ipv4.c 28.5 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12 13 14
/*
 *  net/dccp/ipv4.c
 *
 *  An implementation of the DCCP protocol
 *  Arnaldo Carvalho de Melo <acme@conectiva.com.br>
 *
 *	This program is free software; you can redistribute it and/or
 *	modify it under the terms of the GNU General Public License
 *	as published by the Free Software Foundation; either version
 *	2 of the License, or (at your option) any later version.
 */

#include <linux/dccp.h>
#include <linux/icmp.h>
15
#include <linux/slab.h>
16 17 18 19 20
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/random.h>

#include <net/icmp.h>
21
#include <net/inet_common.h>
22
#include <net/inet_hashtables.h>
23
#include <net/inet_sock.h>
24
#include <net/protocol.h>
25
#include <net/sock.h>
26
#include <net/timewait_sock.h>
27 28
#include <net/tcp_states.h>
#include <net/xfrm.h>
29
#include <net/secure_seq.h>
30

31
#include "ackvec.h"
32 33
#include "ccid.h"
#include "dccp.h"
34
#include "feat.h"
35

36
/*
37
 * The per-net dccp.v4_ctl_sk socket is used for responding to
38 39 40 41
 * the Out-of-the-blue (OOTB) packets. A control sock will be created
 * for this socket at the initialization time.
 */

42
int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
43
{
44
	const struct sockaddr_in *usin = (struct sockaddr_in *)uaddr;
45 46
	struct inet_sock *inet = inet_sk(sk);
	struct dccp_sock *dp = dccp_sk(sk);
47
	__be16 orig_sport, orig_dport;
48
	__be32 daddr, nexthop;
49
	struct flowi4 *fl4;
50
	struct rtable *rt;
51
	int err;
52
	struct ip_options_rcu *inet_opt;
53 54 55 56 57 58 59 60 61 62

	dp->dccps_role = DCCP_ROLE_CLIENT;

	if (addr_len < sizeof(struct sockaddr_in))
		return -EINVAL;

	if (usin->sin_family != AF_INET)
		return -EAFNOSUPPORT;

	nexthop = daddr = usin->sin_addr.s_addr;
63 64

	inet_opt = rcu_dereference_protected(inet->inet_opt,
65
					     lockdep_sock_is_held(sk));
66
	if (inet_opt != NULL && inet_opt->opt.srr) {
67 68
		if (daddr == 0)
			return -EINVAL;
69
		nexthop = inet_opt->opt.faddr;
70 71
	}

72 73
	orig_sport = inet->inet_sport;
	orig_dport = usin->sin_port;
74 75
	fl4 = &inet->cork.fl.u.ip4;
	rt = ip_route_connect(fl4, nexthop, inet->inet_saddr,
76 77
			      RT_CONN_FLAGS(sk), sk->sk_bound_dev_if,
			      IPPROTO_DCCP,
78
			      orig_sport, orig_dport, sk);
79 80
	if (IS_ERR(rt))
		return PTR_ERR(rt);
81 82 83 84 85 86

	if (rt->rt_flags & (RTCF_MULTICAST | RTCF_BROADCAST)) {
		ip_rt_put(rt);
		return -ENETUNREACH;
	}

87
	if (inet_opt == NULL || !inet_opt->opt.srr)
88
		daddr = fl4->daddr;
89

E
Eric Dumazet 已提交
90
	if (inet->inet_saddr == 0)
91
		inet->inet_saddr = fl4->saddr;
92
	sk_rcv_saddr_set(sk, inet->inet_saddr);
E
Eric Dumazet 已提交
93
	inet->inet_dport = usin->sin_port;
94
	sk_daddr_set(sk, daddr);
95

96
	inet_csk(sk)->icsk_ext_hdr_len = 0;
97 98
	if (inet_opt)
		inet_csk(sk)->icsk_ext_hdr_len = inet_opt->opt.optlen;
99 100 101 102 103 104 105
	/*
	 * Socket identity is still unknown (sport may be zero).
	 * However we set state to DCCP_REQUESTING and not releasing socket
	 * lock select source port, enter ourselves into the hash tables and
	 * complete initialization after this.
	 */
	dccp_set_state(sk, DCCP_REQUESTING);
106
	err = inet_hash_connect(&dccp_death_row, sk);
107 108 109
	if (err != 0)
		goto failure;

110
	rt = ip_route_newports(fl4, rt, orig_sport, orig_dport,
111 112
			       inet->inet_sport, inet->inet_dport, sk);
	if (IS_ERR(rt)) {
113
		err = PTR_ERR(rt);
114
		rt = NULL;
115
		goto failure;
116
	}
117
	/* OK, now commit destination to socket.  */
118
	sk_setup_caps(sk, &rt->dst);
119

E
Eric Dumazet 已提交
120 121 122 123 124
	dp->dccps_iss = secure_dccp_sequence_number(inet->inet_saddr,
						    inet->inet_daddr,
						    inet->inet_sport,
						    inet->inet_dport);
	inet->inet_id = dp->dccps_iss ^ jiffies;
125 126 127 128 129 130 131 132

	err = dccp_connect(sk);
	rt = NULL;
	if (err != 0)
		goto failure;
out:
	return err;
failure:
133 134 135
	/*
	 * This unhashes the socket and releases the local port, if necessary.
	 */
136 137 138
	dccp_set_state(sk, DCCP_CLOSED);
	ip_rt_put(rt);
	sk->sk_route_caps = 0;
E
Eric Dumazet 已提交
139
	inet->inet_dport = 0;
140 141
	goto out;
}
142 143
EXPORT_SYMBOL_GPL(dccp_v4_connect);

144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161
/*
 * This routine does path mtu discovery as defined in RFC1191.
 */
static inline void dccp_do_pmtu_discovery(struct sock *sk,
					  const struct iphdr *iph,
					  u32 mtu)
{
	struct dst_entry *dst;
	const struct inet_sock *inet = inet_sk(sk);
	const struct dccp_sock *dp = dccp_sk(sk);

	/* We are not interested in DCCP_LISTEN and request_socks (RESPONSEs
	 * send out by Linux are always < 576bytes so they should go through
	 * unfragmented).
	 */
	if (sk->sk_state == DCCP_LISTEN)
		return;

162 163
	dst = inet_csk_update_pmtu(sk, mtu);
	if (!dst)
164 165 166 167 168 169 170 171 172 173 174
		return;

	/* Something is about to be wrong... Remember soft error
	 * for the case, if this connection will not able to recover.
	 */
	if (mtu < dst_mtu(dst) && ip_dont_fragment(sk, dst))
		sk->sk_err_soft = EMSGSIZE;

	mtu = dst_mtu(dst);

	if (inet->pmtudisc != IP_PMTUDISC_DONT &&
175
	    ip_sk_accept_pmtu(sk) &&
176
	    inet_csk(sk)->icsk_pmtu_cookie > mtu) {
177 178 179
		dccp_sync_mss(sk, mtu);

		/*
180
		 * From RFC 4340, sec. 14.1:
181
		 *
182 183 184
		 *	DCCP-Sync packets are the best choice for upward
		 *	probing, since DCCP-Sync probes do not risk application
		 *	data loss.
185
		 */
186
		dccp_send_sync(sk, dp->dccps_gsr, DCCP_PKT_SYNC);
187 188 189
	} /* else let the usual retransmit timer handle it */
}

190 191 192 193
static void dccp_do_redirect(struct sk_buff *skb, struct sock *sk)
{
	struct dst_entry *dst = __sk_dst_check(sk, 0);

194
	if (dst)
195
		dst->ops->redirect(dst, sk, skb);
196 197
}

198 199 200 201 202 203 204 205 206 207
void dccp_req_err(struct sock *sk, u64 seq)
	{
	struct request_sock *req = inet_reqsk(sk);
	struct net *net = sock_net(sk);

	/*
	 * ICMPs are not backlogged, hence we cannot get an established
	 * socket here.
	 */
	if (!between48(seq, dccp_rsk(req)->dreq_iss, dccp_rsk(req)->dreq_gss)) {
208
		__NET_INC_STATS(net, LINUX_MIB_OUTOFWINDOWICMPS);
209 210 211 212 213 214 215 216 217
	} else {
		/*
		 * Still in RESPOND, just remove it silently.
		 * There is no good way to pass the error to the newly
		 * created socket, and POSIX does not want network
		 * errors returned from accept().
		 */
		inet_csk_reqsk_queue_drop(req->rsk_listener, req);
	}
218
	reqsk_put(req);
219 220 221
}
EXPORT_SYMBOL(dccp_req_err);

222 223 224 225 226 227 228 229 230 231 232 233
/*
 * This routine is called by the ICMP module when it gets some sort of error
 * condition. If err < 0 then the socket should be closed and the error
 * returned to the user. If err > 0 it's just the icmp type << 8 | icmp code.
 * After adjustment header points to the first 8 bytes of the tcp header. We
 * need to find the appropriate port.
 *
 * The locking strategy used here is very "optimistic". When someone else
 * accesses the socket the ICMP is just dropped and for some paths there is no
 * check at all. A more general error queue to queue errors for later handling
 * is probably better.
 */
234
static void dccp_v4_err(struct sk_buff *skb, u32 info)
235 236
{
	const struct iphdr *iph = (struct iphdr *)skb->data;
237
	const u8 offset = iph->ihl << 2;
238
	const struct dccp_hdr *dh;
239 240
	struct dccp_sock *dp;
	struct inet_sock *inet;
241 242
	const int type = icmp_hdr(skb)->type;
	const int code = icmp_hdr(skb)->code;
243 244 245
	struct sock *sk;
	__u64 seq;
	int err;
246
	struct net *net = dev_net(skb->dev);
247

248 249 250 251 252 253 254
	/* Only need dccph_dport & dccph_sport which are the first
	 * 4 bytes in dccp header.
	 * Our caller (icmp_socket_deliver()) already pulled 8 bytes for us.
	 */
	BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_sport) > 8);
	BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_dport) > 8);
	dh = (struct dccp_hdr *)(skb->data + offset);
255

256 257 258 259 260
	sk = __inet_lookup_established(net, &dccp_hashinfo,
				       iph->daddr, dh->dccph_dport,
				       iph->saddr, ntohs(dh->dccph_sport),
				       inet_iif(skb));
	if (!sk) {
E
Eric Dumazet 已提交
261
		__ICMP_INC_STATS(net, ICMP_MIB_INERRORS);
262 263 264 265
		return;
	}

	if (sk->sk_state == DCCP_TIME_WAIT) {
266
		inet_twsk_put(inet_twsk(sk));
267 268
		return;
	}
269 270 271
	seq = dccp_hdr_seq(dh);
	if (sk->sk_state == DCCP_NEW_SYN_RECV)
		return dccp_req_err(sk, seq);
272 273 274 275 276 277

	bh_lock_sock(sk);
	/* If too many ICMPs get dropped on busy
	 * servers this needs to be solved differently.
	 */
	if (sock_owned_by_user(sk))
278
		__NET_INC_STATS(net, LINUX_MIB_LOCKDROPPEDICMPS);
279 280 281 282 283

	if (sk->sk_state == DCCP_CLOSED)
		goto out;

	dp = dccp_sk(sk);
284
	if ((1 << sk->sk_state) & ~(DCCPF_REQUESTING | DCCPF_LISTEN) &&
285
	    !between48(seq, dp->dccps_awl, dp->dccps_awh)) {
286
		__NET_INC_STATS(net, LINUX_MIB_OUTOFWINDOWICMPS);
287 288 289 290
		goto out;
	}

	switch (type) {
291 292 293
	case ICMP_REDIRECT:
		dccp_do_redirect(skb, sk);
		goto out;
294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322
	case ICMP_SOURCE_QUENCH:
		/* Just silently ignore these. */
		goto out;
	case ICMP_PARAMETERPROB:
		err = EPROTO;
		break;
	case ICMP_DEST_UNREACH:
		if (code > NR_ICMP_UNREACH)
			goto out;

		if (code == ICMP_FRAG_NEEDED) { /* PMTU discovery (RFC1191) */
			if (!sock_owned_by_user(sk))
				dccp_do_pmtu_discovery(sk, iph, info);
			goto out;
		}

		err = icmp_err_convert[code].errno;
		break;
	case ICMP_TIME_EXCEEDED:
		err = EHOSTUNREACH;
		break;
	default:
		goto out;
	}

	switch (sk->sk_state) {
	case DCCP_REQUESTING:
	case DCCP_RESPOND:
		if (!sock_owned_by_user(sk)) {
E
Eric Dumazet 已提交
323
			__DCCP_INC_STATS(DCCP_MIB_ATTEMPTFAILS);
324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360
			sk->sk_err = err;

			sk->sk_error_report(sk);

			dccp_done(sk);
		} else
			sk->sk_err_soft = err;
		goto out;
	}

	/* If we've already connected we will keep trying
	 * until we time out, or the user gives up.
	 *
	 * rfc1122 4.2.3.9 allows to consider as hard errors
	 * only PROTO_UNREACH and PORT_UNREACH (well, FRAG_FAILED too,
	 * but it is obsoleted by pmtu discovery).
	 *
	 * Note, that in modern internet, where routing is unreliable
	 * and in each dark corner broken firewalls sit, sending random
	 * errors ordered by their masters even this two messages finally lose
	 * their original sense (even Linux sends invalid PORT_UNREACHs)
	 *
	 * Now we are in compliance with RFCs.
	 *							--ANK (980905)
	 */

	inet = inet_sk(sk);
	if (!sock_owned_by_user(sk) && inet->recverr) {
		sk->sk_err = err;
		sk->sk_error_report(sk);
	} else /* Only an error on timeout */
		sk->sk_err_soft = err;
out:
	bh_unlock_sock(sk);
	sock_put(sk);
}

361
static inline __sum16 dccp_v4_csum_finish(struct sk_buff *skb,
362 363 364 365 366
				      __be32 src, __be32 dst)
{
	return csum_tcpudp_magic(src, dst, skb->len, IPPROTO_DCCP, skb->csum);
}

367
void dccp_v4_send_check(struct sock *sk, struct sk_buff *skb)
368 369 370 371
{
	const struct inet_sock *inet = inet_sk(sk);
	struct dccp_hdr *dh = dccp_hdr(skb);

372
	dccp_csum_outgoing(skb);
E
Eric Dumazet 已提交
373 374 375
	dh->dccph_checksum = dccp_v4_csum_finish(skb,
						 inet->inet_saddr,
						 inet->inet_daddr);
376
}
377 378
EXPORT_SYMBOL_GPL(dccp_v4_send_check);

379
static inline u64 dccp_v4_init_sequence(const struct sk_buff *skb)
380
{
381 382
	return secure_dccp_sequence_number(ip_hdr(skb)->daddr,
					   ip_hdr(skb)->saddr,
383 384 385 386 387 388 389 390 391 392
					   dccp_hdr(skb)->dccph_dport,
					   dccp_hdr(skb)->dccph_sport);
}

/*
 * The three way handshake has completed - we got a valid ACK or DATAACK -
 * now create the new socket.
 *
 * This is the equivalent of TCP's tcp_v4_syn_recv_sock
 */
393 394
struct sock *dccp_v4_request_recv_sock(const struct sock *sk,
				       struct sk_buff *skb,
395
				       struct request_sock *req,
396 397 398
				       struct dst_entry *dst,
				       struct request_sock *req_unhash,
				       bool *own_req)
399 400 401 402 403 404 405 406 407 408
{
	struct inet_request_sock *ireq;
	struct inet_sock *newinet;
	struct sock *newsk;

	if (sk_acceptq_is_full(sk))
		goto exit_overflow;

	newsk = dccp_create_openreq_child(sk, req, skb);
	if (newsk == NULL)
409
		goto exit_nonewsk;
410 411 412

	newinet		   = inet_sk(newsk);
	ireq		   = inet_rsk(req);
413 414
	sk_daddr_set(newsk, ireq->ir_rmt_addr);
	sk_rcv_saddr_set(newsk, ireq->ir_loc_addr);
415
	newinet->inet_saddr	= ireq->ir_loc_addr;
416
	newinet->inet_opt	= ireq->opt;
417 418
	ireq->opt	   = NULL;
	newinet->mc_index  = inet_iif(skb);
419
	newinet->mc_ttl	   = ip_hdr(skb)->ttl;
E
Eric Dumazet 已提交
420
	newinet->inet_id   = jiffies;
421

422 423 424 425 426
	if (dst == NULL && (dst = inet_csk_route_child_sock(sk, newsk, req)) == NULL)
		goto put_and_exit;

	sk_setup_caps(newsk, dst);

427 428
	dccp_sync_mss(newsk, dst_mtu(dst));

429 430
	if (__inet_inherit_port(sk, newsk) < 0)
		goto put_and_exit;
431
	*own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash));
432 433 434 435

	return newsk;

exit_overflow:
436
	__NET_INC_STATS(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
437 438
exit_nonewsk:
	dst_release(dst);
439
exit:
440
	__NET_INC_STATS(sock_net(sk), LINUX_MIB_LISTENDROPS);
441
	return NULL;
442
put_and_exit:
443 444
	inet_csk_prepare_forced_close(newsk);
	dccp_done(newsk);
445
	goto exit;
446
}
447 448
EXPORT_SYMBOL_GPL(dccp_v4_request_recv_sock);

449
static struct dst_entry* dccp_v4_route_skb(struct net *net, struct sock *sk,
450 451 452
					   struct sk_buff *skb)
{
	struct rtable *rt;
453
	const struct iphdr *iph = ip_hdr(skb);
454
	struct flowi4 fl4 = {
455
		.flowi4_oif = inet_iif(skb),
456 457
		.daddr = iph->saddr,
		.saddr = iph->daddr,
458 459
		.flowi4_tos = RT_CONN_FLAGS(sk),
		.flowi4_proto = sk->sk_protocol,
460 461
		.fl4_sport = dccp_hdr(skb)->dccph_dport,
		.fl4_dport = dccp_hdr(skb)->dccph_sport,
462
	};
463

464 465
	security_skb_classify_flow(skb, flowi4_to_flowi(&fl4));
	rt = ip_route_output_flow(net, &fl4, sk);
466
	if (IS_ERR(rt)) {
467
		IP_INC_STATS(net, IPSTATS_MIB_OUTNOROUTES);
468 469 470
		return NULL;
	}

471
	return &rt->dst;
472 473
}

474
static int dccp_v4_send_response(const struct sock *sk, struct request_sock *req)
475 476 477
{
	int err = -1;
	struct sk_buff *skb;
478
	struct dst_entry *dst;
479
	struct flowi4 fl4;
480

481
	dst = inet_csk_route_req(sk, &fl4, req);
482
	if (dst == NULL)
483 484 485 486 487 488 489
		goto out;

	skb = dccp_make_response(sk, dst, req);
	if (skb != NULL) {
		const struct inet_request_sock *ireq = inet_rsk(req);
		struct dccp_hdr *dh = dccp_hdr(skb);

490 491 492 493
		dh->dccph_checksum = dccp_v4_csum_finish(skb, ireq->ir_loc_addr,
							      ireq->ir_rmt_addr);
		err = ip_build_and_send_pkt(skb, sk, ireq->ir_loc_addr,
					    ireq->ir_rmt_addr,
494
					    ireq->opt);
495
		err = net_xmit_eval(err);
496 497 498 499 500 501 502
	}

out:
	dst_release(dst);
	return err;
}

503
static void dccp_v4_ctl_send_reset(const struct sock *sk, struct sk_buff *rxskb)
504 505
{
	int err;
506
	const struct iphdr *rxiph;
507 508
	struct sk_buff *skb;
	struct dst_entry *dst;
E
Eric Dumazet 已提交
509
	struct net *net = dev_net(skb_dst(rxskb)->dev);
510
	struct sock *ctl_sk = net->dccp.v4_ctl_sk;
511 512

	/* Never send a reset in response to a reset. */
513
	if (dccp_hdr(rxskb)->dccph_type == DCCP_PKT_RESET)
514 515
		return;

E
Eric Dumazet 已提交
516
	if (skb_rtable(rxskb)->rt_type != RTN_LOCAL)
517 518
		return;

519
	dst = dccp_v4_route_skb(net, ctl_sk, rxskb);
520 521 522
	if (dst == NULL)
		return;

523
	skb = dccp_ctl_make_reset(ctl_sk, rxskb);
524 525 526
	if (skb == NULL)
		goto out;

527
	rxiph = ip_hdr(rxskb);
528 529
	dccp_hdr(skb)->dccph_checksum = dccp_v4_csum_finish(skb, rxiph->saddr,
								 rxiph->daddr);
E
Eric Dumazet 已提交
530
	skb_dst_set(skb, dst_clone(dst));
531

532
	local_bh_disable();
533 534
	bh_lock_sock(ctl_sk);
	err = ip_build_and_send_pkt(skb, ctl_sk,
535
				    rxiph->daddr, rxiph->saddr, NULL);
536
	bh_unlock_sock(ctl_sk);
537

538
	if (net_xmit_eval(err) == 0) {
539 540
		__DCCP_INC_STATS(DCCP_MIB_OUTSEGS);
		__DCCP_INC_STATS(DCCP_MIB_OUTRSTS);
541
	}
542
	local_bh_enable();
543
out:
544
	dst_release(dst);
545 546
}

547 548
static void dccp_v4_reqsk_destructor(struct request_sock *req)
{
549
	dccp_feat_list_purge(&dccp_rsk(req)->dreq_featneg);
550 551 552
	kfree(inet_rsk(req)->opt);
}

553
void dccp_syn_ack_timeout(const struct request_sock *req)
554 555 556 557
{
}
EXPORT_SYMBOL(dccp_syn_ack_timeout);

558 559 560 561 562 563 564
static struct request_sock_ops dccp_request_sock_ops __read_mostly = {
	.family		= PF_INET,
	.obj_size	= sizeof(struct dccp_request_sock),
	.rtx_syn_ack	= dccp_v4_send_response,
	.send_ack	= dccp_reqsk_send_ack,
	.destructor	= dccp_v4_reqsk_destructor,
	.send_reset	= dccp_v4_ctl_send_reset,
565
	.syn_ack_timeout = dccp_syn_ack_timeout,
566 567 568 569 570 571 572
};

int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
{
	struct inet_request_sock *ireq;
	struct request_sock *req;
	struct dccp_request_sock *dreq;
573
	const __be32 service = dccp_hdr_request(skb)->dccph_req_service;
574 575 576
	struct dccp_skb_cb *dcb = DCCP_SKB_CB(skb);

	/* Never answer to DCCP_PKT_REQUESTs send to broadcast or multicast */
E
Eric Dumazet 已提交
577
	if (skb_rtable(skb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
578
		return 0;	/* discard, don't send a reset here */
579 580

	if (dccp_bad_service_code(sk, service)) {
581
		dcb->dccpd_reset_code = DCCP_RESET_CODE_BAD_SERVICE_CODE;
582
		goto drop;
583
	}
584 585 586 587 588
	/*
	 * TW buckets are converted to open requests without
	 * limitations, they conserve resources and peer is
	 * evidently real one.
	 */
589
	dcb->dccpd_reset_code = DCCP_RESET_CODE_TOO_BUSY;
590 591 592 593 594 595 596 597 598 599 600 601
	if (inet_csk_reqsk_queue_is_full(sk))
		goto drop;

	/*
	 * Accept backlog is full. If we have already queued enough
	 * of warm entries in syn queue, drop request. It is better than
	 * clogging syn queue with openreqs with exponentially increasing
	 * timeout.
	 */
	if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
		goto drop;

602
	req = inet_reqsk_alloc(&dccp_request_sock_ops, sk, true);
603 604 605
	if (req == NULL)
		goto drop;

606 607
	if (dccp_reqsk_init(req, dccp_sk(sk), skb))
		goto drop_and_free;
608

609 610 611 612
	dreq = dccp_rsk(req);
	if (dccp_parse_options(sk, dreq, skb))
		goto drop_and_free;

613 614 615 616
	if (security_inet_conn_request(sk, skb, req))
		goto drop_and_free;

	ireq = inet_rsk(req);
617 618
	sk_rcv_saddr_set(req_to_sk(req), ip_hdr(skb)->daddr);
	sk_daddr_set(req_to_sk(req), ip_hdr(skb)->saddr);
E
Eric Dumazet 已提交
619
	ireq->ireq_family = AF_INET;
620
	ireq->ir_iif = sk->sk_bound_dev_if;
621

622
	/*
623 624 625 626
	 * Step 3: Process LISTEN state
	 *
	 * Set S.ISR, S.GSR, S.SWL, S.SWH from packet or Init Cookie
	 *
627
	 * Setting S.SWL/S.SWH to is deferred to dccp_create_openreq_child().
628 629
	 */
	dreq->dreq_isr	   = dcb->dccpd_seq;
630
	dreq->dreq_gsr	   = dreq->dreq_isr;
631
	dreq->dreq_iss	   = dccp_v4_init_sequence(skb);
632
	dreq->dreq_gss     = dreq->dreq_iss;
633 634
	dreq->dreq_service = service;

C
Christoph Paasch 已提交
635
	if (dccp_v4_send_response(sk, req))
636 637 638 639 640 641 642 643
		goto drop_and_free;

	inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT);
	return 0;

drop_and_free:
	reqsk_free(req);
drop:
E
Eric Dumazet 已提交
644
	__DCCP_INC_STATS(DCCP_MIB_ATTEMPTFAILS);
645 646 647 648
	return -1;
}
EXPORT_SYMBOL_GPL(dccp_v4_conn_request);

649 650 651 652 653 654 655 656 657 658 659 660
int dccp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
{
	struct dccp_hdr *dh = dccp_hdr(skb);

	if (sk->sk_state == DCCP_OPEN) { /* Fast path */
		if (dccp_rcv_established(sk, skb, dh, skb->len))
			goto reset;
		return 0;
	}

	/*
	 *  Step 3: Process LISTEN state
661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677
	 *	 If P.type == Request or P contains a valid Init Cookie option,
	 *	      (* Must scan the packet's options to check for Init
	 *		 Cookies.  Only Init Cookies are processed here,
	 *		 however; other options are processed in Step 8.  This
	 *		 scan need only be performed if the endpoint uses Init
	 *		 Cookies *)
	 *	      (* Generate a new socket and switch to that socket *)
	 *	      Set S := new socket for this port pair
	 *	      S.state = RESPOND
	 *	      Choose S.ISS (initial seqno) or set from Init Cookies
	 *	      Initialize S.GAR := S.ISS
	 *	      Set S.ISR, S.GSR, S.SWL, S.SWH from packet or Init Cookies
	 *	      Continue with S.state == RESPOND
	 *	      (* A Response packet will be generated in Step 11 *)
	 *	 Otherwise,
	 *	      Generate Reset(No Connection) unless P.type == Reset
	 *	      Drop packet and return
678
	 *
679 680
	 * NOTE: the check for the packet types is done in
	 *	 dccp_rcv_state_process
681 682 683 684 685 686 687
	 */

	if (dccp_rcv_state_process(sk, skb, dh, skb->len))
		goto reset;
	return 0;

reset:
688
	dccp_v4_ctl_send_reset(sk, skb);
689 690 691
	kfree_skb(skb);
	return 0;
}
692 693
EXPORT_SYMBOL_GPL(dccp_v4_do_rcv);

694 695 696 697 698
/**
 *	dccp_invalid_packet  -  check for malformed packets
 *	Implements RFC 4340, 8.5:  Step 1: Check header basics
 *	Packets that fail these checks are ignored and do not receive Resets.
 */
699
int dccp_invalid_packet(struct sk_buff *skb)
700 701
{
	const struct dccp_hdr *dh;
702
	unsigned int cscov;
703 704 705 706

	if (skb->pkt_type != PACKET_HOST)
		return 1;

707
	/* If the packet is shorter than 12 bytes, drop packet and return */
708
	if (!pskb_may_pull(skb, sizeof(struct dccp_hdr))) {
709
		DCCP_WARN("pskb_may_pull failed\n");
710 711 712 713 714
		return 1;
	}

	dh = dccp_hdr(skb);

715
	/* If P.type is not understood, drop packet and return */
716
	if (dh->dccph_type >= DCCP_PKT_INVALID) {
717
		DCCP_WARN("invalid packet type\n");
718 719 720 721
		return 1;
	}

	/*
722
	 * If P.Data Offset is too small for packet type, drop packet and return
723 724
	 */
	if (dh->dccph_doff < dccp_hdr_len(skb) / sizeof(u32)) {
725
		DCCP_WARN("P.Data Offset(%u) too small\n", dh->dccph_doff);
726 727
		return 1;
	}
728 729 730
	/*
	 * If P.Data Offset is too too large for packet, drop packet and return
	 */
731
	if (!pskb_may_pull(skb, dh->dccph_doff * sizeof(u32))) {
732
		DCCP_WARN("P.Data Offset(%u) too large\n", dh->dccph_doff);
733 734 735 736 737 738 739
		return 1;
	}

	/*
	 * If P.type is not Data, Ack, or DataAck and P.X == 0 (the packet
	 * has short sequence numbers), drop packet and return
	 */
740 741
	if ((dh->dccph_type < DCCP_PKT_DATA    ||
	    dh->dccph_type > DCCP_PKT_DATAACK) && dh->dccph_x == 0)  {
742 743
		DCCP_WARN("P.type (%s) not Data || [Data]Ack, while P.X == 0\n",
			  dccp_packet_name(dh->dccph_type));
744 745 746
		return 1;
	}

747 748 749 750 751 752
	/*
	 * If P.CsCov is too large for the packet size, drop packet and return.
	 * This must come _before_ checksumming (not as RFC 4340 suggests).
	 */
	cscov = dccp_csum_coverage(skb);
	if (cscov > skb->len) {
753 754
		DCCP_WARN("P.CsCov %u exceeds packet length %d\n",
			  dh->dccph_cscov, skb->len);
755 756 757 758 759 760 761
		return 1;
	}

	/* If header checksum is incorrect, drop packet and return.
	 * (This step is completed in the AF-dependent functions.) */
	skb->csum = skb_checksum(skb, 0, cscov, 0);

762 763
	return 0;
}
764 765
EXPORT_SYMBOL_GPL(dccp_invalid_packet);

766
/* this is called when real data arrives */
767
static int dccp_v4_rcv(struct sk_buff *skb)
768 769
{
	const struct dccp_hdr *dh;
770
	const struct iphdr *iph;
771
	bool refcounted;
772
	struct sock *sk;
773
	int min_cov;
774

775
	/* Step 1: Check header basics */
776 777 778 779

	if (dccp_invalid_packet(skb))
		goto discard_it;

780
	iph = ip_hdr(skb);
781
	/* Step 1: If header checksum is incorrect, drop packet and return */
782
	if (dccp_v4_csum_finish(skb, iph->saddr, iph->daddr)) {
783
		DCCP_WARN("dropped packet with invalid checksum\n");
784 785 786
		goto discard_it;
	}

787 788
	dh = dccp_hdr(skb);

789
	DCCP_SKB_CB(skb)->dccpd_seq  = dccp_hdr_seq(dh);
790 791
	DCCP_SKB_CB(skb)->dccpd_type = dh->dccph_type;

H
Harvey Harrison 已提交
792
	dccp_pr_debug("%8.8s src=%pI4@%-5d dst=%pI4@%-5d seq=%llu",
793
		      dccp_packet_name(dh->dccph_type),
H
Harvey Harrison 已提交
794 795
		      &iph->saddr, ntohs(dh->dccph_sport),
		      &iph->daddr, ntohs(dh->dccph_dport),
796
		      (unsigned long long) DCCP_SKB_CB(skb)->dccpd_seq);
797 798 799 800 801 802

	if (dccp_packet_without_ack(skb)) {
		DCCP_SKB_CB(skb)->dccpd_ack_seq = DCCP_PKT_WITHOUT_ACK_SEQ;
		dccp_pr_debug_cat("\n");
	} else {
		DCCP_SKB_CB(skb)->dccpd_ack_seq = dccp_hdr_ack_seq(skb);
803
		dccp_pr_debug_cat(", ack=%llu\n", (unsigned long long)
804
				  DCCP_SKB_CB(skb)->dccpd_ack_seq);
805 806
	}

807
lookup:
808
	sk = __inet_lookup_skb(&dccp_hashinfo, skb, __dccp_hdr_len(dh),
809
			       dh->dccph_sport, dh->dccph_dport, &refcounted);
810
	if (!sk) {
811 812 813 814 815
		dccp_pr_debug("failed to look up flow ID in table and "
			      "get corresponding socket\n");
		goto no_dccp_socket;
	}

816
	/*
817
	 * Step 2:
818
	 *	... or S.state == TIMEWAIT,
819 820 821 822
	 *		Generate Reset(No Connection) unless P.type == Reset
	 *		Drop packet and return
	 */
	if (sk->sk_state == DCCP_TIME_WAIT) {
823 824 825
		dccp_pr_debug("sk->sk_state == DCCP_TIME_WAIT: do_time_wait\n");
		inet_twsk_put(inet_twsk(sk));
		goto no_dccp_socket;
826 827
	}

828 829
	if (sk->sk_state == DCCP_NEW_SYN_RECV) {
		struct request_sock *req = inet_reqsk(sk);
830
		struct sock *nsk;
831 832

		sk = req->rsk_listener;
833
		if (unlikely(sk->sk_state != DCCP_LISTEN)) {
834
			inet_csk_reqsk_queue_drop_and_put(sk, req);
835 836
			goto lookup;
		}
837
		sock_hold(sk);
838
		refcounted = true;
839
		nsk = dccp_check_req(sk, skb, req);
840 841
		if (!nsk) {
			reqsk_put(req);
842
			goto discard_and_relse;
843 844 845 846 847
		}
		if (nsk == sk) {
			reqsk_put(req);
		} else if (dccp_child_process(sk, nsk, skb)) {
			dccp_v4_ctl_send_reset(sk, skb);
848
			goto discard_and_relse;
849
		} else {
850
			sock_put(sk);
851 852 853
			return 0;
		}
	}
854 855
	/*
	 * RFC 4340, sec. 9.2.1: Minimum Checksum Coverage
856 857
	 *	o if MinCsCov = 0, only packets with CsCov = 0 are accepted
	 *	o if MinCsCov > 0, also accept packets with CsCov >= MinCsCov
858 859 860 861 862 863 864 865 866 867 868
	 */
	min_cov = dccp_sk(sk)->dccps_pcrlen;
	if (dh->dccph_cscov && (min_cov == 0 || dh->dccph_cscov < min_cov))  {
		dccp_pr_debug("Packet CsCov %d does not satisfy MinCsCov %d\n",
			      dh->dccph_cscov, min_cov);
		/* FIXME: "Such packets SHOULD be reported using Data Dropped
		 *         options (Section 11.7) with Drop Code 0, Protocol
		 *         Constraints."                                     */
		goto discard_and_relse;
	}

869
	if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
870
		goto discard_and_relse;
871
	nf_reset(skb);
872

873
	return __sk_receive_skb(sk, skb, 1, dh->dccph_doff * 4, refcounted);
874 875 876 877 878 879

no_dccp_socket:
	if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
		goto discard_it;
	/*
	 * Step 2:
880
	 *	If no socket ...
881 882 883 884
	 *		Generate Reset(No Connection) unless P.type == Reset
	 *		Drop packet and return
	 */
	if (dh->dccph_type != DCCP_PKT_RESET) {
885 886
		DCCP_SKB_CB(skb)->dccpd_reset_code =
					DCCP_RESET_CODE_NO_CONNECTION;
887
		dccp_v4_ctl_send_reset(sk, skb);
888 889 890 891 892 893 894
	}

discard_it:
	kfree_skb(skb);
	return 0;

discard_and_relse:
895 896
	if (refcounted)
		sock_put(sk);
897 898 899
	goto discard_it;
}

900
static const struct inet_connection_sock_af_ops dccp_ipv4_af_ops = {
901 902 903 904 905 906 907 908 909 910
	.queue_xmit	   = ip_queue_xmit,
	.send_check	   = dccp_v4_send_check,
	.rebuild_header	   = inet_sk_rebuild_header,
	.conn_request	   = dccp_v4_conn_request,
	.syn_recv_sock	   = dccp_v4_request_recv_sock,
	.net_header_len	   = sizeof(struct iphdr),
	.setsockopt	   = ip_setsockopt,
	.getsockopt	   = ip_getsockopt,
	.addr2sockaddr	   = inet_csk_addr2sockaddr,
	.sockaddr_len	   = sizeof(struct sockaddr_in),
911
	.bind_conflict	   = inet_csk_bind_conflict,
912
#ifdef CONFIG_COMPAT
913 914
	.compat_setsockopt = compat_ip_setsockopt,
	.compat_getsockopt = compat_ip_getsockopt,
915
#endif
916 917
};

918
static int dccp_v4_init_sock(struct sock *sk)
919
{
920 921
	static __u8 dccp_v4_ctl_sock_initialized;
	int err = dccp_init_sock(sk, dccp_v4_ctl_sock_initialized);
922

923 924 925
	if (err == 0) {
		if (unlikely(!dccp_v4_ctl_sock_initialized))
			dccp_v4_ctl_sock_initialized = 1;
926
		inet_csk(sk)->icsk_af_ops = &dccp_ipv4_af_ops;
927 928
	}

929
	return err;
930 931
}

932 933 934 935
static struct timewait_sock_ops dccp_timewait_sock_ops = {
	.twsk_obj_size	= sizeof(struct inet_timewait_sock),
};

936
static struct proto dccp_v4_prot = {
937 938 939 940 941 942 943 944 945 946 947 948
	.name			= "DCCP",
	.owner			= THIS_MODULE,
	.close			= dccp_close,
	.connect		= dccp_v4_connect,
	.disconnect		= dccp_disconnect,
	.ioctl			= dccp_ioctl,
	.init			= dccp_v4_init_sock,
	.setsockopt		= dccp_setsockopt,
	.getsockopt		= dccp_getsockopt,
	.sendmsg		= dccp_sendmsg,
	.recvmsg		= dccp_recvmsg,
	.backlog_rcv		= dccp_v4_do_rcv,
949 950
	.hash			= inet_hash,
	.unhash			= inet_unhash,
951
	.accept			= inet_csk_accept,
952
	.get_port		= inet_csk_get_port,
953
	.shutdown		= dccp_shutdown,
954
	.destroy		= dccp_destroy_sock,
955 956 957
	.orphan_count		= &dccp_orphan_count,
	.max_header		= MAX_DCCP_HEADER,
	.obj_size		= sizeof(struct dccp_sock),
958
	.slab_flags		= SLAB_DESTROY_BY_RCU,
959
	.rsk_prot		= &dccp_request_sock_ops,
960
	.twsk_prot		= &dccp_timewait_sock_ops,
961
	.h.hashinfo		= &dccp_hashinfo,
962 963 964 965
#ifdef CONFIG_COMPAT
	.compat_setsockopt	= compat_dccp_setsockopt,
	.compat_getsockopt	= compat_dccp_getsockopt,
#endif
966
};
967

968
static const struct net_protocol dccp_v4_protocol = {
969 970 971
	.handler	= dccp_v4_rcv,
	.err_handler	= dccp_v4_err,
	.no_policy	= 1,
972
	.netns_ok	= 1,
973
	.icmp_strict_tag_validation = 1,
974 975 976
};

static const struct proto_ops inet_dccp_ops = {
977 978 979 980 981 982 983 984
	.family		   = PF_INET,
	.owner		   = THIS_MODULE,
	.release	   = inet_release,
	.bind		   = inet_bind,
	.connect	   = inet_stream_connect,
	.socketpair	   = sock_no_socketpair,
	.accept		   = inet_accept,
	.getname	   = inet_getname,
985
	/* FIXME: work on tcp_poll to rename it to inet_csk_poll */
986 987
	.poll		   = dccp_poll,
	.ioctl		   = inet_ioctl,
988
	/* FIXME: work on inet_listen to rename it to sock_common_listen */
989 990 991 992 993 994 995 996
	.listen		   = inet_dccp_listen,
	.shutdown	   = inet_shutdown,
	.setsockopt	   = sock_common_setsockopt,
	.getsockopt	   = sock_common_getsockopt,
	.sendmsg	   = inet_sendmsg,
	.recvmsg	   = sock_common_recvmsg,
	.mmap		   = sock_no_mmap,
	.sendpage	   = sock_no_sendpage,
997
#ifdef CONFIG_COMPAT
998 999
	.compat_setsockopt = compat_sock_common_setsockopt,
	.compat_getsockopt = compat_sock_common_getsockopt,
1000
#endif
1001 1002 1003 1004 1005 1006 1007 1008 1009 1010
};

static struct inet_protosw dccp_v4_protosw = {
	.type		= SOCK_DCCP,
	.protocol	= IPPROTO_DCCP,
	.prot		= &dccp_v4_prot,
	.ops		= &inet_dccp_ops,
	.flags		= INET_PROTOSW_ICSK,
};

1011
static int __net_init dccp_v4_init_net(struct net *net)
1012
{
1013 1014
	if (dccp_hashinfo.bhash == NULL)
		return -ESOCKTNOSUPPORT;
1015

1016 1017
	return inet_ctl_sock_create(&net->dccp.v4_ctl_sk, PF_INET,
				    SOCK_DCCP, IPPROTO_DCCP, net);
1018 1019
}

1020
static void __net_exit dccp_v4_exit_net(struct net *net)
1021
{
1022
	inet_ctl_sock_destroy(net->dccp.v4_ctl_sk);
1023 1024 1025 1026 1027 1028 1029
}

static struct pernet_operations dccp_v4_ops = {
	.init	= dccp_v4_init_net,
	.exit	= dccp_v4_exit_net,
};

1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042
static int __init dccp_v4_init(void)
{
	int err = proto_register(&dccp_v4_prot, 1);

	if (err != 0)
		goto out;

	err = inet_add_protocol(&dccp_v4_protocol, IPPROTO_DCCP);
	if (err != 0)
		goto out_proto_unregister;

	inet_register_protosw(&dccp_v4_protosw);

1043 1044 1045
	err = register_pernet_subsys(&dccp_v4_ops);
	if (err)
		goto out_destroy_ctl_sock;
1046 1047
out:
	return err;
1048
out_destroy_ctl_sock:
1049 1050 1051 1052 1053 1054 1055 1056 1057
	inet_unregister_protosw(&dccp_v4_protosw);
	inet_del_protocol(&dccp_v4_protocol, IPPROTO_DCCP);
out_proto_unregister:
	proto_unregister(&dccp_v4_prot);
	goto out;
}

static void __exit dccp_v4_exit(void)
{
1058
	unregister_pernet_subsys(&dccp_v4_ops);
1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071
	inet_unregister_protosw(&dccp_v4_protosw);
	inet_del_protocol(&dccp_v4_protocol, IPPROTO_DCCP);
	proto_unregister(&dccp_v4_prot);
}

module_init(dccp_v4_init);
module_exit(dccp_v4_exit);

/*
 * __stringify doesn't likes enums, so use SOCK_DCCP (6) and IPPROTO_DCCP (33)
 * values directly, Also cover the case where the protocol is not specified,
 * i.e. net-pf-PF_INET-proto-0-type-SOCK_DCCP
 */
1072 1073
MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, 33, 6);
MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, 0, 6);
1074 1075 1076
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Arnaldo Carvalho de Melo <acme@mandriva.com>");
MODULE_DESCRIPTION("DCCP - Datagram Congestion Controlled Protocol");