has a valid length. 2708 * Since this is an ABORT chunk, we have to discard it 2709 * because of the following text: 2710 * RFC 2960, Section 3.3.7 2711 * If an endpoint receives an ABORT with a format error or for an 2712 * association that doesn't exist, it MUST silently discard it. 2713 * Because the length is "invalid", we can't really discard just 2714 * as we do not know its true length. So, to be safe, discard the 2715 * packet. 2716 */ 2717 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_abort_chunk))) 2718 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 2719 2720 /* ADD-IP: Special case for ABORT chunks 2721 * F4) One special consideration is that ABORT Chunks arriving 2722 * destined to the IP address being deleted MUST be 2723 * ignored (see Section 5.3.1 for further details). 2724 */ 2725 if (SCTP_ADDR_DEL == 2726 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest)) 2727 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 2728 2729 if (!sctp_err_chunk_valid(chunk)) 2730 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 2731 2732 return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands); 2733 } 2734 2735 static enum sctp_disposition __sctp_sf_do_9_1_abort( 2736 struct net *net, 2737 const struct sctp_endpoint *ep, 2738 const struct sctp_association *asoc, 2739 const union sctp_subtype type, 2740 void *arg, 2741 struct sctp_cmd_seq *commands) 2742 { 2743 __be16 error = SCTP_ERROR_NO_ERROR; 2744 struct sctp_chunk *chunk = arg; 2745 unsigned int len; 2746 2747 /* See if we have an error cause code in the chunk. */ 2748 len = ntohs(chunk->chunk_hdr->length); 2749 if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr)) 2750 error = ((struct sctp_errhdr *)chunk->skb->data)->cause; 2751 2752 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(ECONNRESET)); 2753 /* ASSOC_FAILED will DELETE_TCB. */ 2754 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, SCTP_PERR(error)); 2755 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS); 2756 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB); 2757 2758 return SCTP_DISPOSITION_ABORT; 2759 } 2760 2761 /* 2762 * Process an ABORT. (COOKIE-WAIT state) 2763 * 2764 * See sctp_sf_do_9_1_abort() above. 2765 */ 2766 enum sctp_disposition sctp_sf_cookie_wait_abort( 2767 struct net *net, 2768 const struct sctp_endpoint *ep, 2769 const struct sctp_association *asoc, 2770 const union sctp_subtype type, 2771 void *arg, 2772 struct sctp_cmd_seq *commands) 2773 { 2774 __be16 error = SCTP_ERROR_NO_ERROR; 2775 struct sctp_chunk *chunk = arg; 2776 unsigned int len; 2777 2778 if (!sctp_vtag_verify_either(chunk, asoc)) 2779 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 2780 2781 /* Make sure that the ABORT chunk has a valid length. 2782 * Since this is an ABORT chunk, we have to discard it 2783 * because of the following text: 2784 * RFC 2960, Section 3.3.7 2785 * If an endpoint receives an ABORT with a format error or for an 2786 * association that doesn't exist, it MUST silently discard it. 2787 * Because the length is "invalid", we can't really discard just 2788 * as we do not know its true length. So, to be safe, discard the 2789 * packet. 2790 */ 2791 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_abort_chunk))) 2792 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 2793 2794 /* See if we have an error cause code in the chunk. */ 2795 len = ntohs(chunk->chunk_hdr->length); 2796 if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr)) 2797 error = ((struct sctp_errhdr *)chunk->skb->data)->cause; 2798 2799 return sctp_stop_t1_and_abort(net, commands, error, ECONNREFUSED, asoc, 2800 chunk->transport); 2801 } 2802 2803 /* 2804 * Process an incoming ICMP as an ABORT. (COOKIE-WAIT state) 2805 */ 2806 enum sctp_disposition sctp_sf_cookie_wait_icmp_abort( 2807 struct net *net, 2808 const struct sctp_endpoint *ep, 2809 const struct sctp_association *asoc, 2810 const union sctp_subtype type, 2811 void *arg, 2812 struct sctp_cmd_seq *commands) 2813 { 2814 return sctp_stop_t1_and_abort(net, commands, SCTP_ERROR_NO_ERROR, 2815 ENOPROTOOPT, asoc, 2816 (struct sctp_transport *)arg); 2817 } 2818 2819 /* 2820 * Process an ABORT. (COOKIE-ECHOED state) 2821 */ 2822 enum sctp_disposition sctp_sf_cookie_echoed_abort( 2823 struct net *net, 2824 const struct sctp_endpoint *ep, 2825 const struct sctp_association *asoc, 2826 const union sctp_subtype type, 2827 void *arg, 2828 struct sctp_cmd_seq *commands) 2829 { 2830 /* There is a single T1 timer, so we should be able to use 2831 * common function with the COOKIE-WAIT state. 2832 */ 2833 return sctp_sf_cookie_wait_abort(net, ep, asoc, type, arg, commands); 2834 } 2835 2836 /* 2837 * Stop T1 timer and abort association with "INIT failed". 2838 * 2839 * This is common code called by several sctp_sf_*_abort() functions above. 2840 */ 2841 static enum sctp_disposition sctp_stop_t1_and_abort( 2842 struct net *net, 2843 struct sctp_cmd_seq *commands, 2844 __be16 error, int sk_err, 2845 const struct sctp_association *asoc, 2846 struct sctp_transport *transport) 2847 { 2848 pr_debug("%s: ABORT received (INIT)\n", __func__); 2849 2850 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE, 2851 SCTP_STATE(SCTP_STATE_CLOSED)); 2852 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS); 2853 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, 2854 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT)); 2855 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(sk_err)); 2856 /* CMD_INIT_FAILED will DELETE_TCB. */ 2857 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED, 2858 SCTP_PERR(error)); 2859 2860 return SCTP_DISPOSITION_ABORT; 2861 } 2862 2863 /* 2864 * sctp_sf_do_9_2_shut 2865 * 2866 * Section: 9.2 2867 * Upon the reception of the SHUTDOWN, the peer endpoint shall 2868 * - enter the SHUTDOWN-RECEIVED state, 2869 * 2870 * - stop accepting new data from its SCTP user 2871 * 2872 * - verify, by checking the Cumulative TSN Ack field of the chunk, 2873 * that all its outstanding DATA chunks have been received by the 2874 * SHUTDOWN sender. 2875 * 2876 * Once an endpoint as reached the SHUTDOWN-RECEIVED state it MUST NOT 2877 * send a SHUTDOWN in response to a ULP request. And should discard 2878 * subsequent SHUTDOWN chunks. 2879 * 2880 * If there are still outstanding DATA chunks left, the SHUTDOWN 2881 * receiver shall continue to follow normal data transmission 2882 * procedures defined in Section 6 until all outstanding DATA chunks 2883 * are acknowledged; however, the SHUTDOWN receiver MUST NOT accept 2884 * new data from its SCTP user. 2885 * 2886 * Verification Tag: 8.5 Verification Tag [Normal verification] 2887 * 2888 * Inputs 2889 * (endpoint, asoc, chunk) 2890 * 2891 * Outputs 2892 * (asoc, reply_msg, msg_up, timers, counters) 2893 * 2894 * The return value is the disposition of the chunk. 2895 */ 2896 enum sctp_disposition sctp_sf_do_9_2_shutdown( 2897 struct net *net, 2898 const struct sctp_endpoint *ep, 2899 const struct sctp_association *asoc, 2900 const union sctp_subtype type, 2901 void *arg, 2902 struct sctp_cmd_seq *commands) 2903 { 2904 enum sctp_disposition disposition; 2905 struct sctp_chunk *chunk = arg; 2906 struct sctp_shutdownhdr *sdh; 2907 struct sctp_ulpevent *ev; 2908 __u32 ctsn; 2909 2910 if (!sctp_vtag_verify(chunk, asoc)) 2911 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 2912 2913 /* Make sure that the SHUTDOWN chunk has a valid length. */ 2914 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_shutdown_chunk))) 2915 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 2916 commands); 2917 2918 /* Convert the elaborate header. */ 2919 sdh = (struct sctp_shutdownhdr *)chunk->skb->data; 2920 skb_pull(chunk->skb, sizeof(*sdh)); 2921 chunk->subh.shutdown_hdr = sdh; 2922 ctsn = ntohl(sdh->cum_tsn_ack); 2923 2924 if (TSN_lt(ctsn, asoc->ctsn_ack_point)) { 2925 pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn, 2926 asoc->ctsn_ack_point); 2927 2928 return SCTP_DISPOSITION_DISCARD; 2929 } 2930 2931 /* If Cumulative TSN Ack beyond the max tsn currently 2932 * send, terminating the association and respond to the 2933 * sender with an ABORT. 2934 */ 2935 if (!TSN_lt(ctsn, asoc->next_tsn)) 2936 return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands); 2937 2938 /* API 5.3.1.5 SCTP_SHUTDOWN_EVENT 2939 * When a peer sends a SHUTDOWN, SCTP delivers this notification to 2940 * inform the application that it should cease sending data. 2941 */ 2942 ev = sctp_ulpevent_make_shutdown_event(asoc, 0, GFP_ATOMIC); 2943 if (!ev) { 2944 disposition = SCTP_DISPOSITION_NOMEM; 2945 goto out; 2946 } 2947 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev)); 2948 2949 /* Upon the reception of the SHUTDOWN, the peer endpoint shall 2950 * - enter the SHUTDOWN-RECEIVED state, 2951 * - stop accepting new data from its SCTP user 2952 * 2953 * [This is implicit in the new state.] 2954 */ 2955 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE, 2956 SCTP_STATE(SCTP_STATE_SHUTDOWN_RECEIVED)); 2957 disposition = SCTP_DISPOSITION_CONSUME; 2958 2959 if (sctp_outq_is_empty(&asoc->outqueue)) { 2960 disposition = sctp_sf_do_9_2_shutdown_ack(net, ep, asoc, type, 2961 arg, commands); 2962 } 2963 2964 if (SCTP_DISPOSITION_NOMEM == disposition) 2965 goto out; 2966 2967 /* - verify, by checking the Cumulative TSN Ack field of the 2968 * chunk, that all its outstanding DATA chunks have been 2969 * received by the SHUTDOWN sender. 2970 */ 2971 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_CTSN, 2972 SCTP_BE32(chunk->subh.shutdown_hdr->cum_tsn_ack)); 2973 2974 out: 2975 return disposition; 2976 } 2977 2978 /* 2979 * sctp_sf_do_9_2_shut_ctsn 2980 * 2981 * Once an endpoint has reached the SHUTDOWN-RECEIVED state, 2982 * it MUST NOT send a SHUTDOWN in response to a ULP request. 2983 * The Cumulative TSN Ack of the received SHUTDOWN chunk 2984 * MUST be processed. 2985 */ 2986 enum sctp_disposition sctp_sf_do_9_2_shut_ctsn( 2987 struct net *net, 2988 const struct sctp_endpoint *ep, 2989 const struct sctp_association *asoc, 2990 const union sctp_subtype type, 2991 void *arg, 2992 struct sctp_cmd_seq *commands) 2993 { 2994 struct sctp_chunk *chunk = arg; 2995 struct sctp_shutdownhdr *sdh; 2996 __u32 ctsn; 2997 2998 if (!sctp_vtag_verify(chunk, asoc)) 2999 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 3000 3001 /* Make sure that the SHUTDOWN chunk has a valid length. */ 3002 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_shutdown_chunk))) 3003 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 3004 commands); 3005 3006 sdh = (struct sctp_shutdownhdr *)chunk->skb->data; 3007 ctsn = ntohl(sdh->cum_tsn_ack); 3008 3009 if (TSN_lt(ctsn, asoc->ctsn_ack_point)) { 3010 pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn, 3011 asoc->ctsn_ack_point); 3012 3013 return SCTP_DISPOSITION_DISCARD; 3014 } 3015 3016 /* If Cumulative TSN Ack beyond the max tsn currently 3017 * send, terminating the association and respond to the 3018 * sender with an ABORT. 3019 */ 3020 if (!TSN_lt(ctsn, asoc->next_tsn)) 3021 return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands); 3022 3023 /* verify, by checking the Cumulative TSN Ack field of the 3024 * chunk, that all its outstanding DATA chunks have been 3025 * received by the SHUTDOWN sender. 3026 */ 3027 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_CTSN, 3028 SCTP_BE32(sdh->cum_tsn_ack)); 3029 3030 return SCTP_DISPOSITION_CONSUME; 3031 } 3032 3033 /* RFC 2960 9.2 3034 * If an endpoint is in SHUTDOWN-ACK-SENT state and receives an INIT chunk 3035 * (e.g., if the SHUTDOWN COMPLETE was lost) with source and destination 3036 * transport addresses (either in the IP addresses or in the INIT chunk) 3037 * that belong to this association, it should discard the INIT chunk and 3038 * retransmit the SHUTDOWN ACK chunk. 3039 */ 3040 static enum sctp_disposition 3041 __sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep, 3042 const struct sctp_association *asoc, 3043 const union sctp_subtype type, void *arg, 3044 struct sctp_cmd_seq *commands) 3045 { 3046 struct sctp_chunk *chunk = arg; 3047 struct sctp_chunk *reply; 3048 3049 /* Make sure that the chunk has a valid length */ 3050 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) 3051 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 3052 commands); 3053 3054 /* Since we are not going to really process this INIT, there 3055 * is no point in verifying chunk boundaries. Just generate 3056 * the SHUTDOWN ACK. 3057 */ 3058 reply = sctp_make_shutdown_ack(asoc, chunk); 3059 if (NULL == reply) 3060 goto nomem; 3061 3062 /* Set the transport for the SHUTDOWN ACK chunk and the timeout for 3063 * the T2-SHUTDOWN timer. 3064 */ 3065 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply)); 3066 3067 /* and restart the T2-shutdown timer. */ 3068 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART, 3069 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN)); 3070 3071 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply)); 3072 3073 return SCTP_DISPOSITION_CONSUME; 3074 nomem: 3075 return SCTP_DISPOSITION_NOMEM; 3076 } 3077 3078 enum sctp_disposition 3079 sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep, 3080 const struct sctp_association *asoc, 3081 const union sctp_subtype type, void *arg, 3082 struct sctp_cmd_seq *commands) 3083 { 3084 struct sctp_chunk *chunk = arg; 3085 3086 if (!chunk->singleton) 3087 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 3088 3089 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk))) 3090 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 3091 3092 if (chunk->sctp_hdr->vtag != 0) 3093 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands); 3094 3095 return __sctp_sf_do_9_2_reshutack(net, ep, asoc, type, arg, commands); 3096 } 3097 3098 /* 3099 * sctp_sf_do_ecn_cwr 3100 * 3101 * Section: Appendix A: Explicit Congestion Notification 3102 * 3103 * CWR: 3104 * 3105 * RFC 2481 details a specific bit for a sender to send in the header of 3106 * its next outbound TCP segment to indicate to its peer that it has 3107 * reduced its congestion window. This is termed the CWR bit. For 3108 * SCTP the same indication is made by including the CWR chunk. 3109 * This chunk contains one data element, i.e. the TSN number that 3110 * was sent in the ECNE chunk. This element represents the lowest 3111 * TSN number in the datagram that was originally marked with the 3112 * CE bit. 3113 * 3114 * Verification Tag: 8.5 Verification Tag [Normal verification] 3115 * Inputs 3116 * (endpoint, asoc, chunk) 3117 * 3118 * Outputs 3119 * (asoc, reply_msg, msg_up, timers, counters) 3120 * 3121 * The return value is the disposition of the chunk. 3122 */ 3123 enum sctp_disposition sctp_sf_do_ecn_cwr(struct net *net, 3124 const struct sctp_endpoint *ep, 3125 const struct sctp_association *asoc, 3126 const union sctp_subtype type, 3127 void *arg, 3128 struct sctp_cmd_seq *commands) 3129 { 3130 struct sctp_chunk *chunk = arg; 3131 struct sctp_cwrhdr *cwr; 3132 u32 lowest_tsn; 3133 3134 if (!sctp_vtag_verify(chunk, asoc)) 3135 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 3136 3137 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_ecne_chunk))) 3138 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 3139 commands); 3140 3141 cwr = (struct sctp_cwrhdr *)chunk->skb->data; 3142 skb_pull(chunk->skb, sizeof(*cwr)); 3143 3144 lowest_tsn = ntohl(cwr->lowest_tsn); 3145 3146 /* Does this CWR ack the last sent congestion notification? */ 3147 if (TSN_lte(asoc->last_ecne_tsn, lowest_tsn)) { 3148 /* Stop sending ECNE. */ 3149 sctp_add_cmd_sf(commands, 3150 SCTP_CMD_ECN_CWR, 3151 SCTP_U32(lowest_tsn)); 3152 } 3153 return SCTP_DISPOSITION_CONSUME; 3154 } 3155 3156 /* 3157 * sctp_sf_do_ecne 3158 * 3159 * Section: Appendix A: Explicit Congestion Notification 3160 * 3161 * ECN-Echo 3162 * 3163 * RFC 2481 details a specific bit for a receiver to send back in its 3164 * TCP acknowledgements to notify the sender of the Congestion 3165 * Experienced (CE) bit having arrived from the network. For SCTP this 3166 * same indication is made by including the ECNE chunk. This chunk 3167 * contains one data element, i.e. the lowest TSN associated with the IP 3168 * datagram marked with the CE bit..... 3169 * 3170 * Verification Tag: 8.5 Verification Tag [Normal verification] 3171 * Inputs 3172 * (endpoint, asoc, chunk) 3173 * 3174 * Outputs 3175 * (asoc, reply_msg, msg_up, timers, counters) 3176 * 3177 * The return value is the disposition of the chunk. 3178 */ 3179 enum sctp_disposition sctp_sf_do_ecne(struct net *net, 3180 const struct sctp_endpoint *ep, 3181 const struct sctp_association *asoc, 3182 const union sctp_subtype type, 3183 void *arg, struct sctp_cmd_seq *commands) 3184 { 3185 struct sctp_chunk *chunk = arg; 3186 struct sctp_ecnehdr *ecne; 3187 3188 if (!sctp_vtag_verify(chunk, asoc)) 3189 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 3190 3191 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_ecne_chunk))) 3192 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 3193 commands); 3194 3195 ecne = (struct sctp_ecnehdr *)chunk->skb->data; 3196 skb_pull(chunk->skb, sizeof(*ecne)); 3197 3198 /* If this is a newer ECNE than the last CWR packet we sent out */ 3199 sctp_add_cmd_sf(commands, SCTP_CMD_ECN_ECNE, 3200 SCTP_U32(ntohl(ecne->lowest_tsn))); 3201 3202 return SCTP_DISPOSITION_CONSUME; 3203 } 3204 3205 /* 3206 * Section: 6.2 Acknowledgement on Reception of DATA Chunks 3207 * 3208 * The SCTP endpoint MUST always acknowledge the reception of each valid 3209 * DATA chunk. 3210 * 3211 * The guidelines on delayed acknowledgement algorithm specified in 3212 * Section 4.2 of [RFC2581] SHOULD be followed. Specifically, an 3213 * acknowledgement SHOULD be generated for at least every second packet 3214 * (not every second DATA chunk) received, and SHOULD be generated within 3215 * 200 ms of the arrival of any unacknowledged DATA chunk. In some 3216 * situations it may be beneficial for an SCTP transmitter to be more 3217 * conservative than the algorithms detailed in this document allow. 3218 * However, an SCTP transmitter MUST NOT be more aggressive than the 3219 * following algorithms allow. 3220 * 3221 * A SCTP receiver MUST NOT generate more than one SACK for every 3222 * incoming packet, other than to update the offered window as the 3223 * receiving application consumes new data. 3224 * 3225 * Verification Tag: 8.5 Verification Tag [Normal verification] 3226 * 3227 * Inputs 3228 * (endpoint, asoc, chunk) 3229 * 3230 * Outputs 3231 * (asoc, reply_msg, msg_up, timers, counters) 3232 * 3233 * The return value is the disposition of the chunk. 3234 */ 3235 enum sctp_disposition sctp_sf_eat_data_6_2(struct net *net, 3236 const struct sctp_endpoint *ep, 3237 const struct sctp_association *asoc, 3238 const union sctp_subtype type, 3239 void *arg, 3240 struct sctp_cmd_seq *commands) 3241 { 3242 union sctp_arg force = SCTP_NOFORCE(); 3243 struct sctp_chunk *chunk = arg; 3244 int error; 3245 3246 if (!sctp_vtag_verify(chunk, asoc)) { 3247 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG, 3248 SCTP_NULL()); 3249 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 3250 } 3251 3252 if (!sctp_chunk_length_valid(chunk, sctp_datachk_len(&asoc->stream))) 3253 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 3254 commands); 3255 3256 error = sctp_eat_data(asoc, chunk, commands); 3257 switch (error) { 3258 case SCTP_IERROR_NO_ERROR: 3259 break; 3260 case SCTP_IERROR_HIGH_TSN: 3261 case SCTP_IERROR_BAD_STREAM: 3262 SCTP_INC_STATS(net, SCTP_MIB_IN_DATA_CHUNK_DISCARDS); 3263 goto discard_noforce; 3264 case SCTP_IERROR_DUP_TSN: 3265 case SCTP_IERROR_IGNORE_TSN: 3266 SCTP_INC_STATS(net, SCTP_MIB_IN_DATA_CHUNK_DISCARDS); 3267 goto discard_force; 3268 case SCTP_IERROR_NO_DATA: 3269 return SCTP_DISPOSITION_ABORT; 3270 case SCTP_IERROR_PROTO_VIOLATION: 3271 return sctp_sf_abort_violation(net, ep, asoc, chunk, commands, 3272 (u8 *)chunk->subh.data_hdr, 3273 sctp_datahdr_len(&asoc->stream)); 3274 default: 3275 BUG(); 3276 } 3277 3278 if (chunk->chunk_hdr->flags & SCTP_DATA_SACK_IMM) 3279 force = SCTP_FORCE(); 3280 3281 if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) { 3282 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART, 3283 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE)); 3284 } 3285 3286 /* If this is the last chunk in a packet, we need to count it 3287 * toward sack generation. Note that we need to SACK every 3288 * OTHER packet containing data chunks, EVEN IF WE DISCARD 3289 * THEM. We elect to NOT generate SACK's if the chunk fails 3290 * the verification tag test. 3291 * 3292 * RFC 2960 6.2 Acknowledgement on Reception of DATA Chunks 3293 * 3294 * The SCTP endpoint MUST always acknowledge the reception of 3295 * each valid DATA chunk. 3296 * 3297 * The guidelines on delayed acknowledgement algorithm 3298 * specified in Section 4.2 of [RFC2581] SHOULD be followed. 3299 * Specifically, an acknowledgement SHOULD be generated for at 3300 * least every second packet (not every second DATA chunk) 3301 * received, and SHOULD be generated within 200 ms of the 3302 * arrival of any unacknowledged DATA chunk. In some 3303 * situations it may be beneficial for an SCTP transmitter to 3304 * be more conservative than the algorithms detailed in this 3305 * document allow. However, an SCTP transmitter MUST NOT be 3306 * more aggressive than the following algorithms allow. 3307 */ 3308 if (chunk->end_of_packet) 3309 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, force); 3310 3311 return SCTP_DISPOSITION_CONSUME; 3312 3313 discard_force: 3314 /* RFC 2960 6.2 Acknowledgement on Reception of DATA Chunks 3315 * 3316 * When a packet arrives with duplicate DATA chunk(s) and with 3317 * no new DATA chunk(s), the endpoint MUST immediately send a 3318 * SACK with no delay. If a packet arrives with duplicate 3319 * DATA chunk(s) bundled with new DATA chunks, the endpoint 3320 * MAY immediately send a SACK. Normally receipt of duplicate 3321 * DATA chunks will occur when the original SACK chunk was lost 3322 * and the peer's RTO has expired. The duplicate TSN number(s) 3323 * SHOULD be reported in the SACK as duplicate. 3324 */ 3325 /* In our case, we split the MAY SACK advice up whether or not 3326 * the last chunk is a duplicate.' 3327 */ 3328 if (chunk->end_of_packet) 3329 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE()); 3330 return SCTP_DISPOSITION_DISCARD; 3331 3332 discard_noforce: 3333 if (chunk->end_of_packet) 3334 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, force); 3335 3336 return SCTP_DISPOSITION_DISCARD; 3337 } 3338 3339 /* 3340 * sctp_sf_eat_data_fast_4_4 3341 * 3342 * Section: 4 (4) 3343 * (4) In SHUTDOWN-SENT state the endpoint MUST acknowledge any received 3344 * DATA chunks without delay. 3345 * 3346 * Verification Tag: 8.5 Verification Tag [Normal verification] 3347 * Inputs 3348 * (endpoint, asoc, chunk) 3349 * 3350 * Outputs 3351 * (asoc, reply_msg, msg_up, timers, counters) 3352 * 3353 * The return value is the disposition of the chunk. 3354 */ 3355 enum sctp_disposition sctp_sf_eat_data_fast_4_4( 3356 struct net *net, 3357 const struct sctp_endpoint *ep, 3358 const struct sctp_association *asoc, 3359 const union sctp_subtype type, 3360 void *arg, 3361 struct sctp_cmd_seq *commands) 3362 { 3363 struct sctp_chunk *chunk = arg; 3364 int error; 3365 3366 if (!sctp_vtag_verify(chunk, asoc)) { 3367 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG, 3368 SCTP_NULL()); 3369 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 3370 } 3371 3372 if (!sctp_chunk_length_valid(chunk, sctp_datachk_len(&asoc->stream))) 3373 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 3374 commands); 3375 3376 error = sctp_eat_data(asoc, chunk, commands); 3377 switch (error) { 3378 case SCTP_IERROR_NO_ERROR: 3379 case SCTP_IERROR_HIGH_TSN: 3380 case SCTP_IERROR_DUP_TSN: 3381 case SCTP_IERROR_IGNORE_TSN: 3382 case SCTP_IERROR_BAD_STREAM: 3383 break; 3384 case SCTP_IERROR_NO_DATA: 3385 return SCTP_DISPOSITION_ABORT; 3386 case SCTP_IERROR_PROTO_VIOLATION: 3387 return sctp_sf_abort_violation(net, ep, asoc, chunk, commands, 3388 (u8 *)chunk->subh.data_hdr, 3389 sctp_datahdr_len(&asoc->stream)); 3390 default: 3391 BUG(); 3392 } 3393 3394 /* Go a head and force a SACK, since we are shutting down. */ 3395 3396 /* Implementor's Guide. 3397 * 3398 * While in SHUTDOWN-SENT state, the SHUTDOWN sender MUST immediately 3399 * respond to each received packet containing one or more DATA chunk(s) 3400 * with a SACK, a SHUTDOWN chunk, and restart the T2-shutdown timer 3401 */ 3402 if (chunk->end_of_packet) { 3403 /* We must delay the chunk creation since the cumulative 3404 * TSN has not been updated yet. 3405 */ 3406 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SHUTDOWN, SCTP_NULL()); 3407 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE()); 3408 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART, 3409 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN)); 3410 } 3411 3412 return SCTP_DISPOSITION_CONSUME; 3413 } 3414 3415 /* 3416 * Section: 6.2 Processing a Received SACK 3417 * D) Any time a SACK arrives, the endpoint performs the following: 3418 * 3419 * i) If Cumulative TSN Ack is less than the Cumulative TSN Ack Point, 3420 * then drop the SACK. Since Cumulative TSN Ack is monotonically 3421 * increasing, a SACK whose Cumulative TSN Ack is less than the 3422 * Cumulative TSN Ack Point indicates an out-of-order SACK. 3423 * 3424 * ii) Set rwnd equal to the newly received a_rwnd minus the number 3425 * of bytes still outstanding after processing the Cumulative TSN Ack 3426 * and the Gap Ack Blocks. 3427 * 3428 * iii) If the SACK is missing a TSN that was previously 3429 * acknowledged via a Gap Ack Block (e.g., the data receiver 3430 * reneged on the data), then mark the corresponding DATA chunk 3431 * as available for retransmit: Mark it as missing for fast 3432 * retransmit as described in Section 7.2.4 and if no retransmit 3433 * timer is running for the destination address to which the DATA 3434 * chunk was originally transmitted, then T3-rtx is started for 3435 * that destination address. 3436 * 3437 * Verification Tag: 8.5 Verification Tag [Normal verification] 3438 * 3439 * Inputs 3440 * (endpoint, asoc, chunk) 3441 * 3442 * Outputs 3443 * (asoc, reply_msg, msg_up, timers, counters) 3444 * 3445 * The return value is the disposition of the chunk. 3446 */ 3447 enum sctp_disposition sctp_sf_eat_sack_6_2(struct net *net, 3448 const struct sctp_endpoint *ep, 3449 const struct sctp_association *asoc, 3450 const union sctp_subtype type, 3451 void *arg, 3452 struct sctp_cmd_seq *commands) 3453 { 3454 struct sctp_chunk *chunk = arg; 3455 struct sctp_sackhdr *sackh; 3456 __u32 ctsn; 3457 3458 if (!sctp_vtag_verify(chunk, asoc)) 3459 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 3460 3461 /* Make sure that the SACK chunk has a valid length. */ 3462 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_sack_chunk))) 3463 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 3464 commands); 3465 3466 /* Pull the SACK chunk from the data buffer */ 3467 sackh = sctp_sm_pull_sack(chunk); 3468 /* Was this a bogus SACK? */ 3469 if (!sackh) 3470 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 3471 chunk->subh.sack_hdr = sackh; 3472 ctsn = ntohl(sackh->cum_tsn_ack); 3473 3474 /* If Cumulative TSN Ack beyond the max tsn currently 3475 * send, terminating the association and respond to the 3476 * sender with an ABORT. 3477 */ 3478 if (TSN_lte(asoc->next_tsn, ctsn)) 3479 return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands); 3480 3481 trace_sctp_probe(ep, asoc, chunk); 3482 3483 /* i) If Cumulative TSN Ack is less than the Cumulative TSN 3484 * Ack Point, then drop the SACK. Since Cumulative TSN 3485 * Ack is monotonically increasing, a SACK whose 3486 * Cumulative TSN Ack is less than the Cumulative TSN Ack 3487 * Point indicates an out-of-order SACK. 3488 */ 3489 if (TSN_lt(ctsn, asoc->ctsn_ack_point)) { 3490 pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn, 3491 asoc->ctsn_ack_point); 3492 3493 return SCTP_DISPOSITION_DISCARD; 3494 } 3495 3496 /* Return this SACK for further processing. */ 3497 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_SACK, SCTP_CHUNK(chunk)); 3498 3499 /* Note: We do the rest of the work on the PROCESS_SACK 3500 * sideeffect. 3501 */ 3502 return SCTP_DISPOSITION_CONSUME; 3503 } 3504 3505 /* 3506 * Generate an ABORT in response to a packet. 3507 * 3508 * Section: 8.4 Handle "Out of the blue" Packets, sctpimpguide 2.41 3509 * 3510 * 8) The receiver should respond to the sender of the OOTB packet with 3511 * an ABORT. When sending the ABORT, the receiver of the OOTB packet 3512 * MUST fill in the Verification Tag field of the outbound packet 3513 * with the value found in the Verification Tag field of the OOTB 3514 * packet and set the T-bit in the Chunk Flags to indicate that the 3515 * Verification Tag is reflected. After sending this ABORT, the 3516 * receiver of the OOTB packet shall discard the OOTB packet and take 3517 * no further action. 3518 * 3519 * Verification Tag: 3520 * 3521 * The return value is the disposition of the chunk. 3522 */ 3523 static enum sctp_disposition sctp_sf_tabort_8_4_8( 3524 struct net *net, 3525 const struct sctp_endpoint *ep, 3526 const struct sctp_association *asoc, 3527 const union sctp_subtype type, 3528 void *arg, 3529 struct sctp_cmd_seq *commands) 3530 { 3531 struct sctp_packet *packet = NULL; 3532 struct sctp_chunk *chunk = arg; 3533 struct sctp_chunk *abort; 3534 3535 packet = sctp_ootb_pkt_new(net, asoc, chunk); 3536 if (!packet) 3537 return SCTP_DISPOSITION_NOMEM; 3538 3539 /* Make an ABORT. The T bit will be set if the asoc 3540 * is NULL. 3541 */ 3542 abort = sctp_make_abort(asoc, chunk, 0); 3543 if (!abort) { 3544 sctp_ootb_pkt_free(packet); 3545 return SCTP_DISPOSITION_NOMEM; 3546 } 3547 3548 /* Reflect vtag if T-Bit is set */ 3549 if (sctp_test_T_bit(abort)) 3550 packet->vtag = ntohl(chunk->sctp_hdr->vtag); 3551 3552 /* Set the skb to the belonging sock for accounting. */ 3553 abort->skb->sk = ep->base.sk; 3554 3555 sctp_packet_append_chunk(packet, abort); 3556 3557 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT, SCTP_PACKET(packet)); 3558 3559 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS); 3560 3561 sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 3562 return SCTP_DISPOSITION_CONSUME; 3563 } 3564 3565 /* Handling of SCTP Packets Containing an INIT Chunk Matching an 3566 * Existing Associations when the UDP encap port is incorrect. 3567 * 3568 * From Section 4 at draft-tuexen-tsvwg-sctp-udp-encaps-cons-03. 3569 */ 3570 static enum sctp_disposition sctp_sf_new_encap_port( 3571 struct net *net, 3572 const struct sctp_endpoint *ep, 3573 const struct sctp_association *asoc, 3574 const union sctp_subtype type, 3575 void *arg, 3576 struct sctp_cmd_seq *commands) 3577 { 3578 struct sctp_packet *packet = NULL; 3579 struct sctp_chunk *chunk = arg; 3580 struct sctp_chunk *abort; 3581 3582 packet = sctp_ootb_pkt_new(net, asoc, chunk); 3583 if (!packet) 3584 return SCTP_DISPOSITION_NOMEM; 3585 3586 abort = sctp_make_new_encap_port(asoc, chunk); 3587 if (!abort) { 3588 sctp_ootb_pkt_free(packet); 3589 return SCTP_DISPOSITION_NOMEM; 3590 } 3591 3592 abort->skb->sk = ep->base.sk; 3593 3594 sctp_packet_append_chunk(packet, abort); 3595 3596 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT, 3597 SCTP_PACKET(packet)); 3598 3599 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS); 3600 3601 sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 3602 return SCTP_DISPOSITION_CONSUME; 3603 } 3604 3605 /* 3606 * Received an ERROR chunk from peer. Generate SCTP_REMOTE_ERROR 3607 * event as ULP notification for each cause included in the chunk. 3608 * 3609 * API 5.3.1.3 - SCTP_REMOTE_ERROR 3610 * 3611 * The return value is the disposition of the chunk. 3612 */ 3613 enum sctp_disposition sctp_sf_operr_notify(struct net *net, 3614 const struct sctp_endpoint *ep, 3615 const struct sctp_association *asoc, 3616 const union sctp_subtype type, 3617 void *arg, 3618 struct sctp_cmd_seq *commands) 3619 { 3620 struct sctp_chunk *chunk = arg; 3621 struct sctp_errhdr *err; 3622 3623 if (!sctp_vtag_verify(chunk, asoc)) 3624 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 3625 3626 /* Make sure that the ERROR chunk has a valid length. */ 3627 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_operr_chunk))) 3628 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 3629 commands); 3630 sctp_walk_errors(err, chunk->chunk_hdr); 3631 if ((void *)err != (void *)chunk->chunk_end) 3632 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg, 3633 (void *)err, commands); 3634 3635 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR, 3636 SCTP_CHUNK(chunk)); 3637 3638 return SCTP_DISPOSITION_CONSUME; 3639 } 3640 3641 /* 3642 * Process an inbound SHUTDOWN ACK. 3643 * 3644 * From Section 9.2: 3645 * Upon the receipt of the SHUTDOWN ACK, the SHUTDOWN sender shall 3646 * stop the T2-shutdown timer, send a SHUTDOWN COMPLETE chunk to its 3647 * peer, and remove all record of the association. 3648 * 3649 * The return value is the disposition. 3650 */ 3651 enum sctp_disposition sctp_sf_do_9_2_final(struct net *net, 3652 const struct sctp_endpoint *ep, 3653 const struct sctp_association *asoc, 3654 const union sctp_subtype type, 3655 void *arg, 3656 struct sctp_cmd_seq *commands) 3657 { 3658 struct sctp_chunk *chunk = arg; 3659 struct sctp_chunk *reply; 3660 struct sctp_ulpevent *ev; 3661 3662 if (!sctp_vtag_verify(chunk, asoc)) 3663 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 3664 3665 /* Make sure that the SHUTDOWN_ACK chunk has a valid length. */ 3666 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) 3667 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 3668 commands); 3669 /* 10.2 H) SHUTDOWN COMPLETE notification 3670 * 3671 * When SCTP completes the shutdown procedures (section 9.2) this 3672 * notification is passed to the upper layer. 3673 */ 3674 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_SHUTDOWN_COMP, 3675 0, 0, 0, NULL, GFP_ATOMIC); 3676 if (!ev) 3677 goto nomem; 3678 3679 /* ...send a SHUTDOWN COMPLETE chunk to its peer, */ 3680 reply = sctp_make_shutdown_complete(asoc, chunk); 3681 if (!reply) 3682 goto nomem_chunk; 3683 3684 /* Do all the commands now (after allocation), so that we 3685 * have consistent state if memory allocation fails 3686 */ 3687 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev)); 3688 3689 /* Upon the receipt of the SHUTDOWN ACK, the SHUTDOWN sender shall 3690 * stop the T2-shutdown timer, 3691 */ 3692 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, 3693 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN)); 3694 3695 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, 3696 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD)); 3697 3698 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE, 3699 SCTP_STATE(SCTP_STATE_CLOSED)); 3700 SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS); 3701 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB); 3702 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply)); 3703 3704 /* ...and remove all record of the association. */ 3705 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL()); 3706 return SCTP_DISPOSITION_DELETE_TCB; 3707 3708 nomem_chunk: 3709 sctp_ulpevent_free(ev); 3710 nomem: 3711 return SCTP_DISPOSITION_NOMEM; 3712 } 3713 3714 /* 3715 * RFC 2960, 8.4 - Handle "Out of the blue" Packets, sctpimpguide 2.41. 3716 * 3717 * 5) If the packet contains a SHUTDOWN ACK chunk, the receiver should 3718 * respond to the sender of the OOTB packet with a SHUTDOWN COMPLETE. 3719 * When sending the SHUTDOWN COMPLETE, the receiver of the OOTB 3720 * packet must fill in the Verification Tag field of the outbound 3721 * packet with the Verification Tag received in the SHUTDOWN ACK and 3722 * set the T-bit in the Chunk Flags to indicate that the Verification 3723 * Tag is reflected. 3724 * 3725 * 8) The receiver should respond to the sender of the OOTB packet with 3726 * an ABORT. When sending the ABORT, the receiver of the OOTB packet 3727 * MUST fill in the Verification Tag field of the outbound packet 3728 * with the value found in the Verification Tag field of the OOTB 3729 * packet and set the T-bit in the Chunk Flags to indicate that the 3730 * Verification Tag is reflected. After sending this ABORT, the 3731 * receiver of the OOTB packet shall discard the OOTB packet and take 3732 * no further action. 3733 */ 3734 enum sctp_disposition sctp_sf_ootb(struct net *net, 3735 const struct sctp_endpoint *ep, 3736 const struct sctp_association *asoc, 3737 const union sctp_subtype type, 3738 void *arg, struct sctp_cmd_seq *commands) 3739 { 3740 struct sctp_chunk *chunk = arg; 3741 struct sk_buff *skb = chunk->skb; 3742 struct sctp_chunkhdr *ch; 3743 struct sctp_errhdr *err; 3744 int ootb_cookie_ack = 0; 3745 int ootb_shut_ack = 0; 3746 __u8 *ch_end; 3747 3748 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES); 3749 3750 if (asoc && !sctp_vtag_verify(chunk, asoc)) 3751 asoc = NULL; 3752 3753 ch = (struct sctp_chunkhdr *)chunk->chunk_hdr; 3754 do { 3755 /* Report violation if the chunk is less then minimal */ 3756 if (ntohs(ch->length) < sizeof(*ch)) 3757 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 3758 commands); 3759 3760 /* Report violation if chunk len overflows */ 3761 ch_end = ((__u8 *)ch) + SCTP_PAD4(ntohs(ch->length)); 3762 if (ch_end > skb_tail_pointer(skb)) 3763 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 3764 commands); 3765 3766 /* Now that we know we at least have a chunk header, 3767 * do things that are type appropriate. 3768 */ 3769 if (SCTP_CID_SHUTDOWN_ACK == ch->type) 3770 ootb_shut_ack = 1; 3771 3772 /* RFC 2960, Section 3.3.7 3773 * Moreover, under any circumstances, an endpoint that 3774 * receives an ABORT MUST NOT respond to that ABORT by 3775 * sending an ABORT of its own. 3776 */ 3777 if (SCTP_CID_ABORT == ch->type) 3778 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 3779 3780 /* RFC 8.4, 7) If the packet contains a "Stale cookie" ERROR 3781 * or a COOKIE ACK the SCTP Packet should be silently 3782 * discarded. 3783 */ 3784 3785 if (SCTP_CID_COOKIE_ACK == ch->type) 3786 ootb_cookie_ack = 1; 3787 3788 if (SCTP_CID_ERROR == ch->type) { 3789 sctp_walk_errors(err, ch) { 3790 if (SCTP_ERROR_STALE_COOKIE == err->cause) { 3791 ootb_cookie_ack = 1; 3792 break; 3793 } 3794 } 3795 } 3796 3797 ch = (struct sctp_chunkhdr *)ch_end; 3798 } while (ch_end + sizeof(*ch) < skb_tail_pointer(skb)); 3799 3800 if (ootb_shut_ack) 3801 return sctp_sf_shut_8_4_5(net, ep, asoc, type, arg, commands); 3802 else if (ootb_cookie_ack) 3803 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 3804 else 3805 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands); 3806 } 3807 3808 /* 3809 * Handle an "Out of the blue" SHUTDOWN ACK. 3810 * 3811 * Section: 8.4 5, sctpimpguide 2.41. 3812 * 3813 * 5) If the packet contains a SHUTDOWN ACK chunk, the receiver should 3814 * respond to the sender of the OOTB packet with a SHUTDOWN COMPLETE. 3815 * When sending the SHUTDOWN COMPLETE, the receiver of the OOTB 3816 * packet must fill in the Verification Tag field of the outbound 3817 * packet with the Verification Tag received in the SHUTDOWN ACK and 3818 * set the T-bit in the Chunk Flags to indicate that the Verification 3819 * Tag is reflected. 3820 * 3821 * Inputs 3822 * (endpoint, asoc, type, arg, commands) 3823 * 3824 * Outputs 3825 * (enum sctp_disposition) 3826 * 3827 * The return value is the disposition of the chunk. 3828 */ 3829 static enum sctp_disposition sctp_sf_shut_8_4_5( 3830 struct net *net, 3831 const struct sctp_endpoint *ep, 3832 const struct sctp_association *asoc, 3833 const union sctp_subtype type, 3834 void *arg, 3835 struct sctp_cmd_seq *commands) 3836 { 3837 struct sctp_packet *packet = NULL; 3838 struct sctp_chunk *chunk = arg; 3839 struct sctp_chunk *shut; 3840 3841 packet = sctp_ootb_pkt_new(net, asoc, chunk); 3842 if (!packet) 3843 return SCTP_DISPOSITION_NOMEM; 3844 3845 /* Make an SHUTDOWN_COMPLETE. 3846 * The T bit will be set if the asoc is NULL. 3847 */ 3848 shut = sctp_make_shutdown_complete(asoc, chunk); 3849 if (!shut) { 3850 sctp_ootb_pkt_free(packet); 3851 return SCTP_DISPOSITION_NOMEM; 3852 } 3853 3854 /* Reflect vtag if T-Bit is set */ 3855 if (sctp_test_T_bit(shut)) 3856 packet->vtag = ntohl(chunk->sctp_hdr->vtag); 3857 3858 /* Set the skb to the belonging sock for accounting. */ 3859 shut->skb->sk = ep->base.sk; 3860 3861 sctp_packet_append_chunk(packet, shut); 3862 3863 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT, 3864 SCTP_PACKET(packet)); 3865 3866 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS); 3867 3868 /* We need to discard the rest of the packet to prevent 3869 * potential boomming attacks from additional bundled chunks. 3870 * This is documented in SCTP Threats ID. 3871 */ 3872 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 3873 } 3874 3875 /* 3876 * Handle SHUTDOWN ACK in COOKIE_ECHOED or COOKIE_WAIT state. 3877 * 3878 * Verification Tag: 8.5.1 E) Rules for packet carrying a SHUTDOWN ACK 3879 * If the receiver is in COOKIE-ECHOED or COOKIE-WAIT state the 3880 * procedures in section 8.4 SHOULD be followed, in other words it 3881 * should be treated as an Out Of The Blue packet. 3882 * [This means that we do NOT check the Verification Tag on these 3883 * chunks. --piggy ] 3884 * 3885 */ 3886 enum sctp_disposition sctp_sf_do_8_5_1_E_sa(struct net *net, 3887 const struct sctp_endpoint *ep, 3888 const struct sctp_association *asoc, 3889 const union sctp_subtype type, 3890 void *arg, 3891 struct sctp_cmd_seq *commands) 3892 { 3893 struct sctp_chunk *chunk = arg; 3894 3895 if (!sctp_vtag_verify(chunk, asoc)) 3896 asoc = NULL; 3897 3898 /* Make sure that the SHUTDOWN_ACK chunk has a valid length. */ 3899 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) 3900 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 3901 commands); 3902 3903 /* Although we do have an association in this case, it corresponds 3904 * to a restarted association. So the packet is treated as an OOTB 3905 * packet and the state function that handles OOTB SHUTDOWN_ACK is 3906 * called with a NULL association. 3907 */ 3908 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES); 3909 3910 return sctp_sf_shut_8_4_5(net, ep, NULL, type, arg, commands); 3911 } 3912 3913 /* ADDIP Section 4.2 Upon reception of an ASCONF Chunk. */ 3914 enum sctp_disposition sctp_sf_do_asconf(struct net *net, 3915 const struct sctp_endpoint *ep, 3916 const struct sctp_association *asoc, 3917 const union sctp_subtype type, 3918 void *arg, 3919 struct sctp_cmd_seq *commands) 3920 { 3921 struct sctp_paramhdr *err_param = NULL; 3922 struct sctp_chunk *asconf_ack = NULL; 3923 struct sctp_chunk *chunk = arg; 3924 struct sctp_addiphdr *hdr; 3925 __u32 serial; 3926 3927 if (!sctp_vtag_verify(chunk, asoc)) { 3928 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG, 3929 SCTP_NULL()); 3930 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 3931 } 3932 3933 /* Make sure that the ASCONF ADDIP chunk has a valid length. */ 3934 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_addip_chunk))) 3935 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 3936 commands); 3937 3938 /* ADD-IP: Section 4.1.1 3939 * This chunk MUST be sent in an authenticated way by using 3940 * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk 3941 * is received unauthenticated it MUST be silently discarded as 3942 * described in [I-D.ietf-tsvwg-sctp-auth]. 3943 */ 3944 if (!asoc->peer.asconf_capable || 3945 (!net->sctp.addip_noauth && !chunk->auth)) 3946 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 3947 3948 hdr = (struct sctp_addiphdr *)chunk->skb->data; 3949 serial = ntohl(hdr->serial); 3950 3951 /* Verify the ASCONF chunk before processing it. */ 3952 if (!sctp_verify_asconf(asoc, chunk, true, &err_param)) 3953 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg, 3954 (void *)err_param, commands); 3955 3956 /* ADDIP 5.2 E1) Compare the value of the serial number to the value 3957 * the endpoint stored in a new association variable 3958 * 'Peer-Serial-Number'. 3959 */ 3960 if (serial == asoc->peer.addip_serial + 1) { 3961 /* If this is the first instance of ASCONF in the packet, 3962 * we can clean our old ASCONF-ACKs. 3963 */ 3964 if (!chunk->has_asconf) 3965 sctp_assoc_clean_asconf_ack_cache(asoc); 3966 3967 /* ADDIP 5.2 E4) When the Sequence Number matches the next one 3968 * expected, process the ASCONF as described below and after 3969 * processing the ASCONF Chunk, append an ASCONF-ACK Chunk to 3970 * the response packet and cache a copy of it (in the event it 3971 * later needs to be retransmitted). 3972 * 3973 * Essentially, do V1-V5. 3974 */ 3975 asconf_ack = sctp_process_asconf((struct sctp_association *) 3976 asoc, chunk); 3977 if (!asconf_ack) 3978 return SCTP_DISPOSITION_NOMEM; 3979 } else if (serial < asoc->peer.addip_serial + 1) { 3980 /* ADDIP 5.2 E2) 3981 * If the value found in the Sequence Number is less than the 3982 * ('Peer- Sequence-Number' + 1), simply skip to the next 3983 * ASCONF, and include in the outbound response packet 3984 * any previously cached ASCONF-ACK response that was 3985 * sent and saved that matches the Sequence Number of the 3986 * ASCONF. Note: It is possible that no cached ASCONF-ACK 3987 * Chunk exists. This will occur when an older ASCONF 3988 * arrives out of order. In such a case, the receiver 3989 * should skip the ASCONF Chunk and not include ASCONF-ACK 3990 * Chunk for that chunk. 3991 */ 3992 asconf_ack = sctp_assoc_lookup_asconf_ack(asoc, hdr->serial); 3993 if (!asconf_ack) 3994 return SCTP_DISPOSITION_DISCARD; 3995 3996 /* Reset the transport so that we select the correct one 3997 * this time around. This is to make sure that we don't 3998 * accidentally use a stale transport that's been removed. 3999 */ 4000 asconf_ack->transport = NULL; 4001 } else { 4002 /* ADDIP 5.2 E5) Otherwise, the ASCONF Chunk is discarded since 4003 * it must be either a stale packet or from an attacker. 4004 */ 4005 return SCTP_DISPOSITION_DISCARD; 4006 } 4007 4008 /* ADDIP 5.2 E6) The destination address of the SCTP packet 4009 * containing the ASCONF-ACK Chunks MUST be the source address of 4010 * the SCTP packet that held the ASCONF Chunks. 4011 * 4012 * To do this properly, we'll set the destination address of the chunk 4013 * and at the transmit time, will try look up the transport to use. 4014 * Since ASCONFs may be bundled, the correct transport may not be 4015 * created until we process the entire packet, thus this workaround. 4016 */ 4017 asconf_ack->dest = chunk->source; 4018 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(asconf_ack)); 4019 if (asoc->new_transport) { 4020 sctp_sf_heartbeat(ep, asoc, type, asoc->new_transport, commands); 4021 ((struct sctp_association *)asoc)->new_transport = NULL; 4022 } 4023 4024 return SCTP_DISPOSITION_CONSUME; 4025 } 4026 4027 static enum sctp_disposition sctp_send_next_asconf( 4028 struct net *net, 4029 const struct sctp_endpoint *ep, 4030 struct sctp_association *asoc, 4031 const union sctp_subtype type, 4032 struct sctp_cmd_seq *commands) 4033 { 4034 struct sctp_chunk *asconf; 4035 struct list_head *entry; 4036 4037 if (list_empty(&asoc->addip_chunk_list)) 4038 return SCTP_DISPOSITION_CONSUME; 4039 4040 entry = asoc->addip_chunk_list.next; 4041 asconf = list_entry(entry, struct sctp_chunk, list); 4042 4043 list_del_init(entry); 4044 sctp_chunk_hold(asconf); 4045 asoc->addip_last_asconf = asconf; 4046 4047 return sctp_sf_do_prm_asconf(net, ep, asoc, type, asconf, commands); 4048 } 4049 4050 /* 4051 * ADDIP Section 4.3 General rules for address manipulation 4052 * When building TLV parameters for the ASCONF Chunk that will add or 4053 * delete IP addresses the D0 to D13 rules should be applied: 4054 */ 4055 enum sctp_disposition sctp_sf_do_asconf_ack(struct net *net, 4056 const struct sctp_endpoint *ep, 4057 const struct sctp_association *asoc, 4058 const union sctp_subtype type, 4059 void *arg, 4060 struct sctp_cmd_seq *commands) 4061 { 4062 struct sctp_chunk *last_asconf = asoc->addip_last_asconf; 4063 struct sctp_paramhdr *err_param = NULL; 4064 struct sctp_chunk *asconf_ack = arg; 4065 struct sctp_addiphdr *addip_hdr; 4066 __u32 sent_serial, rcvd_serial; 4067 struct sctp_chunk *abort; 4068 4069 if (!sctp_vtag_verify(asconf_ack, asoc)) { 4070 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG, 4071 SCTP_NULL()); 4072 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 4073 } 4074 4075 /* Make sure that the ADDIP chunk has a valid length. */ 4076 if (!sctp_chunk_length_valid(asconf_ack, 4077 sizeof(struct sctp_addip_chunk))) 4078 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 4079 commands); 4080 4081 /* ADD-IP, Section 4.1.2: 4082 * This chunk MUST be sent in an authenticated way by using 4083 * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk 4084 * is received unauthenticated it MUST be silently discarded as 4085 * described in [I-D.ietf-tsvwg-sctp-auth]. 4086 */ 4087 if (!asoc->peer.asconf_capable || 4088 (!net->sctp.addip_noauth && !asconf_ack->auth)) 4089 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 4090 4091 addip_hdr = (struct sctp_addiphdr *)asconf_ack->skb->data; 4092 rcvd_serial = ntohl(addip_hdr->serial); 4093 4094 /* Verify the ASCONF-ACK chunk before processing it. */ 4095 if (!sctp_verify_asconf(asoc, asconf_ack, false, &err_param)) 4096 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg, 4097 (void *)err_param, commands); 4098 4099 if (last_asconf) { 4100 addip_hdr = last_asconf->subh.addip_hdr; 4101 sent_serial = ntohl(addip_hdr->serial); 4102 } else { 4103 sent_serial = asoc->addip_serial - 1; 4104 } 4105 4106 /* D0) If an endpoint receives an ASCONF-ACK that is greater than or 4107 * equal to the next serial number to be used but no ASCONF chunk is 4108 * outstanding the endpoint MUST ABORT the association. Note that a 4109 * sequence number is greater than if it is no more than 2^^31-1 4110 * larger than the current sequence number (using serial arithmetic). 4111 */ 4112 if (ADDIP_SERIAL_gte(rcvd_serial, sent_serial + 1) && 4113 !(asoc->addip_last_asconf)) { 4114 abort = sctp_make_abort(asoc, asconf_ack, 4115 sizeof(struct sctp_errhdr)); 4116 if (abort) { 4117 sctp_init_cause(abort, SCTP_ERROR_ASCONF_ACK, 0); 4118 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, 4119 SCTP_CHUNK(abort)); 4120 } 4121 /* We are going to ABORT, so we might as well stop 4122 * processing the rest of the chunks in the packet. 4123 */ 4124 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, 4125 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO)); 4126 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL()); 4127 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, 4128 SCTP_ERROR(ECONNABORTED)); 4129 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, 4130 SCTP_PERR(SCTP_ERROR_ASCONF_ACK)); 4131 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS); 4132 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB); 4133 return SCTP_DISPOSITION_ABORT; 4134 } 4135 4136 if ((rcvd_serial == sent_serial) && asoc->addip_last_asconf) { 4137 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, 4138 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO)); 4139 4140 if (!sctp_process_asconf_ack((struct sctp_association *)asoc, 4141 asconf_ack)) 4142 return sctp_send_next_asconf(net, ep, 4143 (struct sctp_association *)asoc, 4144 type, commands); 4145 4146 abort = sctp_make_abort(asoc, asconf_ack, 4147 sizeof(struct sctp_errhdr)); 4148 if (abort) { 4149 sctp_init_cause(abort, SCTP_ERROR_RSRC_LOW, 0); 4150 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, 4151 SCTP_CHUNK(abort)); 4152 } 4153 /* We are going to ABORT, so we might as well stop 4154 * processing the rest of the chunks in the packet. 4155 */ 4156 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL()); 4157 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, 4158 SCTP_ERROR(ECONNABORTED)); 4159 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, 4160 SCTP_PERR(SCTP_ERROR_ASCONF_ACK)); 4161 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS); 4162 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB); 4163 return SCTP_DISPOSITION_ABORT; 4164 } 4165 4166 return SCTP_DISPOSITION_DISCARD; 4167 } 4168 4169 /* RE-CONFIG Section 5.2 Upon reception of an RECONF Chunk. */ 4170 enum sctp_disposition sctp_sf_do_reconf(struct net *net, 4171 const struct sctp_endpoint *ep, 4172 const struct sctp_association *asoc, 4173 const union sctp_subtype type, 4174 void *arg, 4175 struct sctp_cmd_seq *commands) 4176 { 4177 struct sctp_paramhdr *err_param = NULL; 4178 struct sctp_chunk *chunk = arg; 4179 struct sctp_reconf_chunk *hdr; 4180 union sctp_params param; 4181 4182 if (!sctp_vtag_verify(chunk, asoc)) { 4183 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG, 4184 SCTP_NULL()); 4185 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 4186 } 4187 4188 /* Make sure that the RECONF chunk has a valid length. */ 4189 if (!sctp_chunk_length_valid(chunk, sizeof(*hdr))) 4190 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 4191 commands); 4192 4193 if (!sctp_verify_reconf(asoc, chunk, &err_param)) 4194 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg, 4195 (void *)err_param, commands); 4196 4197 hdr = (struct sctp_reconf_chunk *)chunk->chunk_hdr; 4198 sctp_walk_params(param, hdr) { 4199 struct sctp_chunk *reply = NULL; 4200 struct sctp_ulpevent *ev = NULL; 4201 4202 if (param.p->type == SCTP_PARAM_RESET_OUT_REQUEST) 4203 reply = sctp_process_strreset_outreq( 4204 (struct sctp_association *)asoc, param, &ev); 4205 else if (param.p->type == SCTP_PARAM_RESET_IN_REQUEST) 4206 reply = sctp_process_strreset_inreq( 4207 (struct sctp_association *)asoc, param, &ev); 4208 else if (param.p->type == SCTP_PARAM_RESET_TSN_REQUEST) 4209 reply = sctp_process_strreset_tsnreq( 4210 (struct sctp_association *)asoc, param, &ev); 4211 else if (param.p->type == SCTP_PARAM_RESET_ADD_OUT_STREAMS) 4212 reply = sctp_process_strreset_addstrm_out( 4213 (struct sctp_association *)asoc, param, &ev); 4214 else if (param.p->type == SCTP_PARAM_RESET_ADD_IN_STREAMS) 4215 reply = sctp_process_strreset_addstrm_in( 4216 (struct sctp_association *)asoc, param, &ev); 4217 else if (param.p->type == SCTP_PARAM_RESET_RESPONSE) 4218 reply = sctp_process_strreset_resp( 4219 (struct sctp_association *)asoc, param, &ev); 4220 4221 if (ev) 4222 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, 4223 SCTP_ULPEVENT(ev)); 4224 4225 if (reply) 4226 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, 4227 SCTP_CHUNK(reply)); 4228 } 4229 4230 return SCTP_DISPOSITION_CONSUME; 4231 } 4232 4233 /* 4234 * PR-SCTP Section 3.6 Receiver Side Implementation of PR-SCTP 4235 * 4236 * When a FORWARD TSN chunk arrives, the data receiver MUST first update 4237 * its cumulative TSN point to the value carried in the FORWARD TSN 4238 * chunk, and then MUST further advance its cumulative TSN point locally 4239 * if possible. 4240 * After the above processing, the data receiver MUST stop reporting any 4241 * missing TSNs earlier than or equal to the new cumulative TSN point. 4242 * 4243 * Verification Tag: 8.5 Verification Tag [Normal verification] 4244 * 4245 * The return value is the disposition of the chunk. 4246 */ 4247 enum sctp_disposition sctp_sf_eat_fwd_tsn(struct net *net, 4248 const struct sctp_endpoint *ep, 4249 const struct sctp_association *asoc, 4250 const union sctp_subtype type, 4251 void *arg, 4252 struct sctp_cmd_seq *commands) 4253 { 4254 struct sctp_fwdtsn_hdr *fwdtsn_hdr; 4255 struct sctp_chunk *chunk = arg; 4256 __u16 len; 4257 __u32 tsn; 4258 4259 if (!sctp_vtag_verify(chunk, asoc)) { 4260 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG, 4261 SCTP_NULL()); 4262 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 4263 } 4264 4265 if (!asoc->peer.prsctp_capable) 4266 return sctp_sf_unk_chunk(net, ep, asoc, type, arg, commands); 4267 4268 /* Make sure that the FORWARD_TSN chunk has valid length. */ 4269 if (!sctp_chunk_length_valid(chunk, sctp_ftsnchk_len(&asoc->stream))) 4270 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 4271 commands); 4272 4273 fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data; 4274 chunk->subh.fwdtsn_hdr = fwdtsn_hdr; 4275 len = ntohs(chunk->chunk_hdr->length); 4276 len -= sizeof(struct sctp_chunkhdr); 4277 skb_pull(chunk->skb, len); 4278 4279 tsn = ntohl(fwdtsn_hdr->new_cum_tsn); 4280 pr_debug("%s: TSN 0x%x\n", __func__, tsn); 4281 4282 /* The TSN is too high--silently discard the chunk and count on it 4283 * getting retransmitted later. 4284 */ 4285 if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0) 4286 goto discard_noforce; 4287 4288 if (!asoc->stream.si->validate_ftsn(chunk)) 4289 goto discard_noforce; 4290 4291 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn)); 4292 if (len > sctp_ftsnhdr_len(&asoc->stream)) 4293 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN, 4294 SCTP_CHUNK(chunk)); 4295 4296 /* Count this as receiving DATA. */ 4297 if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) { 4298 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART, 4299 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE)); 4300 } 4301 4302 /* FIXME: For now send a SACK, but DATA processing may 4303 * send another. 4304 */ 4305 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_NOFORCE()); 4306 4307 return SCTP_DISPOSITION_CONSUME; 4308 4309 discard_noforce: 4310 return SCTP_DISPOSITION_DISCARD; 4311 } 4312 4313 enum sctp_disposition sctp_sf_eat_fwd_tsn_fast( 4314 struct net *net, 4315 const struct sctp_endpoint *ep, 4316 const struct sctp_association *asoc, 4317 const union sctp_subtype type, 4318 void *arg, 4319 struct sctp_cmd_seq *commands) 4320 { 4321 struct sctp_fwdtsn_hdr *fwdtsn_hdr; 4322 struct sctp_chunk *chunk = arg; 4323 __u16 len; 4324 __u32 tsn; 4325 4326 if (!sctp_vtag_verify(chunk, asoc)) { 4327 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG, 4328 SCTP_NULL()); 4329 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 4330 } 4331 4332 if (!asoc->peer.prsctp_capable) 4333 return sctp_sf_unk_chunk(net, ep, asoc, type, arg, commands); 4334 4335 /* Make sure that the FORWARD_TSN chunk has a valid length. */ 4336 if (!sctp_chunk_length_valid(chunk, sctp_ftsnchk_len(&asoc->stream))) 4337 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 4338 commands); 4339 4340 fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data; 4341 chunk->subh.fwdtsn_hdr = fwdtsn_hdr; 4342 len = ntohs(chunk->chunk_hdr->length); 4343 len -= sizeof(struct sctp_chunkhdr); 4344 skb_pull(chunk->skb, len); 4345 4346 tsn = ntohl(fwdtsn_hdr->new_cum_tsn); 4347 pr_debug("%s: TSN 0x%x\n", __func__, tsn); 4348 4349 /* The TSN is too high--silently discard the chunk and count on it 4350 * getting retransmitted later. 4351 */ 4352 if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0) 4353 goto gen_shutdown; 4354 4355 if (!asoc->stream.si->validate_ftsn(chunk)) 4356 goto gen_shutdown; 4357 4358 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn)); 4359 if (len > sctp_ftsnhdr_len(&asoc->stream)) 4360 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN, 4361 SCTP_CHUNK(chunk)); 4362 4363 /* Go a head and force a SACK, since we are shutting down. */ 4364 gen_shutdown: 4365 /* Implementor's Guide. 4366 * 4367 * While in SHUTDOWN-SENT state, the SHUTDOWN sender MUST immediately 4368 * respond to each received packet containing one or more DATA chunk(s) 4369 * with a SACK, a SHUTDOWN chunk, and restart the T2-shutdown timer 4370 */ 4371 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SHUTDOWN, SCTP_NULL()); 4372 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE()); 4373 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART, 4374 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN)); 4375 4376 return SCTP_DISPOSITION_CONSUME; 4377 } 4378 4379 /* 4380 * SCTP-AUTH Section 6.3 Receiving authenticated chunks 4381 * 4382 * The receiver MUST use the HMAC algorithm indicated in the HMAC 4383 * Identifier field. If this algorithm was not specified by the 4384 * receiver in the HMAC-ALGO parameter in the INIT or INIT-ACK chunk 4385 * during association setup, the AUTH chunk and all chunks after it MUST 4386 * be discarded and an ERROR chunk SHOULD be sent with the error cause 4387 * defined in Section 4.1. 4388 * 4389 * If an endpoint with no shared key receives a Shared Key Identifier 4390 * other than 0, it MUST silently discard all authenticated chunks. If 4391 * the endpoint has at least one endpoint pair shared key for the peer, 4392 * it MUST use the key specified by the Shared Key Identifier if a 4393 * key has been configured for that Shared Key Identifier. If no 4394 * endpoint pair shared key has been configured for that Shared Key 4395 * Identifier, all authenticated chunks MUST be silently discarded. 4396 * 4397 * Verification Tag: 8.5 Verification Tag [Normal verification] 4398 * 4399 * The return value is the disposition of the chunk. 4400 */ 4401 static enum sctp_ierror sctp_sf_authenticate( 4402 const struct sctp_association *asoc, 4403 struct sctp_chunk *chunk) 4404 { 4405 struct sctp_shared_key *sh_key = NULL; 4406 struct sctp_authhdr *auth_hdr; 4407 __u8 *save_digest, *digest; 4408 const struct sctp_hmac *hmac; 4409 unsigned int sig_len; 4410 __u16 key_id; 4411 4412 /* Pull in the auth header, so we can do some more verification */ 4413 auth_hdr = (struct sctp_authhdr *)chunk->skb->data; 4414 chunk->subh.auth_hdr = auth_hdr; 4415 skb_pull(chunk->skb, sizeof(*auth_hdr)); 4416 4417 /* Make sure that we support the HMAC algorithm from the auth 4418 * chunk. 4419 */ 4420 if (!sctp_auth_asoc_verify_hmac_id(asoc, auth_hdr->hmac_id)) 4421 return SCTP_IERROR_AUTH_BAD_HMAC; 4422 4423 /* Make sure that the provided shared key identifier has been 4424 * configured 4425 */ 4426 key_id = ntohs(auth_hdr->shkey_id); 4427 if (key_id != asoc->active_key_id) { 4428 sh_key = sctp_auth_get_shkey(asoc, key_id); 4429 if (!sh_key) 4430 return SCTP_IERROR_AUTH_BAD_KEYID; 4431 } 4432 4433 /* Make sure that the length of the signature matches what 4434 * we expect. 4435 */ 4436 sig_len = ntohs(chunk->chunk_hdr->length) - 4437 sizeof(struct sctp_auth_chunk); 4438 hmac = sctp_auth_get_hmac(ntohs(auth_hdr->hmac_id)); 4439 if (sig_len != hmac->hmac_len) 4440 return SCTP_IERROR_PROTO_VIOLATION; 4441 4442 /* Now that we've done validation checks, we can compute and 4443 * verify the hmac. The steps involved are: 4444 * 1. Save the digest from the chunk. 4445 * 2. Zero out the digest in the chunk. 4446 * 3. Compute the new digest 4447 * 4. Compare saved and new digests. 4448 */ 4449 digest = (u8 *)(auth_hdr + 1); 4450 skb_pull(chunk->skb, sig_len); 4451 4452 save_digest = kmemdup(digest, sig_len, GFP_ATOMIC); 4453 if (!save_digest) 4454 goto nomem; 4455 4456 memset(digest, 0, sig_len); 4457 4458 if (sctp_auth_calculate_hmac(asoc, chunk->skb, 4459 (struct sctp_auth_chunk *)chunk->chunk_hdr, 4460 sh_key, GFP_ATOMIC)) { 4461 kfree(save_digest); 4462 return SCTP_IERROR_NOMEM; 4463 } 4464 4465 /* Discard the packet if the digests do not match */ 4466 if (crypto_memneq(save_digest, digest, sig_len)) { 4467 kfree(save_digest); 4468 return SCTP_IERROR_BAD_SIG; 4469 } 4470 4471 kfree(save_digest); 4472 chunk->auth = 1; 4473 4474 return SCTP_IERROR_NO_ERROR; 4475 nomem: 4476 return SCTP_IERROR_NOMEM; 4477 } 4478 4479 enum sctp_disposition sctp_sf_eat_auth(struct net *net, 4480 const struct sctp_endpoint *ep, 4481 const struct sctp_association *asoc, 4482 const union sctp_subtype type, 4483 void *arg, struct sctp_cmd_seq *commands) 4484 { 4485 struct sctp_chunk *chunk = arg; 4486 struct sctp_authhdr *auth_hdr; 4487 struct sctp_chunk *err_chunk; 4488 enum sctp_ierror error; 4489 4490 /* Make sure that the peer has AUTH capable */ 4491 if (!asoc->peer.auth_capable) 4492 return sctp_sf_unk_chunk(net, ep, asoc, type, arg, commands); 4493 4494 if (!sctp_vtag_verify(chunk, asoc)) { 4495 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG, 4496 SCTP_NULL()); 4497 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 4498 } 4499 4500 /* Make sure that the AUTH chunk has valid length. */ 4501 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_auth_chunk))) 4502 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 4503 commands); 4504 4505 auth_hdr = (struct sctp_authhdr *)chunk->skb->data; 4506 error = sctp_sf_authenticate(asoc, chunk); 4507 switch (error) { 4508 case SCTP_IERROR_AUTH_BAD_HMAC: 4509 /* Generate the ERROR chunk and discard the rest 4510 * of the packet 4511 */ 4512 err_chunk = sctp_make_op_error(asoc, chunk, 4513 SCTP_ERROR_UNSUP_HMAC, 4514 &auth_hdr->hmac_id, 4515 sizeof(__u16), 0); 4516 if (err_chunk) { 4517 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, 4518 SCTP_CHUNK(err_chunk)); 4519 } 4520 fallthrough; 4521 case SCTP_IERROR_AUTH_BAD_KEYID: 4522 case SCTP_IERROR_BAD_SIG: 4523 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 4524 4525 case SCTP_IERROR_PROTO_VIOLATION: 4526 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 4527 commands); 4528 4529 case SCTP_IERROR_NOMEM: 4530 return SCTP_DISPOSITION_NOMEM; 4531 4532 default: /* Prevent gcc warnings */ 4533 break; 4534 } 4535 4536 if (asoc->active_key_id != ntohs(auth_hdr->shkey_id)) { 4537 struct sctp_ulpevent *ev; 4538 4539 ev = sctp_ulpevent_make_authkey(asoc, ntohs(auth_hdr->shkey_id), 4540 SCTP_AUTH_NEW_KEY, GFP_ATOMIC); 4541 4542 if (!ev) 4543 return SCTP_DISPOSITION_NOMEM; 4544 4545 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, 4546 SCTP_ULPEVENT(ev)); 4547 } 4548 4549 return SCTP_DISPOSITION_CONSUME; 4550 } 4551 4552 /* 4553 * Process an unknown chunk. 4554 * 4555 * Section: 3.2. Also, 2.1 in the implementor's guide. 4556 * 4557 * Chunk Types are encoded such that the highest-order two bits specify 4558 * the action that must be taken if the processing endpoint does not 4559 * recognize the Chunk Type. 4560 * 4561 * 00 - Stop processing this SCTP packet and discard it, do not process 4562 * any further chunks within it. 4563 * 4564 * 01 - Stop processing this SCTP packet and discard it, do not process 4565 * any further chunks within it, and report the unrecognized 4566 * chunk in an 'Unrecognized Chunk Type'. 4567 * 4568 * 10 - Skip this chunk and continue processing. 4569 * 4570 * 11 - Skip this chunk and continue processing, but report in an ERROR 4571 * Chunk using the 'Unrecognized Chunk Type' cause of error. 4572 * 4573 * The return value is the disposition of the chunk. 4574 */ 4575 enum sctp_disposition sctp_sf_unk_chunk(struct net *net, 4576 const struct sctp_endpoint *ep, 4577 const struct sctp_association *asoc, 4578 const union sctp_subtype type, 4579 void *arg, 4580 struct sctp_cmd_seq *commands) 4581 { 4582 struct sctp_chunk *unk_chunk = arg; 4583 struct sctp_chunk *err_chunk; 4584 struct sctp_chunkhdr *hdr; 4585 4586 pr_debug("%s: processing unknown chunk id:%d\n", __func__, type.chunk); 4587 4588 if (!sctp_vtag_verify(unk_chunk, asoc)) 4589 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 4590 4591 /* Make sure that the chunk has a valid length. 4592 * Since we don't know the chunk type, we use a general 4593 * chunkhdr structure to make a comparison. 4594 */ 4595 if (!sctp_chunk_length_valid(unk_chunk, sizeof(*hdr))) 4596 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 4597 commands); 4598 4599 switch (type.chunk & SCTP_CID_ACTION_MASK) { 4600 case SCTP_CID_ACTION_DISCARD: 4601 /* Discard the packet. */ 4602 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 4603 case SCTP_CID_ACTION_DISCARD_ERR: 4604 /* Generate an ERROR chunk as response. */ 4605 hdr = unk_chunk->chunk_hdr; 4606 err_chunk = sctp_make_op_error(asoc, unk_chunk, 4607 SCTP_ERROR_UNKNOWN_CHUNK, hdr, 4608 SCTP_PAD4(ntohs(hdr->length)), 4609 0); 4610 if (err_chunk) { 4611 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, 4612 SCTP_CHUNK(err_chunk)); 4613 } 4614 4615 /* Discard the packet. */ 4616 sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 4617 return SCTP_DISPOSITION_CONSUME; 4618 case SCTP_CID_ACTION_SKIP: 4619 /* Skip the chunk. */ 4620 return SCTP_DISPOSITION_DISCARD; 4621 case SCTP_CID_ACTION_SKIP_ERR: 4622 /* Generate an ERROR chunk as response. */ 4623 hdr = unk_chunk->chunk_hdr; 4624 err_chunk = sctp_make_op_error(asoc, unk_chunk, 4625 SCTP_ERROR_UNKNOWN_CHUNK, hdr, 4626 SCTP_PAD4(ntohs(hdr->length)), 4627 0); 4628 if (err_chunk) { 4629 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, 4630 SCTP_CHUNK(err_chunk)); 4631 } 4632 /* Skip the chunk. */ 4633 return SCTP_DISPOSITION_CONSUME; 4634 default: 4635 break; 4636 } 4637 4638 return SCTP_DISPOSITION_DISCARD; 4639 } 4640 4641 /* 4642 * Discard the chunk. 4643 * 4644 * Section: 0.2, 5.2.3, 5.2.5, 5.2.6, 6.0, 8.4.6, 8.5.1c, 9.2 4645 * [Too numerous to mention...] 4646 * Verification Tag: No verification needed. 4647 * Inputs 4648 * (endpoint, asoc, chunk) 4649 * 4650 * Outputs 4651 * (asoc, reply_msg, msg_up, timers, counters) 4652 * 4653 * The return value is the disposition of the chunk. 4654 */ 4655 enum sctp_disposition sctp_sf_discard_chunk(struct net *net, 4656 const struct sctp_endpoint *ep, 4657 const struct sctp_association *asoc, 4658 const union sctp_subtype type, 4659 void *arg, 4660 struct sctp_cmd_seq *commands) 4661 { 4662 struct sctp_chunk *chunk = arg; 4663 4664 if (asoc && !sctp_vtag_verify(chunk, asoc)) 4665 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 4666 4667 /* Make sure that the chunk has a valid length. 4668 * Since we don't know the chunk type, we use a general 4669 * chunkhdr structure to make a comparison. 4670 */ 4671 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) 4672 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 4673 commands); 4674 4675 pr_debug("%s: chunk:%d is discarded\n", __func__, type.chunk); 4676 4677 return SCTP_DISPOSITION_DISCARD; 4678 } 4679 4680 /* 4681 * Discard the whole packet. 4682 * 4683 * Section: 8.4 2) 4684 * 4685 * 2) If the OOTB packet contains an ABORT chunk, the receiver MUST 4686 * silently discard the OOTB packet and take no further action. 4687 * 4688 * Verification Tag: No verification necessary 4689 * 4690 * Inputs 4691 * (endpoint, asoc, chunk) 4692 * 4693 * Outputs 4694 * (asoc, reply_msg, msg_up, timers, counters) 4695 * 4696 * The return value is the disposition of the chunk. 4697 */ 4698 enum sctp_disposition sctp_sf_pdiscard(struct net *net, 4699 const struct sctp_endpoint *ep, 4700 const struct sctp_association *asoc, 4701 const union sctp_subtype type, 4702 void *arg, struct sctp_cmd_seq *commands) 4703 { 4704 SCTP_INC_STATS(net, SCTP_MIB_IN_PKT_DISCARDS); 4705 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL()); 4706 4707 return SCTP_DISPOSITION_CONSUME; 4708 } 4709 4710 4711 /* 4712 * The other end is violating protocol. 4713 * 4714 * Section: Not specified 4715 * Verification Tag: Not specified 4716 * Inputs 4717 * (endpoint, asoc, chunk) 4718 * 4719 * Outputs 4720 * (asoc, reply_msg, msg_up, timers, counters) 4721 * 4722 * We simply tag the chunk as a violation. The state machine will log 4723 * the violation and continue. 4724 */ 4725 enum sctp_disposition sctp_sf_violation(struct net *net, 4726 const struct sctp_endpoint *ep, 4727 const struct sctp_association *asoc, 4728 const union sctp_subtype type, 4729 void *arg, 4730 struct sctp_cmd_seq *commands) 4731 { 4732 struct sctp_chunk *chunk = arg; 4733 4734 if (!sctp_vtag_verify(chunk, asoc)) 4735 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 4736 4737 /* Make sure that the chunk has a valid length. */ 4738 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) 4739 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 4740 commands); 4741 4742 return SCTP_DISPOSITION_VIOLATION; 4743 } 4744 4745 /* 4746 * Common function to handle a protocol violation. 4747 */ 4748 static enum sctp_disposition sctp_sf_abort_violation( 4749 struct net *net, 4750 const struct sctp_endpoint *ep, 4751 const struct sctp_association *asoc, 4752 void *arg, 4753 struct sctp_cmd_seq *commands, 4754 const __u8 *payload, 4755 const size_t paylen) 4756 { 4757 struct sctp_packet *packet = NULL; 4758 struct sctp_chunk *chunk = arg; 4759 struct sctp_chunk *abort = NULL; 4760 4761 /* SCTP-AUTH, Section 6.3: 4762 * It should be noted that if the receiver wants to tear 4763 * down an association in an authenticated way only, the 4764 * handling of malformed packets should not result in 4765 * tearing down the association. 4766 * 4767 * This means that if we only want to abort associations 4768 * in an authenticated way (i.e AUTH+ABORT), then we 4769 * can't destroy this association just because the packet 4770 * was malformed. 4771 */ 4772 if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc)) 4773 goto discard; 4774 4775 /* Make the abort chunk. */ 4776 abort = sctp_make_abort_violation(asoc, chunk, payload, paylen); 4777 if (!abort) 4778 goto nomem; 4779 4780 if (asoc) { 4781 /* Treat INIT-ACK as a special case during COOKIE-WAIT. */ 4782 if (chunk->chunk_hdr->type == SCTP_CID_INIT_ACK && 4783 !asoc->peer.i.init_tag) { 4784 struct sctp_initack_chunk *initack; 4785 4786 initack = (struct sctp_initack_chunk *)chunk->chunk_hdr; 4787 if (!sctp_chunk_length_valid(chunk, sizeof(*initack))) 4788 abort->chunk_hdr->flags |= SCTP_CHUNK_FLAG_T; 4789 else { 4790 unsigned int inittag; 4791 4792 inittag = ntohl(initack->init_hdr.init_tag); 4793 sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_INITTAG, 4794 SCTP_U32(inittag)); 4795 } 4796 } 4797 4798 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort)); 4799 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS); 4800 4801 if (asoc->state <= SCTP_STATE_COOKIE_ECHOED) { 4802 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, 4803 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT)); 4804 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, 4805 SCTP_ERROR(ECONNREFUSED)); 4806 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED, 4807 SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION)); 4808 } else { 4809 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, 4810 SCTP_ERROR(ECONNABORTED)); 4811 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, 4812 SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION)); 4813 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB); 4814 } 4815 } else { 4816 packet = sctp_ootb_pkt_new(net, asoc, chunk); 4817 4818 if (!packet) 4819 goto nomem_pkt; 4820 4821 if (sctp_test_T_bit(abort)) 4822 packet->vtag = ntohl(chunk->sctp_hdr->vtag); 4823 4824 abort->skb->sk = ep->base.sk; 4825 4826 sctp_packet_append_chunk(packet, abort); 4827 4828 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT, 4829 SCTP_PACKET(packet)); 4830 4831 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS); 4832 } 4833 4834 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS); 4835 4836 discard: 4837 sctp_sf_pdiscard(net, ep, asoc, SCTP_ST_CHUNK(0), arg, commands); 4838 return SCTP_DISPOSITION_ABORT; 4839 4840 nomem_pkt: 4841 sctp_chunk_free(abort); 4842 nomem: 4843 return SCTP_DISPOSITION_NOMEM; 4844 } 4845 4846 /* 4847 * Handle a protocol violation when the chunk length is invalid. 4848 * "Invalid" length is identified as smaller than the minimal length a 4849 * given chunk can be. For example, a SACK chunk has invalid length 4850 * if its length is set to be smaller than the size of struct sctp_sack_chunk. 4851 * 4852 * We inform the other end by sending an ABORT with a Protocol Violation 4853 * error code. 4854 * 4855 * Section: Not specified 4856 * Verification Tag: Nothing to do 4857 * Inputs 4858 * (endpoint, asoc, chunk) 4859 * 4860 * Outputs 4861 * (reply_msg, msg_up, counters) 4862 * 4863 * Generate an ABORT chunk and terminate the association. 4864 */ 4865 static enum sctp_disposition sctp_sf_violation_chunklen( 4866 struct net *net, 4867 const struct sctp_endpoint *ep, 4868 const struct sctp_association *asoc, 4869 const union sctp_subtype type, 4870 void *arg, 4871 struct sctp_cmd_seq *commands) 4872 { 4873 static const char err_str[] = "The following chunk had invalid length:"; 4874 4875 return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str, 4876 sizeof(err_str)); 4877 } 4878 4879 /* 4880 * Handle a protocol violation when the parameter length is invalid. 4881 * If the length is smaller than the minimum length of a given parameter, 4882 * or accumulated length in multi parameters exceeds the end of the chunk, 4883 * the length is considered as invalid. 4884 */ 4885 static enum sctp_disposition sctp_sf_violation_paramlen( 4886 struct net *net, 4887 const struct sctp_endpoint *ep, 4888 const struct sctp_association *asoc, 4889 const union sctp_subtype type, 4890 void *arg, void *ext, 4891 struct sctp_cmd_seq *commands) 4892 { 4893 struct sctp_paramhdr *param = ext; 4894 struct sctp_chunk *abort = NULL; 4895 struct sctp_chunk *chunk = arg; 4896 4897 if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc)) 4898 goto discard; 4899 4900 /* Make the abort chunk. */ 4901 abort = sctp_make_violation_paramlen(asoc, chunk, param); 4902 if (!abort) 4903 goto nomem; 4904 4905 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort)); 4906 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS); 4907 4908 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, 4909 SCTP_ERROR(ECONNABORTED)); 4910 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, 4911 SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION)); 4912 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB); 4913 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS); 4914 4915 discard: 4916 sctp_sf_pdiscard(net, ep, asoc, SCTP_ST_CHUNK(0), arg, commands); 4917 return SCTP_DISPOSITION_ABORT; 4918 nomem: 4919 return SCTP_DISPOSITION_NOMEM; 4920 } 4921 4922 /* Handle a protocol violation when the peer trying to advance the 4923 * cumulative tsn ack to a point beyond the max tsn currently sent. 4924 * 4925 * We inform the other end by sending an ABORT with a Protocol Violation 4926 * error code. 4927 */ 4928 static enum sctp_disposition sctp_sf_violation_ctsn( 4929 struct net *net, 4930 const struct sctp_endpoint *ep, 4931 const struct sctp_association *asoc, 4932 const union sctp_subtype type, 4933 void *arg, 4934 struct sctp_cmd_seq *commands) 4935 { 4936 static const char err_str[] = "The cumulative tsn ack beyond the max tsn currently sent:"; 4937 4938 return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str, 4939 sizeof(err_str)); 4940 } 4941 4942 /* Handle protocol violation of an invalid chunk bundling. For example, 4943 * when we have an association and we receive bundled INIT-ACK, or 4944 * SHUTDOWN-COMPLETE, our peer is clearly violating the "MUST NOT bundle" 4945 * statement from the specs. Additionally, there might be an attacker 4946 * on the path and we may not want to continue this communication. 4947 */ 4948 static enum sctp_disposition sctp_sf_violation_chunk( 4949 struct net *net, 4950 const struct sctp_endpoint *ep, 4951 const struct sctp_association *asoc, 4952 const union sctp_subtype type, 4953 void *arg, 4954 struct sctp_cmd_seq *commands) 4955 { 4956 static const char err_str[] = "The following chunk violates protocol:"; 4957 4958 return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str, 4959 sizeof(err_str)); 4960 } 4961 /*************************************************************************** 4962 * These are the state functions for handling primitive (Section 10) events. 4963 ***************************************************************************/ 4964 /* 4965 * sctp_sf_do_prm_asoc 4966 * 4967 * Section: 10.1 ULP-to-SCTP 4968 * B) Associate 4969 * 4970 * Format: ASSOCIATE(local SCTP instance name, destination transport addr, 4971 * outbound stream count) 4972 * -> association id [,destination transport addr list] [,outbound stream 4973 * count] 4974 * 4975 * This primitive allows the upper layer to initiate an association to a 4976 * specific peer endpoint. 4977 * 4978 * The peer endpoint shall be specified by one of the transport addresses 4979 * which defines the endpoint (see Section 1.4). If the local SCTP 4980 * instance has not been initialized, the ASSOCIATE is considered an 4981 * error. 4982 * [This is not relevant for the kernel implementation since we do all 4983 * initialization at boot time. It we hadn't initialized we wouldn't 4984 * get anywhere near this code.] 4985 * 4986 * An association id, which is a local handle to the SCTP association, 4987 * will be returned on successful establishment of the association. If 4988 * SCTP is not able to open an SCTP association with the peer endpoint, 4989 * an error is returned. 4990 * [In the kernel implementation, the struct sctp_association needs to 4991 * be created BEFORE causing this primitive to run.] 4992 * 4993 * Other association parameters may be returned, including the 4994 * complete destination transport addresses of the peer as well as the 4995 * outbound stream count of the local endpoint. One of the transport 4996 * address from the returned destination addresses will be selected by 4997 * the local endpoint as default primary path for sending SCTP packets 4998 * to this peer. The returned "destination transport addr list" can 4999 * be used by the ULP to change the default primary path or to force 5000 * sending a packet to a specific transport address. [All of this 5001 * stuff happens when the INIT ACK arrives. This is a NON-BLOCKING 5002 * function.] 5003 * 5004 * Mandatory attributes: 5005 * 5006 * o local SCTP instance name - obtained from the INITIALIZE operation. 5007 * [This is the argument asoc.] 5008 * o destination transport addr - specified as one of the transport 5009 * addresses of the peer endpoint with which the association is to be 5010 * established. 5011 * [This is asoc->peer.active_path.] 5012 * o outbound stream count - the number of outbound streams the ULP 5013 * would like to open towards this peer endpoint. 5014 * [BUG: This is not currently implemented.] 5015 * Optional attributes: 5016 * 5017 * None. 5018 * 5019 * The return value is a disposition. 5020 */ 5021 enum sctp_disposition sctp_sf_do_prm_asoc(struct net *net, 5022 const struct sctp_endpoint *ep, 5023 const struct sctp_association *asoc, 5024 const union sctp_subtype type, 5025 void *arg, 5026 struct sctp_cmd_seq *commands) 5027 { 5028 struct sctp_association *my_asoc; 5029 struct sctp_chunk *repl; 5030 5031 /* The comment below says that we enter COOKIE-WAIT AFTER 5032 * sending the INIT, but that doesn't actually work in our 5033 * implementation... 5034 */ 5035 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE, 5036 SCTP_STATE(SCTP_STATE_COOKIE_WAIT)); 5037 5038 /* RFC 2960 5.1 Normal Establishment of an Association 5039 * 5040 * A) "A" first sends an INIT chunk to "Z". In the INIT, "A" 5041 * must provide its Verification Tag (Tag_A) in the Initiate 5042 * Tag field. Tag_A SHOULD be a random number in the range of 5043 * 1 to 4294967295 (see 5.3.1 for Tag value selection). ... 5044 */ 5045 5046 repl = sctp_make_init(asoc, &asoc->base.bind_addr, GFP_ATOMIC, 0); 5047 if (!repl) 5048 goto nomem; 5049 5050 /* Choose transport for INIT. */ 5051 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT, 5052 SCTP_CHUNK(repl)); 5053 5054 /* Cast away the const modifier, as we want to just 5055 * rerun it through as a sideffect. 5056 */ 5057 my_asoc = (struct sctp_association *)asoc; 5058 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(my_asoc)); 5059 5060 /* After sending the INIT, "A" starts the T1-init timer and 5061 * enters the COOKIE-WAIT state. 5062 */ 5063 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START, 5064 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT)); 5065 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl)); 5066 return SCTP_DISPOSITION_CONSUME; 5067 5068 nomem: 5069 return SCTP_DISPOSITION_NOMEM; 5070 } 5071 5072 /* 5073 * Process the SEND primitive. 5074 * 5075 * Section: 10.1 ULP-to-SCTP 5076 * E) Send 5077 * 5078 * Format: SEND(association id, buffer address, byte count [,context] 5079 * [,stream id] [,life time] [,destination transport address] 5080 * [,unorder flag] [,no-bundle flag] [,payload protocol-id] ) 5081 * -> result 5082 * 5083 * This is the main method to send user data via SCTP. 5084 * 5085 * Mandatory attributes: 5086 * 5087 * o association id - local handle to the SCTP association 5088 * 5089 * o buffer address - the location where the user message to be 5090 * transmitted is stored; 5091 * 5092 * o byte count - The size of the user data in number of bytes; 5093 * 5094 * Optional attributes: 5095 * 5096 * o context - an optional 32 bit integer that will be carried in the 5097 * sending failure notification to the ULP if the transportation of 5098 * this User Message fails. 5099 * 5100 * o stream id - to indicate which stream to send the data on. If not 5101 * specified, stream 0 will be used. 5102 * 5103 * o life time - specifies the life time of the user data. The user data 5104 * will not be sent by SCTP after the life time expires. This 5105 * parameter can be used to avoid efforts to transmit stale 5106 * user messages. SCTP notifies the ULP if the data cannot be 5107 * initiated to transport (i.e. sent to the destination via SCTP's 5108 * send primitive) within the life time variable. However, the 5109 * user data will be transmitted if SCTP has attempted to transmit a 5110 * chunk before the life time expired. 5111 * 5112 * o destination transport address - specified as one of the destination 5113 * transport addresses of the peer endpoint to which this packet 5114 * should be sent. Whenever possible, SCTP should use this destination 5115 * transport address for sending the packets, instead of the current 5116 * primary path. 5117 * 5118 * o unorder flag - this flag, if present, indicates that the user 5119 * would like the data delivered in an unordered fashion to the peer 5120 * (i.e., the U flag is set to 1 on all DATA chunks carrying this 5121 * message). 5122 * 5123 * o no-bundle flag - instructs SCTP not to bundle this user data with 5124 * other outbound DATA chunks. SCTP MAY still bundle even when 5125 * this flag is present, when faced with network congestion. 5126 * 5127 * o payload protocol-id - A 32 bit unsigned integer that is to be 5128 * passed to the peer indicating the type of payload protocol data 5129 * being transmitted. This value is passed as opaque data by SCTP. 5130 * 5131 * The return value is the disposition. 5132 */ 5133 enum sctp_disposition sctp_sf_do_prm_send(struct net *net, 5134 const struct sctp_endpoint *ep, 5135 const struct sctp_association *asoc, 5136 const union sctp_subtype type, 5137 void *arg, 5138 struct sctp_cmd_seq *commands) 5139 { 5140 struct sctp_datamsg *msg = arg; 5141 5142 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_MSG, SCTP_DATAMSG(msg)); 5143 return SCTP_DISPOSITION_CONSUME; 5144 } 5145 5146 /* 5147 * Process the SHUTDOWN primitive. 5148 * 5149 * Section: 10.1: 5150 * C) Shutdown 5151 * 5152 * Format: SHUTDOWN(association id) 5153 * -> result 5154 * 5155 * Gracefully closes an association. Any locally queued user data 5156 * will be delivered to the peer. The association will be terminated only 5157 * after the peer acknowledges all the SCTP packets sent. A success code 5158 * will be returned on successful termination of the association. If 5159 * attempting to terminate the association results in a failure, an error 5160 * code shall be returned. 5161 * 5162 * Mandatory attributes: 5163 * 5164 * o association id - local handle to the SCTP association 5165 * 5166 * Optional attributes: 5167 * 5168 * None. 5169 * 5170 * The return value is the disposition. 5171 */ 5172 enum sctp_disposition sctp_sf_do_9_2_prm_shutdown( 5173 struct net *net, 5174 const struct sctp_endpoint *ep, 5175 const struct sctp_association *asoc, 5176 const union sctp_subtype type, 5177 void *arg, 5178 struct sctp_cmd_seq *commands) 5179 { 5180 enum sctp_disposition disposition; 5181 5182 /* From 9.2 Shutdown of an Association 5183 * Upon receipt of the SHUTDOWN primitive from its upper 5184 * layer, the endpoint enters SHUTDOWN-PENDING state and 5185 * remains there until all outstanding data has been 5186 * acknowledged by its peer. The endpoint accepts no new data 5187 * from its upper layer, but retransmits data to the far end 5188 * if necessary to fill gaps. 5189 */ 5190 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE, 5191 SCTP_STATE(SCTP_STATE_SHUTDOWN_PENDING)); 5192 5193 disposition = SCTP_DISPOSITION_CONSUME; 5194 if (sctp_outq_is_empty(&asoc->outqueue)) { 5195 disposition = sctp_sf_do_9_2_start_shutdown(net, ep, asoc, type, 5196 arg, commands); 5197 } 5198 5199 return disposition; 5200 } 5201 5202 /* 5203 * Process the ABORT primitive. 5204 * 5205 * Section: 10.1: 5206 * C) Abort 5207 * 5208 * Format: Abort(association id [, cause code]) 5209 * -> result 5210 * 5211 * Ungracefully closes an association. Any locally queued user data 5212 * will be discarded and an ABORT chunk is sent to the peer. A success code 5213 * will be returned on successful abortion of the association. If 5214 * attempting to abort the association results in a failure, an error 5215 * code shall be returned. 5216 * 5217 * Mandatory attributes: 5218 * 5219 * o association id - local handle to the SCTP association 5220 * 5221 * Optional attributes: 5222 * 5223 * o cause code - reason of the abort to be passed to the peer 5224 * 5225 * None. 5226 * 5227 * The return value is the disposition. 5228 */ 5229 enum sctp_disposition sctp_sf_do_9_1_prm_abort( 5230 struct net *net, 5231 const struct sctp_endpoint *ep, 5232 const struct sctp_association *asoc, 5233 const union sctp_subtype type, 5234 void *arg, 5235 struct sctp_cmd_seq *commands) 5236 { 5237 /* From 9.1 Abort of an Association 5238 * Upon receipt of the ABORT primitive from its upper 5239 * layer, the endpoint enters CLOSED state and 5240 * discard all outstanding data has been 5241 * acknowledged by its peer. The endpoint accepts no new data 5242 * from its upper layer, but retransmits data to the far end 5243 * if necessary to fill gaps. 5244 */ 5245 struct sctp_chunk *abort = arg; 5246 5247 if (abort) 5248 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort)); 5249 5250 /* Even if we can't send the ABORT due to low memory delete the 5251 * TCB. This is a departure from our typical NOMEM handling. 5252 */ 5253 5254 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, 5255 SCTP_ERROR(ECONNABORTED)); 5256 /* Delete the established association. */ 5257 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, 5258 SCTP_PERR(SCTP_ERROR_USER_ABORT)); 5259 5260 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS); 5261 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB); 5262 5263 return SCTP_DISPOSITION_ABORT; 5264 } 5265 5266 /* We tried an illegal operation on an association which is closed. */ 5267 enum sctp_disposition sctp_sf_error_closed(struct net *net, 5268 const struct sctp_endpoint *ep, 5269 const struct sctp_association *asoc, 5270 const union sctp_subtype type, 5271 void *arg, 5272 struct sctp_cmd_seq *commands) 5273 { 5274 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_ERROR, SCTP_ERROR(-EINVAL)); 5275 return SCTP_DISPOSITION_CONSUME; 5276 } 5277 5278 /* We tried an illegal operation on an association which is shutting 5279 * down. 5280 */ 5281 enum sctp_disposition sctp_sf_error_shutdown( 5282 struct net *net, 5283 const struct sctp_endpoint *ep, 5284 const struct sctp_association *asoc, 5285 const union sctp_subtype type, 5286 void *arg, 5287 struct sctp_cmd_seq *commands) 5288 { 5289 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_ERROR, 5290 SCTP_ERROR(-ESHUTDOWN)); 5291 return SCTP_DISPOSITION_CONSUME; 5292 } 5293 5294 /* 5295 * sctp_cookie_wait_prm_shutdown 5296 * 5297 * Section: 4 Note: 2 5298 * Verification Tag: 5299 * Inputs 5300 * (endpoint, asoc) 5301 * 5302 * The RFC does not explicitly address this issue, but is the route through the 5303 * state table when someone issues a shutdown while in COOKIE_WAIT state. 5304 * 5305 * Outputs 5306 * (timers) 5307 */ 5308 enum sctp_disposition sctp_sf_cookie_wait_prm_shutdown( 5309 struct net *net, 5310 const struct sctp_endpoint *ep, 5311 const struct sctp_association *asoc, 5312 const union sctp_subtype type, 5313 void *arg, 5314 struct sctp_cmd_seq *commands) 5315 { 5316 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, 5317 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT)); 5318 5319 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE, 5320 SCTP_STATE(SCTP_STATE_CLOSED)); 5321 5322 SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS); 5323 5324 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL()); 5325 5326 return SCTP_DISPOSITION_DELETE_TCB; 5327 } 5328 5329 /* 5330 * sctp_cookie_echoed_prm_shutdown 5331 * 5332 * Section: 4 Note: 2 5333 * Verification Tag: 5334 * Inputs 5335 * (endpoint, asoc) 5336 * 5337 * The RFC does not explicitly address this issue, but is the route through the 5338 * state table when someone issues a shutdown while in COOKIE_ECHOED state. 5339 * 5340 * Outputs 5341 * (timers) 5342 */ 5343 enum sctp_disposition sctp_sf_cookie_echoed_prm_shutdown( 5344 struct net *net, 5345 const struct sctp_endpoint *ep, 5346 const struct sctp_association *asoc, 5347 const union sctp_subtype type, 5348 void *arg, 5349 struct sctp_cmd_seq *commands) 5350 { 5351 /* There is a single T1 timer, so we should be able to use 5352 * common function with the COOKIE-WAIT state. 5353 */ 5354 return sctp_sf_cookie_wait_prm_shutdown(net, ep, asoc, type, arg, commands); 5355 } 5356 5357 /* 5358 * sctp_sf_cookie_wait_prm_abort 5359 * 5360 * Section: 4 Note: 2 5361 * Verification Tag: 5362 * Inputs 5363 * (endpoint, asoc) 5364 * 5365 * The RFC does not explicitly address this issue, but is the route through the 5366 * state table when someone issues an abort while in COOKIE_WAIT state. 5367 * 5368 * Outputs 5369 * (timers) 5370 */ 5371 enum sctp_disposition sctp_sf_cookie_wait_prm_abort( 5372 struct net *net, 5373 const struct sctp_endpoint *ep, 5374 const struct sctp_association *asoc, 5375 const union sctp_subtype type, 5376 void *arg, 5377 struct sctp_cmd_seq *commands) 5378 { 5379 struct sctp_chunk *abort = arg; 5380 5381 /* Stop T1-init timer */ 5382 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, 5383 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT)); 5384 5385 if (abort) 5386 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort)); 5387 5388 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE, 5389 SCTP_STATE(SCTP_STATE_CLOSED)); 5390 5391 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS); 5392 5393 /* Even if we can't send the ABORT due to low memory delete the 5394 * TCB. This is a departure from our typical NOMEM handling. 5395 */ 5396 5397 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, 5398 SCTP_ERROR(ECONNREFUSED)); 5399 /* Delete the established association. */ 5400 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED, 5401 SCTP_PERR(SCTP_ERROR_USER_ABORT)); 5402 5403 return SCTP_DISPOSITION_ABORT; 5404 } 5405 5406 /* 5407 * sctp_sf_cookie_echoed_prm_abort 5408 * 5409 * Section: 4 Note: 3 5410 * Verification Tag: 5411 * Inputs 5412 * (endpoint, asoc) 5413 * 5414 * The RFC does not explcitly address this issue, but is the route through the 5415 * state table when someone issues an abort while in COOKIE_ECHOED state. 5416 * 5417 * Outputs 5418 * (timers) 5419 */ 5420 enum sctp_disposition sctp_sf_cookie_echoed_prm_abort( 5421 struct net *net, 5422 const struct sctp_endpoint *ep, 5423 const struct sctp_association *asoc, 5424 const union sctp_subtype type, 5425 void *arg, 5426 struct sctp_cmd_seq *commands) 5427 { 5428 /* There is a single T1 timer, so we should be able to use 5429 * common function with the COOKIE-WAIT state. 5430 */ 5431 return sctp_sf_cookie_wait_prm_abort(net, ep, asoc, type, arg, commands); 5432 } 5433 5434 /* 5435 * sctp_sf_shutdown_pending_prm_abort 5436 * 5437 * Inputs 5438 * (endpoint, asoc) 5439 * 5440 * The RFC does not explicitly address this issue, but is the route through the 5441 * state table when someone issues an abort while in SHUTDOWN-PENDING state. 5442 * 5443 * Outputs 5444 * (timers) 5445 */ 5446 enum sctp_disposition sctp_sf_shutdown_pending_prm_abort( 5447 struct net *net, 5448 const struct sctp_endpoint *ep, 5449 const struct sctp_association *asoc, 5450 const union sctp_subtype type, 5451 void *arg, 5452 struct sctp_cmd_seq *commands) 5453 { 5454 /* Stop the T5-shutdown guard timer. */ 5455 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, 5456 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD)); 5457 5458 return sctp_sf_do_9_1_prm_abort(net, ep, asoc, type, arg, commands); 5459 } 5460 5461 /* 5462 * sctp_sf_shutdown_sent_prm_abort 5463 * 5464 * Inputs 5465 * (endpoint, asoc) 5466 * 5467 * The RFC does not explicitly address this issue, but is the route through the 5468 * state table when someone issues an abort while in SHUTDOWN-SENT state. 5469 * 5470 * Outputs 5471 * (timers) 5472 */ 5473 enum sctp_disposition sctp_sf_shutdown_sent_prm_abort( 5474 struct net *net, 5475 const struct sctp_endpoint *ep, 5476 const struct sctp_association *asoc, 5477 const union sctp_subtype type, 5478 void *arg, 5479 struct sctp_cmd_seq *commands) 5480 { 5481 /* Stop the T2-shutdown timer. */ 5482 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, 5483 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN)); 5484 5485 /* Stop the T5-shutdown guard timer. */ 5486 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, 5487 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD)); 5488 5489 return sctp_sf_do_9_1_prm_abort(net, ep, asoc, type, arg, commands); 5490 } 5491 5492 /* 5493 * sctp_sf_cookie_echoed_prm_abort 5494 * 5495 * Inputs 5496 * (endpoint, asoc) 5497 * 5498 * The RFC does not explcitly address this issue, but is the route through the 5499 * state table when someone issues an abort while in COOKIE_ECHOED state. 5500 * 5501 * Outputs 5502 * (timers) 5503 */ 5504 enum sctp_disposition sctp_sf_shutdown_ack_sent_prm_abort( 5505 struct net *net, 5506 const struct sctp_endpoint *ep, 5507 const struct sctp_association *asoc, 5508 const union sctp_subtype type, 5509 void *arg, 5510 struct sctp_cmd_seq *commands) 5511 { 5512 /* The same T2 timer, so we should be able to use 5513 * common function with the SHUTDOWN-SENT state. 5514 */ 5515 return sctp_sf_shutdown_sent_prm_abort(net, ep, asoc, type, arg, commands); 5516 } 5517 5518 /* 5519 * Process the REQUESTHEARTBEAT primitive 5520 * 5521 * 10.1 ULP-to-SCTP 5522 * J) Request Heartbeat 5523 * 5524 * Format: REQUESTHEARTBEAT(association id, destination transport address) 5525 * 5526 * -> result 5527 * 5528 * Instructs the local endpoint to perform a HeartBeat on the specified 5529 * destination transport address of the given association. The returned 5530 * result should indicate whether the transmission of the HEARTBEAT 5531 * chunk to the destination address is successful. 5532 * 5533 * Mandatory attributes: 5534 * 5535 * o association id - local handle to the SCTP association 5536 * 5537 * o destination transport address - the transport address of the 5538 * association on which a heartbeat should be issued. 5539 */ 5540 enum sctp_disposition sctp_sf_do_prm_requestheartbeat( 5541 struct net *net, 5542 const struct sctp_endpoint *ep, 5543 const struct sctp_association *asoc, 5544 const union sctp_subtype type, 5545 void *arg, 5546 struct sctp_cmd_seq *commands) 5547 { 5548 if (SCTP_DISPOSITION_NOMEM == sctp_sf_heartbeat(ep, asoc, type, 5549 (struct sctp_transport *)arg, commands)) 5550 return SCTP_DISPOSITION_NOMEM; 5551 5552 /* 5553 * RFC 2960 (bis), section 8.3 5554 * 5555 * D) Request an on-demand HEARTBEAT on a specific destination 5556 * transport address of a given association. 5557 * 5558 * The endpoint should increment the respective error counter of 5559 * the destination transport address each time a HEARTBEAT is sent 5560 * to that address and not acknowledged within one RTO. 5561 * 5562 */ 5563 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_HB_SENT, 5564 SCTP_TRANSPORT(arg)); 5565 return SCTP_DISPOSITION_CONSUME; 5566 } 5567 5568 /* 5569 * ADDIP Section 4.1 ASCONF Chunk Procedures 5570 * When an endpoint has an ASCONF signaled change to be sent to the 5571 * remote endpoint it should do A1 to A9 5572 */ 5573 enum sctp_disposition sctp_sf_do_prm_asconf(struct net *net, 5574 const struct sctp_endpoint *ep, 5575 const struct sctp_association *asoc, 5576 const union sctp_subtype type, 5577 void *arg, 5578 struct sctp_cmd_seq *commands) 5579 { 5580 struct sctp_chunk *chunk = arg; 5581 5582 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T4, SCTP_CHUNK(chunk)); 5583 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START, 5584 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO)); 5585 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(chunk)); 5586 return SCTP_DISPOSITION_CONSUME; 5587 } 5588 5589 /* RE-CONFIG Section 5.1 RECONF Chunk Procedures */ 5590 enum sctp_disposition sctp_sf_do_prm_reconf(struct net *net, 5591 const struct sctp_endpoint *ep, 5592 const struct sctp_association *asoc, 5593 const union sctp_subtype type, 5594 void *arg, 5595 struct sctp_cmd_seq *commands) 5596 { 5597 struct sctp_chunk *chunk = arg; 5598 5599 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(chunk)); 5600 return SCTP_DISPOSITION_CONSUME; 5601 } 5602 5603 /* 5604 * Ignore the primitive event 5605 * 5606 * The return value is the disposition of the primitive. 5607 */ 5608 enum sctp_disposition sctp_sf_ignore_primitive( 5609 struct net *net, 5610 const struct sctp_endpoint *ep, 5611 const struct sctp_association *asoc, 5612 const union sctp_subtype type, 5613 void *arg, 5614 struct sctp_cmd_seq *commands) 5615 { 5616 pr_debug("%s: primitive type:%d is ignored\n", __func__, 5617 type.primitive); 5618 5619 return SCTP_DISPOSITION_DISCARD; 5620 } 5621 5622 /*************************************************************************** 5623 * These are the state functions for the OTHER events. 5624 ***************************************************************************/ 5625 5626 /* 5627 * When the SCTP stack has no more user data to send or retransmit, this 5628 * notification is given to the user. Also, at the time when a user app 5629 * subscribes to this event, if there is no data to be sent or 5630 * retransmit, the stack will immediately send up this notification. 5631 */ 5632 enum sctp_disposition sctp_sf_do_no_pending_tsn( 5633 struct net *net, 5634 const struct sctp_endpoint *ep, 5635 const struct sctp_association *asoc, 5636 const union sctp_subtype type, 5637 void *arg, 5638 struct sctp_cmd_seq *commands) 5639 { 5640 struct sctp_ulpevent *event; 5641 5642 event = sctp_ulpevent_make_sender_dry_event(asoc, GFP_ATOMIC); 5643 if (!event) 5644 return SCTP_DISPOSITION_NOMEM; 5645 5646 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(event)); 5647 5648 return SCTP_DISPOSITION_CONSUME; 5649 } 5650 5651 /* 5652 * Start the shutdown negotiation. 5653 * 5654 * From Section 9.2: 5655 * Once all its outstanding data has been acknowledged, the endpoint 5656 * shall send a SHUTDOWN chunk to its peer including in the Cumulative 5657 * TSN Ack field the last sequential TSN it has received from the peer. 5658 * It shall then start the T2-shutdown timer and enter the SHUTDOWN-SENT 5659 * state. If the timer expires, the endpoint must re-send the SHUTDOWN 5660 * with the updated last sequential TSN received from its peer. 5661 * 5662 * The return value is the disposition. 5663 */ 5664 enum sctp_disposition sctp_sf_do_9_2_start_shutdown( 5665 struct net *net, 5666 const struct sctp_endpoint *ep, 5667 const struct sctp_association *asoc, 5668 const union sctp_subtype type, 5669 void *arg, 5670 struct sctp_cmd_seq *commands) 5671 { 5672 struct sctp_chunk *reply; 5673 5674 /* Once all its outstanding data has been acknowledged, the 5675 * endpoint shall send a SHUTDOWN chunk to its peer including 5676 * in the Cumulative TSN Ack field the last sequential TSN it 5677 * has received from the peer. 5678 */ 5679 reply = sctp_make_shutdown(asoc, arg); 5680 if (!reply) 5681 goto nomem; 5682 5683 /* Set the transport for the SHUTDOWN chunk and the timeout for the 5684 * T2-shutdown timer. 5685 */ 5686 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply)); 5687 5688 /* It shall then start the T2-shutdown timer */ 5689 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START, 5690 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN)); 5691 5692 /* RFC 4960 Section 9.2 5693 * The sender of the SHUTDOWN MAY also start an overall guard timer 5694 * 'T5-shutdown-guard' to bound the overall time for shutdown sequence. 5695 */ 5696 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART, 5697 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD)); 5698 5699 if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) 5700 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, 5701 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE)); 5702 5703 /* and enter the SHUTDOWN-SENT state. */ 5704 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE, 5705 SCTP_STATE(SCTP_STATE_SHUTDOWN_SENT)); 5706 5707 /* sctp-implguide 2.10 Issues with Heartbeating and failover 5708 * 5709 * HEARTBEAT ... is discontinued after sending either SHUTDOWN 5710 * or SHUTDOWN-ACK. 5711 */ 5712 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL()); 5713 5714 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply)); 5715 5716 return SCTP_DISPOSITION_CONSUME; 5717 5718 nomem: 5719 return SCTP_DISPOSITION_NOMEM; 5720 } 5721 5722 /* 5723 * Generate a SHUTDOWN ACK now that everything is SACK'd. 5724 * 5725 * From Section 9.2: 5726 * 5727 * If it has no more outstanding DATA chunks, the SHUTDOWN receiver 5728 * shall send a SHUTDOWN ACK and start a T2-shutdown timer of its own, 5729 * entering the SHUTDOWN-ACK-SENT state. If the timer expires, the 5730 * endpoint must re-send the SHUTDOWN ACK. 5731 * 5732 * The return value is the disposition. 5733 */ 5734 enum sctp_disposition sctp_sf_do_9_2_shutdown_ack( 5735 struct net *net, 5736 const struct sctp_endpoint *ep, 5737 const struct sctp_association *asoc, 5738 const union sctp_subtype type, 5739 void *arg, 5740 struct sctp_cmd_seq *commands) 5741 { 5742 struct sctp_chunk *chunk = arg; 5743 struct sctp_chunk *reply; 5744 5745 /* There are 2 ways of getting here: 5746 * 1) called in response to a SHUTDOWN chunk 5747 * 2) called when SCTP_EVENT_NO_PENDING_TSN event is issued. 5748 * 5749 * For the case (2), the arg parameter is set to NULL. We need 5750 * to check that we have a chunk before accessing it's fields. 5751 */ 5752 if (chunk) { 5753 if (!sctp_vtag_verify(chunk, asoc)) 5754 return sctp_sf_pdiscard(net, ep, asoc, type, arg, 5755 commands); 5756 5757 /* Make sure that the SHUTDOWN chunk has a valid length. */ 5758 if (!sctp_chunk_length_valid( 5759 chunk, sizeof(struct sctp_shutdown_chunk))) 5760 return sctp_sf_violation_chunklen(net, ep, asoc, type, 5761 arg, commands); 5762 } 5763 5764 /* If it has no more outstanding DATA chunks, the SHUTDOWN receiver 5765 * shall send a SHUTDOWN ACK ... 5766 */ 5767 reply = sctp_make_shutdown_ack(asoc, chunk); 5768 if (!reply) 5769 goto nomem; 5770 5771 /* Set the transport for the SHUTDOWN ACK chunk and the timeout for 5772 * the T2-shutdown timer. 5773 */ 5774 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply)); 5775 5776 /* and start/restart a T2-shutdown timer of its own, */ 5777 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART, 5778 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN)); 5779 5780 if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) 5781 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, 5782 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE)); 5783 5784 /* Enter the SHUTDOWN-ACK-SENT state. */ 5785 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE, 5786 SCTP_STATE(SCTP_STATE_SHUTDOWN_ACK_SENT)); 5787 5788 /* sctp-implguide 2.10 Issues with Heartbeating and failover 5789 * 5790 * HEARTBEAT ... is discontinued after sending either SHUTDOWN 5791 * or SHUTDOWN-ACK. 5792 */ 5793 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL()); 5794 5795 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply)); 5796 5797 return SCTP_DISPOSITION_CONSUME; 5798 5799 nomem: 5800 return SCTP_DISPOSITION_NOMEM; 5801 } 5802 5803 /* 5804 * Ignore the event defined as other 5805 * 5806 * The return value is the disposition of the event. 5807 */ 5808 enum sctp_disposition sctp_sf_ignore_other(struct net *net, 5809 const struct sctp_endpoint *ep, 5810 const struct sctp_association *asoc, 5811 const union sctp_subtype type, 5812 void *arg, 5813 struct sctp_cmd_seq *commands) 5814 { 5815 pr_debug("%s: the event other type:%d is ignored\n", 5816 __func__, type.other); 5817 5818 return SCTP_DISPOSITION_DISCARD; 5819 } 5820 5821 /************************************************************ 5822 * These are the state functions for handling timeout events. 5823 ************************************************************/ 5824 5825 /* 5826 * RTX Timeout 5827 * 5828 * Section: 6.3.3 Handle T3-rtx Expiration 5829 * 5830 * Whenever the retransmission timer T3-rtx expires for a destination 5831 * address, do the following: 5832 * [See below] 5833 * 5834 * The return value is the disposition of the chunk. 5835 */ 5836 enum sctp_disposition sctp_sf_do_6_3_3_rtx(struct net *net, 5837 const struct sctp_endpoint *ep, 5838 const struct sctp_association *asoc, 5839 const union sctp_subtype type, 5840 void *arg, 5841 struct sctp_cmd_seq *commands) 5842 { 5843 struct sctp_transport *transport = arg; 5844 5845 SCTP_INC_STATS(net, SCTP_MIB_T3_RTX_EXPIREDS); 5846 5847 if (asoc->overall_error_count >= asoc->max_retrans) { 5848 if (asoc->peer.zero_window_announced && 5849 asoc->state == SCTP_STATE_SHUTDOWN_PENDING) { 5850 /* 5851 * We are here likely because the receiver had its rwnd 5852 * closed for a while and we have not been able to 5853 * transmit the locally queued data within the maximum 5854 * retransmission attempts limit. Start the T5 5855 * shutdown guard timer to give the receiver one last 5856 * chance and some additional time to recover before 5857 * aborting. 5858 */ 5859 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START_ONCE, 5860 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD)); 5861 } else { 5862 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, 5863 SCTP_ERROR(ETIMEDOUT)); 5864 /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */ 5865 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, 5866 SCTP_PERR(SCTP_ERROR_NO_ERROR)); 5867 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS); 5868 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB); 5869 return SCTP_DISPOSITION_DELETE_TCB; 5870 } 5871 } 5872 5873 /* E1) For the destination address for which the timer 5874 * expires, adjust its ssthresh with rules defined in Section 5875 * 7.2.3 and set the cwnd <- MTU. 5876 */ 5877 5878 /* E2) For the destination address for which the timer 5879 * expires, set RTO <- RTO * 2 ("back off the timer"). The 5880 * maximum value discussed in rule C7 above (RTO.max) may be 5881 * used to provide an upper bound to this doubling operation. 5882 */ 5883 5884 /* E3) Determine how many of the earliest (i.e., lowest TSN) 5885 * outstanding DATA chunks for the address for which the 5886 * T3-rtx has expired will fit into a single packet, subject 5887 * to the MTU constraint for the path corresponding to the 5888 * destination transport address to which the retransmission 5889 * is being sent (this may be different from the address for 5890 * which the timer expires [see Section 6.4]). Call this 5891 * value K. Bundle and retransmit those K DATA chunks in a 5892 * single packet to the destination endpoint. 5893 * 5894 * Note: Any DATA chunks that were sent to the address for 5895 * which the T3-rtx timer expired but did not fit in one MTU 5896 * (rule E3 above), should be marked for retransmission and 5897 * sent as soon as cwnd allows (normally when a SACK arrives). 5898 */ 5899 5900 /* Do some failure management (Section 8.2). */ 5901 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE, SCTP_TRANSPORT(transport)); 5902 5903 /* NB: Rules E4 and F1 are implicit in R1. */ 5904 sctp_add_cmd_sf(commands, SCTP_CMD_RETRAN, SCTP_TRANSPORT(transport)); 5905 5906 return SCTP_DISPOSITION_CONSUME; 5907 } 5908 5909 /* 5910 * Generate delayed SACK on timeout 5911 * 5912 * Section: 6.2 Acknowledgement on Reception of DATA Chunks 5913 * 5914 * The guidelines on delayed acknowledgement algorithm specified in 5915 * Section 4.2 of [RFC2581] SHOULD be followed. Specifically, an 5916 * acknowledgement SHOULD be generated for at least every second packet 5917 * (not every second DATA chunk) received, and SHOULD be generated 5918 * within 200 ms of the arrival of any unacknowledged DATA chunk. In 5919 * some situations it may be beneficial for an SCTP transmitter to be 5920 * more conservative than the algorithms detailed in this document 5921 * allow. However, an SCTP transmitter MUST NOT be more aggressive than 5922 * the following algorithms allow. 5923 */ 5924 enum sctp_disposition sctp_sf_do_6_2_sack(struct net *net, 5925 const struct sctp_endpoint *ep, 5926 const struct sctp_association *asoc, 5927 const union sctp_subtype type, 5928 void *arg, 5929 struct sctp_cmd_seq *commands) 5930 { 5931 SCTP_INC_STATS(net, SCTP_MIB_DELAY_SACK_EXPIREDS); 5932 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE()); 5933 return SCTP_DISPOSITION_CONSUME; 5934 } 5935 5936 /* 5937 * sctp_sf_t1_init_timer_expire 5938 * 5939 * Section: 4 Note: 2 5940 * Verification Tag: 5941 * Inputs 5942 * (endpoint, asoc) 5943 * 5944 * RFC 2960 Section 4 Notes 5945 * 2) If the T1-init timer expires, the endpoint MUST retransmit INIT 5946 * and re-start the T1-init timer without changing state. This MUST 5947 * be repeated up to 'Max.Init.Retransmits' times. After that, the 5948 * endpoint MUST abort the initialization process and report the 5949 * error to SCTP user. 5950 * 5951 * Outputs 5952 * (timers, events) 5953 * 5954 */ 5955 enum sctp_disposition sctp_sf_t1_init_timer_expire( 5956 struct net *net, 5957 const struct sctp_endpoint *ep, 5958 const struct sctp_association *asoc, 5959 const union sctp_subtype type, 5960 void *arg, 5961 struct sctp_cmd_seq *commands) 5962 { 5963 int attempts = asoc->init_err_counter + 1; 5964 struct sctp_chunk *repl = NULL; 5965 struct sctp_bind_addr *bp; 5966 5967 pr_debug("%s: timer T1 expired (INIT)\n", __func__); 5968 5969 SCTP_INC_STATS(net, SCTP_MIB_T1_INIT_EXPIREDS); 5970 5971 if (attempts <= asoc->max_init_attempts) { 5972 bp = (struct sctp_bind_addr *) &asoc->base.bind_addr; 5973 repl = sctp_make_init(asoc, bp, GFP_ATOMIC, 0); 5974 if (!repl) 5975 return SCTP_DISPOSITION_NOMEM; 5976 5977 /* Choose transport for INIT. */ 5978 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT, 5979 SCTP_CHUNK(repl)); 5980 5981 /* Issue a sideeffect to do the needed accounting. */ 5982 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_RESTART, 5983 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT)); 5984 5985 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl)); 5986 } else { 5987 pr_debug("%s: giving up on INIT, attempts:%d " 5988 "max_init_attempts:%d\n", __func__, attempts, 5989 asoc->max_init_attempts); 5990 5991 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, 5992 SCTP_ERROR(ETIMEDOUT)); 5993 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED, 5994 SCTP_PERR(SCTP_ERROR_NO_ERROR)); 5995 return SCTP_DISPOSITION_DELETE_TCB; 5996 } 5997 5998 return SCTP_DISPOSITION_CONSUME; 5999 } 6000 6001 /* 6002 * sctp_sf_t1_cookie_timer_expire 6003 * 6004 * Section: 4 Note: 2 6005 * Verification Tag: 6006 * Inputs 6007 * (endpoint, asoc) 6008 * 6009 * RFC 2960 Section 4 Notes 6010 * 3) If the T1-cookie timer expires, the endpoint MUST retransmit 6011 * COOKIE ECHO and re-start the T1-cookie timer without changing 6012 * state. This MUST be repeated up to 'Max.Init.Retransmits' times. 6013 * After that, the endpoint MUST abort the initialization process and 6014 * report the error to SCTP user. 6015 * 6016 * Outputs 6017 * (timers, events) 6018 * 6019 */ 6020 enum sctp_disposition sctp_sf_t1_cookie_timer_expire( 6021 struct net *net, 6022 const struct sctp_endpoint *ep, 6023 const struct sctp_association *asoc, 6024 const union sctp_subtype type, 6025 void *arg, 6026 struct sctp_cmd_seq *commands) 6027 { 6028 int attempts = asoc->init_err_counter + 1; 6029 struct sctp_chunk *repl = NULL; 6030 6031 pr_debug("%s: timer T1 expired (COOKIE-ECHO)\n", __func__); 6032 6033 SCTP_INC_STATS(net, SCTP_MIB_T1_COOKIE_EXPIREDS); 6034 6035 if (attempts <= asoc->max_init_attempts) { 6036 repl = sctp_make_cookie_echo(asoc, NULL); 6037 if (!repl) 6038 return SCTP_DISPOSITION_NOMEM; 6039 6040 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT, 6041 SCTP_CHUNK(repl)); 6042 /* Issue a sideeffect to do the needed accounting. */ 6043 sctp_add_cmd_sf(commands, SCTP_CMD_COOKIEECHO_RESTART, 6044 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE)); 6045 6046 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl)); 6047 } else { 6048 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, 6049 SCTP_ERROR(ETIMEDOUT)); 6050 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED, 6051 SCTP_PERR(SCTP_ERROR_NO_ERROR)); 6052 return SCTP_DISPOSITION_DELETE_TCB; 6053 } 6054 6055 return SCTP_DISPOSITION_CONSUME; 6056 } 6057 6058 /* RFC2960 9.2 If the timer expires, the endpoint must re-send the SHUTDOWN 6059 * with the updated last sequential TSN received from its peer. 6060 * 6061 * An endpoint should limit the number of retransmission of the 6062 * SHUTDOWN chunk to the protocol parameter 'Association.Max.Retrans'. 6063 * If this threshold is exceeded the endpoint should destroy the TCB and 6064 * MUST report the peer endpoint unreachable to the upper layer (and 6065 * thus the association enters the CLOSED state). The reception of any 6066 * packet from its peer (i.e. as the peer sends all of its queued DATA 6067 * chunks) should clear the endpoint's retransmission count and restart 6068 * the T2-Shutdown timer, giving its peer ample opportunity to transmit 6069 * all of its queued DATA chunks that have not yet been sent. 6070 */ 6071 enum sctp_disposition sctp_sf_t2_timer_expire( 6072 struct net *net, 6073 const struct sctp_endpoint *ep, 6074 const struct sctp_association *asoc, 6075 const union sctp_subtype type, 6076 void *arg, 6077 struct sctp_cmd_seq *commands) 6078 { 6079 struct sctp_chunk *reply = NULL; 6080 6081 pr_debug("%s: timer T2 expired\n", __func__); 6082 6083 SCTP_INC_STATS(net, SCTP_MIB_T2_SHUTDOWN_EXPIREDS); 6084 6085 ((struct sctp_association *)asoc)->shutdown_retries++; 6086 6087 if (asoc->overall_error_count >= asoc->max_retrans) { 6088 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, 6089 SCTP_ERROR(ETIMEDOUT)); 6090 /* Note: CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */ 6091 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, 6092 SCTP_PERR(SCTP_ERROR_NO_ERROR)); 6093 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS); 6094 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB); 6095 return SCTP_DISPOSITION_DELETE_TCB; 6096 } 6097 6098 switch (asoc->state) { 6099 case SCTP_STATE_SHUTDOWN_SENT: 6100 reply = sctp_make_shutdown(asoc, NULL); 6101 break; 6102 6103 case SCTP_STATE_SHUTDOWN_ACK_SENT: 6104 reply = sctp_make_shutdown_ack(asoc, NULL); 6105 break; 6106 6107 default: 6108 BUG(); 6109 break; 6110 } 6111 6112 if (!reply) 6113 goto nomem; 6114 6115 /* Do some failure management (Section 8.2). 6116 * If we remove the transport an SHUTDOWN was last sent to, don't 6117 * do failure management. 6118 */ 6119 if (asoc->shutdown_last_sent_to) 6120 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE, 6121 SCTP_TRANSPORT(asoc->shutdown_last_sent_to)); 6122 6123 /* Set the transport for the SHUTDOWN/ACK chunk and the timeout for 6124 * the T2-shutdown timer. 6125 */ 6126 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply)); 6127 6128 /* Restart the T2-shutdown timer. */ 6129 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART, 6130 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN)); 6131 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply)); 6132 return SCTP_DISPOSITION_CONSUME; 6133 6134 nomem: 6135 return SCTP_DISPOSITION_NOMEM; 6136 } 6137 6138 /* 6139 * ADDIP Section 4.1 ASCONF Chunk Procedures 6140 * If the T4 RTO timer expires the endpoint should do B1 to B5 6141 */ 6142 enum sctp_disposition sctp_sf_t4_timer_expire( 6143 struct net *net, 6144 const struct sctp_endpoint *ep, 6145 const struct sctp_association *asoc, 6146 const union sctp_subtype type, 6147 void *arg, 6148 struct sctp_cmd_seq *commands) 6149 { 6150 struct sctp_chunk *chunk = asoc->addip_last_asconf; 6151 struct sctp_transport *transport; 6152 6153 if (!chunk) 6154 return SCTP_DISPOSITION_CONSUME; 6155 6156 transport = chunk->transport; 6157 SCTP_INC_STATS(net, SCTP_MIB_T4_RTO_EXPIREDS); 6158 6159 /* ADDIP 4.1 B1) Increment the error counters and perform path failure 6160 * detection on the appropriate destination address as defined in 6161 * RFC2960 [5] section 8.1 and 8.2. 6162 */ 6163 if (transport) 6164 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE, 6165 SCTP_TRANSPORT(transport)); 6166 6167 /* Reconfig T4 timer and transport. */ 6168 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T4, SCTP_CHUNK(chunk)); 6169 6170 /* ADDIP 4.1 B2) Increment the association error counters and perform 6171 * endpoint failure detection on the association as defined in 6172 * RFC2960 [5] section 8.1 and 8.2. 6173 * association error counter is incremented in SCTP_CMD_STRIKE. 6174 */ 6175 if (asoc->overall_error_count >= asoc->max_retrans) { 6176 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, 6177 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO)); 6178 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, 6179 SCTP_ERROR(ETIMEDOUT)); 6180 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, 6181 SCTP_PERR(SCTP_ERROR_NO_ERROR)); 6182 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS); 6183 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB); 6184 return SCTP_DISPOSITION_ABORT; 6185 } 6186 6187 /* ADDIP 4.1 B3) Back-off the destination address RTO value to which 6188 * the ASCONF chunk was sent by doubling the RTO timer value. 6189 * This is done in SCTP_CMD_STRIKE. 6190 */ 6191 6192 /* ADDIP 4.1 B4) Re-transmit the ASCONF Chunk last sent and if possible 6193 * choose an alternate destination address (please refer to RFC2960 6194 * [5] section 6.4.1). An endpoint MUST NOT add new parameters to this 6195 * chunk, it MUST be the same (including its serial number) as the last 6196 * ASCONF sent. 6197 */ 6198 sctp_chunk_hold(asoc->addip_last_asconf); 6199 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, 6200 SCTP_CHUNK(asoc->addip_last_asconf)); 6201 6202 /* ADDIP 4.1 B5) Restart the T-4 RTO timer. Note that if a different 6203 * destination is selected, then the RTO used will be that of the new 6204 * destination address. 6205 */ 6206 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART, 6207 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO)); 6208 6209 return SCTP_DISPOSITION_CONSUME; 6210 } 6211 6212 /* sctpimpguide-05 Section 2.12.2 6213 * The sender of the SHUTDOWN MAY also start an overall guard timer 6214 * 'T5-shutdown-guard' to bound the overall time for shutdown sequence. 6215 * At the expiration of this timer the sender SHOULD abort the association 6216 * by sending an ABORT chunk. 6217 */ 6218 enum sctp_disposition sctp_sf_t5_timer_expire( 6219 struct net *net, 6220 const struct sctp_endpoint *ep, 6221 const struct sctp_association *asoc, 6222 const union sctp_subtype type, 6223 void *arg, 6224 struct sctp_cmd_seq *commands) 6225 { 6226 struct sctp_chunk *reply = NULL; 6227 6228 pr_debug("%s: timer T5 expired\n", __func__); 6229 6230 SCTP_INC_STATS(net, SCTP_MIB_T5_SHUTDOWN_GUARD_EXPIREDS); 6231 6232 reply = sctp_make_abort(asoc, NULL, 0); 6233 if (!reply) 6234 goto nomem; 6235 6236 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply)); 6237 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, 6238 SCTP_ERROR(ETIMEDOUT)); 6239 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, 6240 SCTP_PERR(SCTP_ERROR_NO_ERROR)); 6241 6242 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS); 6243 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB); 6244 6245 return SCTP_DISPOSITION_DELETE_TCB; 6246 nomem: 6247 return SCTP_DISPOSITION_NOMEM; 6248 } 6249 6250 /* Handle expiration of AUTOCLOSE timer. When the autoclose timer expires, 6251 * the association is automatically closed by starting the shutdown process. 6252 * The work that needs to be done is same as when SHUTDOWN is initiated by 6253 * the user. So this routine looks same as sctp_sf_do_9_2_prm_shutdown(). 6254 */ 6255 enum sctp_disposition sctp_sf_autoclose_timer_expire( 6256 struct net *net, 6257 const struct sctp_endpoint *ep, 6258 const struct sctp_association *asoc, 6259 const union sctp_subtype type, 6260 void *arg, 6261 struct sctp_cmd_seq *commands) 6262 { 6263 enum sctp_disposition disposition; 6264 6265 SCTP_INC_STATS(net, SCTP_MIB_AUTOCLOSE_EXPIREDS); 6266 6267 /* From 9.2 Shutdown of an Association 6268 * Upon receipt of the SHUTDOWN primitive from its upper 6269 * layer, the endpoint enters SHUTDOWN-PENDING state and 6270 * remains there until all outstanding data has been 6271 * acknowledged by its peer. The endpoint accepts no new data 6272 * from its upper layer, but retransmits data to the far end 6273 * if necessary to fill gaps. 6274 */ 6275 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE, 6276 SCTP_STATE(SCTP_STATE_SHUTDOWN_PENDING)); 6277 6278 disposition = SCTP_DISPOSITION_CONSUME; 6279 if (sctp_outq_is_empty(&asoc->outqueue)) { 6280 disposition = sctp_sf_do_9_2_start_shutdown(net, ep, asoc, type, 6281 NULL, commands); 6282 } 6283 6284 return disposition; 6285 } 6286 6287 /***************************************************************************** 6288 * These are sa state functions which could apply to all types of events. 6289 ****************************************************************************/ 6290 6291 /* 6292 * This table entry is not implemented. 6293 * 6294 * Inputs 6295 * (endpoint, asoc, chunk) 6296 * 6297 * The return value is the disposition of the chunk. 6298 */ 6299 enum sctp_disposition sctp_sf_not_impl(struct net *net, 6300 const struct sctp_endpoint *ep, 6301 const struct sctp_association *asoc, 6302 const union sctp_subtype type, 6303 void *arg, struct sctp_cmd_seq *commands) 6304 { 6305 return SCTP_DISPOSITION_NOT_IMPL; 6306 } 6307 6308 /* 6309 * This table entry represents a bug. 6310 * 6311 * Inputs 6312 * (endpoint, asoc, chunk) 6313 * 6314 * The return value is the disposition of the chunk. 6315 */ 6316 enum sctp_disposition sctp_sf_bug(struct net *net, 6317 const struct sctp_endpoint *ep, 6318 const struct sctp_association *asoc, 6319 const union sctp_subtype type, 6320 void *arg, struct sctp_cmd_seq *commands) 6321 { 6322 return SCTP_DISPOSITION_BUG; 6323 } 6324 6325 /* 6326 * This table entry represents the firing of a timer in the wrong state. 6327 * Since timer deletion cannot be guaranteed a timer 'may' end up firing 6328 * when the association is in the wrong state. This event should 6329 * be ignored, so as to prevent any rearming of the timer. 6330 * 6331 * Inputs 6332 * (endpoint, asoc, chunk) 6333 * 6334 * The return value is the disposition of the chunk. 6335 */ 6336 enum sctp_disposition sctp_sf_timer_ignore(struct net *net, 6337 const struct sctp_endpoint *ep, 6338 const struct sctp_association *asoc, 6339 const union sctp_subtype type, 6340 void *arg, 6341 struct sctp_cmd_seq *commands) 6342 { 6343 pr_debug("%s: timer %d ignored\n", __func__, type.chunk); 6344 6345 return SCTP_DISPOSITION_CONSUME; 6346 } 6347 6348 /******************************************************************** 6349 * 2nd Level Abstractions 6350 ********************************************************************/ 6351 6352 /* Pull the SACK chunk based on the SACK header. */ 6353 static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk) 6354 { 6355 struct sctp_sackhdr *sack; 6356 __u16 num_dup_tsns; 6357 unsigned int len; 6358 __u16 num_blocks; 6359 6360 /* Protect ourselves from reading too far into 6361 * the skb from a bogus sender. 6362 */ 6363 sack = (struct sctp_sackhdr *) chunk->skb->data; 6364 6365 num_blocks = ntohs(sack->num_gap_ack_blocks); 6366 num_dup_tsns = ntohs(sack->num_dup_tsns); 6367 len = sizeof(struct sctp_sackhdr); 6368 len += (num_blocks + num_dup_tsns) * sizeof(__u32); 6369 if (len > chunk->skb->len) 6370 return NULL; 6371 6372 skb_pull(chunk->skb, len); 6373 6374 return sack; 6375 } 6376 6377 /* Create an ABORT packet to be sent as a response, with the specified 6378 * error causes. 6379 */ 6380 static struct sctp_packet *sctp_abort_pkt_new( 6381 struct net *net, 6382 const struct sctp_endpoint *ep, 6383 const struct sctp_association *asoc, 6384 struct sctp_chunk *chunk, 6385 const void *payload, size_t paylen) 6386 { 6387 struct sctp_packet *packet; 6388 struct sctp_chunk *abort; 6389 6390 packet = sctp_ootb_pkt_new(net, asoc, chunk); 6391 6392 if (packet) { 6393 /* Make an ABORT. 6394 * The T bit will be set if the asoc is NULL. 6395 */ 6396 abort = sctp_make_abort(asoc, chunk, paylen); 6397 if (!abort) { 6398 sctp_ootb_pkt_free(packet); 6399 return NULL; 6400 } 6401 6402 /* Reflect vtag if T-Bit is set */ 6403 if (sctp_test_T_bit(abort)) 6404 packet->vtag = ntohl(chunk->sctp_hdr->vtag); 6405 6406 /* Add specified error causes, i.e., payload, to the 6407 * end of the chunk. 6408 */ 6409 sctp_addto_chunk(abort, paylen, payload); 6410 6411 /* Set the skb to the belonging sock for accounting. */ 6412 abort->skb->sk = ep->base.sk; 6413 6414 sctp_packet_append_chunk(packet, abort); 6415 6416 } 6417 6418 return packet; 6419 } 6420 6421 /* Allocate a packet for responding in the OOTB conditions. */ 6422 static struct sctp_packet *sctp_ootb_pkt_new( 6423 struct net *net, 6424 const struct sctp_association *asoc, 6425 const struct sctp_chunk *chunk) 6426 { 6427 struct sctp_transport *transport; 6428 struct sctp_packet *packet; 6429 __u16 sport, dport; 6430 __u32 vtag; 6431 6432 /* Get the source and destination port from the inbound packet. */ 6433 sport = ntohs(chunk->sctp_hdr->dest); 6434 dport = ntohs(chunk->sctp_hdr->source); 6435 6436 /* The V-tag is going to be the same as the inbound packet if no 6437 * association exists, otherwise, use the peer's vtag. 6438 */ 6439 if (asoc) { 6440 /* Special case the INIT-ACK as there is no peer's vtag 6441 * yet. 6442 */ 6443 switch (chunk->chunk_hdr->type) { 6444 case SCTP_CID_INIT: 6445 case SCTP_CID_INIT_ACK: 6446 { 6447 struct sctp_initack_chunk *initack; 6448 6449 initack = (struct sctp_initack_chunk *)chunk->chunk_hdr; 6450 vtag = ntohl(initack->init_hdr.init_tag); 6451 break; 6452 } 6453 default: 6454 vtag = asoc->peer.i.init_tag; 6455 break; 6456 } 6457 } else { 6458 /* Special case the INIT and stale COOKIE_ECHO as there is no 6459 * vtag yet. 6460 */ 6461 switch (chunk->chunk_hdr->type) { 6462 case SCTP_CID_INIT: 6463 { 6464 struct sctp_init_chunk *init; 6465 6466 init = (struct sctp_init_chunk *)chunk->chunk_hdr; 6467 vtag = ntohl(init->init_hdr.init_tag); 6468 break; 6469 } 6470 default: 6471 vtag = ntohl(chunk->sctp_hdr->vtag); 6472 break; 6473 } 6474 } 6475 6476 /* Make a transport for the bucket, Eliza... */ 6477 transport = sctp_transport_new(net, sctp_source(chunk), GFP_ATOMIC); 6478 if (!transport) 6479 goto nomem; 6480 6481 transport->encap_port = SCTP_INPUT_CB(chunk->skb)->encap_port; 6482 6483 /* Cache a route for the transport with the chunk's destination as 6484 * the source address. 6485 */ 6486 sctp_transport_route(transport, (union sctp_addr *)&chunk->dest, 6487 sctp_sk(net->sctp.ctl_sock)); 6488 6489 packet = &transport->packet; 6490 sctp_packet_init(packet, transport, sport, dport); 6491 sctp_packet_config(packet, vtag, 0); 6492 6493 return packet; 6494 6495 nomem: 6496 return NULL; 6497 } 6498 6499 /* Free the packet allocated earlier for responding in the OOTB condition. */ 6500 void sctp_ootb_pkt_free(struct sctp_packet *packet) 6501 { 6502 sctp_transport_free(packet->transport); 6503 } 6504 6505 /* Send a stale cookie error when a invalid COOKIE ECHO chunk is found */ 6506 static void sctp_send_stale_cookie_err(struct net *net, 6507 const struct sctp_endpoint *ep, 6508 const struct sctp_association *asoc, 6509 const struct sctp_chunk *chunk, 6510 struct sctp_cmd_seq *commands, 6511 struct sctp_chunk *err_chunk) 6512 { 6513 struct sctp_packet *packet; 6514 6515 if (err_chunk) { 6516 packet = sctp_ootb_pkt_new(net, asoc, chunk); 6517 if (packet) { 6518 struct sctp_signed_cookie *cookie; 6519 6520 /* Override the OOTB vtag from the cookie. */ 6521 cookie = chunk->subh.cookie_hdr; 6522 packet->vtag = cookie->c.peer_vtag; 6523 6524 /* Set the skb to the belonging sock for accounting. */ 6525 err_chunk->skb->sk = ep->base.sk; 6526 sctp_packet_append_chunk(packet, err_chunk); 6527 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT, 6528 SCTP_PACKET(packet)); 6529 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS); 6530 } else 6531 sctp_chunk_free (err_chunk); 6532 } 6533 } 6534 6535 6536 /* Process a data chunk */ 6537 static int sctp_eat_data(const struct sctp_association *asoc, 6538 struct sctp_chunk *chunk, 6539 struct sctp_cmd_seq *commands) 6540 { 6541 struct sctp_tsnmap *map = (struct sctp_tsnmap *)&asoc->peer.tsn_map; 6542 struct sock *sk = asoc->base.sk; 6543 struct net *net = sock_net(sk); 6544 struct sctp_datahdr *data_hdr; 6545 struct sctp_chunk *err; 6546 enum sctp_verb deliver; 6547 size_t datalen; 6548 __u32 tsn; 6549 int tmp; 6550 6551 data_hdr = (struct sctp_datahdr *)chunk->skb->data; 6552 chunk->subh.data_hdr = data_hdr; 6553 skb_pull(chunk->skb, sctp_datahdr_len(&asoc->stream)); 6554 6555 tsn = ntohl(data_hdr->tsn); 6556 pr_debug("%s: TSN 0x%x\n", __func__, tsn); 6557 6558 /* ASSERT: Now skb->data is really the user data. */ 6559 6560 /* Process ECN based congestion. 6561 * 6562 * Since the chunk structure is reused for all chunks within 6563 * a packet, we use ecn_ce_done to track if we've already 6564 * done CE processing for this packet. 6565 * 6566 * We need to do ECN processing even if we plan to discard the 6567 * chunk later. 6568 */ 6569 6570 if (asoc->peer.ecn_capable && !chunk->ecn_ce_done) { 6571 struct sctp_af *af = SCTP_INPUT_CB(chunk->skb)->af; 6572 chunk->ecn_ce_done = 1; 6573 6574 if (af->is_ce(sctp_gso_headskb(chunk->skb))) { 6575 /* Do real work as side effect. */ 6576 sctp_add_cmd_sf(commands, SCTP_CMD_ECN_CE, 6577 SCTP_U32(tsn)); 6578 } 6579 } 6580 6581 tmp = sctp_tsnmap_check(&asoc->peer.tsn_map, tsn); 6582 if (tmp < 0) { 6583 /* The TSN is too high--silently discard the chunk and 6584 * count on it getting retransmitted later. 6585 */ 6586 if (chunk->asoc) 6587 chunk->asoc->stats.outofseqtsns++; 6588 return SCTP_IERROR_HIGH_TSN; 6589 } else if (tmp > 0) { 6590 /* This is a duplicate. Record it. */ 6591 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_DUP, SCTP_U32(tsn)); 6592 return SCTP_IERROR_DUP_TSN; 6593 } 6594 6595 /* This is a new TSN. */ 6596 6597 /* Discard if there is no room in the receive window. 6598 * Actually, allow a little bit of overflow (up to a MTU). 6599 */ 6600 datalen = ntohs(chunk->chunk_hdr->length); 6601 datalen -= sctp_datachk_len(&asoc->stream); 6602 6603 deliver = SCTP_CMD_CHUNK_ULP; 6604 6605 /* Think about partial delivery. */ 6606 if ((datalen >= asoc->rwnd) && (!asoc->ulpq.pd_mode)) { 6607 6608 /* Even if we don't accept this chunk there is 6609 * memory pressure. 6610 */ 6611 sctp_add_cmd_sf(commands, SCTP_CMD_PART_DELIVER, SCTP_NULL()); 6612 } 6613 6614 /* Spill over rwnd a little bit. Note: While allowed, this spill over 6615 * seems a bit troublesome in that frag_point varies based on 6616 * PMTU. In cases, such as loopback, this might be a rather 6617 * large spill over. 6618 */ 6619 if ((!chunk->data_accepted) && (!asoc->rwnd || asoc->rwnd_over || 6620 (datalen > asoc->rwnd + asoc->frag_point))) { 6621 6622 /* If this is the next TSN, consider reneging to make 6623 * room. Note: Playing nice with a confused sender. A 6624 * malicious sender can still eat up all our buffer 6625 * space and in the future we may want to detect and 6626 * do more drastic reneging. 6627 */ 6628 if (sctp_tsnmap_has_gap(map) && 6629 (sctp_tsnmap_get_ctsn(map) + 1) == tsn) { 6630 pr_debug("%s: reneging for tsn:%u\n", __func__, tsn); 6631 deliver = SCTP_CMD_RENEGE; 6632 } else { 6633 pr_debug("%s: discard tsn:%u len:%zu, rwnd:%d\n", 6634 __func__, tsn, datalen, asoc->rwnd); 6635 6636 return SCTP_IERROR_IGNORE_TSN; 6637 } 6638 } 6639 6640 /* 6641 * Also try to renege to limit our memory usage in the event that 6642 * we are under memory pressure 6643 * If we can't renege, don't worry about it, the sk_rmem_schedule 6644 * in sctp_ulpevent_make_rcvmsg will drop the frame if we grow our 6645 * memory usage too much 6646 */ 6647 if (sk_under_memory_pressure(sk)) { 6648 if (sctp_tsnmap_has_gap(map) && 6649 (sctp_tsnmap_get_ctsn(map) + 1) == tsn) { 6650 pr_debug("%s: under pressure, reneging for tsn:%u\n", 6651 __func__, tsn); 6652 deliver = SCTP_CMD_RENEGE; 6653 } 6654 } 6655 6656 /* 6657 * Section 3.3.10.9 No User Data (9) 6658 * 6659 * Cause of error 6660 * --------------- 6661 * No User Data: This error cause is returned to the originator of a 6662 * DATA chunk if a received DATA chunk has no user data. 6663 */ 6664 if (unlikely(0 == datalen)) { 6665 err = sctp_make_abort_no_data(asoc, chunk, tsn); 6666 if (err) { 6667 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, 6668 SCTP_CHUNK(err)); 6669 } 6670 /* We are going to ABORT, so we might as well stop 6671 * processing the rest of the chunks in the packet. 6672 */ 6673 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL()); 6674 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, 6675 SCTP_ERROR(ECONNABORTED)); 6676 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, 6677 SCTP_PERR(SCTP_ERROR_NO_DATA)); 6678 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS); 6679 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB); 6680 return SCTP_IERROR_NO_DATA; 6681 } 6682 6683 chunk->data_accepted = 1; 6684 6685 /* Note: Some chunks may get overcounted (if we drop) or overcounted 6686 * if we renege and the chunk arrives again. 6687 */ 6688 if (chunk->chunk_hdr->flags & SCTP_DATA_UNORDERED) { 6689 SCTP_INC_STATS(net, SCTP_MIB_INUNORDERCHUNKS); 6690 if (chunk->asoc) 6691 chunk->asoc->stats.iuodchunks++; 6692 } else { 6693 SCTP_INC_STATS(net, SCTP_MIB_INORDERCHUNKS); 6694 if (chunk->asoc) 6695 chunk->asoc->stats.iodchunks++; 6696 } 6697 6698 /* RFC 2960 6.5 Stream Identifier and Stream Sequence Number 6699 * 6700 * If an endpoint receive a DATA chunk with an invalid stream 6701 * identifier, it shall acknowledge the reception of the DATA chunk 6702 * following the normal procedure, immediately send an ERROR chunk 6703 * with cause set to "Invalid Stream Identifier" (See Section 3.3.10) 6704 * and discard the DATA chunk. 6705 */ 6706 if (ntohs(data_hdr->stream) >= asoc->stream.incnt) { 6707 /* Mark tsn as received even though we drop it */ 6708 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_TSN, SCTP_U32(tsn)); 6709 6710 err = sctp_make_op_error(asoc, chunk, SCTP_ERROR_INV_STRM, 6711 &data_hdr->stream, 6712 sizeof(data_hdr->stream), 6713 sizeof(u16)); 6714 if (err) 6715 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, 6716 SCTP_CHUNK(err)); 6717 return SCTP_IERROR_BAD_STREAM; 6718 } 6719 6720 /* Check to see if the SSN is possible for this TSN. 6721 * The biggest gap we can record is 4K wide. Since SSNs wrap 6722 * at an unsigned short, there is no way that an SSN can 6723 * wrap and for a valid TSN. We can simply check if the current 6724 * SSN is smaller then the next expected one. If it is, it wrapped 6725 * and is invalid. 6726 */ 6727 if (!asoc->stream.si->validate_data(chunk)) 6728 return SCTP_IERROR_PROTO_VIOLATION; 6729 6730 /* Send the data up to the user. Note: Schedule the 6731 * SCTP_CMD_CHUNK_ULP cmd before the SCTP_CMD_GEN_SACK, as the SACK 6732 * chunk needs the updated rwnd. 6733 */ 6734 sctp_add_cmd_sf(commands, deliver, SCTP_CHUNK(chunk)); 6735 6736 return SCTP_IERROR_NO_ERROR; 6737 } 6738