sm_statefuns.c 201.4 KB
Newer Older
1
/* SCTP kernel implementation
L
Linus Torvalds 已提交
2 3 4 5 6 7
 * (C) Copyright IBM Corp. 2001, 2004
 * Copyright (c) 1999-2000 Cisco, Inc.
 * Copyright (c) 1999-2001 Motorola, Inc.
 * Copyright (c) 2001-2002 Intel Corp.
 * Copyright (c) 2002      Nokia Corp.
 *
8
 * This is part of the SCTP Linux Kernel Implementation.
L
Linus Torvalds 已提交
9 10 11
 *
 * These are the state functions for the state machine.
 *
12
 * This SCTP implementation is free software;
L
Linus Torvalds 已提交
13 14 15 16 17
 * you can redistribute it and/or modify it under the terms of
 * the GNU General Public License as published by
 * the Free Software Foundation; either version 2, or (at your option)
 * any later version.
 *
18
 * This SCTP implementation is distributed in the hope that it
L
Linus Torvalds 已提交
19 20 21 22 23 24
 * will be useful, but WITHOUT ANY WARRANTY; without even the implied
 *                 ************************
 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
25 26
 * along with GNU CC; see the file COPYING.  If not, see
 * <http://www.gnu.org/licenses/>.
L
Linus Torvalds 已提交
27 28 29
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
30
 *    lksctp developers <linux-sctp@vger.kernel.org>
L
Linus Torvalds 已提交
31 32 33 34 35 36 37 38 39 40 41 42 43 44 45
 *
 * Written or modified by:
 *    La Monte H.P. Yarroll <piggy@acm.org>
 *    Karl Knutson          <karl@athena.chicago.il.us>
 *    Mathew Kotowsky       <kotowsky@sctp.org>
 *    Sridhar Samudrala     <samudrala@us.ibm.com>
 *    Jon Grimm             <jgrimm@us.ibm.com>
 *    Hui Huang 	    <hui.huang@nokia.com>
 *    Dajiang Zhang 	    <dajiang.zhang@nokia.com>
 *    Daisy Chang	    <daisyc@us.ibm.com>
 *    Ardelle Fan	    <ardelle.fan@intel.com>
 *    Ryan Layer	    <rmlayer@us.ibm.com>
 *    Kevin Gao		    <kevin.gao@intel.com>
 */

46 47
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

L
Linus Torvalds 已提交
48 49 50 51 52 53
#include <linux/types.h>
#include <linux/kernel.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <linux/net.h>
#include <linux/inet.h>
54
#include <linux/slab.h>
L
Linus Torvalds 已提交
55 56 57 58 59 60 61
#include <net/sock.h>
#include <net/inet_ecn.h>
#include <linux/skbuff.h>
#include <net/sctp/sctp.h>
#include <net/sctp/sm.h>
#include <net/sctp/structs.h>

62 63
static struct sctp_packet *sctp_abort_pkt_new(struct net *net,
				  const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
64 65 66 67 68 69 70
				  const struct sctp_association *asoc,
				  struct sctp_chunk *chunk,
				  const void *payload,
				  size_t paylen);
static int sctp_eat_data(const struct sctp_association *asoc,
			 struct sctp_chunk *chunk,
			 sctp_cmd_seq_t *commands);
71 72
static struct sctp_packet *sctp_ootb_pkt_new(struct net *net,
					     const struct sctp_association *asoc,
L
Linus Torvalds 已提交
73
					     const struct sctp_chunk *chunk);
74 75
static void sctp_send_stale_cookie_err(struct net *net,
				       const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
76 77 78 79
				       const struct sctp_association *asoc,
				       const struct sctp_chunk *chunk,
				       sctp_cmd_seq_t *commands,
				       struct sctp_chunk *err_chunk);
80 81
static sctp_disposition_t sctp_sf_do_5_2_6_stale(struct net *net,
						 const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
82
						 const struct sctp_association *asoc,
83
						 const union sctp_subtype type,
L
Linus Torvalds 已提交
84 85
						 void *arg,
						 sctp_cmd_seq_t *commands);
86 87
static sctp_disposition_t sctp_sf_shut_8_4_5(struct net *net,
					     const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
88
					     const struct sctp_association *asoc,
89
					     const union sctp_subtype type,
L
Linus Torvalds 已提交
90 91
					     void *arg,
					     sctp_cmd_seq_t *commands);
92 93
static sctp_disposition_t sctp_sf_tabort_8_4_8(struct net *net,
					const struct sctp_endpoint *ep,
94
					const struct sctp_association *asoc,
95
					const union sctp_subtype type,
96 97
					void *arg,
					sctp_cmd_seq_t *commands);
L
Linus Torvalds 已提交
98 99
static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk);

100 101
static sctp_disposition_t sctp_stop_t1_and_abort(struct net *net,
					   sctp_cmd_seq_t *commands,
102
					   __be16 error, int sk_err,
A
Adrian Bunk 已提交
103 104 105
					   const struct sctp_association *asoc,
					   struct sctp_transport *transport);

106
static sctp_disposition_t sctp_sf_abort_violation(
107
				     struct net *net,
108
				     const struct sctp_endpoint *ep,
109 110 111 112 113 114
				     const struct sctp_association *asoc,
				     void *arg,
				     sctp_cmd_seq_t *commands,
				     const __u8 *payload,
				     const size_t paylen);

A
Adrian Bunk 已提交
115
static sctp_disposition_t sctp_sf_violation_chunklen(
116
				     struct net *net,
A
Adrian Bunk 已提交
117 118
				     const struct sctp_endpoint *ep,
				     const struct sctp_association *asoc,
119
				     const union sctp_subtype type,
A
Adrian Bunk 已提交
120 121
				     void *arg,
				     sctp_cmd_seq_t *commands);
L
Linus Torvalds 已提交
122

123
static sctp_disposition_t sctp_sf_violation_paramlen(
124
				     struct net *net,
125 126
				     const struct sctp_endpoint *ep,
				     const struct sctp_association *asoc,
127
				     const union sctp_subtype type,
128
				     void *arg, void *ext,
129 130
				     sctp_cmd_seq_t *commands);

131
static sctp_disposition_t sctp_sf_violation_ctsn(
132
				     struct net *net,
133 134
				     const struct sctp_endpoint *ep,
				     const struct sctp_association *asoc,
135
				     const union sctp_subtype type,
136 137 138
				     void *arg,
				     sctp_cmd_seq_t *commands);

139
static sctp_disposition_t sctp_sf_violation_chunk(
140
				     struct net *net,
141 142
				     const struct sctp_endpoint *ep,
				     const struct sctp_association *asoc,
143
				     const union sctp_subtype type,
144 145 146
				     void *arg,
				     sctp_cmd_seq_t *commands);

147 148 149 150
static enum sctp_ierror sctp_sf_authenticate(
				struct net *net,
				const struct sctp_endpoint *ep,
				const struct sctp_association *asoc,
151
				const union sctp_subtype type,
152
				struct sctp_chunk *chunk);
153

154 155
static sctp_disposition_t __sctp_sf_do_9_1_abort(struct net *net,
					const struct sctp_endpoint *ep,
156
					const struct sctp_association *asoc,
157
					const union sctp_subtype type,
158 159 160
					void *arg,
					sctp_cmd_seq_t *commands);

L
Linus Torvalds 已提交
161 162 163
/* Small helper function that checks if the chunk length
 * is of the appropriate length.  The 'required_length' argument
 * is set to be the size of a specific chunk we are testing.
164 165
 * Return Values:  true  = Valid length
 * 		   false = Invalid length
L
Linus Torvalds 已提交
166 167
 *
 */
168 169
static inline bool
sctp_chunk_length_valid(struct sctp_chunk *chunk, __u16 required_length)
L
Linus Torvalds 已提交
170 171 172
{
	__u16 chunk_length = ntohs(chunk->chunk_hdr->length);

173 174
	/* Previously already marked? */
	if (unlikely(chunk->pdiscard))
175
		return false;
L
Linus Torvalds 已提交
176
	if (unlikely(chunk_length < required_length))
177
		return false;
L
Linus Torvalds 已提交
178

179
	return true;
L
Linus Torvalds 已提交
180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195
}

/**********************************************************
 * These are the state functions for handling chunk events.
 **********************************************************/

/*
 * Process the final SHUTDOWN COMPLETE.
 *
 * Section: 4 (C) (diagram), 9.2
 * Upon reception of the SHUTDOWN COMPLETE chunk the endpoint will verify
 * that it is in SHUTDOWN-ACK-SENT state, if it is not the chunk should be
 * discarded. If the endpoint is in the SHUTDOWN-ACK-SENT state the endpoint
 * should stop the T2-shutdown timer and remove all knowledge of the
 * association (and thus the association enters the CLOSED state).
 *
196
 * Verification Tag: 8.5.1(C), sctpimpguide 2.41.
L
Linus Torvalds 已提交
197 198
 * C) Rules for packet carrying SHUTDOWN COMPLETE:
 * ...
199 200 201 202 203 204 205 206 207
 * - The receiver of a SHUTDOWN COMPLETE shall accept the packet
 *   if the Verification Tag field of the packet matches its own tag and
 *   the T bit is not set
 *   OR
 *   it is set to its peer's tag and the T bit is set in the Chunk
 *   Flags.
 *   Otherwise, the receiver MUST silently discard the packet
 *   and take no further action.  An endpoint MUST ignore the
 *   SHUTDOWN COMPLETE if it is not in the SHUTDOWN-ACK-SENT state.
L
Linus Torvalds 已提交
208 209 210 211 212 213 214 215 216
 *
 * Inputs
 * (endpoint, asoc, chunk)
 *
 * Outputs
 * (asoc, reply_msg, msg_up, timers, counters)
 *
 * The return value is the disposition of the chunk.
 */
217 218
sctp_disposition_t sctp_sf_do_4_C(struct net *net,
				  const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
219
				  const struct sctp_association *asoc,
220
				  const union sctp_subtype type,
L
Linus Torvalds 已提交
221 222 223 224 225 226
				  void *arg,
				  sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = arg;
	struct sctp_ulpevent *ev;

227
	if (!sctp_vtag_verify_either(chunk, asoc))
228
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
229

L
Linus Torvalds 已提交
230 231 232 233 234 235
	/* RFC 2960 6.10 Bundling
	 *
	 * An endpoint MUST NOT bundle INIT, INIT ACK or
	 * SHUTDOWN COMPLETE with any other chunks.
	 */
	if (!chunk->singleton)
236
		return sctp_sf_violation_chunk(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
237

238
	/* Make sure that the SHUTDOWN_COMPLETE chunk has a valid length. */
239
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
240
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
241
						  commands);
L
Linus Torvalds 已提交
242 243 244 245 246 247 248 249 250

	/* RFC 2960 10.2 SCTP-to-ULP
	 *
	 * H) SHUTDOWN COMPLETE notification
	 *
	 * When SCTP completes the shutdown procedures (section 9.2) this
	 * notification is passed to the upper layer.
	 */
	ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_SHUTDOWN_COMP,
251
					     0, 0, 0, NULL, GFP_ATOMIC);
252 253
	if (ev)
		sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
254
				SCTP_ULPEVENT(ev));
L
Linus Torvalds 已提交
255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272

	/* Upon reception of the SHUTDOWN COMPLETE chunk the endpoint
	 * will verify that it is in SHUTDOWN-ACK-SENT state, if it is
	 * not the chunk should be discarded. If the endpoint is in
	 * the SHUTDOWN-ACK-SENT state the endpoint should stop the
	 * T2-shutdown timer and remove all knowledge of the
	 * association (and thus the association enters the CLOSED
	 * state).
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
			SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));

	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
			SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));

	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
			SCTP_STATE(SCTP_STATE_CLOSED));

273 274
	SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS);
	SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
L
Linus Torvalds 已提交
275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292

	sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());

	return SCTP_DISPOSITION_DELETE_TCB;
}

/*
 * Respond to a normal INIT chunk.
 * We are the side that is being asked for an association.
 *
 * Section: 5.1 Normal Establishment of an Association, B
 * B) "Z" shall respond immediately with an INIT ACK chunk.  The
 *    destination IP address of the INIT ACK MUST be set to the source
 *    IP address of the INIT to which this INIT ACK is responding.  In
 *    the response, besides filling in other parameters, "Z" must set the
 *    Verification Tag field to Tag_A, and also provide its own
 *    Verification Tag (Tag_Z) in the Initiate Tag field.
 *
293
 * Verification Tag: Must be 0.
L
Linus Torvalds 已提交
294 295 296 297 298 299 300 301 302
 *
 * Inputs
 * (endpoint, asoc, chunk)
 *
 * Outputs
 * (asoc, reply_msg, msg_up, timers, counters)
 *
 * The return value is the disposition of the chunk.
 */
303 304
sctp_disposition_t sctp_sf_do_5_1B_init(struct net *net,
					const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
305
					const struct sctp_association *asoc,
306
					const union sctp_subtype type,
L
Linus Torvalds 已提交
307 308 309
					void *arg,
					sctp_cmd_seq_t *commands)
{
310 311
	struct sctp_chunk *chunk = arg, *repl, *err_chunk;
	struct sctp_unrecognized_param *unk_param;
L
Linus Torvalds 已提交
312 313 314 315 316 317 318
	struct sctp_association *new_asoc;
	struct sctp_packet *packet;
	int len;

	/* 6.10 Bundling
	 * An endpoint MUST NOT bundle INIT, INIT ACK or
	 * SHUTDOWN COMPLETE with any other chunks.
319
	 *
L
Linus Torvalds 已提交
320 321 322 323 324 325
	 * IG Section 2.11.2
	 * Furthermore, we require that the receiver of an INIT chunk MUST
	 * enforce these rules by silently discarding an arriving packet
	 * with an INIT chunk that is bundled with other chunks.
	 */
	if (!chunk->singleton)
326
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
327 328 329 330

	/* If the packet is an OOTB packet which is temporarily on the
	 * control endpoint, respond with an ABORT.
	 */
331
	if (ep == sctp_sk(net->sctp.ctl_sock)->ep) {
332
		SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
333
		return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
334
	}
L
Linus Torvalds 已提交
335 336

	/* 3.1 A packet containing an INIT chunk MUST have a zero Verification
337
	 * Tag.
L
Linus Torvalds 已提交
338 339
	 */
	if (chunk->sctp_hdr->vtag != 0)
340
		return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
341 342 343 344 345 346

	/* Make sure that the INIT chunk has a valid length.
	 * Normally, this would cause an ABORT with a Protocol Violation
	 * error, but since we don't have an association, we'll
	 * just discard the packet.
	 */
347
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
348
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
349

350 351 352 353 354 355 356
	/* If the INIT is coming toward a closing socket, we'll send back
	 * and ABORT.  Essentially, this catches the race of INIT being
	 * backloged to the socket at the same time as the user isses close().
	 * Since the socket and all its associations are going away, we
	 * can treat this OOTB
	 */
	if (sctp_sstate(ep->base.sk, CLOSING))
357
		return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
358

L
Linus Torvalds 已提交
359 360
	/* Verify the INIT chunk before processing it. */
	err_chunk = NULL;
361
	if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type,
362
			      (struct sctp_init_chunk *)chunk->chunk_hdr, chunk,
L
Linus Torvalds 已提交
363 364 365 366 367
			      &err_chunk)) {
		/* This chunk contains fatal error. It is to be discarded.
		 * Send an ABORT, with causes if there is any.
		 */
		if (err_chunk) {
368
			packet = sctp_abort_pkt_new(net, ep, asoc, arg,
L
Linus Torvalds 已提交
369
					(__u8 *)(err_chunk->chunk_hdr) +
370
					sizeof(struct sctp_chunkhdr),
L
Linus Torvalds 已提交
371
					ntohs(err_chunk->chunk_hdr->length) -
372
					sizeof(struct sctp_chunkhdr));
L
Linus Torvalds 已提交
373 374 375 376 377 378

			sctp_chunk_free(err_chunk);

			if (packet) {
				sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
						SCTP_PACKET(packet));
379
				SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
L
Linus Torvalds 已提交
380 381 382 383 384
				return SCTP_DISPOSITION_CONSUME;
			} else {
				return SCTP_DISPOSITION_NOMEM;
			}
		} else {
385
			return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg,
L
Linus Torvalds 已提交
386 387 388 389
						    commands);
		}
	}

390
	/* Grab the INIT header.  */
391
	chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data;
L
Linus Torvalds 已提交
392 393

	/* Tag the variable length parameters.  */
394
	chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(struct sctp_inithdr));
L
Linus Torvalds 已提交
395 396 397 398 399

	new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC);
	if (!new_asoc)
		goto nomem;

400 401 402 403 404
	if (sctp_assoc_set_bind_addr_from_ep(new_asoc,
					     sctp_scope(sctp_source(chunk)),
					     GFP_ATOMIC) < 0)
		goto nomem_init;

L
Linus Torvalds 已提交
405
	/* The call, sctp_process_init(), can fail on memory allocation.  */
406
	if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk),
407
			       (struct sctp_init_chunk *)chunk->chunk_hdr,
L
Linus Torvalds 已提交
408 409 410 411 412 413 414 415 416 417 418
			       GFP_ATOMIC))
		goto nomem_init;

	/* B) "Z" shall respond immediately with an INIT ACK chunk.  */

	/* If there are errors need to be reported for unknown parameters,
	 * make sure to reserve enough room in the INIT ACK for them.
	 */
	len = 0;
	if (err_chunk)
		len = ntohs(err_chunk->chunk_hdr->length) -
419
		      sizeof(struct sctp_chunkhdr);
L
Linus Torvalds 已提交
420 421 422

	repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
	if (!repl)
423
		goto nomem_init;
L
Linus Torvalds 已提交
424 425 426 427 428 429 430 431 432 433 434 435 436

	/* If there are errors need to be reported for unknown parameters,
	 * include them in the outgoing INIT ACK as "Unrecognized parameter"
	 * parameter.
	 */
	if (err_chunk) {
		/* Get the "Unrecognized parameter" parameter(s) out of the
		 * ERROR chunk generated by sctp_verify_init(). Since the
		 * error cause code for "unknown parameter" and the
		 * "Unrecognized parameter" type is the same, we can
		 * construct the parameters in INIT ACK by copying the
		 * ERROR causes over.
		 */
437
		unk_param = (struct sctp_unrecognized_param *)
L
Linus Torvalds 已提交
438
			    ((__u8 *)(err_chunk->chunk_hdr) +
439
			    sizeof(struct sctp_chunkhdr));
L
Linus Torvalds 已提交
440 441 442 443 444 445 446
		/* Replace the cause code with the "Unrecognized parameter"
		 * parameter type.
		 */
		sctp_addto_chunk(repl, len, unk_param);
		sctp_chunk_free(err_chunk);
	}

447 448
	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));

L
Linus Torvalds 已提交
449 450 451 452 453 454 455 456 457 458 459 460 461 462 463
	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));

	/*
	 * Note:  After sending out INIT ACK with the State Cookie parameter,
	 * "Z" MUST NOT allocate any resources, nor keep any states for the
	 * new association.  Otherwise, "Z" will be vulnerable to resource
	 * attacks.
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());

	return SCTP_DISPOSITION_DELETE_TCB;

nomem_init:
	sctp_association_free(new_asoc);
nomem:
464 465
	if (err_chunk)
		sctp_chunk_free(err_chunk);
L
Linus Torvalds 已提交
466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496
	return SCTP_DISPOSITION_NOMEM;
}

/*
 * Respond to a normal INIT ACK chunk.
 * We are the side that is initiating the association.
 *
 * Section: 5.1 Normal Establishment of an Association, C
 * C) Upon reception of the INIT ACK from "Z", "A" shall stop the T1-init
 *    timer and leave COOKIE-WAIT state. "A" shall then send the State
 *    Cookie received in the INIT ACK chunk in a COOKIE ECHO chunk, start
 *    the T1-cookie timer, and enter the COOKIE-ECHOED state.
 *
 *    Note: The COOKIE ECHO chunk can be bundled with any pending outbound
 *    DATA chunks, but it MUST be the first chunk in the packet and
 *    until the COOKIE ACK is returned the sender MUST NOT send any
 *    other packets to the peer.
 *
 * Verification Tag: 3.3.3
 *   If the value of the Initiate Tag in a received INIT ACK chunk is
 *   found to be 0, the receiver MUST treat it as an error and close the
 *   association by transmitting an ABORT.
 *
 * Inputs
 * (endpoint, asoc, chunk)
 *
 * Outputs
 * (asoc, reply_msg, msg_up, timers, counters)
 *
 * The return value is the disposition of the chunk.
 */
497 498
sctp_disposition_t sctp_sf_do_5_1C_ack(struct net *net,
				       const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
499
				       const struct sctp_association *asoc,
500
				       const union sctp_subtype type,
L
Linus Torvalds 已提交
501 502 503 504
				       void *arg,
				       sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = arg;
505
	struct sctp_init_chunk *initchunk;
L
Linus Torvalds 已提交
506 507 508 509
	struct sctp_chunk *err_chunk;
	struct sctp_packet *packet;

	if (!sctp_vtag_verify(chunk, asoc))
510
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
511 512 513 514 515 516

	/* 6.10 Bundling
	 * An endpoint MUST NOT bundle INIT, INIT ACK or
	 * SHUTDOWN COMPLETE with any other chunks.
	 */
	if (!chunk->singleton)
517
		return sctp_sf_violation_chunk(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
518

519
	/* Make sure that the INIT-ACK chunk has a valid length */
520
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_initack_chunk)))
521
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
522
						  commands);
L
Linus Torvalds 已提交
523
	/* Grab the INIT header.  */
524
	chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data;
L
Linus Torvalds 已提交
525 526 527

	/* Verify the INIT chunk before processing it. */
	err_chunk = NULL;
528
	if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type,
529
			      (struct sctp_init_chunk *)chunk->chunk_hdr, chunk,
L
Linus Torvalds 已提交
530 531
			      &err_chunk)) {

X
Xin Long 已提交
532
		enum sctp_error error = SCTP_ERROR_NO_RESOURCE;
533

L
Linus Torvalds 已提交
534
		/* This chunk contains fatal error. It is to be discarded.
535 536 537
		 * Send an ABORT, with causes.  If there are no causes,
		 * then there wasn't enough memory.  Just terminate
		 * the association.
L
Linus Torvalds 已提交
538 539
		 */
		if (err_chunk) {
540
			packet = sctp_abort_pkt_new(net, ep, asoc, arg,
L
Linus Torvalds 已提交
541
					(__u8 *)(err_chunk->chunk_hdr) +
542
					sizeof(struct sctp_chunkhdr),
L
Linus Torvalds 已提交
543
					ntohs(err_chunk->chunk_hdr->length) -
544
					sizeof(struct sctp_chunkhdr));
L
Linus Torvalds 已提交
545 546 547 548 549 550

			sctp_chunk_free(err_chunk);

			if (packet) {
				sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
						SCTP_PACKET(packet));
551
				SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
552
				error = SCTP_ERROR_INV_PARAM;
L
Linus Torvalds 已提交
553 554
			}
		}
555 556 557 558 559 560 561 562 563

		/* SCTP-AUTH, Section 6.3:
		 *    It should be noted that if the receiver wants to tear
		 *    down an association in an authenticated way only, the
		 *    handling of malformed packets should not result in
		 *    tearing down the association.
		 *
		 * This means that if we only want to abort associations
		 * in an authenticated way (i.e AUTH+ABORT), then we
L
Lucas De Marchi 已提交
564
		 * can't destroy this association just because the packet
565 566 567
		 * was malformed.
		 */
		if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
568
			return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
569

570 571
		SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
		return sctp_stop_t1_and_abort(net, commands, error, ECONNREFUSED,
572
						asoc, chunk->transport);
L
Linus Torvalds 已提交
573 574 575 576 577
	}

	/* Tag the variable length parameters.  Note that we never
	 * convert the parameters in an INIT chunk.
	 */
578
	chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(struct sctp_inithdr));
L
Linus Torvalds 已提交
579

580
	initchunk = (struct sctp_init_chunk *)chunk->chunk_hdr;
L
Linus Torvalds 已提交
581 582 583 584

	sctp_add_cmd_sf(commands, SCTP_CMD_PEER_INIT,
			SCTP_PEER_INIT(initchunk));

F
Frank Filz 已提交
585 586 587
	/* Reset init error count upon receipt of INIT-ACK.  */
	sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());

L
Linus Torvalds 已提交
588 589 590 591 592 593 594 595 596 597 598
	/* 5.1 C) "A" shall stop the T1-init timer and leave
	 * COOKIE-WAIT state.  "A" shall then ... start the T1-cookie
	 * timer, and enter the COOKIE-ECHOED state.
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
			SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
			SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
			SCTP_STATE(SCTP_STATE_COOKIE_ECHOED));

599 600 601 602 603
	/* SCTP-AUTH: genereate the assocition shared keys so that
	 * we can potentially signe the COOKIE-ECHO.
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_SHKEY, SCTP_NULL());

L
Linus Torvalds 已提交
604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646
	/* 5.1 C) "A" shall then send the State Cookie received in the
	 * INIT ACK chunk in a COOKIE ECHO chunk, ...
	 */
	/* If there is any errors to report, send the ERROR chunk generated
	 * for unknown parameters as well.
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_GEN_COOKIE_ECHO,
			SCTP_CHUNK(err_chunk));

	return SCTP_DISPOSITION_CONSUME;
}

/*
 * Respond to a normal COOKIE ECHO chunk.
 * We are the side that is being asked for an association.
 *
 * Section: 5.1 Normal Establishment of an Association, D
 * D) Upon reception of the COOKIE ECHO chunk, Endpoint "Z" will reply
 *    with a COOKIE ACK chunk after building a TCB and moving to
 *    the ESTABLISHED state. A COOKIE ACK chunk may be bundled with
 *    any pending DATA chunks (and/or SACK chunks), but the COOKIE ACK
 *    chunk MUST be the first chunk in the packet.
 *
 *   IMPLEMENTATION NOTE: An implementation may choose to send the
 *   Communication Up notification to the SCTP user upon reception
 *   of a valid COOKIE ECHO chunk.
 *
 * Verification Tag: 8.5.1 Exceptions in Verification Tag Rules
 * D) Rules for packet carrying a COOKIE ECHO
 *
 * - When sending a COOKIE ECHO, the endpoint MUST use the value of the
 *   Initial Tag received in the INIT ACK.
 *
 * - The receiver of a COOKIE ECHO follows the procedures in Section 5.
 *
 * Inputs
 * (endpoint, asoc, chunk)
 *
 * Outputs
 * (asoc, reply_msg, msg_up, timers, counters)
 *
 * The return value is the disposition of the chunk.
 */
647 648
sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net,
				      const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
649
				      const struct sctp_association *asoc,
650
				      const union sctp_subtype type, void *arg,
L
Linus Torvalds 已提交
651 652 653 654
				      sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = arg;
	struct sctp_association *new_asoc;
655
	struct sctp_init_chunk *peer_init;
L
Linus Torvalds 已提交
656
	struct sctp_chunk *repl;
657
	struct sctp_ulpevent *ev, *ai_ev = NULL;
L
Linus Torvalds 已提交
658 659
	int error = 0;
	struct sctp_chunk *err_chk_p;
660
	struct sock *sk;
L
Linus Torvalds 已提交
661 662 663 664

	/* If the packet is an OOTB packet which is temporarily on the
	 * control endpoint, respond with an ABORT.
	 */
665
	if (ep == sctp_sk(net->sctp.ctl_sock)->ep) {
666
		SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
667
		return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
668
	}
L
Linus Torvalds 已提交
669 670 671 672 673 674

	/* Make sure that the COOKIE_ECHO chunk has a valid length.
	 * In this case, we check that we have enough for at least a
	 * chunk header.  More detailed verification is done
	 * in sctp_unpack_cookie().
	 */
675
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
676
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
677

678 679 680 681 682 683 684
	/* If the endpoint is not listening or if the number of associations
	 * on the TCP-style socket exceed the max backlog, respond with an
	 * ABORT.
	 */
	sk = ep->base.sk;
	if (!sctp_sstate(sk, LISTENING) ||
	    (sctp_style(sk, TCP) && sk_acceptq_is_full(sk)))
685
		return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
686

L
Linus Torvalds 已提交
687 688 689
	/* "Decode" the chunk.  We have no optional parameters so we
	 * are in good shape.
	 */
690
	chunk->subh.cookie_hdr =
L
Linus Torvalds 已提交
691
		(struct sctp_signed_cookie *)chunk->skb->data;
692
	if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
693
					 sizeof(struct sctp_chunkhdr)))
694
		goto nomem;
L
Linus Torvalds 已提交
695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717

	/* 5.1 D) Upon reception of the COOKIE ECHO chunk, Endpoint
	 * "Z" will reply with a COOKIE ACK chunk after building a TCB
	 * and moving to the ESTABLISHED state.
	 */
	new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, &error,
				      &err_chk_p);

	/* FIXME:
	 * If the re-build failed, what is the proper error path
	 * from here?
	 *
	 * [We should abort the association. --piggy]
	 */
	if (!new_asoc) {
		/* FIXME: Several errors are possible.  A bad cookie should
		 * be silently discarded, but think about logging it too.
		 */
		switch (error) {
		case -SCTP_IERROR_NOMEM:
			goto nomem;

		case -SCTP_IERROR_STALE_COOKIE:
718
			sctp_send_stale_cookie_err(net, ep, asoc, chunk, commands,
L
Linus Torvalds 已提交
719
						   err_chk_p);
720
			return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
721 722 723

		case -SCTP_IERROR_BAD_SIG:
		default:
724
			return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
725
		}
L
Linus Torvalds 已提交
726 727 728
	}


729 730 731
	/* Delay state machine commands until later.
	 *
	 * Re-build the bind address for the association is done in
L
Linus Torvalds 已提交
732 733 734 735 736 737 738
	 * the sctp_unpack_cookie() already.
	 */
	/* This is a brand-new association, so these are not yet side
	 * effects--it is safe to run them here.
	 */
	peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];

739
	if (!sctp_process_init(new_asoc, chunk,
740
			       &chunk->subh.cookie_hdr->c.peer_addr,
L
Linus Torvalds 已提交
741 742 743
			       peer_init, GFP_ATOMIC))
		goto nomem_init;

744 745 746 747 748 749 750 751
	/* SCTP-AUTH:  Now that we've populate required fields in
	 * sctp_process_init, set up the assocaition shared keys as
	 * necessary so that we can potentially authenticate the ACK
	 */
	error = sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC);
	if (error)
		goto nomem_init;

752 753 754 755 756 757 758 759
	/* SCTP-AUTH:  auth_chunk pointer is only set when the cookie-echo
	 * is supposed to be authenticated and we have to do delayed
	 * authentication.  We've just recreated the association using
	 * the information in the cookie and now it's much easier to
	 * do the authentication.
	 */
	if (chunk->auth_chunk) {
		struct sctp_chunk auth;
760
		enum sctp_ierror ret;
761

762 763 764 765 766 767
		/* Make sure that we and the peer are AUTH capable */
		if (!net->sctp.auth_enable || !new_asoc->peer.auth_capable) {
			sctp_association_free(new_asoc);
			return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
		}

768 769 770 771
		/* set-up our fake chunk so that we can process it */
		auth.skb = chunk->auth_chunk;
		auth.asoc = chunk->asoc;
		auth.sctp_hdr = chunk->sctp_hdr;
772 773 774 775
		auth.chunk_hdr = (struct sctp_chunkhdr *)
					skb_push(chunk->auth_chunk,
						 sizeof(struct sctp_chunkhdr));
		skb_pull(chunk->auth_chunk, sizeof(struct sctp_chunkhdr));
776 777
		auth.transport = chunk->transport;

778
		ret = sctp_sf_authenticate(net, ep, new_asoc, type, &auth);
779 780
		if (ret != SCTP_IERROR_NO_ERROR) {
			sctp_association_free(new_asoc);
781
			return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
782 783 784
		}
	}

L
Linus Torvalds 已提交
785 786
	repl = sctp_make_cookie_ack(new_asoc, chunk);
	if (!repl)
787
		goto nomem_init;
L
Linus Torvalds 已提交
788 789 790 791 792 793 794 795 796 797

	/* RFC 2960 5.1 Normal Establishment of an Association
	 *
	 * D) IMPLEMENTATION NOTE: An implementation may choose to
	 * send the Communication Up notification to the SCTP user
	 * upon reception of a valid COOKIE ECHO chunk.
	 */
	ev = sctp_ulpevent_make_assoc_change(new_asoc, 0, SCTP_COMM_UP, 0,
					     new_asoc->c.sinit_num_ostreams,
					     new_asoc->c.sinit_max_instreams,
798
					     NULL, GFP_ATOMIC);
L
Linus Torvalds 已提交
799 800 801
	if (!ev)
		goto nomem_ev;

802
	/* Sockets API Draft Section 5.3.1.6
803
	 * When a peer sends a Adaptation Layer Indication parameter , SCTP
L
Linus Torvalds 已提交
804
	 * delivers this notification to inform the application that of the
805
	 * peers requested adaptation layer.
L
Linus Torvalds 已提交
806
	 */
807 808
	if (new_asoc->peer.adaptation_ind) {
		ai_ev = sctp_ulpevent_make_adaptation_indication(new_asoc,
L
Linus Torvalds 已提交
809
							    GFP_ATOMIC);
810 811 812 813 814 815 816 817 818 819 820 821
		if (!ai_ev)
			goto nomem_aiev;
	}

	/* Add all the state machine commands now since we've created
	 * everything.  This way we don't introduce memory corruptions
	 * during side-effect processing and correclty count established
	 * associations.
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
			SCTP_STATE(SCTP_STATE_ESTABLISHED));
822 823
	SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
	SCTP_INC_STATS(net, SCTP_MIB_PASSIVEESTABS);
824 825
	sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());

826
	if (new_asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
827 828 829 830 831 832 833 834 835 836 837
		sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
				SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));

	/* This will send the COOKIE ACK */
	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));

	/* Queue the ASSOC_CHANGE event */
	sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));

	/* Send up the Adaptation Layer Indication event */
	if (ai_ev)
L
Linus Torvalds 已提交
838
		sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
839
				SCTP_ULPEVENT(ai_ev));
L
Linus Torvalds 已提交
840 841 842

	return SCTP_DISPOSITION_CONSUME;

843 844
nomem_aiev:
	sctp_ulpevent_free(ev);
L
Linus Torvalds 已提交
845 846 847 848 849 850 851 852 853 854
nomem_ev:
	sctp_chunk_free(repl);
nomem_init:
	sctp_association_free(new_asoc);
nomem:
	return SCTP_DISPOSITION_NOMEM;
}

/*
 * Respond to a normal COOKIE ACK chunk.
855
 * We are the side that is asking for an association.
L
Linus Torvalds 已提交
856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873
 *
 * RFC 2960 5.1 Normal Establishment of an Association
 *
 * E) Upon reception of the COOKIE ACK, endpoint "A" will move from the
 *    COOKIE-ECHOED state to the ESTABLISHED state, stopping the T1-cookie
 *    timer. It may also notify its ULP about the successful
 *    establishment of the association with a Communication Up
 *    notification (see Section 10).
 *
 * Verification Tag:
 * Inputs
 * (endpoint, asoc, chunk)
 *
 * Outputs
 * (asoc, reply_msg, msg_up, timers, counters)
 *
 * The return value is the disposition of the chunk.
 */
874 875
sctp_disposition_t sctp_sf_do_5_1E_ca(struct net *net,
				      const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
876
				      const struct sctp_association *asoc,
877
				      const union sctp_subtype type, void *arg,
L
Linus Torvalds 已提交
878 879 880 881 882 883
				      sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = arg;
	struct sctp_ulpevent *ev;

	if (!sctp_vtag_verify(chunk, asoc))
884
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
885 886 887 888

	/* Verify that the chunk length for the COOKIE-ACK is OK.
	 * If we don't do this, any bundled chunks may be junked.
	 */
889
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
890
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
L
Linus Torvalds 已提交
891 892 893 894 895 896 897 898
						  commands);

	/* Reset init error count upon receipt of COOKIE-ACK,
	 * to avoid problems with the managemement of this
	 * counter in stale cookie situations when a transition back
	 * from the COOKIE-ECHOED state to the COOKIE-WAIT
	 * state is performed.
	 */
F
Frank Filz 已提交
899
	sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());
L
Linus Torvalds 已提交
900 901 902 903 904 905 906 907 908 909 910

	/* RFC 2960 5.1 Normal Establishment of an Association
	 *
	 * E) Upon reception of the COOKIE ACK, endpoint "A" will move
	 * from the COOKIE-ECHOED state to the ESTABLISHED state,
	 * stopping the T1-cookie timer.
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
			SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
			SCTP_STATE(SCTP_STATE_ESTABLISHED));
911 912
	SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
	SCTP_INC_STATS(net, SCTP_MIB_ACTIVEESTABS);
L
Linus Torvalds 已提交
913
	sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
914
	if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
L
Linus Torvalds 已提交
915 916 917 918 919 920 921 922 923 924
		sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
				SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));

	/* It may also notify its ULP about the successful
	 * establishment of the association with a Communication Up
	 * notification (see Section 10).
	 */
	ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_COMM_UP,
					     0, asoc->c.sinit_num_ostreams,
					     asoc->c.sinit_max_instreams,
925
					     NULL, GFP_ATOMIC);
L
Linus Torvalds 已提交
926 927 928 929 930 931 932

	if (!ev)
		goto nomem;

	sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));

	/* Sockets API Draft Section 5.3.1.6
933
	 * When a peer sends a Adaptation Layer Indication parameter , SCTP
L
Linus Torvalds 已提交
934
	 * delivers this notification to inform the application that of the
935
	 * peers requested adaptation layer.
L
Linus Torvalds 已提交
936
	 */
937 938
	if (asoc->peer.adaptation_ind) {
		ev = sctp_ulpevent_make_adaptation_indication(asoc, GFP_ATOMIC);
L
Linus Torvalds 已提交
939 940 941 942 943 944 945 946 947 948 949 950 951 952 953
		if (!ev)
			goto nomem;

		sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
				SCTP_ULPEVENT(ev));
	}

	return SCTP_DISPOSITION_CONSUME;
nomem:
	return SCTP_DISPOSITION_NOMEM;
}

/* Generate and sendout a heartbeat packet.  */
static sctp_disposition_t sctp_sf_heartbeat(const struct sctp_endpoint *ep,
					    const struct sctp_association *asoc,
954
					    const union sctp_subtype type,
L
Linus Torvalds 已提交
955 956 957 958 959 960 961
					    void *arg,
					    sctp_cmd_seq_t *commands)
{
	struct sctp_transport *transport = (struct sctp_transport *) arg;
	struct sctp_chunk *reply;

	/* Send a heartbeat to our peer.  */
962
	reply = sctp_make_heartbeat(asoc, transport);
L
Linus Torvalds 已提交
963 964 965 966 967 968 969 970 971 972 973 974 975 976
	if (!reply)
		return SCTP_DISPOSITION_NOMEM;

	/* Set rto_pending indicating that an RTT measurement
	 * is started with this heartbeat chunk.
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_RTO_PENDING,
			SCTP_TRANSPORT(transport));

	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
	return SCTP_DISPOSITION_CONSUME;
}

/* Generate a HEARTBEAT packet on the given transport.  */
977 978
sctp_disposition_t sctp_sf_sendbeat_8_3(struct net *net,
					const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
979
					const struct sctp_association *asoc,
980
					const union sctp_subtype type,
L
Linus Torvalds 已提交
981 982 983 984 985
					void *arg,
					sctp_cmd_seq_t *commands)
{
	struct sctp_transport *transport = (struct sctp_transport *) arg;

986
	if (asoc->overall_error_count >= asoc->max_retrans) {
987 988
		sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
				SCTP_ERROR(ETIMEDOUT));
L
Linus Torvalds 已提交
989 990
		/* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
991
				SCTP_PERR(SCTP_ERROR_NO_ERROR));
992 993
		SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
		SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
L
Linus Torvalds 已提交
994 995 996 997 998 999 1000 1001 1002 1003
		return SCTP_DISPOSITION_DELETE_TCB;
	}

	/* Section 3.3.5.
	 * The Sender-specific Heartbeat Info field should normally include
	 * information about the sender's current time when this HEARTBEAT
	 * chunk is sent and the destination transport address to which this
	 * HEARTBEAT is sent (see Section 8.3).
	 */

1004
	if (transport->param_flags & SPP_HB_ENABLE) {
L
Linus Torvalds 已提交
1005 1006 1007 1008
		if (SCTP_DISPOSITION_NOMEM ==
				sctp_sf_heartbeat(ep, asoc, type, arg,
						  commands))
			return SCTP_DISPOSITION_NOMEM;
1009

L
Linus Torvalds 已提交
1010 1011 1012
		/* Set transport error counter and association error counter
		 * when sending heartbeat.
		 */
1013
		sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_HB_SENT,
L
Linus Torvalds 已提交
1014 1015
				SCTP_TRANSPORT(transport));
	}
1016 1017
	sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_IDLE,
			SCTP_TRANSPORT(transport));
L
Linus Torvalds 已提交
1018 1019 1020
	sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMER_UPDATE,
			SCTP_TRANSPORT(transport));

1021
	return SCTP_DISPOSITION_CONSUME;
L
Linus Torvalds 已提交
1022 1023
}

X
Xin Long 已提交
1024 1025 1026 1027
/* resend asoc strreset_chunk.  */
sctp_disposition_t sctp_sf_send_reconf(struct net *net,
				       const struct sctp_endpoint *ep,
				       const struct sctp_association *asoc,
1028
				       const union sctp_subtype type, void *arg,
X
Xin Long 已提交
1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051
				       sctp_cmd_seq_t *commands)
{
	struct sctp_transport *transport = arg;

	if (asoc->overall_error_count >= asoc->max_retrans) {
		sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
				SCTP_ERROR(ETIMEDOUT));
		/* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
				SCTP_PERR(SCTP_ERROR_NO_ERROR));
		SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
		SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
		return SCTP_DISPOSITION_DELETE_TCB;
	}

	sctp_chunk_hold(asoc->strreset_chunk);
	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
			SCTP_CHUNK(asoc->strreset_chunk));
	sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE, SCTP_TRANSPORT(transport));

	return SCTP_DISPOSITION_CONSUME;
}

L
Linus Torvalds 已提交
1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075
/*
 * Process an heartbeat request.
 *
 * Section: 8.3 Path Heartbeat
 * The receiver of the HEARTBEAT should immediately respond with a
 * HEARTBEAT ACK that contains the Heartbeat Information field copied
 * from the received HEARTBEAT chunk.
 *
 * Verification Tag:  8.5 Verification Tag [Normal verification]
 * When receiving an SCTP packet, the endpoint MUST ensure that the
 * value in the Verification Tag field of the received SCTP packet
 * matches its own Tag. If the received Verification Tag value does not
 * match the receiver's own tag value, the receiver shall silently
 * discard the packet and shall not process it any further except for
 * those cases listed in Section 8.5.1 below.
 *
 * Inputs
 * (endpoint, asoc, chunk)
 *
 * Outputs
 * (asoc, reply_msg, msg_up, timers, counters)
 *
 * The return value is the disposition of the chunk.
 */
1076 1077
sctp_disposition_t sctp_sf_beat_8_3(struct net *net,
				    const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
1078
				    const struct sctp_association *asoc,
1079
				    const union sctp_subtype type,
L
Linus Torvalds 已提交
1080 1081 1082
				    void *arg,
				    sctp_cmd_seq_t *commands)
{
1083
	struct sctp_paramhdr *param_hdr;
L
Linus Torvalds 已提交
1084 1085 1086 1087 1088
	struct sctp_chunk *chunk = arg;
	struct sctp_chunk *reply;
	size_t paylen = 0;

	if (!sctp_vtag_verify(chunk, asoc))
1089
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
1090 1091

	/* Make sure that the HEARTBEAT chunk has a valid length. */
1092 1093
	if (!sctp_chunk_length_valid(chunk,
				     sizeof(struct sctp_heartbeat_chunk)))
1094
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
L
Linus Torvalds 已提交
1095 1096 1097 1098 1099 1100
						  commands);

	/* 8.3 The receiver of the HEARTBEAT should immediately
	 * respond with a HEARTBEAT ACK that contains the Heartbeat
	 * Information field copied from the received HEARTBEAT chunk.
	 */
1101
	chunk->subh.hb_hdr = (struct sctp_heartbeathdr *)chunk->skb->data;
1102
	param_hdr = (struct sctp_paramhdr *)chunk->subh.hb_hdr;
1103
	paylen = ntohs(chunk->chunk_hdr->length) - sizeof(struct sctp_chunkhdr);
1104 1105 1106 1107 1108

	if (ntohs(param_hdr->length) > paylen)
		return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
						  param_hdr, commands);

1109 1110
	if (!pskb_pull(chunk->skb, paylen))
		goto nomem;
L
Linus Torvalds 已提交
1111

1112
	reply = sctp_make_heartbeat_ack(asoc, chunk, param_hdr, paylen);
L
Linus Torvalds 已提交
1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150
	if (!reply)
		goto nomem;

	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
	return SCTP_DISPOSITION_CONSUME;

nomem:
	return SCTP_DISPOSITION_NOMEM;
}

/*
 * Process the returning HEARTBEAT ACK.
 *
 * Section: 8.3 Path Heartbeat
 * Upon the receipt of the HEARTBEAT ACK, the sender of the HEARTBEAT
 * should clear the error counter of the destination transport
 * address to which the HEARTBEAT was sent, and mark the destination
 * transport address as active if it is not so marked. The endpoint may
 * optionally report to the upper layer when an inactive destination
 * address is marked as active due to the reception of the latest
 * HEARTBEAT ACK. The receiver of the HEARTBEAT ACK must also
 * clear the association overall error count as well (as defined
 * in section 8.1).
 *
 * The receiver of the HEARTBEAT ACK should also perform an RTT
 * measurement for that destination transport address using the time
 * value carried in the HEARTBEAT ACK chunk.
 *
 * Verification Tag:  8.5 Verification Tag [Normal verification]
 *
 * Inputs
 * (endpoint, asoc, chunk)
 *
 * Outputs
 * (asoc, reply_msg, msg_up, timers, counters)
 *
 * The return value is the disposition of the chunk.
 */
1151 1152
sctp_disposition_t sctp_sf_backbeat_8_3(struct net *net,
					const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
1153
					const struct sctp_association *asoc,
1154
					const union sctp_subtype type,
L
Linus Torvalds 已提交
1155 1156 1157 1158 1159 1160 1161 1162 1163 1164
					void *arg,
					sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = arg;
	union sctp_addr from_addr;
	struct sctp_transport *link;
	sctp_sender_hb_info_t *hbinfo;
	unsigned long max_interval;

	if (!sctp_vtag_verify(chunk, asoc))
1165
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
1166 1167

	/* Make sure that the HEARTBEAT-ACK chunk has a valid length.  */
1168
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr) +
1169
					    sizeof(sctp_sender_hb_info_t)))
1170
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
L
Linus Torvalds 已提交
1171 1172 1173
						  commands);

	hbinfo = (sctp_sender_hb_info_t *) chunk->skb->data;
1174 1175 1176 1177 1178 1179
	/* Make sure that the length of the parameter is what we expect */
	if (ntohs(hbinfo->param_hdr.length) !=
				    sizeof(sctp_sender_hb_info_t)) {
		return SCTP_DISPOSITION_DISCARD;
	}

L
Linus Torvalds 已提交
1180
	from_addr = hbinfo->daddr;
1181
	link = sctp_assoc_lookup_paddr(asoc, &from_addr);
L
Linus Torvalds 已提交
1182 1183

	/* This should never happen, but lets log it if so.  */
F
Frank Filz 已提交
1184 1185
	if (unlikely(!link)) {
		if (from_addr.sa.sa_family == AF_INET6) {
1186 1187 1188 1189
			net_warn_ratelimited("%s association %p could not find address %pI6\n",
					     __func__,
					     asoc,
					     &from_addr.v6.sin6_addr);
F
Frank Filz 已提交
1190
		} else {
1191 1192 1193 1194
			net_warn_ratelimited("%s association %p could not find address %pI4\n",
					     __func__,
					     asoc,
					     &from_addr.v4.sin_addr.s_addr);
F
Frank Filz 已提交
1195
		}
L
Linus Torvalds 已提交
1196 1197 1198
		return SCTP_DISPOSITION_DISCARD;
	}

1199 1200 1201 1202
	/* Validate the 64-bit random nonce. */
	if (hbinfo->hb_nonce != link->hb_nonce)
		return SCTP_DISPOSITION_DISCARD;

1203
	max_interval = link->hbinterval + link->rto;
L
Linus Torvalds 已提交
1204 1205 1206 1207

	/* Check if the timestamp looks valid.  */
	if (time_after(hbinfo->sent_at, jiffies) ||
	    time_after(jiffies, hbinfo->sent_at + max_interval)) {
1208 1209 1210
		pr_debug("%s: HEARTBEAT ACK with invalid timestamp received "
			 "for transport:%p\n", __func__, link);

L
Linus Torvalds 已提交
1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227
		return SCTP_DISPOSITION_DISCARD;
	}

	/* 8.3 Upon the receipt of the HEARTBEAT ACK, the sender of
	 * the HEARTBEAT should clear the error counter of the
	 * destination transport address to which the HEARTBEAT was
	 * sent and mark the destination transport address as active if
	 * it is not so marked.
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_ON, SCTP_TRANSPORT(link));

	return SCTP_DISPOSITION_CONSUME;
}

/* Helper function to send out an abort for the restart
 * condition.
 */
1228
static int sctp_sf_send_restart_abort(struct net *net, union sctp_addr *ssa,
L
Linus Torvalds 已提交
1229 1230 1231 1232 1233 1234 1235 1236
				      struct sctp_chunk *init,
				      sctp_cmd_seq_t *commands)
{
	int len;
	struct sctp_packet *pkt;
	union sctp_addr_param *addrparm;
	struct sctp_errhdr *errhdr;
	struct sctp_endpoint *ep;
1237
	char buffer[sizeof(*errhdr) + sizeof(*addrparm)];
L
Linus Torvalds 已提交
1238 1239 1240 1241 1242 1243 1244 1245 1246 1247
	struct sctp_af *af = sctp_get_af_specific(ssa->v4.sin_family);

	/* Build the error on the stack.   We are way to malloc crazy
	 * throughout the code today.
	 */
	errhdr = (struct sctp_errhdr *)buffer;
	addrparm = (union sctp_addr_param *)errhdr->variable;

	/* Copy into a parm format. */
	len = af->to_addr_param(ssa, addrparm);
1248
	len += sizeof(*errhdr);
L
Linus Torvalds 已提交
1249 1250 1251 1252 1253

	errhdr->cause = SCTP_ERROR_RESTART;
	errhdr->length = htons(len);

	/* Assign to the control socket. */
1254
	ep = sctp_sk(net->sctp.ctl_sock)->ep;
L
Linus Torvalds 已提交
1255 1256 1257 1258

	/* Association is NULL since this may be a restart attack and we
	 * want to send back the attacker's vtag.
	 */
1259
	pkt = sctp_abort_pkt_new(net, ep, NULL, init, errhdr, len);
L
Linus Torvalds 已提交
1260 1261 1262 1263 1264

	if (!pkt)
		goto out;
	sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT, SCTP_PACKET(pkt));

1265
	SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
L
Linus Torvalds 已提交
1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276

	/* Discard the rest of the inbound packet. */
	sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());

out:
	/* Even if there is no memory, treat as a failure so
	 * the packet will get dropped.
	 */
	return 0;
}

J
Joe Perches 已提交
1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288
static bool list_has_sctp_addr(const struct list_head *list,
			       union sctp_addr *ipaddr)
{
	struct sctp_transport *addr;

	list_for_each_entry(addr, list, transports) {
		if (sctp_cmp_addr_exact(ipaddr, &addr->ipaddr))
			return true;
	}

	return false;
}
L
Linus Torvalds 已提交
1289 1290 1291 1292 1293 1294 1295 1296
/* A restart is occurring, check to make sure no new addresses
 * are being added as we may be under a takeover attack.
 */
static int sctp_sf_check_restart_addrs(const struct sctp_association *new_asoc,
				       const struct sctp_association *asoc,
				       struct sctp_chunk *init,
				       sctp_cmd_seq_t *commands)
{
1297
	struct net *net = sock_net(new_asoc->base.sk);
J
Joe Perches 已提交
1298 1299
	struct sctp_transport *new_addr;
	int ret = 1;
L
Linus Torvalds 已提交
1300

J
Joe Perches 已提交
1301
	/* Implementor's Guide - Section 5.2.2
L
Linus Torvalds 已提交
1302 1303 1304 1305 1306 1307 1308 1309 1310 1311
	 * ...
	 * Before responding the endpoint MUST check to see if the
	 * unexpected INIT adds new addresses to the association. If new
	 * addresses are added to the association, the endpoint MUST respond
	 * with an ABORT..
	 */

	/* Search through all current addresses and make sure
	 * we aren't adding any new ones.
	 */
1312
	list_for_each_entry(new_addr, &new_asoc->peer.transport_addr_list,
J
Joe Perches 已提交
1313 1314 1315
			    transports) {
		if (!list_has_sctp_addr(&asoc->peer.transport_addr_list,
					&new_addr->ipaddr)) {
1316
			sctp_sf_send_restart_abort(net, &new_addr->ipaddr, init,
J
Joe Perches 已提交
1317 1318
						   commands);
			ret = 0;
L
Linus Torvalds 已提交
1319
			break;
J
Joe Perches 已提交
1320
		}
L
Linus Torvalds 已提交
1321 1322 1323
	}

	/* Return success if all addresses were found. */
J
Joe Perches 已提交
1324
	return ret;
L
Linus Torvalds 已提交
1325 1326 1327 1328 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352 1353 1354 1355 1356 1357
}

/* Populate the verification/tie tags based on overlapping INIT
 * scenario.
 *
 * Note: Do not use in CLOSED or SHUTDOWN-ACK-SENT state.
 */
static void sctp_tietags_populate(struct sctp_association *new_asoc,
				  const struct sctp_association *asoc)
{
	switch (asoc->state) {

	/* 5.2.1 INIT received in COOKIE-WAIT or COOKIE-ECHOED State */

	case SCTP_STATE_COOKIE_WAIT:
		new_asoc->c.my_vtag     = asoc->c.my_vtag;
		new_asoc->c.my_ttag     = asoc->c.my_vtag;
		new_asoc->c.peer_ttag   = 0;
		break;

	case SCTP_STATE_COOKIE_ECHOED:
		new_asoc->c.my_vtag     = asoc->c.my_vtag;
		new_asoc->c.my_ttag     = asoc->c.my_vtag;
		new_asoc->c.peer_ttag   = asoc->c.peer_vtag;
		break;

	/* 5.2.2 Unexpected INIT in States Other than CLOSED, COOKIE-ECHOED,
	 * COOKIE-WAIT and SHUTDOWN-ACK-SENT
	 */
	default:
		new_asoc->c.my_ttag   = asoc->c.my_vtag;
		new_asoc->c.peer_ttag = asoc->c.peer_vtag;
		break;
1358
	}
L
Linus Torvalds 已提交
1359 1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415

	/* Other parameters for the endpoint SHOULD be copied from the
	 * existing parameters of the association (e.g. number of
	 * outbound streams) into the INIT ACK and cookie.
	 */
	new_asoc->rwnd                  = asoc->rwnd;
	new_asoc->c.sinit_num_ostreams  = asoc->c.sinit_num_ostreams;
	new_asoc->c.sinit_max_instreams = asoc->c.sinit_max_instreams;
	new_asoc->c.initial_tsn         = asoc->c.initial_tsn;
}

/*
 * Compare vtag/tietag values to determine unexpected COOKIE-ECHO
 * handling action.
 *
 * RFC 2960 5.2.4 Handle a COOKIE ECHO when a TCB exists.
 *
 * Returns value representing action to be taken.   These action values
 * correspond to Action/Description values in RFC 2960, Table 2.
 */
static char sctp_tietags_compare(struct sctp_association *new_asoc,
				 const struct sctp_association *asoc)
{
	/* In this case, the peer may have restarted.  */
	if ((asoc->c.my_vtag != new_asoc->c.my_vtag) &&
	    (asoc->c.peer_vtag != new_asoc->c.peer_vtag) &&
	    (asoc->c.my_vtag == new_asoc->c.my_ttag) &&
	    (asoc->c.peer_vtag == new_asoc->c.peer_ttag))
		return 'A';

	/* Collision case B. */
	if ((asoc->c.my_vtag == new_asoc->c.my_vtag) &&
	    ((asoc->c.peer_vtag != new_asoc->c.peer_vtag) ||
	     (0 == asoc->c.peer_vtag))) {
		return 'B';
	}

	/* Collision case D. */
	if ((asoc->c.my_vtag == new_asoc->c.my_vtag) &&
	    (asoc->c.peer_vtag == new_asoc->c.peer_vtag))
		return 'D';

	/* Collision case C. */
	if ((asoc->c.my_vtag != new_asoc->c.my_vtag) &&
	    (asoc->c.peer_vtag == new_asoc->c.peer_vtag) &&
	    (0 == new_asoc->c.my_ttag) &&
	    (0 == new_asoc->c.peer_ttag))
		return 'C';

	/* No match to any of the special cases; discard this packet. */
	return 'E';
}

/* Common helper routine for both duplicate and simulataneous INIT
 * chunk handling.
 */
static sctp_disposition_t sctp_sf_do_unexpected_init(
1416
	struct net *net,
L
Linus Torvalds 已提交
1417 1418
	const struct sctp_endpoint *ep,
	const struct sctp_association *asoc,
1419
	const union sctp_subtype type,
L
Linus Torvalds 已提交
1420 1421
	void *arg, sctp_cmd_seq_t *commands)
{
1422 1423
	struct sctp_chunk *chunk = arg, *repl, *err_chunk;
	struct sctp_unrecognized_param *unk_param;
L
Linus Torvalds 已提交
1424 1425
	struct sctp_association *new_asoc;
	struct sctp_packet *packet;
1426
	sctp_disposition_t retval;
L
Linus Torvalds 已提交
1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438
	int len;

	/* 6.10 Bundling
	 * An endpoint MUST NOT bundle INIT, INIT ACK or
	 * SHUTDOWN COMPLETE with any other chunks.
	 *
	 * IG Section 2.11.2
	 * Furthermore, we require that the receiver of an INIT chunk MUST
	 * enforce these rules by silently discarding an arriving packet
	 * with an INIT chunk that is bundled with other chunks.
	 */
	if (!chunk->singleton)
1439
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
1440 1441

	/* 3.1 A packet containing an INIT chunk MUST have a zero Verification
1442
	 * Tag.
L
Linus Torvalds 已提交
1443 1444
	 */
	if (chunk->sctp_hdr->vtag != 0)
1445
		return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
1446 1447 1448 1449 1450

	/* Make sure that the INIT chunk has a valid length.
	 * In this case, we generate a protocol violation since we have
	 * an association established.
	 */
1451
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
1452
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
L
Linus Torvalds 已提交
1453 1454
						  commands);
	/* Grab the INIT header.  */
1455
	chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data;
L
Linus Torvalds 已提交
1456 1457

	/* Tag the variable length parameters.  */
1458
	chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(struct sctp_inithdr));
L
Linus Torvalds 已提交
1459 1460 1461

	/* Verify the INIT chunk before processing it. */
	err_chunk = NULL;
1462
	if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type,
1463
			      (struct sctp_init_chunk *)chunk->chunk_hdr, chunk,
L
Linus Torvalds 已提交
1464 1465 1466 1467 1468
			      &err_chunk)) {
		/* This chunk contains fatal error. It is to be discarded.
		 * Send an ABORT, with causes if there is any.
		 */
		if (err_chunk) {
1469
			packet = sctp_abort_pkt_new(net, ep, asoc, arg,
L
Linus Torvalds 已提交
1470
					(__u8 *)(err_chunk->chunk_hdr) +
1471
					sizeof(struct sctp_chunkhdr),
L
Linus Torvalds 已提交
1472
					ntohs(err_chunk->chunk_hdr->length) -
1473
					sizeof(struct sctp_chunkhdr));
L
Linus Torvalds 已提交
1474 1475 1476 1477

			if (packet) {
				sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
						SCTP_PACKET(packet));
1478
				SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
L
Linus Torvalds 已提交
1479 1480 1481 1482 1483 1484
				retval = SCTP_DISPOSITION_CONSUME;
			} else {
				retval = SCTP_DISPOSITION_NOMEM;
			}
			goto cleanup;
		} else {
1485
			return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg,
L
Linus Torvalds 已提交
1486 1487 1488 1489 1490 1491 1492 1493 1494 1495 1496 1497 1498 1499 1500
						    commands);
		}
	}

	/*
	 * Other parameters for the endpoint SHOULD be copied from the
	 * existing parameters of the association (e.g. number of
	 * outbound streams) into the INIT ACK and cookie.
	 * FIXME:  We are copying parameters from the endpoint not the
	 * association.
	 */
	new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC);
	if (!new_asoc)
		goto nomem;

1501 1502 1503 1504
	if (sctp_assoc_set_bind_addr_from_ep(new_asoc,
				sctp_scope(sctp_source(chunk)), GFP_ATOMIC) < 0)
		goto nomem;

L
Linus Torvalds 已提交
1505 1506 1507 1508
	/* In the outbound INIT ACK the endpoint MUST copy its current
	 * Verification Tag and Peers Verification tag into a reserved
	 * place (local tie-tag and per tie-tag) within the state cookie.
	 */
1509
	if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk),
1510
			       (struct sctp_init_chunk *)chunk->chunk_hdr,
1511 1512
			       GFP_ATOMIC))
		goto nomem;
L
Linus Torvalds 已提交
1513 1514 1515 1516 1517 1518 1519 1520 1521 1522

	/* Make sure no new addresses are being added during the
	 * restart.   Do not do this check for COOKIE-WAIT state,
	 * since there are no peer addresses to check against.
	 * Upon return an ABORT will have been sent if needed.
	 */
	if (!sctp_state(asoc, COOKIE_WAIT)) {
		if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk,
						 commands)) {
			retval = SCTP_DISPOSITION_CONSUME;
1523
			goto nomem_retval;
L
Linus Torvalds 已提交
1524 1525 1526 1527 1528 1529 1530 1531 1532 1533 1534 1535 1536
		}
	}

	sctp_tietags_populate(new_asoc, asoc);

	/* B) "Z" shall respond immediately with an INIT ACK chunk.  */

	/* If there are errors need to be reported for unknown parameters,
	 * make sure to reserve enough room in the INIT ACK for them.
	 */
	len = 0;
	if (err_chunk) {
		len = ntohs(err_chunk->chunk_hdr->length) -
1537
		      sizeof(struct sctp_chunkhdr);
L
Linus Torvalds 已提交
1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548 1549 1550 1551 1552 1553 1554 1555
	}

	repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
	if (!repl)
		goto nomem;

	/* If there are errors need to be reported for unknown parameters,
	 * include them in the outgoing INIT ACK as "Unrecognized parameter"
	 * parameter.
	 */
	if (err_chunk) {
		/* Get the "Unrecognized parameter" parameter(s) out of the
		 * ERROR chunk generated by sctp_verify_init(). Since the
		 * error cause code for "unknown parameter" and the
		 * "Unrecognized parameter" type is the same, we can
		 * construct the parameters in INIT ACK by copying the
		 * ERROR causes over.
		 */
1556
		unk_param = (struct sctp_unrecognized_param *)
L
Linus Torvalds 已提交
1557
			    ((__u8 *)(err_chunk->chunk_hdr) +
1558
			    sizeof(struct sctp_chunkhdr));
L
Linus Torvalds 已提交
1559 1560 1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575
		/* Replace the cause code with the "Unrecognized parameter"
		 * parameter type.
		 */
		sctp_addto_chunk(repl, len, unk_param);
	}

	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));

	/*
	 * Note: After sending out INIT ACK with the State Cookie parameter,
	 * "Z" MUST NOT allocate any resources for this new association.
	 * Otherwise, "Z" will be vulnerable to resource attacks.
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
	retval = SCTP_DISPOSITION_CONSUME;

1576 1577 1578 1579 1580 1581 1582
	return retval;

nomem:
	retval = SCTP_DISPOSITION_NOMEM;
nomem_retval:
	if (new_asoc)
		sctp_association_free(new_asoc);
L
Linus Torvalds 已提交
1583 1584 1585 1586 1587 1588 1589
cleanup:
	if (err_chunk)
		sctp_chunk_free(err_chunk);
	return retval;
}

/*
L
Lucas De Marchi 已提交
1590
 * Handle simultaneous INIT.
L
Linus Torvalds 已提交
1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610 1611 1612 1613 1614 1615 1616 1617 1618 1619 1620 1621 1622 1623 1624 1625 1626
 * This means we started an INIT and then we got an INIT request from
 * our peer.
 *
 * Section: 5.2.1 INIT received in COOKIE-WAIT or COOKIE-ECHOED State (Item B)
 * This usually indicates an initialization collision, i.e., each
 * endpoint is attempting, at about the same time, to establish an
 * association with the other endpoint.
 *
 * Upon receipt of an INIT in the COOKIE-WAIT or COOKIE-ECHOED state, an
 * endpoint MUST respond with an INIT ACK using the same parameters it
 * sent in its original INIT chunk (including its Verification Tag,
 * unchanged). These original parameters are combined with those from the
 * newly received INIT chunk. The endpoint shall also generate a State
 * Cookie with the INIT ACK. The endpoint uses the parameters sent in its
 * INIT to calculate the State Cookie.
 *
 * After that, the endpoint MUST NOT change its state, the T1-init
 * timer shall be left running and the corresponding TCB MUST NOT be
 * destroyed. The normal procedures for handling State Cookies when
 * a TCB exists will resolve the duplicate INITs to a single association.
 *
 * For an endpoint that is in the COOKIE-ECHOED state it MUST populate
 * its Tie-Tags with the Tag information of itself and its peer (see
 * section 5.2.2 for a description of the Tie-Tags).
 *
 * Verification Tag: Not explicit, but an INIT can not have a valid
 * verification tag, so we skip the check.
 *
 * Inputs
 * (endpoint, asoc, chunk)
 *
 * Outputs
 * (asoc, reply_msg, msg_up, timers, counters)
 *
 * The return value is the disposition of the chunk.
 */
1627 1628
sctp_disposition_t sctp_sf_do_5_2_1_siminit(struct net *net,
				    const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
1629
				    const struct sctp_association *asoc,
1630
				    const union sctp_subtype type,
L
Linus Torvalds 已提交
1631 1632 1633 1634 1635 1636
				    void *arg,
				    sctp_cmd_seq_t *commands)
{
	/* Call helper to do the real work for both simulataneous and
	 * duplicate INIT chunk handling.
	 */
1637
	return sctp_sf_do_unexpected_init(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
1638 1639 1640 1641 1642 1643 1644 1645 1646 1647 1648 1649 1650 1651 1652 1653 1654 1655 1656 1657 1658 1659 1660 1661 1662 1663 1664 1665 1666 1667 1668 1669 1670 1671 1672 1673 1674 1675 1676 1677 1678 1679 1680
}

/*
 * Handle duplicated INIT messages.  These are usually delayed
 * restransmissions.
 *
 * Section: 5.2.2 Unexpected INIT in States Other than CLOSED,
 * COOKIE-ECHOED and COOKIE-WAIT
 *
 * Unless otherwise stated, upon reception of an unexpected INIT for
 * this association, the endpoint shall generate an INIT ACK with a
 * State Cookie.  In the outbound INIT ACK the endpoint MUST copy its
 * current Verification Tag and peer's Verification Tag into a reserved
 * place within the state cookie.  We shall refer to these locations as
 * the Peer's-Tie-Tag and the Local-Tie-Tag.  The outbound SCTP packet
 * containing this INIT ACK MUST carry a Verification Tag value equal to
 * the Initiation Tag found in the unexpected INIT.  And the INIT ACK
 * MUST contain a new Initiation Tag (randomly generated see Section
 * 5.3.1).  Other parameters for the endpoint SHOULD be copied from the
 * existing parameters of the association (e.g. number of outbound
 * streams) into the INIT ACK and cookie.
 *
 * After sending out the INIT ACK, the endpoint shall take no further
 * actions, i.e., the existing association, including its current state,
 * and the corresponding TCB MUST NOT be changed.
 *
 * Note: Only when a TCB exists and the association is not in a COOKIE-
 * WAIT state are the Tie-Tags populated.  For a normal association INIT
 * (i.e. the endpoint is in a COOKIE-WAIT state), the Tie-Tags MUST be
 * set to 0 (indicating that no previous TCB existed).  The INIT ACK and
 * State Cookie are populated as specified in section 5.2.1.
 *
 * Verification Tag: Not specified, but an INIT has no way of knowing
 * what the verification tag could be, so we ignore it.
 *
 * Inputs
 * (endpoint, asoc, chunk)
 *
 * Outputs
 * (asoc, reply_msg, msg_up, timers, counters)
 *
 * The return value is the disposition of the chunk.
 */
1681 1682
sctp_disposition_t sctp_sf_do_5_2_2_dupinit(struct net *net,
					const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
1683
					const struct sctp_association *asoc,
1684
					const union sctp_subtype type,
L
Linus Torvalds 已提交
1685 1686 1687 1688 1689 1690
					void *arg,
					sctp_cmd_seq_t *commands)
{
	/* Call helper to do the real work for both simulataneous and
	 * duplicate INIT chunk handling.
	 */
1691
	return sctp_sf_do_unexpected_init(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
1692 1693 1694
}


1695 1696 1697 1698 1699 1700 1701 1702 1703
/*
 * Unexpected INIT-ACK handler.
 *
 * Section 5.2.3
 * If an INIT ACK received by an endpoint in any state other than the
 * COOKIE-WAIT state, the endpoint should discard the INIT ACK chunk.
 * An unexpected INIT ACK usually indicates the processing of an old or
 * duplicated INIT chunk.
*/
1704 1705
sctp_disposition_t sctp_sf_do_5_2_3_initack(struct net *net,
					    const struct sctp_endpoint *ep,
1706
					    const struct sctp_association *asoc,
1707
					    const union sctp_subtype type,
1708 1709 1710 1711 1712
					    void *arg, sctp_cmd_seq_t *commands)
{
	/* Per the above section, we'll discard the chunk if we have an
	 * endpoint.  If this is an OOTB INIT-ACK, treat it as such.
	 */
1713
	if (ep == sctp_sk(net->sctp.ctl_sock)->ep)
1714
		return sctp_sf_ootb(net, ep, asoc, type, arg, commands);
1715
	else
1716
		return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
1717
}
L
Linus Torvalds 已提交
1718 1719 1720 1721 1722 1723

/* Unexpected COOKIE-ECHO handler for peer restart (Table 2, action 'A')
 *
 * Section 5.2.4
 *  A)  In this case, the peer may have restarted.
 */
1724 1725
static sctp_disposition_t sctp_sf_do_dupcook_a(struct net *net,
					const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
1726 1727 1728 1729 1730
					const struct sctp_association *asoc,
					struct sctp_chunk *chunk,
					sctp_cmd_seq_t *commands,
					struct sctp_association *new_asoc)
{
1731
	struct sctp_init_chunk *peer_init;
L
Linus Torvalds 已提交
1732 1733 1734 1735 1736 1737 1738 1739 1740 1741
	struct sctp_ulpevent *ev;
	struct sctp_chunk *repl;
	struct sctp_chunk *err;
	sctp_disposition_t disposition;

	/* new_asoc is a brand-new association, so these are not yet
	 * side effects--it is safe to run them here.
	 */
	peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];

1742
	if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk), peer_init,
L
Linus Torvalds 已提交
1743 1744 1745 1746 1747 1748 1749 1750 1751 1752 1753 1754 1755 1756 1757 1758 1759 1760
			       GFP_ATOMIC))
		goto nomem;

	/* Make sure no new addresses are being added during the
	 * restart.  Though this is a pretty complicated attack
	 * since you'd have to get inside the cookie.
	 */
	if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk, commands)) {
		return SCTP_DISPOSITION_CONSUME;
	}

	/* If the endpoint is in the SHUTDOWN-ACK-SENT state and recognizes
	 * the peer has restarted (Action A), it MUST NOT setup a new
	 * association but instead resend the SHUTDOWN ACK and send an ERROR
	 * chunk with a "Cookie Received while Shutting Down" error cause to
	 * its peer.
	*/
	if (sctp_state(asoc, SHUTDOWN_ACK_SENT)) {
1761
		disposition = sctp_sf_do_9_2_reshutack(net, ep, asoc,
L
Linus Torvalds 已提交
1762 1763 1764 1765 1766 1767 1768
				SCTP_ST_CHUNK(chunk->chunk_hdr->type),
				chunk, commands);
		if (SCTP_DISPOSITION_NOMEM == disposition)
			goto nomem;

		err = sctp_make_op_error(asoc, chunk,
					 SCTP_ERROR_COOKIE_IN_SHUTDOWN,
1769
					 NULL, 0, 0);
L
Linus Torvalds 已提交
1770 1771 1772 1773 1774 1775 1776
		if (err)
			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
					SCTP_CHUNK(err));

		return SCTP_DISPOSITION_CONSUME;
	}

1777 1778
	/* For now, stop pending T3-rtx and SACK timers, fail any unsent/unacked
	 * data. Consider the optional choice of resending of this data.
L
Linus Torvalds 已提交
1779
	 */
1780 1781 1782
	sctp_add_cmd_sf(commands, SCTP_CMD_T3_RTX_TIMERS_STOP, SCTP_NULL());
	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
			SCTP_TO(SCTP_EVENT_TIMEOUT_SACK));
L
Linus Torvalds 已提交
1783 1784
	sctp_add_cmd_sf(commands, SCTP_CMD_PURGE_OUTQUEUE, SCTP_NULL());

1785 1786 1787 1788 1789 1790 1791
	/* Stop pending T4-rto timer, teardown ASCONF queue, ASCONF-ACK queue
	 * and ASCONF-ACK cache.
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
			SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
	sctp_add_cmd_sf(commands, SCTP_CMD_PURGE_ASCONF_QUEUE, SCTP_NULL());

L
Linus Torvalds 已提交
1792 1793 1794 1795 1796 1797 1798 1799
	repl = sctp_make_cookie_ack(new_asoc, chunk);
	if (!repl)
		goto nomem;

	/* Report association restart to upper layer. */
	ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_RESTART, 0,
					     new_asoc->c.sinit_num_ostreams,
					     new_asoc->c.sinit_max_instreams,
1800
					     NULL, GFP_ATOMIC);
L
Linus Torvalds 已提交
1801 1802 1803
	if (!ev)
		goto nomem_ev;

1804 1805
	/* Update the content of current association. */
	sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
L
Linus Torvalds 已提交
1806
	sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
1807 1808 1809 1810 1811 1812 1813 1814 1815 1816 1817 1818 1819 1820 1821 1822
	if (sctp_state(asoc, SHUTDOWN_PENDING) &&
	    (sctp_sstate(asoc->base.sk, CLOSING) ||
	     sock_flag(asoc->base.sk, SOCK_DEAD))) {
		/* if were currently in SHUTDOWN_PENDING, but the socket
		 * has been closed by user, don't transition to ESTABLISHED.
		 * Instead trigger SHUTDOWN bundled with COOKIE_ACK.
		 */
		sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
		return sctp_sf_do_9_2_start_shutdown(net, ep, asoc,
						     SCTP_ST_CHUNK(0), NULL,
						     commands);
	} else {
		sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
				SCTP_STATE(SCTP_STATE_ESTABLISHED));
		sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
	}
L
Linus Torvalds 已提交
1823 1824 1825 1826 1827 1828 1829 1830 1831 1832 1833 1834 1835 1836 1837 1838
	return SCTP_DISPOSITION_CONSUME;

nomem_ev:
	sctp_chunk_free(repl);
nomem:
	return SCTP_DISPOSITION_NOMEM;
}

/* Unexpected COOKIE-ECHO handler for setup collision (Table 2, action 'B')
 *
 * Section 5.2.4
 *   B) In this case, both sides may be attempting to start an association
 *      at about the same time but the peer endpoint started its INIT
 *      after responding to the local endpoint's INIT
 */
/* This case represents an initialization collision.  */
1839 1840
static sctp_disposition_t sctp_sf_do_dupcook_b(struct net *net,
					const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
1841 1842 1843 1844 1845
					const struct sctp_association *asoc,
					struct sctp_chunk *chunk,
					sctp_cmd_seq_t *commands,
					struct sctp_association *new_asoc)
{
1846
	struct sctp_init_chunk *peer_init;
L
Linus Torvalds 已提交
1847 1848 1849 1850 1851 1852
	struct sctp_chunk *repl;

	/* new_asoc is a brand-new association, so these are not yet
	 * side effects--it is safe to run them here.
	 */
	peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
1853
	if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk), peer_init,
L
Linus Torvalds 已提交
1854 1855 1856 1857 1858 1859 1860
			       GFP_ATOMIC))
		goto nomem;

	/* Update the content of current association.  */
	sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
			SCTP_STATE(SCTP_STATE_ESTABLISHED));
1861
	SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
L
Linus Torvalds 已提交
1862 1863 1864 1865 1866 1867 1868 1869 1870 1871 1872 1873 1874
	sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());

	repl = sctp_make_cookie_ack(new_asoc, chunk);
	if (!repl)
		goto nomem;

	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));

	/* RFC 2960 5.1 Normal Establishment of an Association
	 *
	 * D) IMPLEMENTATION NOTE: An implementation may choose to
	 * send the Communication Up notification to the SCTP user
	 * upon reception of a valid COOKIE ECHO chunk.
1875 1876 1877 1878 1879
	 *
	 * Sadly, this needs to be implemented as a side-effect, because
	 * we are not guaranteed to have set the association id of the real
	 * association and so these notifications need to be delayed until
	 * the association id is allocated.
L
Linus Torvalds 已提交
1880 1881
	 */

1882
	sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_CHANGE, SCTP_U8(SCTP_COMM_UP));
L
Linus Torvalds 已提交
1883 1884

	/* Sockets API Draft Section 5.3.1.6
1885
	 * When a peer sends a Adaptation Layer Indication parameter , SCTP
L
Linus Torvalds 已提交
1886
	 * delivers this notification to inform the application that of the
1887
	 * peers requested adaptation layer.
1888 1889 1890
	 *
	 * This also needs to be done as a side effect for the same reason as
	 * above.
L
Linus Torvalds 已提交
1891
	 */
1892 1893
	if (asoc->peer.adaptation_ind)
		sctp_add_cmd_sf(commands, SCTP_CMD_ADAPTATION_IND, SCTP_NULL());
L
Linus Torvalds 已提交
1894 1895 1896 1897 1898 1899 1900 1901 1902 1903 1904 1905 1906 1907 1908 1909

	return SCTP_DISPOSITION_CONSUME;

nomem:
	return SCTP_DISPOSITION_NOMEM;
}

/* Unexpected COOKIE-ECHO handler for setup collision (Table 2, action 'C')
 *
 * Section 5.2.4
 *  C) In this case, the local endpoint's cookie has arrived late.
 *     Before it arrived, the local endpoint sent an INIT and received an
 *     INIT-ACK and finally sent a COOKIE ECHO with the peer's same tag
 *     but a new tag of its own.
 */
/* This case represents an initialization collision.  */
1910 1911
static sctp_disposition_t sctp_sf_do_dupcook_c(struct net *net,
					const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
1912 1913 1914 1915 1916 1917 1918 1919 1920 1921 1922 1923 1924 1925 1926 1927 1928 1929 1930 1931
					const struct sctp_association *asoc,
					struct sctp_chunk *chunk,
					sctp_cmd_seq_t *commands,
					struct sctp_association *new_asoc)
{
	/* The cookie should be silently discarded.
	 * The endpoint SHOULD NOT change states and should leave
	 * any timers running.
	 */
	return SCTP_DISPOSITION_DISCARD;
}

/* Unexpected COOKIE-ECHO handler lost chunk (Table 2, action 'D')
 *
 * Section 5.2.4
 *
 * D) When both local and remote tags match the endpoint should always
 *    enter the ESTABLISHED state, if it has not already done so.
 */
/* This case represents an initialization collision.  */
1932 1933
static sctp_disposition_t sctp_sf_do_dupcook_d(struct net *net,
					const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
1934 1935 1936 1937 1938
					const struct sctp_association *asoc,
					struct sctp_chunk *chunk,
					sctp_cmd_seq_t *commands,
					struct sctp_association *new_asoc)
{
1939
	struct sctp_ulpevent *ev = NULL, *ai_ev = NULL;
L
Linus Torvalds 已提交
1940 1941 1942 1943
	struct sctp_chunk *repl;

	/* Clarification from Implementor's Guide:
	 * D) When both local and remote tags match the endpoint should
1944 1945 1946
	 * enter the ESTABLISHED state, if it is in the COOKIE-ECHOED state.
	 * It should stop any cookie timer that may be running and send
	 * a COOKIE ACK.
L
Linus Torvalds 已提交
1947 1948 1949 1950 1951 1952 1953 1954
	 */

	/* Don't accidentally move back into established state. */
	if (asoc->state < SCTP_STATE_ESTABLISHED) {
		sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
				SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
		sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
				SCTP_STATE(SCTP_STATE_ESTABLISHED));
1955
		SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
L
Linus Torvalds 已提交
1956 1957 1958 1959 1960 1961 1962 1963 1964 1965
		sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START,
				SCTP_NULL());

		/* RFC 2960 5.1 Normal Establishment of an Association
		 *
		 * D) IMPLEMENTATION NOTE: An implementation may choose
		 * to send the Communication Up notification to the
		 * SCTP user upon reception of a valid COOKIE
		 * ECHO chunk.
		 */
1966
		ev = sctp_ulpevent_make_assoc_change(asoc, 0,
L
Linus Torvalds 已提交
1967
					     SCTP_COMM_UP, 0,
1968 1969
					     asoc->c.sinit_num_ostreams,
					     asoc->c.sinit_max_instreams,
1970
					     NULL, GFP_ATOMIC);
L
Linus Torvalds 已提交
1971 1972 1973 1974
		if (!ev)
			goto nomem;

		/* Sockets API Draft Section 5.3.1.6
1975
		 * When a peer sends a Adaptation Layer Indication parameter,
L
Linus Torvalds 已提交
1976
		 * SCTP delivers this notification to inform the application
1977
		 * that of the peers requested adaptation layer.
L
Linus Torvalds 已提交
1978
		 */
1979 1980
		if (asoc->peer.adaptation_ind) {
			ai_ev = sctp_ulpevent_make_adaptation_indication(asoc,
L
Linus Torvalds 已提交
1981
								 GFP_ATOMIC);
1982
			if (!ai_ev)
L
Linus Torvalds 已提交
1983 1984 1985 1986 1987 1988 1989 1990 1991
				goto nomem;

		}
	}

	repl = sctp_make_cookie_ack(new_asoc, chunk);
	if (!repl)
		goto nomem;

1992 1993
	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));

1994 1995 1996 1997 1998 1999 2000
	if (ev)
		sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
				SCTP_ULPEVENT(ev));
	if (ai_ev)
		sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
					SCTP_ULPEVENT(ai_ev));

L
Linus Torvalds 已提交
2001 2002 2003
	return SCTP_DISPOSITION_CONSUME;

nomem:
2004 2005
	if (ai_ev)
		sctp_ulpevent_free(ai_ev);
L
Linus Torvalds 已提交
2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 2021 2022 2023 2024 2025 2026
	if (ev)
		sctp_ulpevent_free(ev);
	return SCTP_DISPOSITION_NOMEM;
}

/*
 * Handle a duplicate COOKIE-ECHO.  This usually means a cookie-carrying
 * chunk was retransmitted and then delayed in the network.
 *
 * Section: 5.2.4 Handle a COOKIE ECHO when a TCB exists
 *
 * Verification Tag: None.  Do cookie validation.
 *
 * Inputs
 * (endpoint, asoc, chunk)
 *
 * Outputs
 * (asoc, reply_msg, msg_up, timers, counters)
 *
 * The return value is the disposition of the chunk.
 */
2027 2028
sctp_disposition_t sctp_sf_do_5_2_4_dupcook(struct net *net,
					const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
2029
					const struct sctp_association *asoc,
2030
					const union sctp_subtype type,
L
Linus Torvalds 已提交
2031 2032 2033 2034 2035 2036 2037 2038 2039 2040 2041 2042 2043 2044 2045
					void *arg,
					sctp_cmd_seq_t *commands)
{
	sctp_disposition_t retval;
	struct sctp_chunk *chunk = arg;
	struct sctp_association *new_asoc;
	int error = 0;
	char action;
	struct sctp_chunk *err_chk_p;

	/* Make sure that the chunk has a valid length from the protocol
	 * perspective.  In this case check to make sure we have at least
	 * enough for the chunk header.  Cookie length verification is
	 * done later.
	 */
2046
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
2047
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
L
Linus Torvalds 已提交
2048 2049 2050 2051 2052
						  commands);

	/* "Decode" the chunk.  We have no optional parameters so we
	 * are in good shape.
	 */
2053
	chunk->subh.cookie_hdr = (struct sctp_signed_cookie *)chunk->skb->data;
2054
	if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
2055
					sizeof(struct sctp_chunkhdr)))
2056
		goto nomem;
L
Linus Torvalds 已提交
2057 2058 2059 2060 2061 2062 2063 2064 2065 2066 2067 2068 2069 2070 2071 2072 2073 2074 2075 2076 2077 2078 2079 2080

	/* In RFC 2960 5.2.4 3, if both Verification Tags in the State Cookie
	 * of a duplicate COOKIE ECHO match the Verification Tags of the
	 * current association, consider the State Cookie valid even if
	 * the lifespan is exceeded.
	 */
	new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, &error,
				      &err_chk_p);

	/* FIXME:
	 * If the re-build failed, what is the proper error path
	 * from here?
	 *
	 * [We should abort the association. --piggy]
	 */
	if (!new_asoc) {
		/* FIXME: Several errors are possible.  A bad cookie should
		 * be silently discarded, but think about logging it too.
		 */
		switch (error) {
		case -SCTP_IERROR_NOMEM:
			goto nomem;

		case -SCTP_IERROR_STALE_COOKIE:
2081
			sctp_send_stale_cookie_err(net, ep, asoc, chunk, commands,
L
Linus Torvalds 已提交
2082
						   err_chk_p);
2083
			return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
2084 2085
		case -SCTP_IERROR_BAD_SIG:
		default:
2086
			return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2087
		}
L
Linus Torvalds 已提交
2088 2089
	}

2090 2091 2092
	/* Set temp so that it won't be added into hashtable */
	new_asoc->temp = 1;

L
Linus Torvalds 已提交
2093 2094 2095 2096 2097 2098 2099
	/* Compare the tie_tag in cookie with the verification tag of
	 * current association.
	 */
	action = sctp_tietags_compare(new_asoc, asoc);

	switch (action) {
	case 'A': /* Association restart. */
2100
		retval = sctp_sf_do_dupcook_a(net, ep, asoc, chunk, commands,
L
Linus Torvalds 已提交
2101 2102 2103 2104
					      new_asoc);
		break;

	case 'B': /* Collision case B. */
2105
		retval = sctp_sf_do_dupcook_b(net, ep, asoc, chunk, commands,
L
Linus Torvalds 已提交
2106 2107 2108 2109
					      new_asoc);
		break;

	case 'C': /* Collision case C. */
2110
		retval = sctp_sf_do_dupcook_c(net, ep, asoc, chunk, commands,
L
Linus Torvalds 已提交
2111 2112 2113 2114
					      new_asoc);
		break;

	case 'D': /* Collision case D. */
2115
		retval = sctp_sf_do_dupcook_d(net, ep, asoc, chunk, commands,
L
Linus Torvalds 已提交
2116 2117 2118 2119
					      new_asoc);
		break;

	default: /* Discard packet for all others. */
2120
		retval = sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
2121
		break;
2122
	}
L
Linus Torvalds 已提交
2123 2124

	/* Delete the tempory new association. */
2125
	sctp_add_cmd_sf(commands, SCTP_CMD_SET_ASOC, SCTP_ASOC(new_asoc));
L
Linus Torvalds 已提交
2126 2127
	sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());

2128 2129 2130 2131 2132 2133
	/* Restore association pointer to provide SCTP command interpeter
	 * with a valid context in case it needs to manipulate
	 * the queues */
	sctp_add_cmd_sf(commands, SCTP_CMD_SET_ASOC,
			 SCTP_ASOC((struct sctp_association *)asoc));

L
Linus Torvalds 已提交
2134 2135 2136 2137 2138 2139 2140 2141 2142 2143 2144 2145
	return retval;

nomem:
	return SCTP_DISPOSITION_NOMEM;
}

/*
 * Process an ABORT.  (SHUTDOWN-PENDING state)
 *
 * See sctp_sf_do_9_1_abort().
 */
sctp_disposition_t sctp_sf_shutdown_pending_abort(
2146
	struct net *net,
L
Linus Torvalds 已提交
2147 2148
	const struct sctp_endpoint *ep,
	const struct sctp_association *asoc,
2149
	const union sctp_subtype type,
L
Linus Torvalds 已提交
2150 2151 2152 2153 2154 2155
	void *arg,
	sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = arg;

	if (!sctp_vtag_verify_either(chunk, asoc))
2156
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
2157 2158 2159 2160 2161 2162 2163

	/* Make sure that the ABORT chunk has a valid length.
	 * Since this is an ABORT chunk, we have to discard it
	 * because of the following text:
	 * RFC 2960, Section 3.3.7
	 *    If an endpoint receives an ABORT with a format error or for an
	 *    association that doesn't exist, it MUST silently discard it.
L
Lucas De Marchi 已提交
2164
	 * Because the length is "invalid", we can't really discard just
L
Linus Torvalds 已提交
2165 2166 2167
	 * as we do not know its true length.  So, to be safe, discard the
	 * packet.
	 */
2168
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_abort_chunk)))
2169
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
2170

2171 2172 2173 2174 2175 2176 2177
	/* ADD-IP: Special case for ABORT chunks
	 * F4)  One special consideration is that ABORT Chunks arriving
	 * destined to the IP address being deleted MUST be
	 * ignored (see Section 5.3.1 for further details).
	 */
	if (SCTP_ADDR_DEL ==
		    sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2178
		return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
2179

2180
	return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
2181 2182 2183 2184 2185 2186 2187
}

/*
 * Process an ABORT.  (SHUTDOWN-SENT state)
 *
 * See sctp_sf_do_9_1_abort().
 */
2188 2189
sctp_disposition_t sctp_sf_shutdown_sent_abort(struct net *net,
					const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
2190
					const struct sctp_association *asoc,
2191
					const union sctp_subtype type,
L
Linus Torvalds 已提交
2192 2193 2194 2195 2196 2197
					void *arg,
					sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = arg;

	if (!sctp_vtag_verify_either(chunk, asoc))
2198
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
2199 2200 2201 2202 2203 2204 2205

	/* Make sure that the ABORT chunk has a valid length.
	 * Since this is an ABORT chunk, we have to discard it
	 * because of the following text:
	 * RFC 2960, Section 3.3.7
	 *    If an endpoint receives an ABORT with a format error or for an
	 *    association that doesn't exist, it MUST silently discard it.
L
Lucas De Marchi 已提交
2206
	 * Because the length is "invalid", we can't really discard just
L
Linus Torvalds 已提交
2207 2208 2209
	 * as we do not know its true length.  So, to be safe, discard the
	 * packet.
	 */
2210
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_abort_chunk)))
2211
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
2212

2213 2214 2215 2216 2217 2218 2219
	/* ADD-IP: Special case for ABORT chunks
	 * F4)  One special consideration is that ABORT Chunks arriving
	 * destined to the IP address being deleted MUST be
	 * ignored (see Section 5.3.1 for further details).
	 */
	if (SCTP_ADDR_DEL ==
		    sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2220
		return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
2221

L
Linus Torvalds 已提交
2222 2223 2224 2225 2226 2227 2228 2229
	/* Stop the T2-shutdown timer. */
	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
			SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));

	/* Stop the T5-shutdown guard timer.  */
	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
			SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));

2230
	return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
2231 2232 2233 2234 2235 2236 2237 2238
}

/*
 * Process an ABORT.  (SHUTDOWN-ACK-SENT state)
 *
 * See sctp_sf_do_9_1_abort().
 */
sctp_disposition_t sctp_sf_shutdown_ack_sent_abort(
2239
	struct net *net,
L
Linus Torvalds 已提交
2240 2241
	const struct sctp_endpoint *ep,
	const struct sctp_association *asoc,
2242
	const union sctp_subtype type,
L
Linus Torvalds 已提交
2243 2244 2245 2246 2247 2248
	void *arg,
	sctp_cmd_seq_t *commands)
{
	/* The same T2 timer, so we should be able to use
	 * common function with the SHUTDOWN-SENT state.
	 */
2249
	return sctp_sf_shutdown_sent_abort(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
2250 2251 2252 2253 2254 2255 2256 2257 2258 2259 2260 2261 2262 2263 2264 2265
}

/*
 * Handle an Error received in COOKIE_ECHOED state.
 *
 * Only handle the error type of stale COOKIE Error, the other errors will
 * be ignored.
 *
 * Inputs
 * (endpoint, asoc, chunk)
 *
 * Outputs
 * (asoc, reply_msg, msg_up, timers, counters)
 *
 * The return value is the disposition of the chunk.
 */
2266 2267
sctp_disposition_t sctp_sf_cookie_echoed_err(struct net *net,
					const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
2268
					const struct sctp_association *asoc,
2269
					const union sctp_subtype type,
L
Linus Torvalds 已提交
2270 2271 2272 2273
					void *arg,
					sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = arg;
2274
	struct sctp_errhdr *err;
L
Linus Torvalds 已提交
2275 2276

	if (!sctp_vtag_verify(chunk, asoc))
2277
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
2278 2279 2280 2281

	/* Make sure that the ERROR chunk has a valid length.
	 * The parameter walking depends on this as well.
	 */
2282
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_operr_chunk)))
2283
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
L
Linus Torvalds 已提交
2284 2285 2286 2287 2288 2289 2290 2291 2292
						  commands);

	/* Process the error here */
	/* FUTURE FIXME:  When PR-SCTP related and other optional
	 * parms are emitted, this will have to change to handle multiple
	 * errors.
	 */
	sctp_walk_errors(err, chunk->chunk_hdr) {
		if (SCTP_ERROR_STALE_COOKIE == err->cause)
2293
			return sctp_sf_do_5_2_6_stale(net, ep, asoc, type,
L
Linus Torvalds 已提交
2294 2295 2296 2297 2298 2299 2300 2301
							arg, commands);
	}

	/* It is possible to have malformed error causes, and that
	 * will cause us to end the walk early.  However, since
	 * we are discarding the packet, there should be no adverse
	 * affects.
	 */
2302
	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
2303 2304 2305 2306 2307 2308 2309 2310 2311 2312 2313 2314 2315 2316 2317 2318 2319 2320 2321 2322 2323 2324 2325 2326 2327 2328 2329
}

/*
 * Handle a Stale COOKIE Error
 *
 * Section: 5.2.6 Handle Stale COOKIE Error
 * If the association is in the COOKIE-ECHOED state, the endpoint may elect
 * one of the following three alternatives.
 * ...
 * 3) Send a new INIT chunk to the endpoint, adding a Cookie
 *    Preservative parameter requesting an extension to the lifetime of
 *    the State Cookie. When calculating the time extension, an
 *    implementation SHOULD use the RTT information measured based on the
 *    previous COOKIE ECHO / ERROR exchange, and should add no more
 *    than 1 second beyond the measured RTT, due to long State Cookie
 *    lifetimes making the endpoint more subject to a replay attack.
 *
 * Verification Tag:  Not explicit, but safe to ignore.
 *
 * Inputs
 * (endpoint, asoc, chunk)
 *
 * Outputs
 * (asoc, reply_msg, msg_up, timers, counters)
 *
 * The return value is the disposition of the chunk.
 */
2330 2331
static sctp_disposition_t sctp_sf_do_5_2_6_stale(struct net *net,
						 const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
2332
						 const struct sctp_association *asoc,
2333
						 const union sctp_subtype type,
L
Linus Torvalds 已提交
2334 2335 2336
						 void *arg,
						 sctp_cmd_seq_t *commands)
{
F
Frank Filz 已提交
2337
	int attempts = asoc->init_err_counter + 1;
2338 2339 2340
	struct sctp_chunk *chunk = arg, *reply;
	struct sctp_cookie_preserve_param bht;
	struct sctp_bind_addr *bp;
2341
	struct sctp_errhdr *err;
2342
	u32 stale;
L
Linus Torvalds 已提交
2343

2344
	if (attempts > asoc->max_init_attempts) {
2345 2346
		sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
				SCTP_ERROR(ETIMEDOUT));
L
Linus Torvalds 已提交
2347
		sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
2348
				SCTP_PERR(SCTP_ERROR_STALE_COOKIE));
L
Linus Torvalds 已提交
2349 2350 2351
		return SCTP_DISPOSITION_DELETE_TCB;
	}

2352
	err = (struct sctp_errhdr *)(chunk->skb->data);
L
Linus Torvalds 已提交
2353 2354 2355 2356 2357 2358 2359 2360 2361 2362 2363 2364 2365 2366 2367

	/* When calculating the time extension, an implementation
	 * SHOULD use the RTT information measured based on the
	 * previous COOKIE ECHO / ERROR exchange, and should add no
	 * more than 1 second beyond the measured RTT, due to long
	 * State Cookie lifetimes making the endpoint more subject to
	 * a replay attack.
	 * Measure of Staleness's unit is usec. (1/1000000 sec)
	 * Suggested Cookie Life-span Increment's unit is msec.
	 * (1/1000 sec)
	 * In general, if you use the suggested cookie life, the value
	 * found in the field of measure of staleness should be doubled
	 * to give ample time to retransmit the new cookie and thus
	 * yield a higher probability of success on the reattempt.
	 */
2368
	stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err)));
L
Linus Torvalds 已提交
2369 2370 2371 2372 2373 2374 2375 2376 2377 2378 2379 2380 2381 2382 2383 2384 2385 2386 2387 2388 2389 2390 2391 2392 2393 2394
	stale = (stale * 2) / 1000;

	bht.param_hdr.type = SCTP_PARAM_COOKIE_PRESERVATIVE;
	bht.param_hdr.length = htons(sizeof(bht));
	bht.lifespan_increment = htonl(stale);

	/* Build that new INIT chunk.  */
	bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
	reply = sctp_make_init(asoc, bp, GFP_ATOMIC, sizeof(bht));
	if (!reply)
		goto nomem;

	sctp_addto_chunk(reply, sizeof(bht), &bht);

	/* Clear peer's init_tag cached in assoc as we are sending a new INIT */
	sctp_add_cmd_sf(commands, SCTP_CMD_CLEAR_INIT_TAG, SCTP_NULL());

	/* Stop pending T3-rtx and heartbeat timers */
	sctp_add_cmd_sf(commands, SCTP_CMD_T3_RTX_TIMERS_STOP, SCTP_NULL());
	sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());

	/* Delete non-primary peer ip addresses since we are transitioning
	 * back to the COOKIE-WAIT state
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_DEL_NON_PRIMARY, SCTP_NULL());

2395 2396
	/* If we've sent any data bundled with COOKIE-ECHO we will need to
	 * resend
L
Linus Torvalds 已提交
2397
	 */
2398
	sctp_add_cmd_sf(commands, SCTP_CMD_T1_RETRAN,
L
Linus Torvalds 已提交
2399 2400 2401 2402 2403
			SCTP_TRANSPORT(asoc->peer.primary_path));

	/* Cast away the const modifier, as we want to just
	 * rerun it through as a sideffect.
	 */
F
Frank Filz 已提交
2404
	sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_INC, SCTP_NULL());
L
Linus Torvalds 已提交
2405 2406 2407 2408 2409 2410 2411 2412 2413 2414 2415 2416 2417 2418 2419 2420 2421 2422 2423 2424 2425 2426 2427 2428 2429 2430 2431 2432 2433 2434 2435 2436 2437 2438 2439 2440 2441 2442 2443 2444 2445 2446 2447 2448 2449 2450 2451

	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
			SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
			SCTP_STATE(SCTP_STATE_COOKIE_WAIT));
	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
			SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));

	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));

	return SCTP_DISPOSITION_CONSUME;

nomem:
	return SCTP_DISPOSITION_NOMEM;
}

/*
 * Process an ABORT.
 *
 * Section: 9.1
 * After checking the Verification Tag, the receiving endpoint shall
 * remove the association from its record, and shall report the
 * termination to its upper layer.
 *
 * Verification Tag: 8.5.1 Exceptions in Verification Tag Rules
 * B) Rules for packet carrying ABORT:
 *
 *  - The endpoint shall always fill in the Verification Tag field of the
 *    outbound packet with the destination endpoint's tag value if it
 *    is known.
 *
 *  - If the ABORT is sent in response to an OOTB packet, the endpoint
 *    MUST follow the procedure described in Section 8.4.
 *
 *  - The receiver MUST accept the packet if the Verification Tag
 *    matches either its own tag, OR the tag of its peer. Otherwise, the
 *    receiver MUST silently discard the packet and take no further
 *    action.
 *
 * Inputs
 * (endpoint, asoc, chunk)
 *
 * Outputs
 * (asoc, reply_msg, msg_up, timers, counters)
 *
 * The return value is the disposition of the chunk.
 */
2452 2453
sctp_disposition_t sctp_sf_do_9_1_abort(struct net *net,
					const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
2454
					const struct sctp_association *asoc,
2455
					const union sctp_subtype type,
L
Linus Torvalds 已提交
2456 2457 2458 2459 2460 2461
					void *arg,
					sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = arg;

	if (!sctp_vtag_verify_either(chunk, asoc))
2462
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
2463 2464 2465 2466 2467 2468 2469

	/* Make sure that the ABORT chunk has a valid length.
	 * Since this is an ABORT chunk, we have to discard it
	 * because of the following text:
	 * RFC 2960, Section 3.3.7
	 *    If an endpoint receives an ABORT with a format error or for an
	 *    association that doesn't exist, it MUST silently discard it.
L
Lucas De Marchi 已提交
2470
	 * Because the length is "invalid", we can't really discard just
L
Linus Torvalds 已提交
2471 2472 2473
	 * as we do not know its true length.  So, to be safe, discard the
	 * packet.
	 */
2474
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_abort_chunk)))
2475
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
2476

2477 2478 2479 2480 2481 2482 2483
	/* ADD-IP: Special case for ABORT chunks
	 * F4)  One special consideration is that ABORT Chunks arriving
	 * destined to the IP address being deleted MUST be
	 * ignored (see Section 5.3.1 for further details).
	 */
	if (SCTP_ADDR_DEL ==
		    sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2484
		return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
2485

2486
	return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
2487 2488
}

2489 2490
static sctp_disposition_t __sctp_sf_do_9_1_abort(struct net *net,
					const struct sctp_endpoint *ep,
2491
					const struct sctp_association *asoc,
2492
					const union sctp_subtype type,
2493 2494 2495 2496
					void *arg,
					sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = arg;
2497
	unsigned int len;
2498 2499
	__be16 error = SCTP_ERROR_NO_ERROR;

L
Linus Torvalds 已提交
2500 2501
	/* See if we have an error cause code in the chunk.  */
	len = ntohs(chunk->chunk_hdr->length);
2502
	if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr)) {
2503
		struct sctp_errhdr *err;
2504 2505 2506

		sctp_walk_errors(err, chunk->chunk_hdr);
		if ((void *)err != (void *)chunk->chunk_end)
2507 2508
			return sctp_sf_pdiscard(net, ep, asoc, type, arg,
						commands);
2509

2510
		error = ((struct sctp_errhdr *)chunk->skb->data)->cause;
2511
	}
L
Linus Torvalds 已提交
2512

2513
	sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(ECONNRESET));
2514
	/* ASSOC_FAILED will DELETE_TCB. */
2515
	sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, SCTP_PERR(error));
2516 2517
	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
	SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
L
Linus Torvalds 已提交
2518 2519 2520 2521 2522 2523 2524 2525 2526

	return SCTP_DISPOSITION_ABORT;
}

/*
 * Process an ABORT.  (COOKIE-WAIT state)
 *
 * See sctp_sf_do_9_1_abort() above.
 */
2527 2528
sctp_disposition_t sctp_sf_cookie_wait_abort(struct net *net,
				     const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
2529
				     const struct sctp_association *asoc,
2530
				     const union sctp_subtype type,
L
Linus Torvalds 已提交
2531 2532 2533 2534
				     void *arg,
				     sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = arg;
2535
	unsigned int len;
2536
	__be16 error = SCTP_ERROR_NO_ERROR;
L
Linus Torvalds 已提交
2537 2538

	if (!sctp_vtag_verify_either(chunk, asoc))
2539
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
2540 2541 2542 2543 2544 2545 2546

	/* Make sure that the ABORT chunk has a valid length.
	 * Since this is an ABORT chunk, we have to discard it
	 * because of the following text:
	 * RFC 2960, Section 3.3.7
	 *    If an endpoint receives an ABORT with a format error or for an
	 *    association that doesn't exist, it MUST silently discard it.
L
Lucas De Marchi 已提交
2547
	 * Because the length is "invalid", we can't really discard just
L
Linus Torvalds 已提交
2548 2549 2550
	 * as we do not know its true length.  So, to be safe, discard the
	 * packet.
	 */
2551
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_abort_chunk)))
2552
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
2553 2554 2555 2556

	/* See if we have an error cause code in the chunk.  */
	len = ntohs(chunk->chunk_hdr->length);
	if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
2557
		error = ((struct sctp_errhdr *)chunk->skb->data)->cause;
L
Linus Torvalds 已提交
2558

2559
	return sctp_stop_t1_and_abort(net, commands, error, ECONNREFUSED, asoc,
2560
				      chunk->transport);
L
Linus Torvalds 已提交
2561 2562 2563 2564 2565
}

/*
 * Process an incoming ICMP as an ABORT.  (COOKIE-WAIT state)
 */
2566 2567
sctp_disposition_t sctp_sf_cookie_wait_icmp_abort(struct net *net,
					const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
2568
					const struct sctp_association *asoc,
2569
					const union sctp_subtype type,
L
Linus Torvalds 已提交
2570 2571 2572
					void *arg,
					sctp_cmd_seq_t *commands)
{
2573
	return sctp_stop_t1_and_abort(net, commands, SCTP_ERROR_NO_ERROR,
2574
				      ENOPROTOOPT, asoc,
F
Frank Filz 已提交
2575
				      (struct sctp_transport *)arg);
L
Linus Torvalds 已提交
2576 2577 2578 2579 2580
}

/*
 * Process an ABORT.  (COOKIE-ECHOED state)
 */
2581 2582
sctp_disposition_t sctp_sf_cookie_echoed_abort(struct net *net,
					       const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
2583
					       const struct sctp_association *asoc,
2584
					       const union sctp_subtype type,
L
Linus Torvalds 已提交
2585 2586 2587 2588 2589 2590
					       void *arg,
					       sctp_cmd_seq_t *commands)
{
	/* There is a single T1 timer, so we should be able to use
	 * common function with the COOKIE-WAIT state.
	 */
2591
	return sctp_sf_cookie_wait_abort(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
2592 2593 2594 2595 2596 2597 2598
}

/*
 * Stop T1 timer and abort association with "INIT failed".
 *
 * This is common code called by several sctp_sf_*_abort() functions above.
 */
2599 2600
static sctp_disposition_t sctp_stop_t1_and_abort(struct net *net,
					   sctp_cmd_seq_t *commands,
2601
					   __be16 error, int sk_err,
F
Frank Filz 已提交
2602 2603
					   const struct sctp_association *asoc,
					   struct sctp_transport *transport)
L
Linus Torvalds 已提交
2604
{
2605 2606
	pr_debug("%s: ABORT received (INIT)\n", __func__);

L
Linus Torvalds 已提交
2607 2608
	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
			SCTP_STATE(SCTP_STATE_CLOSED));
2609
	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
L
Linus Torvalds 已提交
2610 2611
	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
			SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
2612
	sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(sk_err));
L
Linus Torvalds 已提交
2613 2614
	/* CMD_INIT_FAILED will DELETE_TCB. */
	sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
2615
			SCTP_PERR(error));
2616

F
Frank Filz 已提交
2617
	return SCTP_DISPOSITION_ABORT;
L
Linus Torvalds 已提交
2618 2619 2620 2621 2622 2623 2624 2625 2626 2627 2628 2629 2630 2631 2632 2633 2634 2635 2636 2637 2638 2639 2640 2641 2642 2643 2644 2645 2646 2647 2648 2649 2650 2651 2652
}

/*
 * sctp_sf_do_9_2_shut
 *
 * Section: 9.2
 * Upon the reception of the SHUTDOWN, the peer endpoint shall
 *  - enter the SHUTDOWN-RECEIVED state,
 *
 *  - stop accepting new data from its SCTP user
 *
 *  - verify, by checking the Cumulative TSN Ack field of the chunk,
 *    that all its outstanding DATA chunks have been received by the
 *    SHUTDOWN sender.
 *
 * Once an endpoint as reached the SHUTDOWN-RECEIVED state it MUST NOT
 * send a SHUTDOWN in response to a ULP request. And should discard
 * subsequent SHUTDOWN chunks.
 *
 * If there are still outstanding DATA chunks left, the SHUTDOWN
 * receiver shall continue to follow normal data transmission
 * procedures defined in Section 6 until all outstanding DATA chunks
 * are acknowledged; however, the SHUTDOWN receiver MUST NOT accept
 * new data from its SCTP user.
 *
 * Verification Tag:  8.5 Verification Tag [Normal verification]
 *
 * Inputs
 * (endpoint, asoc, chunk)
 *
 * Outputs
 * (asoc, reply_msg, msg_up, timers, counters)
 *
 * The return value is the disposition of the chunk.
 */
2653 2654
sctp_disposition_t sctp_sf_do_9_2_shutdown(struct net *net,
					   const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
2655
					   const struct sctp_association *asoc,
2656
					   const union sctp_subtype type,
L
Linus Torvalds 已提交
2657 2658 2659 2660 2661
					   void *arg,
					   sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = arg;
	sctp_disposition_t disposition;
2662
	struct sctp_shutdownhdr *sdh;
L
Linus Torvalds 已提交
2663
	struct sctp_ulpevent *ev;
2664
	__u32 ctsn;
L
Linus Torvalds 已提交
2665 2666

	if (!sctp_vtag_verify(chunk, asoc))
2667
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
2668 2669

	/* Make sure that the SHUTDOWN chunk has a valid length. */
2670
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_shutdown_chunk)))
2671
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
L
Linus Torvalds 已提交
2672 2673 2674
						  commands);

	/* Convert the elaborate header.  */
2675 2676
	sdh = (struct sctp_shutdownhdr *)chunk->skb->data;
	skb_pull(chunk->skb, sizeof(*sdh));
L
Linus Torvalds 已提交
2677
	chunk->subh.shutdown_hdr = sdh;
2678 2679
	ctsn = ntohl(sdh->cum_tsn_ack);

2680
	if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
2681 2682 2683
		pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn,
			 asoc->ctsn_ack_point);

2684 2685 2686
		return SCTP_DISPOSITION_DISCARD;
	}

2687 2688 2689 2690 2691
	/* If Cumulative TSN Ack beyond the max tsn currently
	 * send, terminating the association and respond to the
	 * sender with an ABORT.
	 */
	if (!TSN_lt(ctsn, asoc->next_tsn))
2692
		return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
2693

2694 2695 2696 2697 2698 2699 2700
	/* API 5.3.1.5 SCTP_SHUTDOWN_EVENT
	 * When a peer sends a SHUTDOWN, SCTP delivers this notification to
	 * inform the application that it should cease sending data.
	 */
	ev = sctp_ulpevent_make_shutdown_event(asoc, 0, GFP_ATOMIC);
	if (!ev) {
		disposition = SCTP_DISPOSITION_NOMEM;
2701
		goto out;
2702 2703 2704
	}
	sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));

L
Linus Torvalds 已提交
2705 2706 2707 2708 2709 2710 2711 2712 2713 2714 2715
	/* Upon the reception of the SHUTDOWN, the peer endpoint shall
	 *  - enter the SHUTDOWN-RECEIVED state,
	 *  - stop accepting new data from its SCTP user
	 *
	 * [This is implicit in the new state.]
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
			SCTP_STATE(SCTP_STATE_SHUTDOWN_RECEIVED));
	disposition = SCTP_DISPOSITION_CONSUME;

	if (sctp_outq_is_empty(&asoc->outqueue)) {
2716
		disposition = sctp_sf_do_9_2_shutdown_ack(net, ep, asoc, type,
L
Linus Torvalds 已提交
2717 2718 2719 2720 2721 2722 2723 2724 2725 2726 2727
							  arg, commands);
	}

	if (SCTP_DISPOSITION_NOMEM == disposition)
		goto out;

	/*  - verify, by checking the Cumulative TSN Ack field of the
	 *    chunk, that all its outstanding DATA chunks have been
	 *    received by the SHUTDOWN sender.
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_CTSN,
2728
			SCTP_BE32(chunk->subh.shutdown_hdr->cum_tsn_ack));
L
Linus Torvalds 已提交
2729 2730 2731 2732 2733

out:
	return disposition;
}

2734 2735 2736 2737 2738 2739 2740 2741
/*
 * sctp_sf_do_9_2_shut_ctsn
 *
 * Once an endpoint has reached the SHUTDOWN-RECEIVED state,
 * it MUST NOT send a SHUTDOWN in response to a ULP request.
 * The Cumulative TSN Ack of the received SHUTDOWN chunk
 * MUST be processed.
 */
2742 2743
sctp_disposition_t sctp_sf_do_9_2_shut_ctsn(struct net *net,
					   const struct sctp_endpoint *ep,
2744
					   const struct sctp_association *asoc,
2745
					   const union sctp_subtype type,
2746 2747 2748 2749
					   void *arg,
					   sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = arg;
2750
	struct sctp_shutdownhdr *sdh;
2751
	__u32 ctsn;
2752 2753

	if (!sctp_vtag_verify(chunk, asoc))
2754
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2755 2756

	/* Make sure that the SHUTDOWN chunk has a valid length. */
2757
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_shutdown_chunk)))
2758
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2759 2760
						  commands);

2761
	sdh = (struct sctp_shutdownhdr *)chunk->skb->data;
2762 2763 2764
	ctsn = ntohl(sdh->cum_tsn_ack);

	if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
2765 2766 2767
		pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn,
			 asoc->ctsn_ack_point);

2768 2769
		return SCTP_DISPOSITION_DISCARD;
	}
2770 2771 2772 2773 2774

	/* If Cumulative TSN Ack beyond the max tsn currently
	 * send, terminating the association and respond to the
	 * sender with an ABORT.
	 */
2775
	if (!TSN_lt(ctsn, asoc->next_tsn))
2776
		return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands);
2777 2778 2779 2780 2781 2782 2783 2784 2785 2786 2787

	/* verify, by checking the Cumulative TSN Ack field of the
	 * chunk, that all its outstanding DATA chunks have been
	 * received by the SHUTDOWN sender.
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_CTSN,
			SCTP_BE32(sdh->cum_tsn_ack));

	return SCTP_DISPOSITION_CONSUME;
}

L
Linus Torvalds 已提交
2788 2789 2790 2791 2792 2793 2794
/* RFC 2960 9.2
 * If an endpoint is in SHUTDOWN-ACK-SENT state and receives an INIT chunk
 * (e.g., if the SHUTDOWN COMPLETE was lost) with source and destination
 * transport addresses (either in the IP addresses or in the INIT chunk)
 * that belong to this association, it should discard the INIT chunk and
 * retransmit the SHUTDOWN ACK chunk.
 */
2795 2796
sctp_disposition_t sctp_sf_do_9_2_reshutack(struct net *net,
				    const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
2797
				    const struct sctp_association *asoc,
2798
				    const union sctp_subtype type,
L
Linus Torvalds 已提交
2799 2800 2801 2802 2803 2804
				    void *arg,
				    sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = (struct sctp_chunk *) arg;
	struct sctp_chunk *reply;

2805
	/* Make sure that the chunk has a valid length */
2806
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
2807
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2808 2809
						  commands);

L
Linus Torvalds 已提交
2810 2811 2812 2813 2814 2815 2816 2817 2818 2819 2820 2821 2822 2823 2824 2825 2826 2827 2828 2829 2830 2831 2832 2833 2834 2835 2836 2837 2838 2839 2840 2841 2842 2843 2844 2845 2846 2847 2848 2849 2850 2851 2852 2853 2854 2855 2856 2857 2858
	/* Since we are not going to really process this INIT, there
	 * is no point in verifying chunk boundries.  Just generate
	 * the SHUTDOWN ACK.
	 */
	reply = sctp_make_shutdown_ack(asoc, chunk);
	if (NULL == reply)
		goto nomem;

	/* Set the transport for the SHUTDOWN ACK chunk and the timeout for
	 * the T2-SHUTDOWN timer.
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));

	/* and restart the T2-shutdown timer. */
	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
			SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));

	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));

	return SCTP_DISPOSITION_CONSUME;
nomem:
	return SCTP_DISPOSITION_NOMEM;
}

/*
 * sctp_sf_do_ecn_cwr
 *
 * Section:  Appendix A: Explicit Congestion Notification
 *
 * CWR:
 *
 * RFC 2481 details a specific bit for a sender to send in the header of
 * its next outbound TCP segment to indicate to its peer that it has
 * reduced its congestion window.  This is termed the CWR bit.  For
 * SCTP the same indication is made by including the CWR chunk.
 * This chunk contains one data element, i.e. the TSN number that
 * was sent in the ECNE chunk.  This element represents the lowest
 * TSN number in the datagram that was originally marked with the
 * CE bit.
 *
 * Verification Tag: 8.5 Verification Tag [Normal verification]
 * Inputs
 * (endpoint, asoc, chunk)
 *
 * Outputs
 * (asoc, reply_msg, msg_up, timers, counters)
 *
 * The return value is the disposition of the chunk.
 */
2859 2860
sctp_disposition_t sctp_sf_do_ecn_cwr(struct net *net,
				      const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
2861
				      const struct sctp_association *asoc,
2862
				      const union sctp_subtype type,
L
Linus Torvalds 已提交
2863 2864 2865 2866
				      void *arg,
				      sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = arg;
2867
	struct sctp_cwrhdr *cwr;
2868
	u32 lowest_tsn;
L
Linus Torvalds 已提交
2869 2870

	if (!sctp_vtag_verify(chunk, asoc))
2871
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
2872

2873
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_ecne_chunk)))
2874
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
L
Linus Torvalds 已提交
2875
						  commands);
2876

2877 2878
	cwr = (struct sctp_cwrhdr *)chunk->skb->data;
	skb_pull(chunk->skb, sizeof(*cwr));
L
Linus Torvalds 已提交
2879

2880
	lowest_tsn = ntohl(cwr->lowest_tsn);
L
Linus Torvalds 已提交
2881 2882

	/* Does this CWR ack the last sent congestion notification? */
2883
	if (TSN_lte(asoc->last_ecne_tsn, lowest_tsn)) {
L
Linus Torvalds 已提交
2884 2885 2886
		/* Stop sending ECNE. */
		sctp_add_cmd_sf(commands,
				SCTP_CMD_ECN_CWR,
2887
				SCTP_U32(lowest_tsn));
L
Linus Torvalds 已提交
2888 2889 2890 2891 2892 2893 2894 2895 2896 2897 2898 2899 2900 2901 2902 2903 2904 2905 2906 2907 2908 2909 2910 2911 2912 2913 2914
	}
	return SCTP_DISPOSITION_CONSUME;
}

/*
 * sctp_sf_do_ecne
 *
 * Section:  Appendix A: Explicit Congestion Notification
 *
 * ECN-Echo
 *
 * RFC 2481 details a specific bit for a receiver to send back in its
 * TCP acknowledgements to notify the sender of the Congestion
 * Experienced (CE) bit having arrived from the network.  For SCTP this
 * same indication is made by including the ECNE chunk.  This chunk
 * contains one data element, i.e. the lowest TSN associated with the IP
 * datagram marked with the CE bit.....
 *
 * Verification Tag: 8.5 Verification Tag [Normal verification]
 * Inputs
 * (endpoint, asoc, chunk)
 *
 * Outputs
 * (asoc, reply_msg, msg_up, timers, counters)
 *
 * The return value is the disposition of the chunk.
 */
2915 2916
sctp_disposition_t sctp_sf_do_ecne(struct net *net,
				   const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
2917
				   const struct sctp_association *asoc,
2918
				   const union sctp_subtype type,
L
Linus Torvalds 已提交
2919 2920 2921 2922
				   void *arg,
				   sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = arg;
2923
	struct sctp_ecnehdr *ecne;
L
Linus Torvalds 已提交
2924 2925

	if (!sctp_vtag_verify(chunk, asoc))
2926
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
2927

2928
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_ecne_chunk)))
2929
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
L
Linus Torvalds 已提交
2930 2931
						  commands);

2932 2933
	ecne = (struct sctp_ecnehdr *)chunk->skb->data;
	skb_pull(chunk->skb, sizeof(*ecne));
L
Linus Torvalds 已提交
2934 2935 2936 2937 2938 2939 2940 2941 2942 2943 2944 2945 2946 2947 2948 2949 2950 2951 2952 2953 2954 2955 2956 2957 2958 2959 2960 2961 2962 2963 2964 2965 2966 2967 2968 2969 2970 2971

	/* If this is a newer ECNE than the last CWR packet we sent out */
	sctp_add_cmd_sf(commands, SCTP_CMD_ECN_ECNE,
			SCTP_U32(ntohl(ecne->lowest_tsn)));

	return SCTP_DISPOSITION_CONSUME;
}

/*
 * Section: 6.2  Acknowledgement on Reception of DATA Chunks
 *
 * The SCTP endpoint MUST always acknowledge the reception of each valid
 * DATA chunk.
 *
 * The guidelines on delayed acknowledgement algorithm specified in
 * Section 4.2 of [RFC2581] SHOULD be followed. Specifically, an
 * acknowledgement SHOULD be generated for at least every second packet
 * (not every second DATA chunk) received, and SHOULD be generated within
 * 200 ms of the arrival of any unacknowledged DATA chunk. In some
 * situations it may be beneficial for an SCTP transmitter to be more
 * conservative than the algorithms detailed in this document allow.
 * However, an SCTP transmitter MUST NOT be more aggressive than the
 * following algorithms allow.
 *
 * A SCTP receiver MUST NOT generate more than one SACK for every
 * incoming packet, other than to update the offered window as the
 * receiving application consumes new data.
 *
 * Verification Tag:  8.5 Verification Tag [Normal verification]
 *
 * Inputs
 * (endpoint, asoc, chunk)
 *
 * Outputs
 * (asoc, reply_msg, msg_up, timers, counters)
 *
 * The return value is the disposition of the chunk.
 */
2972 2973
sctp_disposition_t sctp_sf_eat_data_6_2(struct net *net,
					const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
2974
					const struct sctp_association *asoc,
2975
					const union sctp_subtype type,
L
Linus Torvalds 已提交
2976 2977 2978 2979
					void *arg,
					sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = arg;
2980
	sctp_arg_t force = SCTP_NOFORCE();
L
Linus Torvalds 已提交
2981 2982 2983 2984 2985
	int error;

	if (!sctp_vtag_verify(chunk, asoc)) {
		sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
				SCTP_NULL());
2986
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2987
	}
L
Linus Torvalds 已提交
2988

2989
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_data_chunk)))
2990
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
L
Linus Torvalds 已提交
2991 2992
						  commands);

2993
	error = sctp_eat_data(asoc, chunk, commands);
L
Linus Torvalds 已提交
2994 2995 2996 2997 2998
	switch (error) {
	case SCTP_IERROR_NO_ERROR:
		break;
	case SCTP_IERROR_HIGH_TSN:
	case SCTP_IERROR_BAD_STREAM:
2999
		SCTP_INC_STATS(net, SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
L
Linus Torvalds 已提交
3000 3001 3002
		goto discard_noforce;
	case SCTP_IERROR_DUP_TSN:
	case SCTP_IERROR_IGNORE_TSN:
3003
		SCTP_INC_STATS(net, SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
L
Linus Torvalds 已提交
3004 3005
		goto discard_force;
	case SCTP_IERROR_NO_DATA:
3006
		return SCTP_DISPOSITION_ABORT;
3007
	case SCTP_IERROR_PROTO_VIOLATION:
3008
		return sctp_sf_abort_violation(net, ep, asoc, chunk, commands,
3009 3010
					       (u8 *)chunk->subh.data_hdr,
					       sizeof(struct sctp_datahdr));
L
Linus Torvalds 已提交
3011 3012 3013 3014
	default:
		BUG();
	}

3015 3016 3017
	if (chunk->chunk_hdr->flags & SCTP_DATA_SACK_IMM)
		force = SCTP_FORCE();

3018
	if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) {
L
Linus Torvalds 已提交
3019 3020 3021 3022 3023 3024 3025 3026 3027 3028 3029 3030 3031 3032 3033 3034 3035 3036 3037 3038 3039 3040 3041 3042 3043 3044
		sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
				SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
	}

	/* If this is the last chunk in a packet, we need to count it
	 * toward sack generation.  Note that we need to SACK every
	 * OTHER packet containing data chunks, EVEN IF WE DISCARD
	 * THEM.  We elect to NOT generate SACK's if the chunk fails
	 * the verification tag test.
	 *
	 * RFC 2960 6.2 Acknowledgement on Reception of DATA Chunks
	 *
	 * The SCTP endpoint MUST always acknowledge the reception of
	 * each valid DATA chunk.
	 *
	 * The guidelines on delayed acknowledgement algorithm
	 * specified in  Section 4.2 of [RFC2581] SHOULD be followed.
	 * Specifically, an acknowledgement SHOULD be generated for at
	 * least every second packet (not every second DATA chunk)
	 * received, and SHOULD be generated within 200 ms of the
	 * arrival of any unacknowledged DATA chunk.  In some
	 * situations it may be beneficial for an SCTP transmitter to
	 * be more conservative than the algorithms detailed in this
	 * document allow. However, an SCTP transmitter MUST NOT be
	 * more aggressive than the following algorithms allow.
	 */
3045
	if (chunk->end_of_packet)
3046
		sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, force);
L
Linus Torvalds 已提交
3047 3048 3049 3050 3051 3052 3053 3054 3055 3056 3057 3058 3059 3060 3061 3062 3063 3064 3065 3066 3067 3068 3069

	return SCTP_DISPOSITION_CONSUME;

discard_force:
	/* RFC 2960 6.2 Acknowledgement on Reception of DATA Chunks
	 *
	 * When a packet arrives with duplicate DATA chunk(s) and with
	 * no new DATA chunk(s), the endpoint MUST immediately send a
	 * SACK with no delay.  If a packet arrives with duplicate
	 * DATA chunk(s) bundled with new DATA chunks, the endpoint
	 * MAY immediately send a SACK.  Normally receipt of duplicate
	 * DATA chunks will occur when the original SACK chunk was lost
	 * and the peer's RTO has expired.  The duplicate TSN number(s)
	 * SHOULD be reported in the SACK as duplicate.
	 */
	/* In our case, we split the MAY SACK advice up whether or not
	 * the last chunk is a duplicate.'
	 */
	if (chunk->end_of_packet)
		sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
	return SCTP_DISPOSITION_DISCARD;

discard_noforce:
3070
	if (chunk->end_of_packet)
3071
		sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, force);
L
Linus Torvalds 已提交
3072 3073 3074 3075 3076 3077 3078 3079 3080 3081 3082 3083 3084 3085 3086 3087 3088 3089 3090 3091

	return SCTP_DISPOSITION_DISCARD;
}

/*
 * sctp_sf_eat_data_fast_4_4
 *
 * Section: 4 (4)
 * (4) In SHUTDOWN-SENT state the endpoint MUST acknowledge any received
 *    DATA chunks without delay.
 *
 * Verification Tag:  8.5 Verification Tag [Normal verification]
 * Inputs
 * (endpoint, asoc, chunk)
 *
 * Outputs
 * (asoc, reply_msg, msg_up, timers, counters)
 *
 * The return value is the disposition of the chunk.
 */
3092 3093
sctp_disposition_t sctp_sf_eat_data_fast_4_4(struct net *net,
				     const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
3094
				     const struct sctp_association *asoc,
3095
				     const union sctp_subtype type,
L
Linus Torvalds 已提交
3096 3097 3098 3099 3100 3101 3102 3103 3104
				     void *arg,
				     sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = arg;
	int error;

	if (!sctp_vtag_verify(chunk, asoc)) {
		sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
				SCTP_NULL());
3105
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
3106 3107
	}

3108
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_data_chunk)))
3109
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
L
Linus Torvalds 已提交
3110 3111
						  commands);

3112
	error = sctp_eat_data(asoc, chunk, commands);
L
Linus Torvalds 已提交
3113 3114 3115 3116 3117 3118 3119 3120
	switch (error) {
	case SCTP_IERROR_NO_ERROR:
	case SCTP_IERROR_HIGH_TSN:
	case SCTP_IERROR_DUP_TSN:
	case SCTP_IERROR_IGNORE_TSN:
	case SCTP_IERROR_BAD_STREAM:
		break;
	case SCTP_IERROR_NO_DATA:
3121
		return SCTP_DISPOSITION_ABORT;
3122
	case SCTP_IERROR_PROTO_VIOLATION:
3123
		return sctp_sf_abort_violation(net, ep, asoc, chunk, commands,
3124 3125
					       (u8 *)chunk->subh.data_hdr,
					       sizeof(struct sctp_datahdr));
L
Linus Torvalds 已提交
3126 3127 3128 3129 3130 3131 3132 3133 3134 3135 3136 3137 3138 3139 3140 3141 3142 3143 3144 3145 3146 3147 3148 3149 3150 3151 3152 3153 3154 3155 3156 3157 3158 3159 3160 3161 3162 3163 3164 3165 3166 3167 3168 3169 3170 3171 3172 3173 3174 3175 3176 3177 3178 3179 3180 3181 3182
	default:
		BUG();
	}

	/* Go a head and force a SACK, since we are shutting down. */

	/* Implementor's Guide.
	 *
	 * While in SHUTDOWN-SENT state, the SHUTDOWN sender MUST immediately
	 * respond to each received packet containing one or more DATA chunk(s)
	 * with a SACK, a SHUTDOWN chunk, and restart the T2-shutdown timer
	 */
	if (chunk->end_of_packet) {
		/* We must delay the chunk creation since the cumulative
		 * TSN has not been updated yet.
		 */
		sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SHUTDOWN, SCTP_NULL());
		sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
		sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
				SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
	}

	return SCTP_DISPOSITION_CONSUME;
}

/*
 * Section: 6.2  Processing a Received SACK
 * D) Any time a SACK arrives, the endpoint performs the following:
 *
 *     i) If Cumulative TSN Ack is less than the Cumulative TSN Ack Point,
 *     then drop the SACK.   Since Cumulative TSN Ack is monotonically
 *     increasing, a SACK whose Cumulative TSN Ack is less than the
 *     Cumulative TSN Ack Point indicates an out-of-order SACK.
 *
 *     ii) Set rwnd equal to the newly received a_rwnd minus the number
 *     of bytes still outstanding after processing the Cumulative TSN Ack
 *     and the Gap Ack Blocks.
 *
 *     iii) If the SACK is missing a TSN that was previously
 *     acknowledged via a Gap Ack Block (e.g., the data receiver
 *     reneged on the data), then mark the corresponding DATA chunk
 *     as available for retransmit:  Mark it as missing for fast
 *     retransmit as described in Section 7.2.4 and if no retransmit
 *     timer is running for the destination address to which the DATA
 *     chunk was originally transmitted, then T3-rtx is started for
 *     that destination address.
 *
 * Verification Tag:  8.5 Verification Tag [Normal verification]
 *
 * Inputs
 * (endpoint, asoc, chunk)
 *
 * Outputs
 * (asoc, reply_msg, msg_up, timers, counters)
 *
 * The return value is the disposition of the chunk.
 */
3183 3184
sctp_disposition_t sctp_sf_eat_sack_6_2(struct net *net,
					const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
3185
					const struct sctp_association *asoc,
3186
					const union sctp_subtype type,
L
Linus Torvalds 已提交
3187 3188 3189 3190
					void *arg,
					sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = arg;
3191
	struct sctp_sackhdr *sackh;
L
Linus Torvalds 已提交
3192 3193 3194
	__u32 ctsn;

	if (!sctp_vtag_verify(chunk, asoc))
3195
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
3196 3197

	/* Make sure that the SACK chunk has a valid length. */
3198
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_sack_chunk)))
3199
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
L
Linus Torvalds 已提交
3200 3201 3202 3203 3204 3205
						  commands);

	/* Pull the SACK chunk from the data buffer */
	sackh = sctp_sm_pull_sack(chunk);
	/* Was this a bogus SACK? */
	if (!sackh)
3206
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
3207 3208 3209 3210 3211 3212 3213 3214 3215 3216
	chunk->subh.sack_hdr = sackh;
	ctsn = ntohl(sackh->cum_tsn_ack);

	/* i) If Cumulative TSN Ack is less than the Cumulative TSN
	 *     Ack Point, then drop the SACK.  Since Cumulative TSN
	 *     Ack is monotonically increasing, a SACK whose
	 *     Cumulative TSN Ack is less than the Cumulative TSN Ack
	 *     Point indicates an out-of-order SACK.
	 */
	if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
3217 3218 3219
		pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn,
			 asoc->ctsn_ack_point);

L
Linus Torvalds 已提交
3220 3221 3222
		return SCTP_DISPOSITION_DISCARD;
	}

3223 3224 3225 3226 3227
	/* If Cumulative TSN Ack beyond the max tsn currently
	 * send, terminating the association and respond to the
	 * sender with an ABORT.
	 */
	if (!TSN_lt(ctsn, asoc->next_tsn))
3228
		return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands);
3229

L
Linus Torvalds 已提交
3230
	/* Return this SACK for further processing.  */
3231
	sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_SACK, SCTP_CHUNK(chunk));
L
Linus Torvalds 已提交
3232 3233 3234 3235 3236 3237 3238 3239 3240 3241

	/* Note: We do the rest of the work on the PROCESS_SACK
	 * sideeffect.
	 */
	return SCTP_DISPOSITION_CONSUME;
}

/*
 * Generate an ABORT in response to a packet.
 *
3242
 * Section: 8.4 Handle "Out of the blue" Packets, sctpimpguide 2.41
L
Linus Torvalds 已提交
3243
 *
3244 3245 3246 3247 3248 3249 3250 3251
 * 8) The receiver should respond to the sender of the OOTB packet with
 *    an ABORT.  When sending the ABORT, the receiver of the OOTB packet
 *    MUST fill in the Verification Tag field of the outbound packet
 *    with the value found in the Verification Tag field of the OOTB
 *    packet and set the T-bit in the Chunk Flags to indicate that the
 *    Verification Tag is reflected.  After sending this ABORT, the
 *    receiver of the OOTB packet shall discard the OOTB packet and take
 *    no further action.
L
Linus Torvalds 已提交
3252 3253 3254 3255 3256
 *
 * Verification Tag:
 *
 * The return value is the disposition of the chunk.
*/
3257 3258
static sctp_disposition_t sctp_sf_tabort_8_4_8(struct net *net,
					const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
3259
					const struct sctp_association *asoc,
3260
					const union sctp_subtype type,
L
Linus Torvalds 已提交
3261 3262 3263 3264 3265 3266 3267
					void *arg,
					sctp_cmd_seq_t *commands)
{
	struct sctp_packet *packet = NULL;
	struct sctp_chunk *chunk = arg;
	struct sctp_chunk *abort;

3268
	packet = sctp_ootb_pkt_new(net, asoc, chunk);
3269 3270
	if (!packet)
		return SCTP_DISPOSITION_NOMEM;
L
Linus Torvalds 已提交
3271

3272 3273 3274 3275 3276 3277 3278 3279
	/* Make an ABORT. The T bit will be set if the asoc
	 * is NULL.
	 */
	abort = sctp_make_abort(asoc, chunk, 0);
	if (!abort) {
		sctp_ootb_pkt_free(packet);
		return SCTP_DISPOSITION_NOMEM;
	}
3280

3281 3282 3283
	/* Reflect vtag if T-Bit is set */
	if (sctp_test_T_bit(abort))
		packet->vtag = ntohl(chunk->sctp_hdr->vtag);
L
Linus Torvalds 已提交
3284

3285 3286
	/* Set the skb to the belonging sock for accounting.  */
	abort->skb->sk = ep->base.sk;
L
Linus Torvalds 已提交
3287

3288
	sctp_packet_append_chunk(packet, abort);
L
Linus Torvalds 已提交
3289

3290 3291
	sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
			SCTP_PACKET(packet));
L
Linus Torvalds 已提交
3292

3293
	SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
L
Linus Torvalds 已提交
3294

3295 3296
	sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
	return SCTP_DISPOSITION_CONSUME;
L
Linus Torvalds 已提交
3297 3298 3299 3300 3301 3302 3303 3304 3305 3306
}

/*
 * Received an ERROR chunk from peer.  Generate SCTP_REMOTE_ERROR
 * event as ULP notification for each cause included in the chunk.
 *
 * API 5.3.1.3 - SCTP_REMOTE_ERROR
 *
 * The return value is the disposition of the chunk.
*/
3307 3308
sctp_disposition_t sctp_sf_operr_notify(struct net *net,
					const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
3309
					const struct sctp_association *asoc,
3310
					const union sctp_subtype type,
L
Linus Torvalds 已提交
3311 3312 3313 3314
					void *arg,
					sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = arg;
3315
	struct sctp_errhdr *err;
L
Linus Torvalds 已提交
3316 3317

	if (!sctp_vtag_verify(chunk, asoc))
3318
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
3319 3320

	/* Make sure that the ERROR chunk has a valid length. */
3321
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_operr_chunk)))
3322
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
L
Linus Torvalds 已提交
3323
						  commands);
3324 3325
	sctp_walk_errors(err, chunk->chunk_hdr);
	if ((void *)err != (void *)chunk->chunk_end)
3326
		return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
3327
						  (void *)err, commands);
L
Linus Torvalds 已提交
3328

3329 3330
	sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,
			SCTP_CHUNK(chunk));
L
Linus Torvalds 已提交
3331 3332 3333 3334 3335 3336 3337 3338 3339 3340 3341 3342 3343 3344

	return SCTP_DISPOSITION_CONSUME;
}

/*
 * Process an inbound SHUTDOWN ACK.
 *
 * From Section 9.2:
 * Upon the receipt of the SHUTDOWN ACK, the SHUTDOWN sender shall
 * stop the T2-shutdown timer, send a SHUTDOWN COMPLETE chunk to its
 * peer, and remove all record of the association.
 *
 * The return value is the disposition.
 */
3345 3346
sctp_disposition_t sctp_sf_do_9_2_final(struct net *net,
					const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
3347
					const struct sctp_association *asoc,
3348
					const union sctp_subtype type,
L
Linus Torvalds 已提交
3349 3350 3351 3352 3353 3354 3355 3356
					void *arg,
					sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = arg;
	struct sctp_chunk *reply;
	struct sctp_ulpevent *ev;

	if (!sctp_vtag_verify(chunk, asoc))
3357
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
3358 3359

	/* Make sure that the SHUTDOWN_ACK chunk has a valid length. */
3360
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
3361
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
L
Linus Torvalds 已提交
3362 3363 3364 3365 3366 3367 3368
						  commands);
	/* 10.2 H) SHUTDOWN COMPLETE notification
	 *
	 * When SCTP completes the shutdown procedures (section 9.2) this
	 * notification is passed to the upper layer.
	 */
	ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_SHUTDOWN_COMP,
3369
					     0, 0, 0, NULL, GFP_ATOMIC);
L
Linus Torvalds 已提交
3370 3371 3372
	if (!ev)
		goto nomem;

3373 3374 3375 3376 3377 3378 3379 3380
	/* ...send a SHUTDOWN COMPLETE chunk to its peer, */
	reply = sctp_make_shutdown_complete(asoc, chunk);
	if (!reply)
		goto nomem_chunk;

	/* Do all the commands now (after allocation), so that we
	 * have consistent state if memory allocation failes
	 */
L
Linus Torvalds 已提交
3381 3382 3383 3384 3385 3386 3387 3388 3389 3390 3391 3392 3393
	sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));

	/* Upon the receipt of the SHUTDOWN ACK, the SHUTDOWN sender shall
	 * stop the T2-shutdown timer,
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
			SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));

	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
			SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));

	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
			SCTP_STATE(SCTP_STATE_CLOSED));
3394 3395
	SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS);
	SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
L
Linus Torvalds 已提交
3396 3397 3398 3399 3400 3401
	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));

	/* ...and remove all record of the association. */
	sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
	return SCTP_DISPOSITION_DELETE_TCB;

3402 3403
nomem_chunk:
	sctp_ulpevent_free(ev);
L
Linus Torvalds 已提交
3404 3405 3406 3407 3408
nomem:
	return SCTP_DISPOSITION_NOMEM;
}

/*
3409 3410
 * RFC 2960, 8.4 - Handle "Out of the blue" Packets, sctpimpguide 2.41.
 *
L
Linus Torvalds 已提交
3411 3412 3413 3414 3415
 * 5) If the packet contains a SHUTDOWN ACK chunk, the receiver should
 *    respond to the sender of the OOTB packet with a SHUTDOWN COMPLETE.
 *    When sending the SHUTDOWN COMPLETE, the receiver of the OOTB
 *    packet must fill in the Verification Tag field of the outbound
 *    packet with the Verification Tag received in the SHUTDOWN ACK and
3416 3417
 *    set the T-bit in the Chunk Flags to indicate that the Verification
 *    Tag is reflected.
L
Linus Torvalds 已提交
3418 3419 3420 3421 3422
 *
 * 8) The receiver should respond to the sender of the OOTB packet with
 *    an ABORT.  When sending the ABORT, the receiver of the OOTB packet
 *    MUST fill in the Verification Tag field of the outbound packet
 *    with the value found in the Verification Tag field of the OOTB
3423 3424 3425 3426
 *    packet and set the T-bit in the Chunk Flags to indicate that the
 *    Verification Tag is reflected.  After sending this ABORT, the
 *    receiver of the OOTB packet shall discard the OOTB packet and take
 *    no further action.
L
Linus Torvalds 已提交
3427
 */
3428 3429
sctp_disposition_t sctp_sf_ootb(struct net *net,
				const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
3430
				const struct sctp_association *asoc,
3431
				const union sctp_subtype type,
L
Linus Torvalds 已提交
3432 3433 3434 3435 3436
				void *arg,
				sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = arg;
	struct sk_buff *skb = chunk->skb;
3437
	struct sctp_chunkhdr *ch;
3438
	struct sctp_errhdr *err;
L
Linus Torvalds 已提交
3439 3440
	__u8 *ch_end;
	int ootb_shut_ack = 0;
3441
	int ootb_cookie_ack = 0;
L
Linus Torvalds 已提交
3442

3443
	SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
L
Linus Torvalds 已提交
3444

3445
	ch = (struct sctp_chunkhdr *)chunk->chunk_hdr;
L
Linus Torvalds 已提交
3446
	do {
3447
		/* Report violation if the chunk is less then minimal */
3448
		if (ntohs(ch->length) < sizeof(*ch))
3449
			return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3450
						  commands);
L
Linus Torvalds 已提交
3451

3452 3453 3454 3455 3456 3457
		/* Report violation if chunk len overflows */
		ch_end = ((__u8 *)ch) + SCTP_PAD4(ntohs(ch->length));
		if (ch_end > skb_tail_pointer(skb))
			return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
						  commands);

3458 3459 3460
		/* Now that we know we at least have a chunk header,
		 * do things that are type appropriate.
		 */
L
Linus Torvalds 已提交
3461 3462 3463 3464 3465 3466 3467 3468 3469
		if (SCTP_CID_SHUTDOWN_ACK == ch->type)
			ootb_shut_ack = 1;

		/* RFC 2960, Section 3.3.7
		 *   Moreover, under any circumstances, an endpoint that
		 *   receives an ABORT  MUST NOT respond to that ABORT by
		 *   sending an ABORT of its own.
		 */
		if (SCTP_CID_ABORT == ch->type)
3470
			return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3471

3472 3473 3474 3475 3476 3477 3478 3479 3480 3481 3482 3483 3484 3485 3486 3487 3488
		/* RFC 8.4, 7) If the packet contains a "Stale cookie" ERROR
		 * or a COOKIE ACK the SCTP Packet should be silently
		 * discarded.
		 */

		if (SCTP_CID_COOKIE_ACK == ch->type)
			ootb_cookie_ack = 1;

		if (SCTP_CID_ERROR == ch->type) {
			sctp_walk_errors(err, ch) {
				if (SCTP_ERROR_STALE_COOKIE == err->cause) {
					ootb_cookie_ack = 1;
					break;
				}
			}
		}

3489
		ch = (struct sctp_chunkhdr *)ch_end;
3490
	} while (ch_end < skb_tail_pointer(skb));
L
Linus Torvalds 已提交
3491 3492

	if (ootb_shut_ack)
3493
		return sctp_sf_shut_8_4_5(net, ep, asoc, type, arg, commands);
3494
	else if (ootb_cookie_ack)
3495
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
3496
	else
3497
		return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
3498 3499 3500 3501 3502
}

/*
 * Handle an "Out of the blue" SHUTDOWN ACK.
 *
3503 3504
 * Section: 8.4 5, sctpimpguide 2.41.
 *
L
Linus Torvalds 已提交
3505
 * 5) If the packet contains a SHUTDOWN ACK chunk, the receiver should
3506 3507 3508 3509 3510 3511
 *    respond to the sender of the OOTB packet with a SHUTDOWN COMPLETE.
 *    When sending the SHUTDOWN COMPLETE, the receiver of the OOTB
 *    packet must fill in the Verification Tag field of the outbound
 *    packet with the Verification Tag received in the SHUTDOWN ACK and
 *    set the T-bit in the Chunk Flags to indicate that the Verification
 *    Tag is reflected.
L
Linus Torvalds 已提交
3512 3513 3514 3515 3516 3517 3518 3519 3520
 *
 * Inputs
 * (endpoint, asoc, type, arg, commands)
 *
 * Outputs
 * (sctp_disposition_t)
 *
 * The return value is the disposition of the chunk.
 */
3521 3522
static sctp_disposition_t sctp_sf_shut_8_4_5(struct net *net,
					     const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
3523
					     const struct sctp_association *asoc,
3524
					     const union sctp_subtype type,
L
Linus Torvalds 已提交
3525 3526 3527 3528 3529 3530 3531
					     void *arg,
					     sctp_cmd_seq_t *commands)
{
	struct sctp_packet *packet = NULL;
	struct sctp_chunk *chunk = arg;
	struct sctp_chunk *shut;

3532
	packet = sctp_ootb_pkt_new(net, asoc, chunk);
3533 3534
	if (!packet)
		return SCTP_DISPOSITION_NOMEM;
L
Linus Torvalds 已提交
3535

3536 3537 3538 3539 3540 3541 3542 3543
	/* Make an SHUTDOWN_COMPLETE.
	 * The T bit will be set if the asoc is NULL.
	 */
	shut = sctp_make_shutdown_complete(asoc, chunk);
	if (!shut) {
		sctp_ootb_pkt_free(packet);
		return SCTP_DISPOSITION_NOMEM;
	}
3544

3545 3546 3547
	/* Reflect vtag if T-Bit is set */
	if (sctp_test_T_bit(shut))
		packet->vtag = ntohl(chunk->sctp_hdr->vtag);
L
Linus Torvalds 已提交
3548

3549 3550
	/* Set the skb to the belonging sock for accounting.  */
	shut->skb->sk = ep->base.sk;
L
Linus Torvalds 已提交
3551

3552
	sctp_packet_append_chunk(packet, shut);
L
Linus Torvalds 已提交
3553

3554 3555
	sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
			SCTP_PACKET(packet));
L
Linus Torvalds 已提交
3556

3557
	SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
L
Linus Torvalds 已提交
3558

3559 3560 3561
	/* If the chunk length is invalid, we don't want to process
	 * the reset of the packet.
	 */
3562
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
3563
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
3564

3565 3566 3567 3568 3569
	/* We need to discard the rest of the packet to prevent
	 * potential bomming attacks from additional bundled chunks.
	 * This is documented in SCTP Threats ID.
	 */
	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
3570 3571 3572 3573 3574 3575 3576 3577 3578 3579 3580 3581 3582
}

/*
 * Handle SHUTDOWN ACK in COOKIE_ECHOED or COOKIE_WAIT state.
 *
 * Verification Tag:  8.5.1 E) Rules for packet carrying a SHUTDOWN ACK
 *   If the receiver is in COOKIE-ECHOED or COOKIE-WAIT state the
 *   procedures in section 8.4 SHOULD be followed, in other words it
 *   should be treated as an Out Of The Blue packet.
 *   [This means that we do NOT check the Verification Tag on these
 *   chunks. --piggy ]
 *
 */
3583 3584
sctp_disposition_t sctp_sf_do_8_5_1_E_sa(struct net *net,
				      const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
3585
				      const struct sctp_association *asoc,
3586
				      const union sctp_subtype type,
L
Linus Torvalds 已提交
3587 3588 3589
				      void *arg,
				      sctp_cmd_seq_t *commands)
{
3590 3591 3592
	struct sctp_chunk *chunk = arg;

	/* Make sure that the SHUTDOWN_ACK chunk has a valid length. */
3593
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
3594
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3595 3596
						  commands);

L
Linus Torvalds 已提交
3597 3598 3599 3600 3601
	/* Although we do have an association in this case, it corresponds
	 * to a restarted association. So the packet is treated as an OOTB
	 * packet and the state function that handles OOTB SHUTDOWN_ACK is
	 * called with a NULL association.
	 */
3602
	SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
3603

3604
	return sctp_sf_shut_8_4_5(net, ep, NULL, type, arg, commands);
L
Linus Torvalds 已提交
3605 3606 3607
}

/* ADDIP Section 4.2 Upon reception of an ASCONF Chunk.  */
3608 3609
sctp_disposition_t sctp_sf_do_asconf(struct net *net,
				     const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
3610
				     const struct sctp_association *asoc,
3611
				     const union sctp_subtype type, void *arg,
L
Linus Torvalds 已提交
3612 3613 3614 3615
				     sctp_cmd_seq_t *commands)
{
	struct sctp_chunk	*chunk = arg;
	struct sctp_chunk	*asconf_ack = NULL;
3616
	struct sctp_paramhdr	*err_param = NULL;
3617
	struct sctp_addiphdr	*hdr;
L
Linus Torvalds 已提交
3618 3619 3620 3621 3622
	__u32			serial;

	if (!sctp_vtag_verify(chunk, asoc)) {
		sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
				SCTP_NULL());
3623
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
3624 3625
	}

3626 3627 3628 3629 3630 3631
	/* ADD-IP: Section 4.1.1
	 * This chunk MUST be sent in an authenticated way by using
	 * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk
	 * is received unauthenticated it MUST be silently discarded as
	 * described in [I-D.ietf-tsvwg-sctp-auth].
	 */
3632
	if (!net->sctp.addip_noauth && !chunk->auth)
3633 3634
		return sctp_sf_discard_chunk(net, ep, asoc, type, arg,
					     commands);
3635

L
Linus Torvalds 已提交
3636
	/* Make sure that the ASCONF ADDIP chunk has a valid length.  */
3637
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_addip_chunk)))
3638
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
L
Linus Torvalds 已提交
3639 3640
						  commands);

3641
	hdr = (struct sctp_addiphdr *)chunk->skb->data;
L
Linus Torvalds 已提交
3642 3643
	serial = ntohl(hdr->serial);

3644
	/* Verify the ASCONF chunk before processing it. */
3645
	if (!sctp_verify_asconf(asoc, chunk, true, &err_param))
3646
		return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
3647
						  (void *)err_param, commands);
3648

3649
	/* ADDIP 5.2 E1) Compare the value of the serial number to the value
L
Linus Torvalds 已提交
3650
	 * the endpoint stored in a new association variable
3651
	 * 'Peer-Serial-Number'.
L
Linus Torvalds 已提交
3652 3653
	 */
	if (serial == asoc->peer.addip_serial + 1) {
3654 3655 3656 3657 3658 3659 3660 3661 3662 3663 3664 3665 3666
		/* If this is the first instance of ASCONF in the packet,
		 * we can clean our old ASCONF-ACKs.
		 */
		if (!chunk->has_asconf)
			sctp_assoc_clean_asconf_ack_cache(asoc);

		/* ADDIP 5.2 E4) When the Sequence Number matches the next one
		 * expected, process the ASCONF as described below and after
		 * processing the ASCONF Chunk, append an ASCONF-ACK Chunk to
		 * the response packet and cache a copy of it (in the event it
		 * later needs to be retransmitted).
		 *
		 * Essentially, do V1-V5.
L
Linus Torvalds 已提交
3667 3668 3669 3670 3671
		 */
		asconf_ack = sctp_process_asconf((struct sctp_association *)
						 asoc, chunk);
		if (!asconf_ack)
			return SCTP_DISPOSITION_NOMEM;
3672 3673 3674 3675 3676 3677 3678 3679 3680 3681 3682 3683
	} else if (serial < asoc->peer.addip_serial + 1) {
		/* ADDIP 5.2 E2)
		 * If the value found in the Sequence Number is less than the
		 * ('Peer- Sequence-Number' + 1), simply skip to the next
		 * ASCONF, and include in the outbound response packet
		 * any previously cached ASCONF-ACK response that was
		 * sent and saved that matches the Sequence Number of the
		 * ASCONF.  Note: It is possible that no cached ASCONF-ACK
		 * Chunk exists.  This will occur when an older ASCONF
		 * arrives out of order.  In such a case, the receiver
		 * should skip the ASCONF Chunk and not include ASCONF-ACK
		 * Chunk for that chunk.
L
Linus Torvalds 已提交
3684
		 */
3685 3686
		asconf_ack = sctp_assoc_lookup_asconf_ack(asoc, hdr->serial);
		if (!asconf_ack)
L
Linus Torvalds 已提交
3687
			return SCTP_DISPOSITION_DISCARD;
3688 3689 3690 3691 3692 3693

		/* Reset the transport so that we select the correct one
		 * this time around.  This is to make sure that we don't
		 * accidentally use a stale transport that's been removed.
		 */
		asconf_ack->transport = NULL;
L
Linus Torvalds 已提交
3694
	} else {
3695
		/* ADDIP 5.2 E5) Otherwise, the ASCONF Chunk is discarded since
L
Linus Torvalds 已提交
3696
		 * it must be either a stale packet or from an attacker.
3697
		 */
L
Linus Torvalds 已提交
3698 3699 3700
		return SCTP_DISPOSITION_DISCARD;
	}

3701 3702 3703 3704 3705 3706 3707
	/* ADDIP 5.2 E6)  The destination address of the SCTP packet
	 * containing the ASCONF-ACK Chunks MUST be the source address of
	 * the SCTP packet that held the ASCONF Chunks.
	 *
	 * To do this properly, we'll set the destination address of the chunk
	 * and at the transmit time, will try look up the transport to use.
	 * Since ASCONFs may be bundled, the correct transport may not be
3708
	 * created until we process the entire packet, thus this workaround.
L
Linus Torvalds 已提交
3709
	 */
3710
	asconf_ack->dest = chunk->source;
L
Linus Torvalds 已提交
3711
	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(asconf_ack));
3712
	if (asoc->new_transport) {
3713
		sctp_sf_heartbeat(ep, asoc, type, asoc->new_transport, commands);
3714 3715
		((struct sctp_association *)asoc)->new_transport = NULL;
	}
3716

L
Linus Torvalds 已提交
3717 3718 3719 3720 3721 3722 3723 3724
	return SCTP_DISPOSITION_CONSUME;
}

/*
 * ADDIP Section 4.3 General rules for address manipulation
 * When building TLV parameters for the ASCONF Chunk that will add or
 * delete IP addresses the D0 to D13 rules should be applied:
 */
3725 3726
sctp_disposition_t sctp_sf_do_asconf_ack(struct net *net,
					 const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
3727
					 const struct sctp_association *asoc,
3728 3729
					 const union sctp_subtype type,
					 void *arg,
L
Linus Torvalds 已提交
3730 3731 3732 3733 3734
					 sctp_cmd_seq_t *commands)
{
	struct sctp_chunk	*asconf_ack = arg;
	struct sctp_chunk	*last_asconf = asoc->addip_last_asconf;
	struct sctp_chunk	*abort;
3735
	struct sctp_paramhdr	*err_param = NULL;
3736
	struct sctp_addiphdr	*addip_hdr;
L
Linus Torvalds 已提交
3737 3738 3739 3740 3741
	__u32			sent_serial, rcvd_serial;

	if (!sctp_vtag_verify(asconf_ack, asoc)) {
		sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
				SCTP_NULL());
3742
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
3743 3744
	}

3745 3746 3747 3748 3749 3750
	/* ADD-IP, Section 4.1.2:
	 * This chunk MUST be sent in an authenticated way by using
	 * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk
	 * is received unauthenticated it MUST be silently discarded as
	 * described in [I-D.ietf-tsvwg-sctp-auth].
	 */
3751
	if (!net->sctp.addip_noauth && !asconf_ack->auth)
3752 3753
		return sctp_sf_discard_chunk(net, ep, asoc, type, arg,
					     commands);
3754

L
Linus Torvalds 已提交
3755
	/* Make sure that the ADDIP chunk has a valid length.  */
3756 3757
	if (!sctp_chunk_length_valid(asconf_ack,
				     sizeof(struct sctp_addip_chunk)))
3758
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
L
Linus Torvalds 已提交
3759 3760
						  commands);

3761
	addip_hdr = (struct sctp_addiphdr *)asconf_ack->skb->data;
L
Linus Torvalds 已提交
3762 3763
	rcvd_serial = ntohl(addip_hdr->serial);

3764
	/* Verify the ASCONF-ACK chunk before processing it. */
3765
	if (!sctp_verify_asconf(asoc, asconf_ack, false, &err_param))
3766
		return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
3767
			   (void *)err_param, commands);
3768

L
Linus Torvalds 已提交
3769
	if (last_asconf) {
3770
		addip_hdr = (struct sctp_addiphdr *)last_asconf->subh.addip_hdr;
L
Linus Torvalds 已提交
3771 3772 3773 3774 3775 3776 3777 3778 3779 3780 3781 3782 3783 3784
		sent_serial = ntohl(addip_hdr->serial);
	} else {
		sent_serial = asoc->addip_serial - 1;
	}

	/* D0) If an endpoint receives an ASCONF-ACK that is greater than or
	 * equal to the next serial number to be used but no ASCONF chunk is
	 * outstanding the endpoint MUST ABORT the association. Note that a
	 * sequence number is greater than if it is no more than 2^^31-1
	 * larger than the current sequence number (using serial arithmetic).
	 */
	if (ADDIP_SERIAL_gte(rcvd_serial, sent_serial + 1) &&
	    !(asoc->addip_last_asconf)) {
		abort = sctp_make_abort(asoc, asconf_ack,
3785
					sizeof(struct sctp_errhdr));
L
Linus Torvalds 已提交
3786
		if (abort) {
3787
			sctp_init_cause(abort, SCTP_ERROR_ASCONF_ACK, 0);
L
Linus Torvalds 已提交
3788 3789 3790 3791 3792 3793 3794 3795
			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
					SCTP_CHUNK(abort));
		}
		/* We are going to ABORT, so we might as well stop
		 * processing the rest of the chunks in the packet.
		 */
		sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
				SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
3796
		sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
3797
		sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
3798
				SCTP_ERROR(ECONNABORTED));
L
Linus Torvalds 已提交
3799
		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
3800
				SCTP_PERR(SCTP_ERROR_ASCONF_ACK));
3801 3802
		SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
		SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
L
Linus Torvalds 已提交
3803 3804 3805 3806 3807 3808 3809 3810
		return SCTP_DISPOSITION_ABORT;
	}

	if ((rcvd_serial == sent_serial) && asoc->addip_last_asconf) {
		sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
				SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));

		if (!sctp_process_asconf_ack((struct sctp_association *)asoc,
3811 3812 3813 3814 3815 3816
					     asconf_ack)) {
			/* Successfully processed ASCONF_ACK.  We can
			 * release the next asconf if we have one.
			 */
			sctp_add_cmd_sf(commands, SCTP_CMD_SEND_NEXT_ASCONF,
					SCTP_NULL());
L
Linus Torvalds 已提交
3817
			return SCTP_DISPOSITION_CONSUME;
3818
		}
L
Linus Torvalds 已提交
3819 3820

		abort = sctp_make_abort(asoc, asconf_ack,
3821
					sizeof(struct sctp_errhdr));
L
Linus Torvalds 已提交
3822
		if (abort) {
3823
			sctp_init_cause(abort, SCTP_ERROR_RSRC_LOW, 0);
L
Linus Torvalds 已提交
3824 3825 3826 3827 3828 3829
			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
					SCTP_CHUNK(abort));
		}
		/* We are going to ABORT, so we might as well stop
		 * processing the rest of the chunks in the packet.
		 */
3830
		sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
3831
		sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
3832
				SCTP_ERROR(ECONNABORTED));
L
Linus Torvalds 已提交
3833
		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
3834
				SCTP_PERR(SCTP_ERROR_ASCONF_ACK));
3835 3836
		SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
		SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
L
Linus Torvalds 已提交
3837 3838 3839 3840 3841 3842
		return SCTP_DISPOSITION_ABORT;
	}

	return SCTP_DISPOSITION_DISCARD;
}

X
Xin Long 已提交
3843 3844 3845 3846
/* RE-CONFIG Section 5.2 Upon reception of an RECONF Chunk. */
sctp_disposition_t sctp_sf_do_reconf(struct net *net,
				     const struct sctp_endpoint *ep,
				     const struct sctp_association *asoc,
3847
				     const union sctp_subtype type, void *arg,
X
Xin Long 已提交
3848 3849 3850 3851 3852 3853 3854 3855 3856 3857 3858 3859 3860 3861 3862 3863 3864 3865 3866 3867 3868 3869 3870 3871 3872 3873 3874 3875 3876 3877 3878 3879 3880
				     sctp_cmd_seq_t *commands)
{
	struct sctp_paramhdr *err_param = NULL;
	struct sctp_chunk *chunk = arg;
	struct sctp_reconf_chunk *hdr;
	union sctp_params param;

	if (!sctp_vtag_verify(chunk, asoc)) {
		sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
				SCTP_NULL());
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
	}

	/* Make sure that the RECONF chunk has a valid length.  */
	if (!sctp_chunk_length_valid(chunk, sizeof(*hdr)))
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
						  commands);

	if (!sctp_verify_reconf(asoc, chunk, &err_param))
		return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
						  (void *)err_param, commands);

	hdr = (struct sctp_reconf_chunk *)chunk->chunk_hdr;
	sctp_walk_params(param, hdr, params) {
		struct sctp_chunk *reply = NULL;
		struct sctp_ulpevent *ev = NULL;

		if (param.p->type == SCTP_PARAM_RESET_OUT_REQUEST)
			reply = sctp_process_strreset_outreq(
				(struct sctp_association *)asoc, param, &ev);
		else if (param.p->type == SCTP_PARAM_RESET_IN_REQUEST)
			reply = sctp_process_strreset_inreq(
				(struct sctp_association *)asoc, param, &ev);
3881 3882 3883
		else if (param.p->type == SCTP_PARAM_RESET_TSN_REQUEST)
			reply = sctp_process_strreset_tsnreq(
				(struct sctp_association *)asoc, param, &ev);
3884 3885 3886
		else if (param.p->type == SCTP_PARAM_RESET_ADD_OUT_STREAMS)
			reply = sctp_process_strreset_addstrm_out(
				(struct sctp_association *)asoc, param, &ev);
3887 3888 3889
		else if (param.p->type == SCTP_PARAM_RESET_ADD_IN_STREAMS)
			reply = sctp_process_strreset_addstrm_in(
				(struct sctp_association *)asoc, param, &ev);
3890 3891 3892
		else if (param.p->type == SCTP_PARAM_RESET_RESPONSE)
			reply = sctp_process_strreset_resp(
				(struct sctp_association *)asoc, param, &ev);
X
Xin Long 已提交
3893 3894 3895 3896 3897 3898 3899 3900 3901 3902 3903 3904 3905

		if (ev)
			sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
					SCTP_ULPEVENT(ev));

		if (reply)
			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
					SCTP_CHUNK(reply));
	}

	return SCTP_DISPOSITION_CONSUME;
}

L
Linus Torvalds 已提交
3906 3907 3908 3909 3910 3911 3912 3913 3914 3915 3916 3917 3918 3919
/*
 * PR-SCTP Section 3.6 Receiver Side Implementation of PR-SCTP
 *
 * When a FORWARD TSN chunk arrives, the data receiver MUST first update
 * its cumulative TSN point to the value carried in the FORWARD TSN
 * chunk, and then MUST further advance its cumulative TSN point locally
 * if possible.
 * After the above processing, the data receiver MUST stop reporting any
 * missing TSNs earlier than or equal to the new cumulative TSN point.
 *
 * Verification Tag:  8.5 Verification Tag [Normal verification]
 *
 * The return value is the disposition of the chunk.
 */
3920 3921
sctp_disposition_t sctp_sf_eat_fwd_tsn(struct net *net,
				       const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
3922
				       const struct sctp_association *asoc,
3923
				       const union sctp_subtype type,
L
Linus Torvalds 已提交
3924 3925 3926 3927 3928
				       void *arg,
				       sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = arg;
	struct sctp_fwdtsn_hdr *fwdtsn_hdr;
3929
	struct sctp_fwdtsn_skip *skip;
L
Linus Torvalds 已提交
3930 3931 3932 3933 3934 3935
	__u16 len;
	__u32 tsn;

	if (!sctp_vtag_verify(chunk, asoc)) {
		sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
				SCTP_NULL());
3936
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
3937 3938
	}

3939 3940 3941
	if (!asoc->peer.prsctp_capable)
		return sctp_sf_unk_chunk(net, ep, asoc, type, arg, commands);

L
Linus Torvalds 已提交
3942 3943
	/* Make sure that the FORWARD_TSN chunk has valid length.  */
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_fwdtsn_chunk)))
3944
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
L
Linus Torvalds 已提交
3945 3946 3947 3948 3949 3950 3951 3952 3953
						  commands);

	fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data;
	chunk->subh.fwdtsn_hdr = fwdtsn_hdr;
	len = ntohs(chunk->chunk_hdr->length);
	len -= sizeof(struct sctp_chunkhdr);
	skb_pull(chunk->skb, len);

	tsn = ntohl(fwdtsn_hdr->new_cum_tsn);
3954
	pr_debug("%s: TSN 0x%x\n", __func__, tsn);
L
Linus Torvalds 已提交
3955 3956 3957 3958 3959 3960 3961

	/* The TSN is too high--silently discard the chunk and count on it
	 * getting retransmitted later.
	 */
	if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
		goto discard_noforce;

3962 3963
	/* Silently discard the chunk if stream-id is not valid */
	sctp_walk_fwdtsn(skip, chunk) {
3964
		if (ntohs(skip->stream) >= asoc->stream.incnt)
3965 3966 3967
			goto discard_noforce;
	}

L
Linus Torvalds 已提交
3968 3969
	sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
	if (len > sizeof(struct sctp_fwdtsn_hdr))
3970
		sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
L
Linus Torvalds 已提交
3971
				SCTP_CHUNK(chunk));
3972

L
Linus Torvalds 已提交
3973
	/* Count this as receiving DATA. */
3974
	if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) {
L
Linus Torvalds 已提交
3975 3976 3977
		sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
				SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
	}
3978

L
Linus Torvalds 已提交
3979
	/* FIXME: For now send a SACK, but DATA processing may
3980
	 * send another.
L
Linus Torvalds 已提交
3981 3982 3983 3984 3985 3986 3987 3988 3989 3990
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_NOFORCE());

	return SCTP_DISPOSITION_CONSUME;

discard_noforce:
	return SCTP_DISPOSITION_DISCARD;
}

sctp_disposition_t sctp_sf_eat_fwd_tsn_fast(
3991
	struct net *net,
L
Linus Torvalds 已提交
3992 3993
	const struct sctp_endpoint *ep,
	const struct sctp_association *asoc,
3994
	const union sctp_subtype type,
L
Linus Torvalds 已提交
3995 3996 3997 3998 3999
	void *arg,
	sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = arg;
	struct sctp_fwdtsn_hdr *fwdtsn_hdr;
4000
	struct sctp_fwdtsn_skip *skip;
L
Linus Torvalds 已提交
4001 4002 4003 4004 4005 4006
	__u16 len;
	__u32 tsn;

	if (!sctp_vtag_verify(chunk, asoc)) {
		sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
				SCTP_NULL());
4007
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
4008 4009
	}

4010 4011 4012
	if (!asoc->peer.prsctp_capable)
		return sctp_sf_unk_chunk(net, ep, asoc, type, arg, commands);

L
Linus Torvalds 已提交
4013 4014
	/* Make sure that the FORWARD_TSN chunk has a valid length.  */
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_fwdtsn_chunk)))
4015
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
L
Linus Torvalds 已提交
4016 4017 4018 4019 4020 4021 4022 4023 4024
						  commands);

	fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data;
	chunk->subh.fwdtsn_hdr = fwdtsn_hdr;
	len = ntohs(chunk->chunk_hdr->length);
	len -= sizeof(struct sctp_chunkhdr);
	skb_pull(chunk->skb, len);

	tsn = ntohl(fwdtsn_hdr->new_cum_tsn);
4025
	pr_debug("%s: TSN 0x%x\n", __func__, tsn);
L
Linus Torvalds 已提交
4026 4027 4028 4029 4030 4031 4032

	/* The TSN is too high--silently discard the chunk and count on it
	 * getting retransmitted later.
	 */
	if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
		goto gen_shutdown;

4033 4034
	/* Silently discard the chunk if stream-id is not valid */
	sctp_walk_fwdtsn(skip, chunk) {
4035
		if (ntohs(skip->stream) >= asoc->stream.incnt)
4036 4037 4038
			goto gen_shutdown;
	}

L
Linus Torvalds 已提交
4039 4040
	sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
	if (len > sizeof(struct sctp_fwdtsn_hdr))
4041
		sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
L
Linus Torvalds 已提交
4042
				SCTP_CHUNK(chunk));
4043

L
Linus Torvalds 已提交
4044 4045 4046 4047 4048 4049 4050 4051 4052 4053 4054 4055 4056
	/* Go a head and force a SACK, since we are shutting down. */
gen_shutdown:
	/* Implementor's Guide.
	 *
	 * While in SHUTDOWN-SENT state, the SHUTDOWN sender MUST immediately
	 * respond to each received packet containing one or more DATA chunk(s)
	 * with a SACK, a SHUTDOWN chunk, and restart the T2-shutdown timer
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SHUTDOWN, SCTP_NULL());
	sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
			SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));

4057
	return SCTP_DISPOSITION_CONSUME;
L
Linus Torvalds 已提交
4058 4059
}

4060
/*
L
Lucas De Marchi 已提交
4061
 * SCTP-AUTH Section 6.3 Receiving authenticated chukns
4062 4063 4064 4065 4066 4067 4068 4069 4070 4071 4072 4073 4074 4075 4076 4077 4078 4079 4080 4081
 *
 *    The receiver MUST use the HMAC algorithm indicated in the HMAC
 *    Identifier field.  If this algorithm was not specified by the
 *    receiver in the HMAC-ALGO parameter in the INIT or INIT-ACK chunk
 *    during association setup, the AUTH chunk and all chunks after it MUST
 *    be discarded and an ERROR chunk SHOULD be sent with the error cause
 *    defined in Section 4.1.
 *
 *    If an endpoint with no shared key receives a Shared Key Identifier
 *    other than 0, it MUST silently discard all authenticated chunks.  If
 *    the endpoint has at least one endpoint pair shared key for the peer,
 *    it MUST use the key specified by the Shared Key Identifier if a
 *    key has been configured for that Shared Key Identifier.  If no
 *    endpoint pair shared key has been configured for that Shared Key
 *    Identifier, all authenticated chunks MUST be silently discarded.
 *
 * Verification Tag:  8.5 Verification Tag [Normal verification]
 *
 * The return value is the disposition of the chunk.
 */
4082 4083 4084 4085
static enum sctp_ierror sctp_sf_authenticate(
				struct net *net,
				const struct sctp_endpoint *ep,
				const struct sctp_association *asoc,
4086
				const union sctp_subtype type,
4087
				struct sctp_chunk *chunk)
4088 4089 4090 4091 4092 4093 4094 4095 4096 4097 4098
{
	struct sctp_authhdr *auth_hdr;
	struct sctp_hmac *hmac;
	unsigned int sig_len;
	__u16 key_id;
	__u8 *save_digest;
	__u8 *digest;

	/* Pull in the auth header, so we can do some more verification */
	auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
	chunk->subh.auth_hdr = auth_hdr;
4099
	skb_pull(chunk->skb, sizeof(*auth_hdr));
4100

4101
	/* Make sure that we support the HMAC algorithm from the auth
4102 4103 4104 4105 4106 4107 4108 4109 4110 4111 4112 4113 4114 4115 4116 4117
	 * chunk.
	 */
	if (!sctp_auth_asoc_verify_hmac_id(asoc, auth_hdr->hmac_id))
		return SCTP_IERROR_AUTH_BAD_HMAC;

	/* Make sure that the provided shared key identifier has been
	 * configured
	 */
	key_id = ntohs(auth_hdr->shkey_id);
	if (key_id != asoc->active_key_id && !sctp_auth_get_shkey(asoc, key_id))
		return SCTP_IERROR_AUTH_BAD_KEYID;


	/* Make sure that the length of the signature matches what
	 * we expect.
	 */
4118 4119
	sig_len = ntohs(chunk->chunk_hdr->length) -
		  sizeof(struct sctp_auth_chunk);
4120 4121 4122 4123 4124 4125 4126 4127 4128 4129 4130 4131 4132 4133 4134 4135 4136 4137 4138 4139 4140
	hmac = sctp_auth_get_hmac(ntohs(auth_hdr->hmac_id));
	if (sig_len != hmac->hmac_len)
		return SCTP_IERROR_PROTO_VIOLATION;

	/* Now that we've done validation checks, we can compute and
	 * verify the hmac.  The steps involved are:
	 *  1. Save the digest from the chunk.
	 *  2. Zero out the digest in the chunk.
	 *  3. Compute the new digest
	 *  4. Compare saved and new digests.
	 */
	digest = auth_hdr->hmac;
	skb_pull(chunk->skb, sig_len);

	save_digest = kmemdup(digest, sig_len, GFP_ATOMIC);
	if (!save_digest)
		goto nomem;

	memset(digest, 0, sig_len);

	sctp_auth_calculate_hmac(asoc, chunk->skb,
4141 4142
				 (struct sctp_auth_chunk *)chunk->chunk_hdr,
				 GFP_ATOMIC);
4143 4144 4145 4146 4147 4148 4149 4150 4151 4152 4153 4154 4155 4156 4157

	/* Discard the packet if the digests do not match */
	if (memcmp(save_digest, digest, sig_len)) {
		kfree(save_digest);
		return SCTP_IERROR_BAD_SIG;
	}

	kfree(save_digest);
	chunk->auth = 1;

	return SCTP_IERROR_NO_ERROR;
nomem:
	return SCTP_IERROR_NOMEM;
}

4158 4159
sctp_disposition_t sctp_sf_eat_auth(struct net *net,
				    const struct sctp_endpoint *ep,
4160
				    const struct sctp_association *asoc,
4161
				    const union sctp_subtype type,
4162 4163 4164 4165
				    void *arg,
				    sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = arg;
4166
	struct sctp_authhdr *auth_hdr;
4167
	struct sctp_chunk *err_chunk;
4168
	enum sctp_ierror error;
4169

4170 4171
	/* Make sure that the peer has AUTH capable */
	if (!asoc->peer.auth_capable)
4172
		return sctp_sf_unk_chunk(net, ep, asoc, type, arg, commands);
4173

4174 4175 4176
	if (!sctp_vtag_verify(chunk, asoc)) {
		sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
				SCTP_NULL());
4177
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4178 4179 4180 4181
	}

	/* Make sure that the AUTH chunk has valid length.  */
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_auth_chunk)))
4182
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4183 4184 4185
						  commands);

	auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
4186
	error = sctp_sf_authenticate(net, ep, asoc, type, chunk);
4187
	switch (error) {
J
Joe Perches 已提交
4188 4189 4190 4191 4192 4193 4194 4195 4196 4197 4198 4199 4200 4201 4202
	case SCTP_IERROR_AUTH_BAD_HMAC:
		/* Generate the ERROR chunk and discard the rest
		 * of the packet
		 */
		err_chunk = sctp_make_op_error(asoc, chunk,
					       SCTP_ERROR_UNSUP_HMAC,
					       &auth_hdr->hmac_id,
					       sizeof(__u16), 0);
		if (err_chunk) {
			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
					SCTP_CHUNK(err_chunk));
		}
		/* Fall Through */
	case SCTP_IERROR_AUTH_BAD_KEYID:
	case SCTP_IERROR_BAD_SIG:
4203
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
J
Joe Perches 已提交
4204 4205

	case SCTP_IERROR_PROTO_VIOLATION:
4206
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
J
Joe Perches 已提交
4207 4208 4209 4210 4211 4212 4213
						  commands);

	case SCTP_IERROR_NOMEM:
		return SCTP_DISPOSITION_NOMEM;

	default:			/* Prevent gcc warnings */
		break;
4214 4215
	}

4216 4217 4218 4219 4220 4221 4222 4223 4224 4225 4226 4227 4228
	if (asoc->active_key_id != ntohs(auth_hdr->shkey_id)) {
		struct sctp_ulpevent *ev;

		ev = sctp_ulpevent_make_authkey(asoc, ntohs(auth_hdr->shkey_id),
				    SCTP_AUTH_NEWKEY, GFP_ATOMIC);

		if (!ev)
			return -ENOMEM;

		sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
				SCTP_ULPEVENT(ev));
	}

4229 4230 4231
	return SCTP_DISPOSITION_CONSUME;
}

L
Linus Torvalds 已提交
4232 4233 4234 4235 4236 4237 4238 4239 4240 4241 4242 4243 4244 4245 4246 4247 4248 4249 4250 4251 4252 4253 4254
/*
 * Process an unknown chunk.
 *
 * Section: 3.2. Also, 2.1 in the implementor's guide.
 *
 * Chunk Types are encoded such that the highest-order two bits specify
 * the action that must be taken if the processing endpoint does not
 * recognize the Chunk Type.
 *
 * 00 - Stop processing this SCTP packet and discard it, do not process
 *      any further chunks within it.
 *
 * 01 - Stop processing this SCTP packet and discard it, do not process
 *      any further chunks within it, and report the unrecognized
 *      chunk in an 'Unrecognized Chunk Type'.
 *
 * 10 - Skip this chunk and continue processing.
 *
 * 11 - Skip this chunk and continue processing, but report in an ERROR
 *      Chunk using the 'Unrecognized Chunk Type' cause of error.
 *
 * The return value is the disposition of the chunk.
 */
4255 4256
sctp_disposition_t sctp_sf_unk_chunk(struct net *net,
				     const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
4257
				     const struct sctp_association *asoc,
4258
				     const union sctp_subtype type,
L
Linus Torvalds 已提交
4259 4260 4261 4262 4263
				     void *arg,
				     sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *unk_chunk = arg;
	struct sctp_chunk *err_chunk;
4264
	struct sctp_chunkhdr *hdr;
L
Linus Torvalds 已提交
4265

4266
	pr_debug("%s: processing unknown chunk id:%d\n", __func__, type.chunk);
L
Linus Torvalds 已提交
4267 4268

	if (!sctp_vtag_verify(unk_chunk, asoc))
4269
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
4270 4271 4272 4273 4274

	/* Make sure that the chunk has a valid length.
	 * Since we don't know the chunk type, we use a general
	 * chunkhdr structure to make a comparison.
	 */
4275
	if (!sctp_chunk_length_valid(unk_chunk, sizeof(*hdr)))
4276
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
L
Linus Torvalds 已提交
4277 4278 4279 4280 4281
						  commands);

	switch (type.chunk & SCTP_CID_ACTION_MASK) {
	case SCTP_CID_ACTION_DISCARD:
		/* Discard the packet.  */
4282
		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
4283 4284 4285 4286 4287
	case SCTP_CID_ACTION_DISCARD_ERR:
		/* Generate an ERROR chunk as response. */
		hdr = unk_chunk->chunk_hdr;
		err_chunk = sctp_make_op_error(asoc, unk_chunk,
					       SCTP_ERROR_UNKNOWN_CHUNK, hdr,
4288
					       SCTP_PAD4(ntohs(hdr->length)),
4289
					       0);
L
Linus Torvalds 已提交
4290 4291 4292 4293
		if (err_chunk) {
			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
					SCTP_CHUNK(err_chunk));
		}
4294 4295

		/* Discard the packet.  */
4296
		sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
4297 4298 4299 4300 4301 4302 4303 4304 4305
		return SCTP_DISPOSITION_CONSUME;
	case SCTP_CID_ACTION_SKIP:
		/* Skip the chunk.  */
		return SCTP_DISPOSITION_DISCARD;
	case SCTP_CID_ACTION_SKIP_ERR:
		/* Generate an ERROR chunk as response. */
		hdr = unk_chunk->chunk_hdr;
		err_chunk = sctp_make_op_error(asoc, unk_chunk,
					       SCTP_ERROR_UNKNOWN_CHUNK, hdr,
4306
					       SCTP_PAD4(ntohs(hdr->length)),
4307
					       0);
L
Linus Torvalds 已提交
4308 4309 4310 4311 4312 4313 4314 4315 4316 4317 4318 4319 4320 4321 4322 4323 4324 4325 4326 4327 4328 4329 4330 4331 4332 4333 4334
		if (err_chunk) {
			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
					SCTP_CHUNK(err_chunk));
		}
		/* Skip the chunk.  */
		return SCTP_DISPOSITION_CONSUME;
	default:
		break;
	}

	return SCTP_DISPOSITION_DISCARD;
}

/*
 * Discard the chunk.
 *
 * Section: 0.2, 5.2.3, 5.2.5, 5.2.6, 6.0, 8.4.6, 8.5.1c, 9.2
 * [Too numerous to mention...]
 * Verification Tag: No verification needed.
 * Inputs
 * (endpoint, asoc, chunk)
 *
 * Outputs
 * (asoc, reply_msg, msg_up, timers, counters)
 *
 * The return value is the disposition of the chunk.
 */
4335 4336
sctp_disposition_t sctp_sf_discard_chunk(struct net *net,
					 const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
4337
					 const struct sctp_association *asoc,
4338
					 const union sctp_subtype type,
L
Linus Torvalds 已提交
4339 4340 4341
					 void *arg,
					 sctp_cmd_seq_t *commands)
{
4342 4343 4344 4345 4346 4347
	struct sctp_chunk *chunk = arg;

	/* Make sure that the chunk has a valid length.
	 * Since we don't know the chunk type, we use a general
	 * chunkhdr structure to make a comparison.
	 */
4348
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
4349
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4350 4351
						  commands);

4352 4353
	pr_debug("%s: chunk:%d is discarded\n", __func__, type.chunk);

L
Linus Torvalds 已提交
4354 4355 4356 4357 4358 4359 4360 4361 4362 4363 4364 4365 4366 4367 4368 4369 4370 4371 4372 4373 4374
	return SCTP_DISPOSITION_DISCARD;
}

/*
 * Discard the whole packet.
 *
 * Section: 8.4 2)
 *
 * 2) If the OOTB packet contains an ABORT chunk, the receiver MUST
 *    silently discard the OOTB packet and take no further action.
 *
 * Verification Tag: No verification necessary
 *
 * Inputs
 * (endpoint, asoc, chunk)
 *
 * Outputs
 * (asoc, reply_msg, msg_up, timers, counters)
 *
 * The return value is the disposition of the chunk.
 */
4375 4376
sctp_disposition_t sctp_sf_pdiscard(struct net *net,
				    const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
4377
				    const struct sctp_association *asoc,
4378
				    const union sctp_subtype type,
L
Linus Torvalds 已提交
4379 4380 4381
				    void *arg,
				    sctp_cmd_seq_t *commands)
{
4382
	SCTP_INC_STATS(net, SCTP_MIB_IN_PKT_DISCARDS);
L
Linus Torvalds 已提交
4383 4384 4385 4386 4387 4388 4389 4390 4391 4392 4393 4394 4395 4396 4397 4398 4399 4400 4401 4402
	sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());

	return SCTP_DISPOSITION_CONSUME;
}


/*
 * The other end is violating protocol.
 *
 * Section: Not specified
 * Verification Tag: Not specified
 * Inputs
 * (endpoint, asoc, chunk)
 *
 * Outputs
 * (asoc, reply_msg, msg_up, timers, counters)
 *
 * We simply tag the chunk as a violation.  The state machine will log
 * the violation and continue.
 */
4403 4404
sctp_disposition_t sctp_sf_violation(struct net *net,
				     const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
4405
				     const struct sctp_association *asoc,
4406
				     const union sctp_subtype type,
L
Linus Torvalds 已提交
4407 4408 4409
				     void *arg,
				     sctp_cmd_seq_t *commands)
{
4410 4411 4412
	struct sctp_chunk *chunk = arg;

	/* Make sure that the chunk has a valid length. */
4413
	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
4414
		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4415 4416
						  commands);

L
Linus Torvalds 已提交
4417 4418 4419 4420
	return SCTP_DISPOSITION_VIOLATION;
}

/*
4421
 * Common function to handle a protocol violation.
L
Linus Torvalds 已提交
4422
 */
4423
static sctp_disposition_t sctp_sf_abort_violation(
4424
				     struct net *net,
4425
				     const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
4426 4427
				     const struct sctp_association *asoc,
				     void *arg,
4428 4429 4430
				     sctp_cmd_seq_t *commands,
				     const __u8 *payload,
				     const size_t paylen)
L
Linus Torvalds 已提交
4431
{
4432
	struct sctp_packet *packet = NULL;
L
Linus Torvalds 已提交
4433 4434 4435
	struct sctp_chunk *chunk =  arg;
	struct sctp_chunk *abort = NULL;

4436 4437 4438 4439 4440 4441 4442 4443
	/* SCTP-AUTH, Section 6.3:
	 *    It should be noted that if the receiver wants to tear
	 *    down an association in an authenticated way only, the
	 *    handling of malformed packets should not result in
	 *    tearing down the association.
	 *
	 * This means that if we only want to abort associations
	 * in an authenticated way (i.e AUTH+ABORT), then we
L
Lucas De Marchi 已提交
4444
	 * can't destroy this association just because the packet
4445 4446 4447 4448 4449
	 * was malformed.
	 */
	if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
		goto discard;

4450 4451 4452 4453 4454
	/* Make the abort chunk. */
	abort = sctp_make_abort_violation(asoc, chunk, payload, paylen);
	if (!abort)
		goto nomem;

4455
	if (asoc) {
4456 4457 4458
		/* Treat INIT-ACK as a special case during COOKIE-WAIT. */
		if (chunk->chunk_hdr->type == SCTP_CID_INIT_ACK &&
		    !asoc->peer.i.init_tag) {
4459
			struct sctp_initack_chunk *initack;
4460

4461 4462
			initack = (struct sctp_initack_chunk *)chunk->chunk_hdr;
			if (!sctp_chunk_length_valid(chunk, sizeof(*initack)))
4463 4464 4465 4466 4467 4468 4469 4470 4471 4472
				abort->chunk_hdr->flags |= SCTP_CHUNK_FLAG_T;
			else {
				unsigned int inittag;

				inittag = ntohl(initack->init_hdr.init_tag);
				sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_INITTAG,
						SCTP_U32(inittag));
			}
		}

4473
		sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
4474
		SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
L
Linus Torvalds 已提交
4475

4476 4477 4478 4479 4480 4481 4482 4483 4484 4485 4486 4487
		if (asoc->state <= SCTP_STATE_COOKIE_ECHOED) {
			sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
					SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
			sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
					SCTP_ERROR(ECONNREFUSED));
			sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
					SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
		} else {
			sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
					SCTP_ERROR(ECONNABORTED));
			sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
					SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
4488
			SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
4489
		}
L
Linus Torvalds 已提交
4490
	} else {
4491
		packet = sctp_ootb_pkt_new(net, asoc, chunk);
4492 4493 4494 4495 4496 4497 4498 4499 4500 4501 4502 4503 4504 4505

		if (!packet)
			goto nomem_pkt;

		if (sctp_test_T_bit(abort))
			packet->vtag = ntohl(chunk->sctp_hdr->vtag);

		abort->skb->sk = ep->base.sk;

		sctp_packet_append_chunk(packet, abort);

		sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
			SCTP_PACKET(packet));

4506
		SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
L
Linus Torvalds 已提交
4507 4508
	}

4509
	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
4510

4511
discard:
4512
	sctp_sf_pdiscard(net, ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
L
Linus Torvalds 已提交
4513 4514
	return SCTP_DISPOSITION_ABORT;

4515 4516
nomem_pkt:
	sctp_chunk_free(abort);
L
Linus Torvalds 已提交
4517 4518 4519 4520
nomem:
	return SCTP_DISPOSITION_NOMEM;
}

4521 4522
/*
 * Handle a protocol violation when the chunk length is invalid.
4523
 * "Invalid" length is identified as smaller than the minimal length a
4524
 * given chunk can be.  For example, a SACK chunk has invalid length
4525
 * if its length is set to be smaller than the size of struct sctp_sack_chunk.
4526 4527 4528 4529 4530 4531 4532 4533 4534 4535 4536 4537 4538 4539 4540
 *
 * We inform the other end by sending an ABORT with a Protocol Violation
 * error code.
 *
 * Section: Not specified
 * Verification Tag:  Nothing to do
 * Inputs
 * (endpoint, asoc, chunk)
 *
 * Outputs
 * (reply_msg, msg_up, counters)
 *
 * Generate an  ABORT chunk and terminate the association.
 */
static sctp_disposition_t sctp_sf_violation_chunklen(
4541
				     struct net *net,
4542 4543
				     const struct sctp_endpoint *ep,
				     const struct sctp_association *asoc,
4544
				     const union sctp_subtype type,
4545 4546 4547
				     void *arg,
				     sctp_cmd_seq_t *commands)
{
4548
	static const char err_str[] = "The following chunk had invalid length:";
4549

4550
	return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str,
4551 4552 4553
					sizeof(err_str));
}

4554 4555
/*
 * Handle a protocol violation when the parameter length is invalid.
4556 4557 4558
 * If the length is smaller than the minimum length of a given parameter,
 * or accumulated length in multi parameters exceeds the end of the chunk,
 * the length is considered as invalid.
4559 4560
 */
static sctp_disposition_t sctp_sf_violation_paramlen(
4561
				     struct net *net,
4562 4563
				     const struct sctp_endpoint *ep,
				     const struct sctp_association *asoc,
4564
				     const union sctp_subtype type,
4565 4566 4567 4568 4569 4570
				     void *arg, void *ext,
				     sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk =  arg;
	struct sctp_paramhdr *param = ext;
	struct sctp_chunk *abort = NULL;
4571

4572 4573 4574 4575 4576 4577 4578 4579 4580
	if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
		goto discard;

	/* Make the abort chunk. */
	abort = sctp_make_violation_paramlen(asoc, chunk, param);
	if (!abort)
		goto nomem;

	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
4581
	SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
4582 4583 4584 4585 4586

	sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
			SCTP_ERROR(ECONNABORTED));
	sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
			SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
4587 4588
	SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
4589 4590

discard:
4591
	sctp_sf_pdiscard(net, ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
4592 4593 4594
	return SCTP_DISPOSITION_ABORT;
nomem:
	return SCTP_DISPOSITION_NOMEM;
4595 4596
}

4597 4598 4599 4600 4601 4602 4603
/* Handle a protocol violation when the peer trying to advance the
 * cumulative tsn ack to a point beyond the max tsn currently sent.
 *
 * We inform the other end by sending an ABORT with a Protocol Violation
 * error code.
 */
static sctp_disposition_t sctp_sf_violation_ctsn(
4604
				     struct net *net,
4605 4606
				     const struct sctp_endpoint *ep,
				     const struct sctp_association *asoc,
4607
				     const union sctp_subtype type,
4608 4609 4610
				     void *arg,
				     sctp_cmd_seq_t *commands)
{
4611
	static const char err_str[] = "The cumulative tsn ack beyond the max tsn currently sent:";
4612

4613
	return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str,
4614 4615 4616
					sizeof(err_str));
}

4617
/* Handle protocol violation of an invalid chunk bundling.  For example,
L
Lucas De Marchi 已提交
4618
 * when we have an association and we receive bundled INIT-ACK, or
4619
 * SHUDOWN-COMPLETE, our peer is clearly violationg the "MUST NOT bundle"
L
Lucas De Marchi 已提交
4620
 * statement from the specs.  Additionally, there might be an attacker
4621 4622 4623
 * on the path and we may not want to continue this communication.
 */
static sctp_disposition_t sctp_sf_violation_chunk(
4624
				     struct net *net,
4625 4626
				     const struct sctp_endpoint *ep,
				     const struct sctp_association *asoc,
4627
				     const union sctp_subtype type,
4628 4629 4630
				     void *arg,
				     sctp_cmd_seq_t *commands)
{
4631
	static const char err_str[] = "The following chunk violates protocol:";
4632 4633

	if (!asoc)
4634
		return sctp_sf_violation(net, ep, asoc, type, arg, commands);
4635

4636
	return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str,
4637 4638
					sizeof(err_str));
}
L
Linus Torvalds 已提交
4639 4640 4641 4642 4643 4644 4645 4646 4647 4648 4649 4650 4651 4652 4653 4654 4655 4656 4657 4658 4659 4660 4661 4662 4663 4664 4665 4666 4667 4668 4669 4670 4671 4672 4673 4674 4675 4676 4677 4678 4679 4680 4681 4682 4683 4684 4685 4686 4687 4688 4689 4690 4691 4692 4693 4694 4695 4696 4697 4698
/***************************************************************************
 * These are the state functions for handling primitive (Section 10) events.
 ***************************************************************************/
/*
 * sctp_sf_do_prm_asoc
 *
 * Section: 10.1 ULP-to-SCTP
 * B) Associate
 *
 * Format: ASSOCIATE(local SCTP instance name, destination transport addr,
 * outbound stream count)
 * -> association id [,destination transport addr list] [,outbound stream
 * count]
 *
 * This primitive allows the upper layer to initiate an association to a
 * specific peer endpoint.
 *
 * The peer endpoint shall be specified by one of the transport addresses
 * which defines the endpoint (see Section 1.4).  If the local SCTP
 * instance has not been initialized, the ASSOCIATE is considered an
 * error.
 * [This is not relevant for the kernel implementation since we do all
 * initialization at boot time.  It we hadn't initialized we wouldn't
 * get anywhere near this code.]
 *
 * An association id, which is a local handle to the SCTP association,
 * will be returned on successful establishment of the association. If
 * SCTP is not able to open an SCTP association with the peer endpoint,
 * an error is returned.
 * [In the kernel implementation, the struct sctp_association needs to
 * be created BEFORE causing this primitive to run.]
 *
 * Other association parameters may be returned, including the
 * complete destination transport addresses of the peer as well as the
 * outbound stream count of the local endpoint. One of the transport
 * address from the returned destination addresses will be selected by
 * the local endpoint as default primary path for sending SCTP packets
 * to this peer.  The returned "destination transport addr list" can
 * be used by the ULP to change the default primary path or to force
 * sending a packet to a specific transport address.  [All of this
 * stuff happens when the INIT ACK arrives.  This is a NON-BLOCKING
 * function.]
 *
 * Mandatory attributes:
 *
 * o local SCTP instance name - obtained from the INITIALIZE operation.
 *   [This is the argument asoc.]
 * o destination transport addr - specified as one of the transport
 * addresses of the peer endpoint with which the association is to be
 * established.
 *  [This is asoc->peer.active_path.]
 * o outbound stream count - the number of outbound streams the ULP
 * would like to open towards this peer endpoint.
 * [BUG: This is not currently implemented.]
 * Optional attributes:
 *
 * None.
 *
 * The return value is a disposition.
 */
4699 4700
sctp_disposition_t sctp_sf_do_prm_asoc(struct net *net,
				       const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
4701
				       const struct sctp_association *asoc,
4702
				       const union sctp_subtype type,
L
Linus Torvalds 已提交
4703 4704 4705 4706
				       void *arg,
				       sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *repl;
4707
	struct sctp_association *my_asoc;
L
Linus Torvalds 已提交
4708 4709 4710 4711 4712 4713 4714 4715 4716 4717 4718 4719 4720 4721 4722 4723 4724 4725 4726 4727

	/* The comment below says that we enter COOKIE-WAIT AFTER
	 * sending the INIT, but that doesn't actually work in our
	 * implementation...
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
			SCTP_STATE(SCTP_STATE_COOKIE_WAIT));

	/* RFC 2960 5.1 Normal Establishment of an Association
	 *
	 * A) "A" first sends an INIT chunk to "Z".  In the INIT, "A"
	 * must provide its Verification Tag (Tag_A) in the Initiate
	 * Tag field.  Tag_A SHOULD be a random number in the range of
	 * 1 to 4294967295 (see 5.3.1 for Tag value selection). ...
	 */

	repl = sctp_make_init(asoc, &asoc->base.bind_addr, GFP_ATOMIC, 0);
	if (!repl)
		goto nomem;

4728 4729 4730 4731
	/* Choose transport for INIT. */
	sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
			SCTP_CHUNK(repl));

L
Linus Torvalds 已提交
4732 4733 4734
	/* Cast away the const modifier, as we want to just
	 * rerun it through as a sideffect.
	 */
4735 4736
	my_asoc = (struct sctp_association *)asoc;
	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(my_asoc));
L
Linus Torvalds 已提交
4737 4738 4739 4740 4741 4742 4743 4744 4745 4746 4747 4748 4749 4750 4751 4752 4753 4754 4755 4756 4757 4758 4759 4760 4761 4762 4763 4764 4765 4766 4767 4768 4769 4770 4771 4772 4773 4774 4775 4776 4777 4778 4779 4780 4781 4782 4783 4784 4785 4786 4787 4788 4789 4790 4791 4792 4793 4794 4795 4796 4797 4798 4799 4800 4801 4802 4803 4804 4805 4806 4807 4808 4809 4810

	/* After sending the INIT, "A" starts the T1-init timer and
	 * enters the COOKIE-WAIT state.
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
			SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
	return SCTP_DISPOSITION_CONSUME;

nomem:
	return SCTP_DISPOSITION_NOMEM;
}

/*
 * Process the SEND primitive.
 *
 * Section: 10.1 ULP-to-SCTP
 * E) Send
 *
 * Format: SEND(association id, buffer address, byte count [,context]
 *         [,stream id] [,life time] [,destination transport address]
 *         [,unorder flag] [,no-bundle flag] [,payload protocol-id] )
 * -> result
 *
 * This is the main method to send user data via SCTP.
 *
 * Mandatory attributes:
 *
 *  o association id - local handle to the SCTP association
 *
 *  o buffer address - the location where the user message to be
 *    transmitted is stored;
 *
 *  o byte count - The size of the user data in number of bytes;
 *
 * Optional attributes:
 *
 *  o context - an optional 32 bit integer that will be carried in the
 *    sending failure notification to the ULP if the transportation of
 *    this User Message fails.
 *
 *  o stream id - to indicate which stream to send the data on. If not
 *    specified, stream 0 will be used.
 *
 *  o life time - specifies the life time of the user data. The user data
 *    will not be sent by SCTP after the life time expires. This
 *    parameter can be used to avoid efforts to transmit stale
 *    user messages. SCTP notifies the ULP if the data cannot be
 *    initiated to transport (i.e. sent to the destination via SCTP's
 *    send primitive) within the life time variable. However, the
 *    user data will be transmitted if SCTP has attempted to transmit a
 *    chunk before the life time expired.
 *
 *  o destination transport address - specified as one of the destination
 *    transport addresses of the peer endpoint to which this packet
 *    should be sent. Whenever possible, SCTP should use this destination
 *    transport address for sending the packets, instead of the current
 *    primary path.
 *
 *  o unorder flag - this flag, if present, indicates that the user
 *    would like the data delivered in an unordered fashion to the peer
 *    (i.e., the U flag is set to 1 on all DATA chunks carrying this
 *    message).
 *
 *  o no-bundle flag - instructs SCTP not to bundle this user data with
 *    other outbound DATA chunks. SCTP MAY still bundle even when
 *    this flag is present, when faced with network congestion.
 *
 *  o payload protocol-id - A 32 bit unsigned integer that is to be
 *    passed to the peer indicating the type of payload protocol data
 *    being transmitted. This value is passed as opaque data by SCTP.
 *
 * The return value is the disposition.
 */
4811 4812
sctp_disposition_t sctp_sf_do_prm_send(struct net *net,
				       const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
4813
				       const struct sctp_association *asoc,
4814
				       const union sctp_subtype type,
L
Linus Torvalds 已提交
4815 4816 4817
				       void *arg,
				       sctp_cmd_seq_t *commands)
{
4818
	struct sctp_datamsg *msg = arg;
L
Linus Torvalds 已提交
4819

4820
	sctp_add_cmd_sf(commands, SCTP_CMD_SEND_MSG, SCTP_DATAMSG(msg));
L
Linus Torvalds 已提交
4821 4822 4823 4824 4825 4826 4827 4828 4829 4830 4831 4832 4833 4834 4835 4836 4837 4838 4839 4840 4841 4842 4843 4844 4845 4846 4847 4848 4849 4850
	return SCTP_DISPOSITION_CONSUME;
}

/*
 * Process the SHUTDOWN primitive.
 *
 * Section: 10.1:
 * C) Shutdown
 *
 * Format: SHUTDOWN(association id)
 * -> result
 *
 * Gracefully closes an association. Any locally queued user data
 * will be delivered to the peer. The association will be terminated only
 * after the peer acknowledges all the SCTP packets sent.  A success code
 * will be returned on successful termination of the association. If
 * attempting to terminate the association results in a failure, an error
 * code shall be returned.
 *
 * Mandatory attributes:
 *
 *  o association id - local handle to the SCTP association
 *
 * Optional attributes:
 *
 * None.
 *
 * The return value is the disposition.
 */
sctp_disposition_t sctp_sf_do_9_2_prm_shutdown(
4851
	struct net *net,
L
Linus Torvalds 已提交
4852 4853
	const struct sctp_endpoint *ep,
	const struct sctp_association *asoc,
4854
	const union sctp_subtype type,
L
Linus Torvalds 已提交
4855 4856 4857 4858 4859 4860 4861 4862 4863 4864 4865 4866 4867 4868 4869 4870 4871 4872
	void *arg,
	sctp_cmd_seq_t *commands)
{
	int disposition;

	/* From 9.2 Shutdown of an Association
	 * Upon receipt of the SHUTDOWN primitive from its upper
	 * layer, the endpoint enters SHUTDOWN-PENDING state and
	 * remains there until all outstanding data has been
	 * acknowledged by its peer. The endpoint accepts no new data
	 * from its upper layer, but retransmits data to the far end
	 * if necessary to fill gaps.
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
			SCTP_STATE(SCTP_STATE_SHUTDOWN_PENDING));

	disposition = SCTP_DISPOSITION_CONSUME;
	if (sctp_outq_is_empty(&asoc->outqueue)) {
4873
		disposition = sctp_sf_do_9_2_start_shutdown(net, ep, asoc, type,
L
Linus Torvalds 已提交
4874 4875 4876 4877 4878 4879 4880 4881 4882 4883 4884 4885 4886 4887 4888 4889 4890 4891 4892 4893 4894 4895 4896 4897 4898 4899 4900 4901 4902 4903 4904 4905 4906
							    arg, commands);
	}
	return disposition;
}

/*
 * Process the ABORT primitive.
 *
 * Section: 10.1:
 * C) Abort
 *
 * Format: Abort(association id [, cause code])
 * -> result
 *
 * Ungracefully closes an association. Any locally queued user data
 * will be discarded and an ABORT chunk is sent to the peer.  A success code
 * will be returned on successful abortion of the association. If
 * attempting to abort the association results in a failure, an error
 * code shall be returned.
 *
 * Mandatory attributes:
 *
 *  o association id - local handle to the SCTP association
 *
 * Optional attributes:
 *
 *  o cause code - reason of the abort to be passed to the peer
 *
 * None.
 *
 * The return value is the disposition.
 */
sctp_disposition_t sctp_sf_do_9_1_prm_abort(
4907
	struct net *net,
L
Linus Torvalds 已提交
4908 4909
	const struct sctp_endpoint *ep,
	const struct sctp_association *asoc,
4910
	const union sctp_subtype type,
L
Linus Torvalds 已提交
4911 4912 4913 4914 4915 4916 4917 4918 4919 4920 4921
	void *arg,
	sctp_cmd_seq_t *commands)
{
	/* From 9.1 Abort of an Association
	 * Upon receipt of the ABORT primitive from its upper
	 * layer, the endpoint enters CLOSED state and
	 * discard all outstanding data has been
	 * acknowledged by its peer. The endpoint accepts no new data
	 * from its upper layer, but retransmits data to the far end
	 * if necessary to fill gaps.
	 */
4922
	struct sctp_chunk *abort = arg;
L
Linus Torvalds 已提交
4923

4924 4925
	if (abort)
		sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
L
Linus Torvalds 已提交
4926 4927 4928 4929 4930

	/* Even if we can't send the ABORT due to low memory delete the
	 * TCB.  This is a departure from our typical NOMEM handling.
	 */

4931 4932
	sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
			SCTP_ERROR(ECONNABORTED));
L
Linus Torvalds 已提交
4933 4934
	/* Delete the established association. */
	sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
4935
			SCTP_PERR(SCTP_ERROR_USER_ABORT));
L
Linus Torvalds 已提交
4936

4937 4938
	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
	SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
L
Linus Torvalds 已提交
4939

4940
	return SCTP_DISPOSITION_ABORT;
L
Linus Torvalds 已提交
4941 4942 4943
}

/* We tried an illegal operation on an association which is closed.  */
4944 4945
sctp_disposition_t sctp_sf_error_closed(struct net *net,
					const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
4946
					const struct sctp_association *asoc,
4947
					const union sctp_subtype type,
L
Linus Torvalds 已提交
4948 4949 4950 4951 4952 4953 4954 4955 4956 4957
					void *arg,
					sctp_cmd_seq_t *commands)
{
	sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_ERROR, SCTP_ERROR(-EINVAL));
	return SCTP_DISPOSITION_CONSUME;
}

/* We tried an illegal operation on an association which is shutting
 * down.
 */
4958 4959
sctp_disposition_t sctp_sf_error_shutdown(struct net *net,
					  const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
4960
					  const struct sctp_association *asoc,
4961
					  const union sctp_subtype type,
L
Linus Torvalds 已提交
4962 4963 4964 4965 4966 4967 4968 4969 4970 4971 4972 4973 4974 4975 4976 4977 4978 4979 4980 4981 4982 4983 4984
					  void *arg,
					  sctp_cmd_seq_t *commands)
{
	sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_ERROR,
			SCTP_ERROR(-ESHUTDOWN));
	return SCTP_DISPOSITION_CONSUME;
}

/*
 * sctp_cookie_wait_prm_shutdown
 *
 * Section: 4 Note: 2
 * Verification Tag:
 * Inputs
 * (endpoint, asoc)
 *
 * The RFC does not explicitly address this issue, but is the route through the
 * state table when someone issues a shutdown while in COOKIE_WAIT state.
 *
 * Outputs
 * (timers)
 */
sctp_disposition_t sctp_sf_cookie_wait_prm_shutdown(
4985
	struct net *net,
L
Linus Torvalds 已提交
4986 4987
	const struct sctp_endpoint *ep,
	const struct sctp_association *asoc,
4988
	const union sctp_subtype type,
L
Linus Torvalds 已提交
4989 4990 4991 4992 4993 4994 4995 4996 4997
	void *arg,
	sctp_cmd_seq_t *commands)
{
	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
			SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));

	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
			SCTP_STATE(SCTP_STATE_CLOSED));

4998
	SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS);
L
Linus Torvalds 已提交
4999 5000 5001 5002 5003 5004 5005 5006 5007 5008 5009 5010 5011 5012 5013 5014 5015 5016 5017 5018 5019

	sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());

	return SCTP_DISPOSITION_DELETE_TCB;
}

/*
 * sctp_cookie_echoed_prm_shutdown
 *
 * Section: 4 Note: 2
 * Verification Tag:
 * Inputs
 * (endpoint, asoc)
 *
 * The RFC does not explcitly address this issue, but is the route through the
 * state table when someone issues a shutdown while in COOKIE_ECHOED state.
 *
 * Outputs
 * (timers)
 */
sctp_disposition_t sctp_sf_cookie_echoed_prm_shutdown(
5020
	struct net *net,
L
Linus Torvalds 已提交
5021 5022
	const struct sctp_endpoint *ep,
	const struct sctp_association *asoc,
5023
	const union sctp_subtype type,
L
Linus Torvalds 已提交
5024 5025 5026 5027 5028
	void *arg, sctp_cmd_seq_t *commands)
{
	/* There is a single T1 timer, so we should be able to use
	 * common function with the COOKIE-WAIT state.
	 */
5029
	return sctp_sf_cookie_wait_prm_shutdown(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
5030 5031 5032 5033 5034 5035 5036 5037 5038 5039 5040 5041 5042 5043 5044 5045 5046
}

/*
 * sctp_sf_cookie_wait_prm_abort
 *
 * Section: 4 Note: 2
 * Verification Tag:
 * Inputs
 * (endpoint, asoc)
 *
 * The RFC does not explicitly address this issue, but is the route through the
 * state table when someone issues an abort while in COOKIE_WAIT state.
 *
 * Outputs
 * (timers)
 */
sctp_disposition_t sctp_sf_cookie_wait_prm_abort(
5047
	struct net *net,
L
Linus Torvalds 已提交
5048 5049
	const struct sctp_endpoint *ep,
	const struct sctp_association *asoc,
5050
	const union sctp_subtype type,
L
Linus Torvalds 已提交
5051 5052 5053
	void *arg,
	sctp_cmd_seq_t *commands)
{
5054
	struct sctp_chunk *abort = arg;
L
Linus Torvalds 已提交
5055 5056 5057 5058 5059

	/* Stop T1-init timer */
	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
			SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));

5060 5061
	if (abort)
		sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
L
Linus Torvalds 已提交
5062 5063 5064 5065

	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
			SCTP_STATE(SCTP_STATE_CLOSED));

5066
	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
L
Linus Torvalds 已提交
5067 5068 5069 5070 5071

	/* Even if we can't send the ABORT due to low memory delete the
	 * TCB.  This is a departure from our typical NOMEM handling.
	 */

5072 5073
	sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
			SCTP_ERROR(ECONNREFUSED));
L
Linus Torvalds 已提交
5074 5075
	/* Delete the established association. */
	sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
5076
			SCTP_PERR(SCTP_ERROR_USER_ABORT));
L
Linus Torvalds 已提交
5077

5078
	return SCTP_DISPOSITION_ABORT;
L
Linus Torvalds 已提交
5079 5080 5081 5082 5083 5084 5085 5086 5087 5088 5089 5090 5091 5092 5093 5094 5095
}

/*
 * sctp_sf_cookie_echoed_prm_abort
 *
 * Section: 4 Note: 3
 * Verification Tag:
 * Inputs
 * (endpoint, asoc)
 *
 * The RFC does not explcitly address this issue, but is the route through the
 * state table when someone issues an abort while in COOKIE_ECHOED state.
 *
 * Outputs
 * (timers)
 */
sctp_disposition_t sctp_sf_cookie_echoed_prm_abort(
5096
	struct net *net,
L
Linus Torvalds 已提交
5097 5098
	const struct sctp_endpoint *ep,
	const struct sctp_association *asoc,
5099
	const union sctp_subtype type,
L
Linus Torvalds 已提交
5100 5101 5102 5103 5104 5105
	void *arg,
	sctp_cmd_seq_t *commands)
{
	/* There is a single T1 timer, so we should be able to use
	 * common function with the COOKIE-WAIT state.
	 */
5106
	return sctp_sf_cookie_wait_prm_abort(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
5107 5108 5109 5110 5111 5112 5113 5114 5115 5116 5117 5118 5119 5120 5121
}

/*
 * sctp_sf_shutdown_pending_prm_abort
 *
 * Inputs
 * (endpoint, asoc)
 *
 * The RFC does not explicitly address this issue, but is the route through the
 * state table when someone issues an abort while in SHUTDOWN-PENDING state.
 *
 * Outputs
 * (timers)
 */
sctp_disposition_t sctp_sf_shutdown_pending_prm_abort(
5122
	struct net *net,
L
Linus Torvalds 已提交
5123 5124
	const struct sctp_endpoint *ep,
	const struct sctp_association *asoc,
5125
	const union sctp_subtype type,
L
Linus Torvalds 已提交
5126 5127 5128 5129 5130 5131 5132
	void *arg,
	sctp_cmd_seq_t *commands)
{
	/* Stop the T5-shutdown guard timer.  */
	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
			SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));

5133
	return sctp_sf_do_9_1_prm_abort(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
5134 5135 5136 5137 5138 5139 5140 5141 5142 5143 5144 5145 5146 5147 5148
}

/*
 * sctp_sf_shutdown_sent_prm_abort
 *
 * Inputs
 * (endpoint, asoc)
 *
 * The RFC does not explicitly address this issue, but is the route through the
 * state table when someone issues an abort while in SHUTDOWN-SENT state.
 *
 * Outputs
 * (timers)
 */
sctp_disposition_t sctp_sf_shutdown_sent_prm_abort(
5149
	struct net *net,
L
Linus Torvalds 已提交
5150 5151
	const struct sctp_endpoint *ep,
	const struct sctp_association *asoc,
5152
	const union sctp_subtype type,
L
Linus Torvalds 已提交
5153 5154 5155 5156 5157 5158 5159 5160 5161 5162 5163
	void *arg,
	sctp_cmd_seq_t *commands)
{
	/* Stop the T2-shutdown timer.  */
	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
			SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));

	/* Stop the T5-shutdown guard timer.  */
	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
			SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));

5164
	return sctp_sf_do_9_1_prm_abort(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
5165 5166 5167 5168 5169 5170 5171 5172 5173 5174 5175 5176 5177 5178 5179
}

/*
 * sctp_sf_cookie_echoed_prm_abort
 *
 * Inputs
 * (endpoint, asoc)
 *
 * The RFC does not explcitly address this issue, but is the route through the
 * state table when someone issues an abort while in COOKIE_ECHOED state.
 *
 * Outputs
 * (timers)
 */
sctp_disposition_t sctp_sf_shutdown_ack_sent_prm_abort(
5180
	struct net *net,
L
Linus Torvalds 已提交
5181 5182
	const struct sctp_endpoint *ep,
	const struct sctp_association *asoc,
5183
	const union sctp_subtype type,
L
Linus Torvalds 已提交
5184 5185 5186 5187 5188 5189
	void *arg,
	sctp_cmd_seq_t *commands)
{
	/* The same T2 timer, so we should be able to use
	 * common function with the SHUTDOWN-SENT state.
	 */
5190
	return sctp_sf_shutdown_sent_prm_abort(net, ep, asoc, type, arg, commands);
L
Linus Torvalds 已提交
5191 5192 5193 5194 5195 5196 5197 5198 5199 5200 5201 5202 5203 5204 5205 5206 5207 5208 5209 5210 5211 5212 5213 5214 5215
}

/*
 * Process the REQUESTHEARTBEAT primitive
 *
 * 10.1 ULP-to-SCTP
 * J) Request Heartbeat
 *
 * Format: REQUESTHEARTBEAT(association id, destination transport address)
 *
 * -> result
 *
 * Instructs the local endpoint to perform a HeartBeat on the specified
 * destination transport address of the given association. The returned
 * result should indicate whether the transmission of the HEARTBEAT
 * chunk to the destination address is successful.
 *
 * Mandatory attributes:
 *
 * o association id - local handle to the SCTP association
 *
 * o destination transport address - the transport address of the
 *   association on which a heartbeat should be issued.
 */
sctp_disposition_t sctp_sf_do_prm_requestheartbeat(
5216
					struct net *net,
L
Linus Torvalds 已提交
5217 5218
					const struct sctp_endpoint *ep,
					const struct sctp_association *asoc,
5219
					const union sctp_subtype type,
L
Linus Torvalds 已提交
5220 5221 5222
					void *arg,
					sctp_cmd_seq_t *commands)
{
5223 5224 5225 5226 5227 5228 5229 5230 5231 5232 5233 5234 5235 5236 5237
	if (SCTP_DISPOSITION_NOMEM == sctp_sf_heartbeat(ep, asoc, type,
				      (struct sctp_transport *)arg, commands))
		return SCTP_DISPOSITION_NOMEM;

	/*
	 * RFC 2960 (bis), section 8.3
	 *
	 *    D) Request an on-demand HEARTBEAT on a specific destination
	 *    transport address of a given association.
	 *
	 *    The endpoint should increment the respective error  counter of
	 *    the destination transport address each time a HEARTBEAT is sent
	 *    to that address and not acknowledged within one RTO.
	 *
	 */
5238
	sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_HB_SENT,
5239 5240
			SCTP_TRANSPORT(arg));
	return SCTP_DISPOSITION_CONSUME;
L
Linus Torvalds 已提交
5241 5242 5243 5244 5245 5246 5247
}

/*
 * ADDIP Section 4.1 ASCONF Chunk Procedures
 * When an endpoint has an ASCONF signaled change to be sent to the
 * remote endpoint it should do A1 to A9
 */
5248 5249
sctp_disposition_t sctp_sf_do_prm_asconf(struct net *net,
					const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
5250
					const struct sctp_association *asoc,
5251
					const union sctp_subtype type,
L
Linus Torvalds 已提交
5252 5253 5254 5255 5256 5257 5258 5259 5260 5261 5262 5263
					void *arg,
					sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = arg;

	sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T4, SCTP_CHUNK(chunk));
	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
			SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(chunk));
	return SCTP_DISPOSITION_CONSUME;
}

X
Xin Long 已提交
5264 5265 5266 5267
/* RE-CONFIG Section 5.1 RECONF Chunk Procedures */
sctp_disposition_t sctp_sf_do_prm_reconf(struct net *net,
					 const struct sctp_endpoint *ep,
					 const struct sctp_association *asoc,
5268
					 const union sctp_subtype type,
X
Xin Long 已提交
5269 5270 5271 5272 5273 5274 5275 5276
					 void *arg, sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = arg;

	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(chunk));
	return SCTP_DISPOSITION_CONSUME;
}

L
Linus Torvalds 已提交
5277 5278 5279 5280 5281 5282
/*
 * Ignore the primitive event
 *
 * The return value is the disposition of the primitive.
 */
sctp_disposition_t sctp_sf_ignore_primitive(
5283
	struct net *net,
L
Linus Torvalds 已提交
5284 5285
	const struct sctp_endpoint *ep,
	const struct sctp_association *asoc,
5286
	const union sctp_subtype type,
L
Linus Torvalds 已提交
5287 5288 5289
	void *arg,
	sctp_cmd_seq_t *commands)
{
5290 5291 5292
	pr_debug("%s: primitive type:%d is ignored\n", __func__,
		 type.primitive);

L
Linus Torvalds 已提交
5293 5294 5295 5296 5297 5298 5299
	return SCTP_DISPOSITION_DISCARD;
}

/***************************************************************************
 * These are the state functions for the OTHER events.
 ***************************************************************************/

5300 5301 5302 5303 5304 5305 5306
/*
 * When the SCTP stack has no more user data to send or retransmit, this
 * notification is given to the user. Also, at the time when a user app
 * subscribes to this event, if there is no data to be sent or
 * retransmit, the stack will immediately send up this notification.
 */
sctp_disposition_t sctp_sf_do_no_pending_tsn(
5307
	struct net *net,
5308 5309
	const struct sctp_endpoint *ep,
	const struct sctp_association *asoc,
5310
	const union sctp_subtype type,
5311 5312 5313 5314 5315 5316 5317 5318 5319 5320 5321 5322 5323 5324
	void *arg,
	sctp_cmd_seq_t *commands)
{
	struct sctp_ulpevent *event;

	event = sctp_ulpevent_make_sender_dry_event(asoc, GFP_ATOMIC);
	if (!event)
		return SCTP_DISPOSITION_NOMEM;

	sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(event));

	return SCTP_DISPOSITION_CONSUME;
}

L
Linus Torvalds 已提交
5325 5326 5327 5328 5329 5330 5331 5332 5333 5334 5335 5336 5337 5338
/*
 * Start the shutdown negotiation.
 *
 * From Section 9.2:
 * Once all its outstanding data has been acknowledged, the endpoint
 * shall send a SHUTDOWN chunk to its peer including in the Cumulative
 * TSN Ack field the last sequential TSN it has received from the peer.
 * It shall then start the T2-shutdown timer and enter the SHUTDOWN-SENT
 * state. If the timer expires, the endpoint must re-send the SHUTDOWN
 * with the updated last sequential TSN received from its peer.
 *
 * The return value is the disposition.
 */
sctp_disposition_t sctp_sf_do_9_2_start_shutdown(
5339
	struct net *net,
L
Linus Torvalds 已提交
5340 5341
	const struct sctp_endpoint *ep,
	const struct sctp_association *asoc,
5342
	const union sctp_subtype type,
L
Linus Torvalds 已提交
5343 5344 5345 5346 5347 5348 5349 5350 5351 5352 5353 5354 5355 5356 5357 5358 5359 5360 5361 5362 5363 5364 5365
	void *arg,
	sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *reply;

	/* Once all its outstanding data has been acknowledged, the
	 * endpoint shall send a SHUTDOWN chunk to its peer including
	 * in the Cumulative TSN Ack field the last sequential TSN it
	 * has received from the peer.
	 */
	reply = sctp_make_shutdown(asoc, NULL);
	if (!reply)
		goto nomem;

	/* Set the transport for the SHUTDOWN chunk and the timeout for the
	 * T2-shutdown timer.
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));

	/* It shall then start the T2-shutdown timer */
	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
			SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));

5366 5367 5368 5369
	/* RFC 4960 Section 9.2
	 * The sender of the SHUTDOWN MAY also start an overall guard timer
	 * 'T5-shutdown-guard' to bound the overall time for shutdown sequence.
	 */
5370
	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
5371 5372
			SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));

5373
	if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
L
Linus Torvalds 已提交
5374 5375 5376 5377 5378 5379 5380 5381 5382 5383
		sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
				SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));

	/* and enter the SHUTDOWN-SENT state.  */
	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
			SCTP_STATE(SCTP_STATE_SHUTDOWN_SENT));

	/* sctp-implguide 2.10 Issues with Heartbeating and failover
	 *
	 * HEARTBEAT ... is discontinued after sending either SHUTDOWN
5384
	 * or SHUTDOWN-ACK.
L
Linus Torvalds 已提交
5385 5386 5387 5388 5389 5390 5391 5392 5393 5394 5395 5396 5397 5398 5399 5400 5401 5402 5403 5404 5405 5406 5407 5408
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());

	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));

	return SCTP_DISPOSITION_CONSUME;

nomem:
	return SCTP_DISPOSITION_NOMEM;
}

/*
 * Generate a SHUTDOWN ACK now that everything is SACK'd.
 *
 * From Section 9.2:
 *
 * If it has no more outstanding DATA chunks, the SHUTDOWN receiver
 * shall send a SHUTDOWN ACK and start a T2-shutdown timer of its own,
 * entering the SHUTDOWN-ACK-SENT state. If the timer expires, the
 * endpoint must re-send the SHUTDOWN ACK.
 *
 * The return value is the disposition.
 */
sctp_disposition_t sctp_sf_do_9_2_shutdown_ack(
5409
	struct net *net,
L
Linus Torvalds 已提交
5410 5411
	const struct sctp_endpoint *ep,
	const struct sctp_association *asoc,
5412
	const union sctp_subtype type,
L
Linus Torvalds 已提交
5413 5414 5415 5416 5417 5418 5419 5420 5421 5422 5423 5424 5425 5426 5427
	void *arg,
	sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = (struct sctp_chunk *) arg;
	struct sctp_chunk *reply;

	/* There are 2 ways of getting here:
	 *    1) called in response to a SHUTDOWN chunk
	 *    2) called when SCTP_EVENT_NO_PENDING_TSN event is issued.
	 *
	 * For the case (2), the arg parameter is set to NULL.  We need
	 * to check that we have a chunk before accessing it's fields.
	 */
	if (chunk) {
		if (!sctp_vtag_verify(chunk, asoc))
5428 5429
			return sctp_sf_pdiscard(net, ep, asoc, type, arg,
						commands);
L
Linus Torvalds 已提交
5430 5431

		/* Make sure that the SHUTDOWN chunk has a valid length. */
5432 5433 5434 5435
		if (!sctp_chunk_length_valid(
				chunk, sizeof(struct sctp_shutdown_chunk)))
			return sctp_sf_violation_chunklen(net, ep, asoc, type,
							  arg, commands);
L
Linus Torvalds 已提交
5436 5437 5438 5439 5440 5441 5442 5443 5444 5445 5446 5447 5448 5449 5450 5451 5452 5453
	}

	/* If it has no more outstanding DATA chunks, the SHUTDOWN receiver
	 * shall send a SHUTDOWN ACK ...
	 */
	reply = sctp_make_shutdown_ack(asoc, chunk);
	if (!reply)
		goto nomem;

	/* Set the transport for the SHUTDOWN ACK chunk and the timeout for
	 * the T2-shutdown timer.
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));

	/* and start/restart a T2-shutdown timer of its own, */
	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
			SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));

5454
	if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
L
Linus Torvalds 已提交
5455 5456 5457 5458 5459 5460 5461 5462 5463 5464
		sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
				SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));

	/* Enter the SHUTDOWN-ACK-SENT state.  */
	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
			SCTP_STATE(SCTP_STATE_SHUTDOWN_ACK_SENT));

	/* sctp-implguide 2.10 Issues with Heartbeating and failover
	 *
	 * HEARTBEAT ... is discontinued after sending either SHUTDOWN
5465
	 * or SHUTDOWN-ACK.
L
Linus Torvalds 已提交
5466 5467 5468 5469 5470 5471 5472 5473 5474 5475 5476 5477 5478 5479 5480 5481
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());

	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));

	return SCTP_DISPOSITION_CONSUME;

nomem:
	return SCTP_DISPOSITION_NOMEM;
}

/*
 * Ignore the event defined as other
 *
 * The return value is the disposition of the event.
 */
5482 5483
sctp_disposition_t sctp_sf_ignore_other(struct net *net,
					const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
5484
					const struct sctp_association *asoc,
5485
					const union sctp_subtype type,
L
Linus Torvalds 已提交
5486 5487 5488
					void *arg,
					sctp_cmd_seq_t *commands)
{
5489 5490 5491
	pr_debug("%s: the event other type:%d is ignored\n",
		 __func__, type.other);

L
Linus Torvalds 已提交
5492 5493 5494 5495 5496 5497 5498 5499 5500 5501 5502 5503 5504 5505 5506 5507 5508 5509
	return SCTP_DISPOSITION_DISCARD;
}

/************************************************************
 * These are the state functions for handling timeout events.
 ************************************************************/

/*
 * RTX Timeout
 *
 * Section: 6.3.3 Handle T3-rtx Expiration
 *
 * Whenever the retransmission timer T3-rtx expires for a destination
 * address, do the following:
 * [See below]
 *
 * The return value is the disposition of the chunk.
 */
5510 5511
sctp_disposition_t sctp_sf_do_6_3_3_rtx(struct net *net,
					const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
5512
					const struct sctp_association *asoc,
5513
					const union sctp_subtype type,
L
Linus Torvalds 已提交
5514 5515 5516 5517 5518
					void *arg,
					sctp_cmd_seq_t *commands)
{
	struct sctp_transport *transport = arg;

5519
	SCTP_INC_STATS(net, SCTP_MIB_T3_RTX_EXPIREDS);
5520

L
Linus Torvalds 已提交
5521
	if (asoc->overall_error_count >= asoc->max_retrans) {
5522 5523
		if (asoc->peer.zero_window_announced &&
		    asoc->state == SCTP_STATE_SHUTDOWN_PENDING) {
5524 5525 5526 5527 5528 5529 5530 5531 5532 5533 5534 5535 5536 5537 5538 5539 5540
			/*
			 * We are here likely because the receiver had its rwnd
			 * closed for a while and we have not been able to
			 * transmit the locally queued data within the maximum
			 * retransmission attempts limit.  Start the T5
			 * shutdown guard timer to give the receiver one last
			 * chance and some additional time to recover before
			 * aborting.
			 */
			sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START_ONCE,
				SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
		} else {
			sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
					SCTP_ERROR(ETIMEDOUT));
			/* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
			sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
					SCTP_PERR(SCTP_ERROR_NO_ERROR));
5541 5542
			SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
			SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
5543 5544
			return SCTP_DISPOSITION_DELETE_TCB;
		}
L
Linus Torvalds 已提交
5545 5546 5547 5548 5549 5550 5551 5552 5553 5554 5555 5556 5557 5558 5559 5560 5561 5562 5563 5564 5565 5566 5567 5568 5569 5570 5571 5572 5573 5574 5575 5576
	}

	/* E1) For the destination address for which the timer
	 * expires, adjust its ssthresh with rules defined in Section
	 * 7.2.3 and set the cwnd <- MTU.
	 */

	/* E2) For the destination address for which the timer
	 * expires, set RTO <- RTO * 2 ("back off the timer").  The
	 * maximum value discussed in rule C7 above (RTO.max) may be
	 * used to provide an upper bound to this doubling operation.
	 */

	/* E3) Determine how many of the earliest (i.e., lowest TSN)
	 * outstanding DATA chunks for the address for which the
	 * T3-rtx has expired will fit into a single packet, subject
	 * to the MTU constraint for the path corresponding to the
	 * destination transport address to which the retransmission
	 * is being sent (this may be different from the address for
	 * which the timer expires [see Section 6.4]).  Call this
	 * value K. Bundle and retransmit those K DATA chunks in a
	 * single packet to the destination endpoint.
	 *
	 * Note: Any DATA chunks that were sent to the address for
	 * which the T3-rtx timer expired but did not fit in one MTU
	 * (rule E3 above), should be marked for retransmission and
	 * sent as soon as cwnd allows (normally when a SACK arrives).
	 */

	/* Do some failure management (Section 8.2). */
	sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE, SCTP_TRANSPORT(transport));

5577 5578 5579
	/* NB: Rules E4 and F1 are implicit in R1.  */
	sctp_add_cmd_sf(commands, SCTP_CMD_RETRAN, SCTP_TRANSPORT(transport));

L
Linus Torvalds 已提交
5580 5581 5582 5583 5584 5585 5586 5587 5588 5589 5590 5591 5592 5593 5594 5595 5596 5597
	return SCTP_DISPOSITION_CONSUME;
}

/*
 * Generate delayed SACK on timeout
 *
 * Section: 6.2  Acknowledgement on Reception of DATA Chunks
 *
 * The guidelines on delayed acknowledgement algorithm specified in
 * Section 4.2 of [RFC2581] SHOULD be followed.  Specifically, an
 * acknowledgement SHOULD be generated for at least every second packet
 * (not every second DATA chunk) received, and SHOULD be generated
 * within 200 ms of the arrival of any unacknowledged DATA chunk.  In
 * some situations it may be beneficial for an SCTP transmitter to be
 * more conservative than the algorithms detailed in this document
 * allow. However, an SCTP transmitter MUST NOT be more aggressive than
 * the following algorithms allow.
 */
5598 5599
sctp_disposition_t sctp_sf_do_6_2_sack(struct net *net,
				       const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
5600
				       const struct sctp_association *asoc,
5601
				       const union sctp_subtype type,
L
Linus Torvalds 已提交
5602 5603 5604
				       void *arg,
				       sctp_cmd_seq_t *commands)
{
5605
	SCTP_INC_STATS(net, SCTP_MIB_DELAY_SACK_EXPIREDS);
L
Linus Torvalds 已提交
5606 5607 5608 5609 5610
	sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
	return SCTP_DISPOSITION_CONSUME;
}

/*
F
Frank Filz 已提交
5611
 * sctp_sf_t1_init_timer_expire
L
Linus Torvalds 已提交
5612 5613 5614 5615 5616 5617 5618 5619 5620 5621 5622 5623 5624
 *
 * Section: 4 Note: 2
 * Verification Tag:
 * Inputs
 * (endpoint, asoc)
 *
 *  RFC 2960 Section 4 Notes
 *  2) If the T1-init timer expires, the endpoint MUST retransmit INIT
 *     and re-start the T1-init timer without changing state.  This MUST
 *     be repeated up to 'Max.Init.Retransmits' times.  After that, the
 *     endpoint MUST abort the initialization process and report the
 *     error to SCTP user.
 *
F
Frank Filz 已提交
5625 5626 5627 5628
 * Outputs
 * (timers, events)
 *
 */
5629 5630
sctp_disposition_t sctp_sf_t1_init_timer_expire(struct net *net,
					   const struct sctp_endpoint *ep,
F
Frank Filz 已提交
5631
					   const struct sctp_association *asoc,
5632
					   const union sctp_subtype type,
F
Frank Filz 已提交
5633 5634 5635 5636 5637 5638 5639
					   void *arg,
					   sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *repl = NULL;
	struct sctp_bind_addr *bp;
	int attempts = asoc->init_err_counter + 1;

5640 5641
	pr_debug("%s: timer T1 expired (INIT)\n", __func__);

5642
	SCTP_INC_STATS(net, SCTP_MIB_T1_INIT_EXPIREDS);
F
Frank Filz 已提交
5643

5644
	if (attempts <= asoc->max_init_attempts) {
F
Frank Filz 已提交
5645 5646 5647 5648 5649 5650 5651 5652 5653 5654 5655 5656 5657 5658 5659
		bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
		repl = sctp_make_init(asoc, bp, GFP_ATOMIC, 0);
		if (!repl)
			return SCTP_DISPOSITION_NOMEM;

		/* Choose transport for INIT. */
		sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
				SCTP_CHUNK(repl));

		/* Issue a sideeffect to do the needed accounting. */
		sctp_add_cmd_sf(commands, SCTP_CMD_INIT_RESTART,
				SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));

		sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
	} else {
5660 5661 5662 5663
		pr_debug("%s: giving up on INIT, attempts:%d "
			 "max_init_attempts:%d\n", __func__, attempts,
			 asoc->max_init_attempts);

5664 5665
		sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
				SCTP_ERROR(ETIMEDOUT));
F
Frank Filz 已提交
5666
		sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
5667
				SCTP_PERR(SCTP_ERROR_NO_ERROR));
F
Frank Filz 已提交
5668 5669 5670 5671 5672 5673 5674 5675 5676 5677 5678 5679 5680 5681 5682 5683
		return SCTP_DISPOSITION_DELETE_TCB;
	}

	return SCTP_DISPOSITION_CONSUME;
}

/*
 * sctp_sf_t1_cookie_timer_expire
 *
 * Section: 4 Note: 2
 * Verification Tag:
 * Inputs
 * (endpoint, asoc)
 *
 *  RFC 2960 Section 4 Notes
 *  3) If the T1-cookie timer expires, the endpoint MUST retransmit
L
Linus Torvalds 已提交
5684 5685 5686 5687 5688 5689 5690 5691 5692
 *     COOKIE ECHO and re-start the T1-cookie timer without changing
 *     state.  This MUST be repeated up to 'Max.Init.Retransmits' times.
 *     After that, the endpoint MUST abort the initialization process and
 *     report the error to SCTP user.
 *
 * Outputs
 * (timers, events)
 *
 */
5693 5694
sctp_disposition_t sctp_sf_t1_cookie_timer_expire(struct net *net,
					   const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
5695
					   const struct sctp_association *asoc,
5696
					   const union sctp_subtype type,
L
Linus Torvalds 已提交
5697 5698 5699
					   void *arg,
					   sctp_cmd_seq_t *commands)
{
F
Frank Filz 已提交
5700 5701
	struct sctp_chunk *repl = NULL;
	int attempts = asoc->init_err_counter + 1;
L
Linus Torvalds 已提交
5702

5703 5704
	pr_debug("%s: timer T1 expired (COOKIE-ECHO)\n", __func__);

5705
	SCTP_INC_STATS(net, SCTP_MIB_T1_COOKIE_EXPIREDS);
L
Linus Torvalds 已提交
5706

5707
	if (attempts <= asoc->max_init_attempts) {
F
Frank Filz 已提交
5708
		repl = sctp_make_cookie_echo(asoc, NULL);
L
Linus Torvalds 已提交
5709
		if (!repl)
F
Frank Filz 已提交
5710
			return SCTP_DISPOSITION_NOMEM;
L
Linus Torvalds 已提交
5711

5712 5713
		sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
				SCTP_CHUNK(repl));
L
Linus Torvalds 已提交
5714
		/* Issue a sideeffect to do the needed accounting. */
F
Frank Filz 已提交
5715 5716 5717
		sctp_add_cmd_sf(commands, SCTP_CMD_COOKIEECHO_RESTART,
				SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));

L
Linus Torvalds 已提交
5718 5719
		sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
	} else {
5720 5721
		sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
				SCTP_ERROR(ETIMEDOUT));
L
Linus Torvalds 已提交
5722
		sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
5723
				SCTP_PERR(SCTP_ERROR_NO_ERROR));
L
Linus Torvalds 已提交
5724 5725 5726 5727 5728 5729 5730 5731 5732 5733 5734 5735 5736 5737 5738 5739 5740 5741 5742
		return SCTP_DISPOSITION_DELETE_TCB;
	}

	return SCTP_DISPOSITION_CONSUME;
}

/* RFC2960 9.2 If the timer expires, the endpoint must re-send the SHUTDOWN
 * with the updated last sequential TSN received from its peer.
 *
 * An endpoint should limit the number of retransmissions of the
 * SHUTDOWN chunk to the protocol parameter 'Association.Max.Retrans'.
 * If this threshold is exceeded the endpoint should destroy the TCB and
 * MUST report the peer endpoint unreachable to the upper layer (and
 * thus the association enters the CLOSED state).  The reception of any
 * packet from its peer (i.e. as the peer sends all of its queued DATA
 * chunks) should clear the endpoint's retransmission count and restart
 * the T2-Shutdown timer,  giving its peer ample opportunity to transmit
 * all of its queued DATA chunks that have not yet been sent.
 */
5743 5744
sctp_disposition_t sctp_sf_t2_timer_expire(struct net *net,
					   const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
5745
					   const struct sctp_association *asoc,
5746
					   const union sctp_subtype type,
L
Linus Torvalds 已提交
5747 5748 5749 5750 5751
					   void *arg,
					   sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *reply = NULL;

5752 5753
	pr_debug("%s: timer T2 expired\n", __func__);

5754
	SCTP_INC_STATS(net, SCTP_MIB_T2_SHUTDOWN_EXPIREDS);
5755

5756 5757
	((struct sctp_association *)asoc)->shutdown_retries++;

L
Linus Torvalds 已提交
5758
	if (asoc->overall_error_count >= asoc->max_retrans) {
5759 5760
		sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
				SCTP_ERROR(ETIMEDOUT));
L
Linus Torvalds 已提交
5761 5762
		/* Note:  CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5763
				SCTP_PERR(SCTP_ERROR_NO_ERROR));
5764 5765
		SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
		SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
L
Linus Torvalds 已提交
5766 5767 5768 5769 5770 5771 5772 5773 5774 5775 5776 5777 5778 5779 5780
		return SCTP_DISPOSITION_DELETE_TCB;
	}

	switch (asoc->state) {
	case SCTP_STATE_SHUTDOWN_SENT:
		reply = sctp_make_shutdown(asoc, NULL);
		break;

	case SCTP_STATE_SHUTDOWN_ACK_SENT:
		reply = sctp_make_shutdown_ack(asoc, NULL);
		break;

	default:
		BUG();
		break;
5781
	}
L
Linus Torvalds 已提交
5782 5783 5784 5785

	if (!reply)
		goto nomem;

5786 5787 5788 5789 5790 5791 5792
	/* Do some failure management (Section 8.2).
	 * If we remove the transport an SHUTDOWN was last sent to, don't
	 * do failure management.
	 */
	if (asoc->shutdown_last_sent_to)
		sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE,
				SCTP_TRANSPORT(asoc->shutdown_last_sent_to));
L
Linus Torvalds 已提交
5793 5794 5795 5796 5797 5798 5799 5800 5801 5802 5803 5804 5805 5806 5807 5808 5809 5810 5811 5812 5813

	/* Set the transport for the SHUTDOWN/ACK chunk and the timeout for
	 * the T2-shutdown timer.
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));

	/* Restart the T2-shutdown timer.  */
	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
			SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
	return SCTP_DISPOSITION_CONSUME;

nomem:
	return SCTP_DISPOSITION_NOMEM;
}

/*
 * ADDIP Section 4.1 ASCONF CHunk Procedures
 * If the T4 RTO timer expires the endpoint should do B1 to B5
 */
sctp_disposition_t sctp_sf_t4_timer_expire(
5814
	struct net *net,
L
Linus Torvalds 已提交
5815 5816
	const struct sctp_endpoint *ep,
	const struct sctp_association *asoc,
5817
	const union sctp_subtype type,
L
Linus Torvalds 已提交
5818 5819 5820 5821 5822 5823
	void *arg,
	sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *chunk = asoc->addip_last_asconf;
	struct sctp_transport *transport = chunk->transport;

5824
	SCTP_INC_STATS(net, SCTP_MIB_T4_RTO_EXPIREDS);
5825

L
Linus Torvalds 已提交
5826 5827 5828 5829
	/* ADDIP 4.1 B1) Increment the error counters and perform path failure
	 * detection on the appropriate destination address as defined in
	 * RFC2960 [5] section 8.1 and 8.2.
	 */
5830 5831 5832
	if (transport)
		sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE,
				SCTP_TRANSPORT(transport));
L
Linus Torvalds 已提交
5833 5834 5835 5836 5837 5838 5839 5840 5841 5842 5843 5844

	/* Reconfig T4 timer and transport. */
	sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T4, SCTP_CHUNK(chunk));

	/* ADDIP 4.1 B2) Increment the association error counters and perform
	 * endpoint failure detection on the association as defined in
	 * RFC2960 [5] section 8.1 and 8.2.
	 * association error counter is incremented in SCTP_CMD_STRIKE.
	 */
	if (asoc->overall_error_count >= asoc->max_retrans) {
		sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
				SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
5845 5846
		sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
				SCTP_ERROR(ETIMEDOUT));
L
Linus Torvalds 已提交
5847
		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5848
				SCTP_PERR(SCTP_ERROR_NO_ERROR));
5849 5850
		SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
		SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
L
Linus Torvalds 已提交
5851 5852 5853 5854 5855 5856 5857 5858 5859 5860 5861
		return SCTP_DISPOSITION_ABORT;
	}

	/* ADDIP 4.1 B3) Back-off the destination address RTO value to which
	 * the ASCONF chunk was sent by doubling the RTO timer value.
	 * This is done in SCTP_CMD_STRIKE.
	 */

	/* ADDIP 4.1 B4) Re-transmit the ASCONF Chunk last sent and if possible
	 * choose an alternate destination address (please refer to RFC2960
	 * [5] section 6.4.1). An endpoint MUST NOT add new parameters to this
5862
	 * chunk, it MUST be the same (including its serial number) as the last
L
Linus Torvalds 已提交
5863 5864 5865 5866 5867 5868 5869 5870 5871 5872 5873 5874 5875 5876 5877 5878 5879 5880 5881 5882 5883 5884
	 * ASCONF sent.
	 */
	sctp_chunk_hold(asoc->addip_last_asconf);
	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
			SCTP_CHUNK(asoc->addip_last_asconf));

	/* ADDIP 4.1 B5) Restart the T-4 RTO timer. Note that if a different
	 * destination is selected, then the RTO used will be that of the new
	 * destination address.
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
			SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));

	return SCTP_DISPOSITION_CONSUME;
}

/* sctpimpguide-05 Section 2.12.2
 * The sender of the SHUTDOWN MAY also start an overall guard timer
 * 'T5-shutdown-guard' to bound the overall time for shutdown sequence.
 * At the expiration of this timer the sender SHOULD abort the association
 * by sending an ABORT chunk.
 */
5885 5886
sctp_disposition_t sctp_sf_t5_timer_expire(struct net *net,
					   const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
5887
					   const struct sctp_association *asoc,
5888
					   const union sctp_subtype type,
L
Linus Torvalds 已提交
5889 5890 5891 5892 5893
					   void *arg,
					   sctp_cmd_seq_t *commands)
{
	struct sctp_chunk *reply = NULL;

5894 5895
	pr_debug("%s: timer T5 expired\n", __func__);

5896
	SCTP_INC_STATS(net, SCTP_MIB_T5_SHUTDOWN_GUARD_EXPIREDS);
L
Linus Torvalds 已提交
5897 5898 5899 5900 5901 5902

	reply = sctp_make_abort(asoc, NULL, 0);
	if (!reply)
		goto nomem;

	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
5903 5904
	sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
			SCTP_ERROR(ETIMEDOUT));
L
Linus Torvalds 已提交
5905
	sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5906
			SCTP_PERR(SCTP_ERROR_NO_ERROR));
L
Linus Torvalds 已提交
5907

5908 5909
	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
	SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
5910

L
Linus Torvalds 已提交
5911 5912 5913 5914 5915 5916 5917 5918 5919 5920 5921
	return SCTP_DISPOSITION_DELETE_TCB;
nomem:
	return SCTP_DISPOSITION_NOMEM;
}

/* Handle expiration of AUTOCLOSE timer.  When the autoclose timer expires,
 * the association is automatically closed by starting the shutdown process.
 * The work that needs to be done is same as when SHUTDOWN is initiated by
 * the user.  So this routine looks same as sctp_sf_do_9_2_prm_shutdown().
 */
sctp_disposition_t sctp_sf_autoclose_timer_expire(
5922
	struct net *net,
L
Linus Torvalds 已提交
5923 5924
	const struct sctp_endpoint *ep,
	const struct sctp_association *asoc,
5925
	const union sctp_subtype type,
L
Linus Torvalds 已提交
5926 5927 5928 5929 5930
	void *arg,
	sctp_cmd_seq_t *commands)
{
	int disposition;

5931
	SCTP_INC_STATS(net, SCTP_MIB_AUTOCLOSE_EXPIREDS);
5932

L
Linus Torvalds 已提交
5933 5934 5935 5936 5937 5938 5939 5940 5941 5942 5943 5944 5945
	/* From 9.2 Shutdown of an Association
	 * Upon receipt of the SHUTDOWN primitive from its upper
	 * layer, the endpoint enters SHUTDOWN-PENDING state and
	 * remains there until all outstanding data has been
	 * acknowledged by its peer. The endpoint accepts no new data
	 * from its upper layer, but retransmits data to the far end
	 * if necessary to fill gaps.
	 */
	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
			SCTP_STATE(SCTP_STATE_SHUTDOWN_PENDING));

	disposition = SCTP_DISPOSITION_CONSUME;
	if (sctp_outq_is_empty(&asoc->outqueue)) {
5946
		disposition = sctp_sf_do_9_2_start_shutdown(net, ep, asoc, type,
L
Linus Torvalds 已提交
5947 5948 5949 5950 5951 5952 5953 5954 5955 5956 5957 5958 5959 5960 5961 5962 5963
							    arg, commands);
	}
	return disposition;
}

/*****************************************************************************
 * These are sa state functions which could apply to all types of events.
 ****************************************************************************/

/*
 * This table entry is not implemented.
 *
 * Inputs
 * (endpoint, asoc, chunk)
 *
 * The return value is the disposition of the chunk.
 */
5964 5965
sctp_disposition_t sctp_sf_not_impl(struct net *net,
				    const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
5966
				    const struct sctp_association *asoc,
5967
				    const union sctp_subtype type,
L
Linus Torvalds 已提交
5968 5969 5970 5971 5972 5973 5974 5975 5976 5977 5978 5979 5980 5981
				    void *arg,
				    sctp_cmd_seq_t *commands)
{
	return SCTP_DISPOSITION_NOT_IMPL;
}

/*
 * This table entry represents a bug.
 *
 * Inputs
 * (endpoint, asoc, chunk)
 *
 * The return value is the disposition of the chunk.
 */
5982 5983
sctp_disposition_t sctp_sf_bug(struct net *net,
			       const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
5984
			       const struct sctp_association *asoc,
5985
			       const union sctp_subtype type,
L
Linus Torvalds 已提交
5986 5987 5988 5989 5990 5991 5992 5993 5994 5995 5996 5997 5998 5999 6000 6001 6002
			       void *arg,
			       sctp_cmd_seq_t *commands)
{
	return SCTP_DISPOSITION_BUG;
}

/*
 * This table entry represents the firing of a timer in the wrong state.
 * Since timer deletion cannot be guaranteed a timer 'may' end up firing
 * when the association is in the wrong state.   This event should
 * be ignored, so as to prevent any rearming of the timer.
 *
 * Inputs
 * (endpoint, asoc, chunk)
 *
 * The return value is the disposition of the chunk.
 */
6003 6004
sctp_disposition_t sctp_sf_timer_ignore(struct net *net,
					const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
6005
					const struct sctp_association *asoc,
6006
					const union sctp_subtype type,
L
Linus Torvalds 已提交
6007 6008 6009
					void *arg,
					sctp_cmd_seq_t *commands)
{
6010 6011
	pr_debug("%s: timer %d ignored\n", __func__, type.chunk);

L
Linus Torvalds 已提交
6012 6013 6014 6015 6016 6017 6018 6019 6020 6021 6022 6023 6024 6025 6026 6027 6028 6029 6030 6031 6032 6033 6034 6035 6036 6037 6038 6039 6040 6041 6042 6043 6044 6045 6046
	return SCTP_DISPOSITION_CONSUME;
}

/********************************************************************
 * 2nd Level Abstractions
 ********************************************************************/

/* Pull the SACK chunk based on the SACK header. */
static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk)
{
	struct sctp_sackhdr *sack;
	unsigned int len;
	__u16 num_blocks;
	__u16 num_dup_tsns;

	/* Protect ourselves from reading too far into
	 * the skb from a bogus sender.
	 */
	sack = (struct sctp_sackhdr *) chunk->skb->data;

	num_blocks = ntohs(sack->num_gap_ack_blocks);
	num_dup_tsns = ntohs(sack->num_dup_tsns);
	len = sizeof(struct sctp_sackhdr);
	len += (num_blocks + num_dup_tsns) * sizeof(__u32);
	if (len > chunk->skb->len)
		return NULL;

	skb_pull(chunk->skb, len);

	return sack;
}

/* Create an ABORT packet to be sent as a response, with the specified
 * error causes.
 */
6047 6048
static struct sctp_packet *sctp_abort_pkt_new(struct net *net,
				  const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
6049 6050 6051 6052 6053 6054 6055 6056
				  const struct sctp_association *asoc,
				  struct sctp_chunk *chunk,
				  const void *payload,
				  size_t paylen)
{
	struct sctp_packet *packet;
	struct sctp_chunk *abort;

6057
	packet = sctp_ootb_pkt_new(net, asoc, chunk);
L
Linus Torvalds 已提交
6058 6059 6060 6061 6062 6063 6064 6065 6066 6067

	if (packet) {
		/* Make an ABORT.
		 * The T bit will be set if the asoc is NULL.
		 */
		abort = sctp_make_abort(asoc, chunk, paylen);
		if (!abort) {
			sctp_ootb_pkt_free(packet);
			return NULL;
		}
6068 6069 6070 6071 6072

		/* Reflect vtag if T-Bit is set */
		if (sctp_test_T_bit(abort))
			packet->vtag = ntohl(chunk->sctp_hdr->vtag);

L
Linus Torvalds 已提交
6073 6074 6075 6076 6077 6078 6079 6080 6081 6082 6083 6084 6085 6086 6087 6088
		/* Add specified error causes, i.e., payload, to the
		 * end of the chunk.
		 */
		sctp_addto_chunk(abort, paylen, payload);

		/* Set the skb to the belonging sock for accounting.  */
		abort->skb->sk = ep->base.sk;

		sctp_packet_append_chunk(packet, abort);

	}

	return packet;
}

/* Allocate a packet for responding in the OOTB conditions.  */
6089 6090
static struct sctp_packet *sctp_ootb_pkt_new(struct net *net,
					     const struct sctp_association *asoc,
L
Linus Torvalds 已提交
6091 6092 6093 6094 6095 6096 6097 6098 6099 6100 6101 6102 6103 6104 6105 6106
					     const struct sctp_chunk *chunk)
{
	struct sctp_packet *packet;
	struct sctp_transport *transport;
	__u16 sport;
	__u16 dport;
	__u32 vtag;

	/* Get the source and destination port from the inbound packet.  */
	sport = ntohs(chunk->sctp_hdr->dest);
	dport = ntohs(chunk->sctp_hdr->source);

	/* The V-tag is going to be the same as the inbound packet if no
	 * association exists, otherwise, use the peer's vtag.
	 */
	if (asoc) {
6107 6108 6109
		/* Special case the INIT-ACK as there is no peer's vtag
		 * yet.
		 */
6110
		switch (chunk->chunk_hdr->type) {
6111 6112
		case SCTP_CID_INIT_ACK:
		{
6113
			struct sctp_initack_chunk *initack;
6114

6115
			initack = (struct sctp_initack_chunk *)chunk->chunk_hdr;
6116 6117 6118 6119 6120 6121 6122
			vtag = ntohl(initack->init_hdr.init_tag);
			break;
		}
		default:
			vtag = asoc->peer.i.init_tag;
			break;
		}
L
Linus Torvalds 已提交
6123 6124 6125 6126
	} else {
		/* Special case the INIT and stale COOKIE_ECHO as there is no
		 * vtag yet.
		 */
6127
		switch (chunk->chunk_hdr->type) {
L
Linus Torvalds 已提交
6128 6129
		case SCTP_CID_INIT:
		{
6130
			struct sctp_init_chunk *init;
L
Linus Torvalds 已提交
6131

6132
			init = (struct sctp_init_chunk *)chunk->chunk_hdr;
L
Linus Torvalds 已提交
6133 6134 6135
			vtag = ntohl(init->init_hdr.init_tag);
			break;
		}
6136
		default:
L
Linus Torvalds 已提交
6137 6138 6139 6140 6141 6142
			vtag = ntohl(chunk->sctp_hdr->vtag);
			break;
		}
	}

	/* Make a transport for the bucket, Eliza... */
6143
	transport = sctp_transport_new(net, sctp_source(chunk), GFP_ATOMIC);
L
Linus Torvalds 已提交
6144 6145 6146 6147 6148 6149
	if (!transport)
		goto nomem;

	/* Cache a route for the transport with the chunk's destination as
	 * the source address.
	 */
6150
	sctp_transport_route(transport, (union sctp_addr *)&chunk->dest,
6151
			     sctp_sk(net->sctp.ctl_sock));
L
Linus Torvalds 已提交
6152

6153 6154 6155
	packet = &transport->packet;
	sctp_packet_init(packet, transport, sport, dport);
	sctp_packet_config(packet, vtag, 0);
L
Linus Torvalds 已提交
6156 6157 6158 6159 6160 6161 6162 6163 6164 6165 6166 6167 6168 6169

	return packet;

nomem:
	return NULL;
}

/* Free the packet allocated earlier for responding in the OOTB condition.  */
void sctp_ootb_pkt_free(struct sctp_packet *packet)
{
	sctp_transport_free(packet->transport);
}

/* Send a stale cookie error when a invalid COOKIE ECHO chunk is found  */
6170 6171
static void sctp_send_stale_cookie_err(struct net *net,
				       const struct sctp_endpoint *ep,
L
Linus Torvalds 已提交
6172 6173 6174 6175 6176 6177 6178 6179
				       const struct sctp_association *asoc,
				       const struct sctp_chunk *chunk,
				       sctp_cmd_seq_t *commands,
				       struct sctp_chunk *err_chunk)
{
	struct sctp_packet *packet;

	if (err_chunk) {
6180
		packet = sctp_ootb_pkt_new(net, asoc, chunk);
L
Linus Torvalds 已提交
6181 6182 6183 6184 6185 6186
		if (packet) {
			struct sctp_signed_cookie *cookie;

			/* Override the OOTB vtag from the cookie. */
			cookie = chunk->subh.cookie_hdr;
			packet->vtag = cookie->c.peer_vtag;
6187

L
Linus Torvalds 已提交
6188 6189 6190 6191 6192
			/* Set the skb to the belonging sock for accounting. */
			err_chunk->skb->sk = ep->base.sk;
			sctp_packet_append_chunk(packet, err_chunk);
			sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
					SCTP_PACKET(packet));
6193
			SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
L
Linus Torvalds 已提交
6194 6195 6196 6197 6198 6199 6200 6201 6202 6203 6204
		} else
			sctp_chunk_free (err_chunk);
	}
}


/* Process a data chunk */
static int sctp_eat_data(const struct sctp_association *asoc,
			 struct sctp_chunk *chunk,
			 sctp_cmd_seq_t *commands)
{
6205
	struct sctp_datahdr *data_hdr;
L
Linus Torvalds 已提交
6206 6207 6208 6209 6210
	struct sctp_chunk *err;
	size_t datalen;
	sctp_verb_t deliver;
	int tmp;
	__u32 tsn;
6211
	struct sctp_tsnmap *map = (struct sctp_tsnmap *)&asoc->peer.tsn_map;
6212
	struct sock *sk = asoc->base.sk;
6213
	struct net *net = sock_net(sk);
6214 6215 6216
	u16 ssn;
	u16 sid;
	u8 ordered = 0;
L
Linus Torvalds 已提交
6217

6218 6219 6220
	data_hdr = (struct sctp_datahdr *)chunk->skb->data;
	chunk->subh.data_hdr = data_hdr;
	skb_pull(chunk->skb, sizeof(*data_hdr));
L
Linus Torvalds 已提交
6221 6222

	tsn = ntohl(data_hdr->tsn);
6223
	pr_debug("%s: TSN 0x%x\n", __func__, tsn);
L
Linus Torvalds 已提交
6224 6225 6226 6227 6228 6229 6230 6231 6232 6233 6234 6235 6236

	/* ASSERT:  Now skb->data is really the user data.  */

	/* Process ECN based congestion.
	 *
	 * Since the chunk structure is reused for all chunks within
	 * a packet, we use ecn_ce_done to track if we've already
	 * done CE processing for this packet.
	 *
	 * We need to do ECN processing even if we plan to discard the
	 * chunk later.
	 */

6237
	if (asoc->peer.ecn_capable && !chunk->ecn_ce_done) {
6238
		struct sctp_af *af = SCTP_INPUT_CB(chunk->skb)->af;
L
Linus Torvalds 已提交
6239 6240
		chunk->ecn_ce_done = 1;

6241
		if (af->is_ce(sctp_gso_headskb(chunk->skb))) {
L
Linus Torvalds 已提交
6242 6243 6244 6245 6246 6247 6248 6249 6250 6251 6252
			/* Do real work as sideffect. */
			sctp_add_cmd_sf(commands, SCTP_CMD_ECN_CE,
					SCTP_U32(tsn));
		}
	}

	tmp = sctp_tsnmap_check(&asoc->peer.tsn_map, tsn);
	if (tmp < 0) {
		/* The TSN is too high--silently discard the chunk and
		 * count on it getting retransmitted later.
		 */
6253 6254
		if (chunk->asoc)
			chunk->asoc->stats.outofseqtsns++;
L
Linus Torvalds 已提交
6255 6256 6257 6258 6259 6260 6261 6262 6263 6264 6265 6266 6267
		return SCTP_IERROR_HIGH_TSN;
	} else if (tmp > 0) {
		/* This is a duplicate.  Record it.  */
		sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_DUP, SCTP_U32(tsn));
		return SCTP_IERROR_DUP_TSN;
	}

	/* This is a new TSN.  */

	/* Discard if there is no room in the receive window.
	 * Actually, allow a little bit of overflow (up to a MTU).
	 */
	datalen = ntohs(chunk->chunk_hdr->length);
6268
	datalen -= sizeof(struct sctp_data_chunk);
L
Linus Torvalds 已提交
6269 6270 6271 6272 6273 6274 6275 6276 6277 6278 6279 6280

	deliver = SCTP_CMD_CHUNK_ULP;

	/* Think about partial delivery. */
	if ((datalen >= asoc->rwnd) && (!asoc->ulpq.pd_mode)) {

		/* Even if we don't accept this chunk there is
		 * memory pressure.
		 */
		sctp_add_cmd_sf(commands, SCTP_CMD_PART_DELIVER, SCTP_NULL());
	}

6281
	/* Spill over rwnd a little bit.  Note: While allowed, this spill over
L
Linus Torvalds 已提交
6282 6283 6284
	 * seems a bit troublesome in that frag_point varies based on
	 * PMTU.  In cases, such as loopback, this might be a rather
	 * large spill over.
6285
	 */
6286
	if ((!chunk->data_accepted) && (!asoc->rwnd || asoc->rwnd_over ||
6287
	    (datalen > asoc->rwnd + asoc->frag_point))) {
L
Linus Torvalds 已提交
6288 6289 6290 6291 6292 6293 6294

		/* If this is the next TSN, consider reneging to make
		 * room.   Note: Playing nice with a confused sender.  A
		 * malicious sender can still eat up all our buffer
		 * space and in the future we may want to detect and
		 * do more drastic reneging.
		 */
6295 6296
		if (sctp_tsnmap_has_gap(map) &&
		    (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
6297
			pr_debug("%s: reneging for tsn:%u\n", __func__, tsn);
L
Linus Torvalds 已提交
6298 6299
			deliver = SCTP_CMD_RENEGE;
		} else {
6300 6301 6302
			pr_debug("%s: discard tsn:%u len:%zu, rwnd:%d\n",
				 __func__, tsn, datalen, asoc->rwnd);

L
Linus Torvalds 已提交
6303 6304 6305 6306
			return SCTP_IERROR_IGNORE_TSN;
		}
	}

6307 6308 6309
	/*
	 * Also try to renege to limit our memory usage in the event that
	 * we are under memory pressure
6310
	 * If we can't renege, don't worry about it, the sk_rmem_schedule
6311 6312 6313 6314 6315
	 * in sctp_ulpevent_make_rcvmsg will drop the frame if we grow our
	 * memory usage too much
	 */
	if (*sk->sk_prot_creator->memory_pressure) {
		if (sctp_tsnmap_has_gap(map) &&
6316
		    (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
6317 6318
			pr_debug("%s: under pressure, reneging for tsn:%u\n",
				 __func__, tsn);
6319 6320 6321 6322
			deliver = SCTP_CMD_RENEGE;
		 }
	}

L
Linus Torvalds 已提交
6323 6324 6325 6326 6327 6328 6329 6330 6331 6332 6333 6334 6335 6336 6337 6338 6339
	/*
	 * Section 3.3.10.9 No User Data (9)
	 *
	 * Cause of error
	 * ---------------
	 * No User Data:  This error cause is returned to the originator of a
	 * DATA chunk if a received DATA chunk has no user data.
	 */
	if (unlikely(0 == datalen)) {
		err = sctp_make_abort_no_data(asoc, chunk, tsn);
		if (err) {
			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
					SCTP_CHUNK(err));
		}
		/* We are going to ABORT, so we might as well stop
		 * processing the rest of the chunks in the packet.
		 */
6340
		sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
6341 6342
		sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
				SCTP_ERROR(ECONNABORTED));
L
Linus Torvalds 已提交
6343
		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
6344
				SCTP_PERR(SCTP_ERROR_NO_DATA));
6345 6346
		SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
		SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
L
Linus Torvalds 已提交
6347 6348 6349
		return SCTP_IERROR_NO_DATA;
	}

6350 6351
	chunk->data_accepted = 1;

L
Linus Torvalds 已提交
6352 6353 6354
	/* Note: Some chunks may get overcounted (if we drop) or overcounted
	 * if we renege and the chunk arrives again.
	 */
6355
	if (chunk->chunk_hdr->flags & SCTP_DATA_UNORDERED) {
6356
		SCTP_INC_STATS(net, SCTP_MIB_INUNORDERCHUNKS);
6357 6358 6359
		if (chunk->asoc)
			chunk->asoc->stats.iuodchunks++;
	} else {
6360
		SCTP_INC_STATS(net, SCTP_MIB_INORDERCHUNKS);
6361 6362
		if (chunk->asoc)
			chunk->asoc->stats.iodchunks++;
6363 6364
		ordered = 1;
	}
L
Linus Torvalds 已提交
6365 6366 6367 6368 6369 6370 6371 6372 6373

	/* RFC 2960 6.5 Stream Identifier and Stream Sequence Number
	 *
	 * If an endpoint receive a DATA chunk with an invalid stream
	 * identifier, it shall acknowledge the reception of the DATA chunk
	 * following the normal procedure, immediately send an ERROR chunk
	 * with cause set to "Invalid Stream Identifier" (See Section 3.3.10)
	 * and discard the DATA chunk.
	 */
6374
	sid = ntohs(data_hdr->stream);
6375
	if (sid >= asoc->stream.incnt) {
6376 6377 6378
		/* Mark tsn as received even though we drop it */
		sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_TSN, SCTP_U32(tsn));

L
Linus Torvalds 已提交
6379 6380
		err = sctp_make_op_error(asoc, chunk, SCTP_ERROR_INV_STRM,
					 &data_hdr->stream,
6381 6382
					 sizeof(data_hdr->stream),
					 sizeof(u16));
L
Linus Torvalds 已提交
6383 6384 6385 6386 6387 6388
		if (err)
			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
					SCTP_CHUNK(err));
		return SCTP_IERROR_BAD_STREAM;
	}

6389 6390 6391 6392 6393 6394 6395 6396
	/* Check to see if the SSN is possible for this TSN.
	 * The biggest gap we can record is 4K wide.  Since SSNs wrap
	 * at an unsigned short, there is no way that an SSN can
	 * wrap and for a valid TSN.  We can simply check if the current
	 * SSN is smaller then the next expected one.  If it is, it wrapped
	 * and is invalid.
	 */
	ssn = ntohs(data_hdr->ssn);
6397
	if (ordered && SSN_lt(ssn, sctp_ssn_peek(&asoc->stream, in, sid)))
6398 6399
		return SCTP_IERROR_PROTO_VIOLATION;

L
Linus Torvalds 已提交
6400 6401 6402 6403 6404 6405 6406 6407
	/* Send the data up to the user.  Note:  Schedule  the
	 * SCTP_CMD_CHUNK_ULP cmd before the SCTP_CMD_GEN_SACK, as the SACK
	 * chunk needs the updated rwnd.
	 */
	sctp_add_cmd_sf(commands, deliver, SCTP_CHUNK(chunk));

	return SCTP_IERROR_NO_ERROR;
}