1 /* SCTP kernel implementation
2 * (C) Copyright IBM Corp. 2001, 2004
3 * Copyright (c) 1999-2000 Cisco, Inc.
4 * Copyright (c) 1999-2001 Motorola, Inc.
5 * Copyright (c) 2001-2003 Intel Corp.
6 * Copyright (c) 2001-2002 Nokia, Inc.
7 * Copyright (c) 2001 La Monte H.P. Yarroll
8 *
9 * This file is part of the SCTP kernel implementation
10 *
11 * These functions interface with the sockets layer to implement the
12 * SCTP Extensions for the Sockets API.
13 *
14 * Note that the descriptions from the specification are USER level
15 * functions--this file is the functions which populate the struct proto
16 * for SCTP which is the BOTTOM of the sockets interface.
17 *
18 * This SCTP implementation is free software;
19 * you can redistribute it and/or modify it under the terms of
20 * the GNU General Public License as published by
21 * the Free Software Foundation; either version 2, or (at your option)
22 * any later version.
23 *
24 * This SCTP implementation is distributed in the hope that it
25 * will be useful, but WITHOUT ANY WARRANTY; without even the implied
26 * ************************
27 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
28 * See the GNU General Public License for more details.
29 *
30 * You should have received a copy of the GNU General Public License
31 * along with GNU CC; see the file COPYING. If not, see
32 * <http://www.gnu.org/licenses/>.
33 *
34 * Please send any bug reports or fixes you make to the
35 * email address(es):
36 * lksctp developers <linux-sctp@vger.kernel.org>
37 *
38 * Written or modified by:
39 * La Monte H.P. Yarroll <piggy@acm.org>
40 * Narasimha Budihal <narsi@refcode.org>
41 * Karl Knutson <karl@athena.chicago.il.us>
42 * Jon Grimm <jgrimm@us.ibm.com>
43 * Xingang Guo <xingang.guo@intel.com>
44 * Daisy Chang <daisyc@us.ibm.com>
45 * Sridhar Samudrala <samudrala@us.ibm.com>
46 * Inaky Perez-Gonzalez <inaky.gonzalez@intel.com>
47 * Ardelle Fan <ardelle.fan@intel.com>
48 * Ryan Layer <rmlayer@us.ibm.com>
49 * Anup Pemmaiah <pemmaiah@cc.usu.edu>
50 * Kevin Gao <kevin.gao@intel.com>
51 */
52
53 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
54
55 #include <linux/types.h>
56 #include <linux/kernel.h>
57 #include <linux/wait.h>
58 #include <linux/time.h>
59 #include <linux/ip.h>
60 #include <linux/capability.h>
61 #include <linux/fcntl.h>
62 #include <linux/poll.h>
63 #include <linux/init.h>
64 #include <linux/crypto.h>
65 #include <linux/slab.h>
66 #include <linux/file.h>
67 #include <linux/compat.h>
68
69 #include <net/ip.h>
70 #include <net/icmp.h>
71 #include <net/route.h>
72 #include <net/ipv6.h>
73 #include <net/inet_common.h>
74 #include <net/busy_poll.h>
75
76 #include <linux/socket.h> /* for sa_family_t */
77 #include <linux/export.h>
78 #include <net/sock.h>
79 #include <net/sctp/sctp.h>
80 #include <net/sctp/sm.h>
81
82 /* Forward declarations for internal helper functions. */
83 static int sctp_writeable(struct sock *sk);
84 static void sctp_wfree(struct sk_buff *skb);
85 static int sctp_wait_for_sndbuf(struct sctp_association *, long *timeo_p,
86 size_t msg_len);
87 static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p);
88 static int sctp_wait_for_connect(struct sctp_association *, long *timeo_p);
89 static int sctp_wait_for_accept(struct sock *sk, long timeo);
90 static void sctp_wait_for_close(struct sock *sk, long timeo);
91 static void sctp_destruct_sock(struct sock *sk);
92 static struct sctp_af *sctp_sockaddr_af(struct sctp_sock *opt,
93 union sctp_addr *addr, int len);
94 static int sctp_bindx_add(struct sock *, struct sockaddr *, int);
95 static int sctp_bindx_rem(struct sock *, struct sockaddr *, int);
96 static int sctp_send_asconf_add_ip(struct sock *, struct sockaddr *, int);
97 static int sctp_send_asconf_del_ip(struct sock *, struct sockaddr *, int);
98 static int sctp_send_asconf(struct sctp_association *asoc,
99 struct sctp_chunk *chunk);
100 static int sctp_do_bind(struct sock *, union sctp_addr *, int);
101 static int sctp_autobind(struct sock *sk);
102 static void sctp_sock_migrate(struct sock *, struct sock *,
103 struct sctp_association *, sctp_socket_type_t);
104
105 static int sctp_memory_pressure;
106 static atomic_long_t sctp_memory_allocated;
107 struct percpu_counter sctp_sockets_allocated;
108
sctp_enter_memory_pressure(struct sock * sk)109 static void sctp_enter_memory_pressure(struct sock *sk)
110 {
111 sctp_memory_pressure = 1;
112 }
113
114
115 /* Get the sndbuf space available at the time on the association. */
sctp_wspace(struct sctp_association * asoc)116 static inline int sctp_wspace(struct sctp_association *asoc)
117 {
118 int amt;
119
120 if (asoc->ep->sndbuf_policy)
121 amt = asoc->sndbuf_used;
122 else
123 amt = sk_wmem_alloc_get(asoc->base.sk);
124
125 if (amt >= asoc->base.sk->sk_sndbuf) {
126 if (asoc->base.sk->sk_userlocks & SOCK_SNDBUF_LOCK)
127 amt = 0;
128 else {
129 amt = sk_stream_wspace(asoc->base.sk);
130 if (amt < 0)
131 amt = 0;
132 }
133 } else {
134 amt = asoc->base.sk->sk_sndbuf - amt;
135 }
136 return amt;
137 }
138
139 /* Increment the used sndbuf space count of the corresponding association by
140 * the size of the outgoing data chunk.
141 * Also, set the skb destructor for sndbuf accounting later.
142 *
143 * Since it is always 1-1 between chunk and skb, and also a new skb is always
144 * allocated for chunk bundling in sctp_packet_transmit(), we can use the
145 * destructor in the data chunk skb for the purpose of the sndbuf space
146 * tracking.
147 */
sctp_set_owner_w(struct sctp_chunk * chunk)148 static inline void sctp_set_owner_w(struct sctp_chunk *chunk)
149 {
150 struct sctp_association *asoc = chunk->asoc;
151 struct sock *sk = asoc->base.sk;
152
153 /* The sndbuf space is tracked per association. */
154 sctp_association_hold(asoc);
155
156 skb_set_owner_w(chunk->skb, sk);
157
158 chunk->skb->destructor = sctp_wfree;
159 /* Save the chunk pointer in skb for sctp_wfree to use later. */
160 skb_shinfo(chunk->skb)->destructor_arg = chunk;
161
162 asoc->sndbuf_used += SCTP_DATA_SNDSIZE(chunk) +
163 sizeof(struct sk_buff) +
164 sizeof(struct sctp_chunk);
165
166 atomic_add(sizeof(struct sctp_chunk), &sk->sk_wmem_alloc);
167 sk->sk_wmem_queued += chunk->skb->truesize;
168 sk_mem_charge(sk, chunk->skb->truesize);
169 }
170
171 /* Verify that this is a valid address. */
sctp_verify_addr(struct sock * sk,union sctp_addr * addr,int len)172 static inline int sctp_verify_addr(struct sock *sk, union sctp_addr *addr,
173 int len)
174 {
175 struct sctp_af *af;
176
177 /* Verify basic sockaddr. */
178 af = sctp_sockaddr_af(sctp_sk(sk), addr, len);
179 if (!af)
180 return -EINVAL;
181
182 /* Is this a valid SCTP address? */
183 if (!af->addr_valid(addr, sctp_sk(sk), NULL))
184 return -EINVAL;
185
186 if (!sctp_sk(sk)->pf->send_verify(sctp_sk(sk), (addr)))
187 return -EINVAL;
188
189 return 0;
190 }
191
192 /* Look up the association by its id. If this is not a UDP-style
193 * socket, the ID field is always ignored.
194 */
sctp_id2assoc(struct sock * sk,sctp_assoc_t id)195 struct sctp_association *sctp_id2assoc(struct sock *sk, sctp_assoc_t id)
196 {
197 struct sctp_association *asoc = NULL;
198
199 /* If this is not a UDP-style socket, assoc id should be ignored. */
200 if (!sctp_style(sk, UDP)) {
201 /* Return NULL if the socket state is not ESTABLISHED. It
202 * could be a TCP-style listening socket or a socket which
203 * hasn't yet called connect() to establish an association.
204 */
205 if (!sctp_sstate(sk, ESTABLISHED))
206 return NULL;
207
208 /* Get the first and the only association from the list. */
209 if (!list_empty(&sctp_sk(sk)->ep->asocs))
210 asoc = list_entry(sctp_sk(sk)->ep->asocs.next,
211 struct sctp_association, asocs);
212 return asoc;
213 }
214
215 /* Otherwise this is a UDP-style socket. */
216 if (!id || (id == (sctp_assoc_t)-1))
217 return NULL;
218
219 spin_lock_bh(&sctp_assocs_id_lock);
220 asoc = (struct sctp_association *)idr_find(&sctp_assocs_id, (int)id);
221 spin_unlock_bh(&sctp_assocs_id_lock);
222
223 if (!asoc || (asoc->base.sk != sk) || asoc->base.dead)
224 return NULL;
225
226 return asoc;
227 }
228
229 /* Look up the transport from an address and an assoc id. If both address and
230 * id are specified, the associations matching the address and the id should be
231 * the same.
232 */
sctp_addr_id2transport(struct sock * sk,struct sockaddr_storage * addr,sctp_assoc_t id)233 static struct sctp_transport *sctp_addr_id2transport(struct sock *sk,
234 struct sockaddr_storage *addr,
235 sctp_assoc_t id)
236 {
237 struct sctp_association *addr_asoc = NULL, *id_asoc = NULL;
238 struct sctp_transport *transport;
239 union sctp_addr *laddr = (union sctp_addr *)addr;
240
241 addr_asoc = sctp_endpoint_lookup_assoc(sctp_sk(sk)->ep,
242 laddr,
243 &transport);
244
245 if (!addr_asoc)
246 return NULL;
247
248 id_asoc = sctp_id2assoc(sk, id);
249 if (id_asoc && (id_asoc != addr_asoc))
250 return NULL;
251
252 sctp_get_pf_specific(sk->sk_family)->addr_to_user(sctp_sk(sk),
253 (union sctp_addr *)addr);
254
255 return transport;
256 }
257
258 /* API 3.1.2 bind() - UDP Style Syntax
259 * The syntax of bind() is,
260 *
261 * ret = bind(int sd, struct sockaddr *addr, int addrlen);
262 *
263 * sd - the socket descriptor returned by socket().
264 * addr - the address structure (struct sockaddr_in or struct
265 * sockaddr_in6 [RFC 2553]),
266 * addr_len - the size of the address structure.
267 */
sctp_bind(struct sock * sk,struct sockaddr * addr,int addr_len)268 static int sctp_bind(struct sock *sk, struct sockaddr *addr, int addr_len)
269 {
270 int retval = 0;
271
272 lock_sock(sk);
273
274 pr_debug("%s: sk:%p, addr:%p, addr_len:%d\n", __func__, sk,
275 addr, addr_len);
276
277 /* Disallow binding twice. */
278 if (!sctp_sk(sk)->ep->base.bind_addr.port)
279 retval = sctp_do_bind(sk, (union sctp_addr *)addr,
280 addr_len);
281 else
282 retval = -EINVAL;
283
284 release_sock(sk);
285
286 return retval;
287 }
288
289 static long sctp_get_port_local(struct sock *, union sctp_addr *);
290
291 /* Verify this is a valid sockaddr. */
sctp_sockaddr_af(struct sctp_sock * opt,union sctp_addr * addr,int len)292 static struct sctp_af *sctp_sockaddr_af(struct sctp_sock *opt,
293 union sctp_addr *addr, int len)
294 {
295 struct sctp_af *af;
296
297 /* Check minimum size. */
298 if (len < sizeof (struct sockaddr))
299 return NULL;
300
301 /* V4 mapped address are really of AF_INET family */
302 if (addr->sa.sa_family == AF_INET6 &&
303 ipv6_addr_v4mapped(&addr->v6.sin6_addr)) {
304 if (!opt->pf->af_supported(AF_INET, opt))
305 return NULL;
306 } else {
307 /* Does this PF support this AF? */
308 if (!opt->pf->af_supported(addr->sa.sa_family, opt))
309 return NULL;
310 }
311
312 /* If we get this far, af is valid. */
313 af = sctp_get_af_specific(addr->sa.sa_family);
314
315 if (len < af->sockaddr_len)
316 return NULL;
317
318 return af;
319 }
320
321 /* Bind a local address either to an endpoint or to an association. */
sctp_do_bind(struct sock * sk,union sctp_addr * addr,int len)322 static int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)
323 {
324 struct net *net = sock_net(sk);
325 struct sctp_sock *sp = sctp_sk(sk);
326 struct sctp_endpoint *ep = sp->ep;
327 struct sctp_bind_addr *bp = &ep->base.bind_addr;
328 struct sctp_af *af;
329 unsigned short snum;
330 int ret = 0;
331
332 /* Common sockaddr verification. */
333 af = sctp_sockaddr_af(sp, addr, len);
334 if (!af) {
335 pr_debug("%s: sk:%p, newaddr:%p, len:%d EINVAL\n",
336 __func__, sk, addr, len);
337 return -EINVAL;
338 }
339
340 snum = ntohs(addr->v4.sin_port);
341
342 pr_debug("%s: sk:%p, new addr:%pISc, port:%d, new port:%d, len:%d\n",
343 __func__, sk, &addr->sa, bp->port, snum, len);
344
345 /* PF specific bind() address verification. */
346 if (!sp->pf->bind_verify(sp, addr))
347 return -EADDRNOTAVAIL;
348
349 /* We must either be unbound, or bind to the same port.
350 * It's OK to allow 0 ports if we are already bound.
351 * We'll just inhert an already bound port in this case
352 */
353 if (bp->port) {
354 if (!snum)
355 snum = bp->port;
356 else if (snum != bp->port) {
357 pr_debug("%s: new port %d doesn't match existing port "
358 "%d\n", __func__, snum, bp->port);
359 return -EINVAL;
360 }
361 }
362
363 if (snum && snum < PROT_SOCK &&
364 !ns_capable(net->user_ns, CAP_NET_BIND_SERVICE))
365 return -EACCES;
366
367 /* See if the address matches any of the addresses we may have
368 * already bound before checking against other endpoints.
369 */
370 if (sctp_bind_addr_match(bp, addr, sp))
371 return -EINVAL;
372
373 /* Make sure we are allowed to bind here.
374 * The function sctp_get_port_local() does duplicate address
375 * detection.
376 */
377 addr->v4.sin_port = htons(snum);
378 if ((ret = sctp_get_port_local(sk, addr))) {
379 return -EADDRINUSE;
380 }
381
382 /* Refresh ephemeral port. */
383 if (!bp->port)
384 bp->port = inet_sk(sk)->inet_num;
385
386 /* Add the address to the bind address list.
387 * Use GFP_ATOMIC since BHs will be disabled.
388 */
389 ret = sctp_add_bind_addr(bp, addr, SCTP_ADDR_SRC, GFP_ATOMIC);
390
391 /* Copy back into socket for getsockname() use. */
392 if (!ret) {
393 inet_sk(sk)->inet_sport = htons(inet_sk(sk)->inet_num);
394 sp->pf->to_sk_saddr(addr, sk);
395 }
396
397 return ret;
398 }
399
400 /* ADDIP Section 4.1.1 Congestion Control of ASCONF Chunks
401 *
402 * R1) One and only one ASCONF Chunk MAY be in transit and unacknowledged
403 * at any one time. If a sender, after sending an ASCONF chunk, decides
404 * it needs to transfer another ASCONF Chunk, it MUST wait until the
405 * ASCONF-ACK Chunk returns from the previous ASCONF Chunk before sending a
406 * subsequent ASCONF. Note this restriction binds each side, so at any
407 * time two ASCONF may be in-transit on any given association (one sent
408 * from each endpoint).
409 */
sctp_send_asconf(struct sctp_association * asoc,struct sctp_chunk * chunk)410 static int sctp_send_asconf(struct sctp_association *asoc,
411 struct sctp_chunk *chunk)
412 {
413 struct net *net = sock_net(asoc->base.sk);
414 int retval = 0;
415
416 /* If there is an outstanding ASCONF chunk, queue it for later
417 * transmission.
418 */
419 if (asoc->addip_last_asconf) {
420 list_add_tail(&chunk->list, &asoc->addip_chunk_list);
421 goto out;
422 }
423
424 /* Hold the chunk until an ASCONF_ACK is received. */
425 sctp_chunk_hold(chunk);
426 retval = sctp_primitive_ASCONF(net, asoc, chunk);
427 if (retval)
428 sctp_chunk_free(chunk);
429 else
430 asoc->addip_last_asconf = chunk;
431
432 out:
433 return retval;
434 }
435
436 /* Add a list of addresses as bind addresses to local endpoint or
437 * association.
438 *
439 * Basically run through each address specified in the addrs/addrcnt
440 * array/length pair, determine if it is IPv6 or IPv4 and call
441 * sctp_do_bind() on it.
442 *
443 * If any of them fails, then the operation will be reversed and the
444 * ones that were added will be removed.
445 *
446 * Only sctp_setsockopt_bindx() is supposed to call this function.
447 */
sctp_bindx_add(struct sock * sk,struct sockaddr * addrs,int addrcnt)448 static int sctp_bindx_add(struct sock *sk, struct sockaddr *addrs, int addrcnt)
449 {
450 int cnt;
451 int retval = 0;
452 void *addr_buf;
453 struct sockaddr *sa_addr;
454 struct sctp_af *af;
455
456 pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n", __func__, sk,
457 addrs, addrcnt);
458
459 addr_buf = addrs;
460 for (cnt = 0; cnt < addrcnt; cnt++) {
461 /* The list may contain either IPv4 or IPv6 address;
462 * determine the address length for walking thru the list.
463 */
464 sa_addr = addr_buf;
465 af = sctp_get_af_specific(sa_addr->sa_family);
466 if (!af) {
467 retval = -EINVAL;
468 goto err_bindx_add;
469 }
470
471 retval = sctp_do_bind(sk, (union sctp_addr *)sa_addr,
472 af->sockaddr_len);
473
474 addr_buf += af->sockaddr_len;
475
476 err_bindx_add:
477 if (retval < 0) {
478 /* Failed. Cleanup the ones that have been added */
479 if (cnt > 0)
480 sctp_bindx_rem(sk, addrs, cnt);
481 return retval;
482 }
483 }
484
485 return retval;
486 }
487
488 /* Send an ASCONF chunk with Add IP address parameters to all the peers of the
489 * associations that are part of the endpoint indicating that a list of local
490 * addresses are added to the endpoint.
491 *
492 * If any of the addresses is already in the bind address list of the
493 * association, we do not send the chunk for that association. But it will not
494 * affect other associations.
495 *
496 * Only sctp_setsockopt_bindx() is supposed to call this function.
497 */
sctp_send_asconf_add_ip(struct sock * sk,struct sockaddr * addrs,int addrcnt)498 static int sctp_send_asconf_add_ip(struct sock *sk,
499 struct sockaddr *addrs,
500 int addrcnt)
501 {
502 struct net *net = sock_net(sk);
503 struct sctp_sock *sp;
504 struct sctp_endpoint *ep;
505 struct sctp_association *asoc;
506 struct sctp_bind_addr *bp;
507 struct sctp_chunk *chunk;
508 struct sctp_sockaddr_entry *laddr;
509 union sctp_addr *addr;
510 union sctp_addr saveaddr;
511 void *addr_buf;
512 struct sctp_af *af;
513 struct list_head *p;
514 int i;
515 int retval = 0;
516
517 if (!net->sctp.addip_enable)
518 return retval;
519
520 sp = sctp_sk(sk);
521 ep = sp->ep;
522
523 pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n",
524 __func__, sk, addrs, addrcnt);
525
526 list_for_each_entry(asoc, &ep->asocs, asocs) {
527 if (!asoc->peer.asconf_capable)
528 continue;
529
530 if (asoc->peer.addip_disabled_mask & SCTP_PARAM_ADD_IP)
531 continue;
532
533 if (!sctp_state(asoc, ESTABLISHED))
534 continue;
535
536 /* Check if any address in the packed array of addresses is
537 * in the bind address list of the association. If so,
538 * do not send the asconf chunk to its peer, but continue with
539 * other associations.
540 */
541 addr_buf = addrs;
542 for (i = 0; i < addrcnt; i++) {
543 addr = addr_buf;
544 af = sctp_get_af_specific(addr->v4.sin_family);
545 if (!af) {
546 retval = -EINVAL;
547 goto out;
548 }
549
550 if (sctp_assoc_lookup_laddr(asoc, addr))
551 break;
552
553 addr_buf += af->sockaddr_len;
554 }
555 if (i < addrcnt)
556 continue;
557
558 /* Use the first valid address in bind addr list of
559 * association as Address Parameter of ASCONF CHUNK.
560 */
561 bp = &asoc->base.bind_addr;
562 p = bp->address_list.next;
563 laddr = list_entry(p, struct sctp_sockaddr_entry, list);
564 chunk = sctp_make_asconf_update_ip(asoc, &laddr->a, addrs,
565 addrcnt, SCTP_PARAM_ADD_IP);
566 if (!chunk) {
567 retval = -ENOMEM;
568 goto out;
569 }
570
571 /* Add the new addresses to the bind address list with
572 * use_as_src set to 0.
573 */
574 addr_buf = addrs;
575 for (i = 0; i < addrcnt; i++) {
576 addr = addr_buf;
577 af = sctp_get_af_specific(addr->v4.sin_family);
578 memcpy(&saveaddr, addr, af->sockaddr_len);
579 retval = sctp_add_bind_addr(bp, &saveaddr,
580 SCTP_ADDR_NEW, GFP_ATOMIC);
581 addr_buf += af->sockaddr_len;
582 }
583 if (asoc->src_out_of_asoc_ok) {
584 struct sctp_transport *trans;
585
586 list_for_each_entry(trans,
587 &asoc->peer.transport_addr_list, transports) {
588 /* Clear the source and route cache */
589 dst_release(trans->dst);
590 trans->cwnd = min(4*asoc->pathmtu, max_t(__u32,
591 2*asoc->pathmtu, 4380));
592 trans->ssthresh = asoc->peer.i.a_rwnd;
593 trans->rto = asoc->rto_initial;
594 sctp_max_rto(asoc, trans);
595 trans->rtt = trans->srtt = trans->rttvar = 0;
596 sctp_transport_route(trans, NULL,
597 sctp_sk(asoc->base.sk));
598 }
599 }
600 retval = sctp_send_asconf(asoc, chunk);
601 }
602
603 out:
604 return retval;
605 }
606
607 /* Remove a list of addresses from bind addresses list. Do not remove the
608 * last address.
609 *
610 * Basically run through each address specified in the addrs/addrcnt
611 * array/length pair, determine if it is IPv6 or IPv4 and call
612 * sctp_del_bind() on it.
613 *
614 * If any of them fails, then the operation will be reversed and the
615 * ones that were removed will be added back.
616 *
617 * At least one address has to be left; if only one address is
618 * available, the operation will return -EBUSY.
619 *
620 * Only sctp_setsockopt_bindx() is supposed to call this function.
621 */
sctp_bindx_rem(struct sock * sk,struct sockaddr * addrs,int addrcnt)622 static int sctp_bindx_rem(struct sock *sk, struct sockaddr *addrs, int addrcnt)
623 {
624 struct sctp_sock *sp = sctp_sk(sk);
625 struct sctp_endpoint *ep = sp->ep;
626 int cnt;
627 struct sctp_bind_addr *bp = &ep->base.bind_addr;
628 int retval = 0;
629 void *addr_buf;
630 union sctp_addr *sa_addr;
631 struct sctp_af *af;
632
633 pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n",
634 __func__, sk, addrs, addrcnt);
635
636 addr_buf = addrs;
637 for (cnt = 0; cnt < addrcnt; cnt++) {
638 /* If the bind address list is empty or if there is only one
639 * bind address, there is nothing more to be removed (we need
640 * at least one address here).
641 */
642 if (list_empty(&bp->address_list) ||
643 (sctp_list_single_entry(&bp->address_list))) {
644 retval = -EBUSY;
645 goto err_bindx_rem;
646 }
647
648 sa_addr = addr_buf;
649 af = sctp_get_af_specific(sa_addr->sa.sa_family);
650 if (!af) {
651 retval = -EINVAL;
652 goto err_bindx_rem;
653 }
654
655 if (!af->addr_valid(sa_addr, sp, NULL)) {
656 retval = -EADDRNOTAVAIL;
657 goto err_bindx_rem;
658 }
659
660 if (sa_addr->v4.sin_port &&
661 sa_addr->v4.sin_port != htons(bp->port)) {
662 retval = -EINVAL;
663 goto err_bindx_rem;
664 }
665
666 if (!sa_addr->v4.sin_port)
667 sa_addr->v4.sin_port = htons(bp->port);
668
669 /* FIXME - There is probably a need to check if sk->sk_saddr and
670 * sk->sk_rcv_addr are currently set to one of the addresses to
671 * be removed. This is something which needs to be looked into
672 * when we are fixing the outstanding issues with multi-homing
673 * socket routing and failover schemes. Refer to comments in
674 * sctp_do_bind(). -daisy
675 */
676 retval = sctp_del_bind_addr(bp, sa_addr);
677
678 addr_buf += af->sockaddr_len;
679 err_bindx_rem:
680 if (retval < 0) {
681 /* Failed. Add the ones that has been removed back */
682 if (cnt > 0)
683 sctp_bindx_add(sk, addrs, cnt);
684 return retval;
685 }
686 }
687
688 return retval;
689 }
690
691 /* Send an ASCONF chunk with Delete IP address parameters to all the peers of
692 * the associations that are part of the endpoint indicating that a list of
693 * local addresses are removed from the endpoint.
694 *
695 * If any of the addresses is already in the bind address list of the
696 * association, we do not send the chunk for that association. But it will not
697 * affect other associations.
698 *
699 * Only sctp_setsockopt_bindx() is supposed to call this function.
700 */
sctp_send_asconf_del_ip(struct sock * sk,struct sockaddr * addrs,int addrcnt)701 static int sctp_send_asconf_del_ip(struct sock *sk,
702 struct sockaddr *addrs,
703 int addrcnt)
704 {
705 struct net *net = sock_net(sk);
706 struct sctp_sock *sp;
707 struct sctp_endpoint *ep;
708 struct sctp_association *asoc;
709 struct sctp_transport *transport;
710 struct sctp_bind_addr *bp;
711 struct sctp_chunk *chunk;
712 union sctp_addr *laddr;
713 void *addr_buf;
714 struct sctp_af *af;
715 struct sctp_sockaddr_entry *saddr;
716 int i;
717 int retval = 0;
718 int stored = 0;
719
720 chunk = NULL;
721 if (!net->sctp.addip_enable)
722 return retval;
723
724 sp = sctp_sk(sk);
725 ep = sp->ep;
726
727 pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n",
728 __func__, sk, addrs, addrcnt);
729
730 list_for_each_entry(asoc, &ep->asocs, asocs) {
731
732 if (!asoc->peer.asconf_capable)
733 continue;
734
735 if (asoc->peer.addip_disabled_mask & SCTP_PARAM_DEL_IP)
736 continue;
737
738 if (!sctp_state(asoc, ESTABLISHED))
739 continue;
740
741 /* Check if any address in the packed array of addresses is
742 * not present in the bind address list of the association.
743 * If so, do not send the asconf chunk to its peer, but
744 * continue with other associations.
745 */
746 addr_buf = addrs;
747 for (i = 0; i < addrcnt; i++) {
748 laddr = addr_buf;
749 af = sctp_get_af_specific(laddr->v4.sin_family);
750 if (!af) {
751 retval = -EINVAL;
752 goto out;
753 }
754
755 if (!sctp_assoc_lookup_laddr(asoc, laddr))
756 break;
757
758 addr_buf += af->sockaddr_len;
759 }
760 if (i < addrcnt)
761 continue;
762
763 /* Find one address in the association's bind address list
764 * that is not in the packed array of addresses. This is to
765 * make sure that we do not delete all the addresses in the
766 * association.
767 */
768 bp = &asoc->base.bind_addr;
769 laddr = sctp_find_unmatch_addr(bp, (union sctp_addr *)addrs,
770 addrcnt, sp);
771 if ((laddr == NULL) && (addrcnt == 1)) {
772 if (asoc->asconf_addr_del_pending)
773 continue;
774 asoc->asconf_addr_del_pending =
775 kzalloc(sizeof(union sctp_addr), GFP_ATOMIC);
776 if (asoc->asconf_addr_del_pending == NULL) {
777 retval = -ENOMEM;
778 goto out;
779 }
780 asoc->asconf_addr_del_pending->sa.sa_family =
781 addrs->sa_family;
782 asoc->asconf_addr_del_pending->v4.sin_port =
783 htons(bp->port);
784 if (addrs->sa_family == AF_INET) {
785 struct sockaddr_in *sin;
786
787 sin = (struct sockaddr_in *)addrs;
788 asoc->asconf_addr_del_pending->v4.sin_addr.s_addr = sin->sin_addr.s_addr;
789 } else if (addrs->sa_family == AF_INET6) {
790 struct sockaddr_in6 *sin6;
791
792 sin6 = (struct sockaddr_in6 *)addrs;
793 asoc->asconf_addr_del_pending->v6.sin6_addr = sin6->sin6_addr;
794 }
795
796 pr_debug("%s: keep the last address asoc:%p %pISc at %p\n",
797 __func__, asoc, &asoc->asconf_addr_del_pending->sa,
798 asoc->asconf_addr_del_pending);
799
800 asoc->src_out_of_asoc_ok = 1;
801 stored = 1;
802 goto skip_mkasconf;
803 }
804
805 if (laddr == NULL)
806 return -EINVAL;
807
808 /* We do not need RCU protection throughout this loop
809 * because this is done under a socket lock from the
810 * setsockopt call.
811 */
812 chunk = sctp_make_asconf_update_ip(asoc, laddr, addrs, addrcnt,
813 SCTP_PARAM_DEL_IP);
814 if (!chunk) {
815 retval = -ENOMEM;
816 goto out;
817 }
818
819 skip_mkasconf:
820 /* Reset use_as_src flag for the addresses in the bind address
821 * list that are to be deleted.
822 */
823 addr_buf = addrs;
824 for (i = 0; i < addrcnt; i++) {
825 laddr = addr_buf;
826 af = sctp_get_af_specific(laddr->v4.sin_family);
827 list_for_each_entry(saddr, &bp->address_list, list) {
828 if (sctp_cmp_addr_exact(&saddr->a, laddr))
829 saddr->state = SCTP_ADDR_DEL;
830 }
831 addr_buf += af->sockaddr_len;
832 }
833
834 /* Update the route and saddr entries for all the transports
835 * as some of the addresses in the bind address list are
836 * about to be deleted and cannot be used as source addresses.
837 */
838 list_for_each_entry(transport, &asoc->peer.transport_addr_list,
839 transports) {
840 dst_release(transport->dst);
841 sctp_transport_route(transport, NULL,
842 sctp_sk(asoc->base.sk));
843 }
844
845 if (stored)
846 /* We don't need to transmit ASCONF */
847 continue;
848 retval = sctp_send_asconf(asoc, chunk);
849 }
850 out:
851 return retval;
852 }
853
854 /* set addr events to assocs in the endpoint. ep and addr_wq must be locked */
sctp_asconf_mgmt(struct sctp_sock * sp,struct sctp_sockaddr_entry * addrw)855 int sctp_asconf_mgmt(struct sctp_sock *sp, struct sctp_sockaddr_entry *addrw)
856 {
857 struct sock *sk = sctp_opt2sk(sp);
858 union sctp_addr *addr;
859 struct sctp_af *af;
860
861 /* It is safe to write port space in caller. */
862 addr = &addrw->a;
863 addr->v4.sin_port = htons(sp->ep->base.bind_addr.port);
864 af = sctp_get_af_specific(addr->sa.sa_family);
865 if (!af)
866 return -EINVAL;
867 if (sctp_verify_addr(sk, addr, af->sockaddr_len))
868 return -EINVAL;
869
870 if (addrw->state == SCTP_ADDR_NEW)
871 return sctp_send_asconf_add_ip(sk, (struct sockaddr *)addr, 1);
872 else
873 return sctp_send_asconf_del_ip(sk, (struct sockaddr *)addr, 1);
874 }
875
876 /* Helper for tunneling sctp_bindx() requests through sctp_setsockopt()
877 *
878 * API 8.1
879 * int sctp_bindx(int sd, struct sockaddr *addrs, int addrcnt,
880 * int flags);
881 *
882 * If sd is an IPv4 socket, the addresses passed must be IPv4 addresses.
883 * If the sd is an IPv6 socket, the addresses passed can either be IPv4
884 * or IPv6 addresses.
885 *
886 * A single address may be specified as INADDR_ANY or IN6ADDR_ANY, see
887 * Section 3.1.2 for this usage.
888 *
889 * addrs is a pointer to an array of one or more socket addresses. Each
890 * address is contained in its appropriate structure (i.e. struct
891 * sockaddr_in or struct sockaddr_in6) the family of the address type
892 * must be used to distinguish the address length (note that this
893 * representation is termed a "packed array" of addresses). The caller
894 * specifies the number of addresses in the array with addrcnt.
895 *
896 * On success, sctp_bindx() returns 0. On failure, sctp_bindx() returns
897 * -1, and sets errno to the appropriate error code.
898 *
899 * For SCTP, the port given in each socket address must be the same, or
900 * sctp_bindx() will fail, setting errno to EINVAL.
901 *
902 * The flags parameter is formed from the bitwise OR of zero or more of
903 * the following currently defined flags:
904 *
905 * SCTP_BINDX_ADD_ADDR
906 *
907 * SCTP_BINDX_REM_ADDR
908 *
909 * SCTP_BINDX_ADD_ADDR directs SCTP to add the given addresses to the
910 * association, and SCTP_BINDX_REM_ADDR directs SCTP to remove the given
911 * addresses from the association. The two flags are mutually exclusive;
912 * if both are given, sctp_bindx() will fail with EINVAL. A caller may
913 * not remove all addresses from an association; sctp_bindx() will
914 * reject such an attempt with EINVAL.
915 *
916 * An application can use sctp_bindx(SCTP_BINDX_ADD_ADDR) to associate
917 * additional addresses with an endpoint after calling bind(). Or use
918 * sctp_bindx(SCTP_BINDX_REM_ADDR) to remove some addresses a listening
919 * socket is associated with so that no new association accepted will be
920 * associated with those addresses. If the endpoint supports dynamic
921 * address a SCTP_BINDX_REM_ADDR or SCTP_BINDX_ADD_ADDR may cause a
922 * endpoint to send the appropriate message to the peer to change the
923 * peers address lists.
924 *
925 * Adding and removing addresses from a connected association is
926 * optional functionality. Implementations that do not support this
927 * functionality should return EOPNOTSUPP.
928 *
929 * Basically do nothing but copying the addresses from user to kernel
930 * land and invoking either sctp_bindx_add() or sctp_bindx_rem() on the sk.
931 * This is used for tunneling the sctp_bindx() request through sctp_setsockopt()
932 * from userspace.
933 *
934 * We don't use copy_from_user() for optimization: we first do the
935 * sanity checks (buffer size -fast- and access check-healthy
936 * pointer); if all of those succeed, then we can alloc the memory
937 * (expensive operation) needed to copy the data to kernel. Then we do
938 * the copying without checking the user space area
939 * (__copy_from_user()).
940 *
941 * On exit there is no need to do sockfd_put(), sys_setsockopt() does
942 * it.
943 *
944 * sk The sk of the socket
945 * addrs The pointer to the addresses in user land
946 * addrssize Size of the addrs buffer
947 * op Operation to perform (add or remove, see the flags of
948 * sctp_bindx)
949 *
950 * Returns 0 if ok, <0 errno code on error.
951 */
sctp_setsockopt_bindx(struct sock * sk,struct sockaddr __user * addrs,int addrs_size,int op)952 static int sctp_setsockopt_bindx(struct sock *sk,
953 struct sockaddr __user *addrs,
954 int addrs_size, int op)
955 {
956 struct sockaddr *kaddrs;
957 int err;
958 int addrcnt = 0;
959 int walk_size = 0;
960 struct sockaddr *sa_addr;
961 void *addr_buf;
962 struct sctp_af *af;
963
964 pr_debug("%s: sk:%p addrs:%p addrs_size:%d opt:%d\n",
965 __func__, sk, addrs, addrs_size, op);
966
967 if (unlikely(addrs_size <= 0))
968 return -EINVAL;
969
970 /* Check the user passed a healthy pointer. */
971 if (unlikely(!access_ok(VERIFY_READ, addrs, addrs_size)))
972 return -EFAULT;
973
974 /* Alloc space for the address array in kernel memory. */
975 kaddrs = kmalloc(addrs_size, GFP_KERNEL);
976 if (unlikely(!kaddrs))
977 return -ENOMEM;
978
979 if (__copy_from_user(kaddrs, addrs, addrs_size)) {
980 kfree(kaddrs);
981 return -EFAULT;
982 }
983
984 /* Walk through the addrs buffer and count the number of addresses. */
985 addr_buf = kaddrs;
986 while (walk_size < addrs_size) {
987 if (walk_size + sizeof(sa_family_t) > addrs_size) {
988 kfree(kaddrs);
989 return -EINVAL;
990 }
991
992 sa_addr = addr_buf;
993 af = sctp_get_af_specific(sa_addr->sa_family);
994
995 /* If the address family is not supported or if this address
996 * causes the address buffer to overflow return EINVAL.
997 */
998 if (!af || (walk_size + af->sockaddr_len) > addrs_size) {
999 kfree(kaddrs);
1000 return -EINVAL;
1001 }
1002 addrcnt++;
1003 addr_buf += af->sockaddr_len;
1004 walk_size += af->sockaddr_len;
1005 }
1006
1007 /* Do the work. */
1008 switch (op) {
1009 case SCTP_BINDX_ADD_ADDR:
1010 err = sctp_bindx_add(sk, kaddrs, addrcnt);
1011 if (err)
1012 goto out;
1013 err = sctp_send_asconf_add_ip(sk, kaddrs, addrcnt);
1014 break;
1015
1016 case SCTP_BINDX_REM_ADDR:
1017 err = sctp_bindx_rem(sk, kaddrs, addrcnt);
1018 if (err)
1019 goto out;
1020 err = sctp_send_asconf_del_ip(sk, kaddrs, addrcnt);
1021 break;
1022
1023 default:
1024 err = -EINVAL;
1025 break;
1026 }
1027
1028 out:
1029 kfree(kaddrs);
1030
1031 return err;
1032 }
1033
1034 /* __sctp_connect(struct sock* sk, struct sockaddr *kaddrs, int addrs_size)
1035 *
1036 * Common routine for handling connect() and sctp_connectx().
1037 * Connect will come in with just a single address.
1038 */
__sctp_connect(struct sock * sk,struct sockaddr * kaddrs,int addrs_size,sctp_assoc_t * assoc_id)1039 static int __sctp_connect(struct sock *sk,
1040 struct sockaddr *kaddrs,
1041 int addrs_size,
1042 sctp_assoc_t *assoc_id)
1043 {
1044 struct net *net = sock_net(sk);
1045 struct sctp_sock *sp;
1046 struct sctp_endpoint *ep;
1047 struct sctp_association *asoc = NULL;
1048 struct sctp_association *asoc2;
1049 struct sctp_transport *transport;
1050 union sctp_addr to;
1051 sctp_scope_t scope;
1052 long timeo;
1053 int err = 0;
1054 int addrcnt = 0;
1055 int walk_size = 0;
1056 union sctp_addr *sa_addr = NULL;
1057 void *addr_buf;
1058 unsigned short port;
1059 unsigned int f_flags = 0;
1060
1061 sp = sctp_sk(sk);
1062 ep = sp->ep;
1063
1064 /* connect() cannot be done on a socket that is already in ESTABLISHED
1065 * state - UDP-style peeled off socket or a TCP-style socket that
1066 * is already connected.
1067 * It cannot be done even on a TCP-style listening socket.
1068 */
1069 if (sctp_sstate(sk, ESTABLISHED) ||
1070 (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING))) {
1071 err = -EISCONN;
1072 goto out_free;
1073 }
1074
1075 /* Walk through the addrs buffer and count the number of addresses. */
1076 addr_buf = kaddrs;
1077 while (walk_size < addrs_size) {
1078 struct sctp_af *af;
1079
1080 if (walk_size + sizeof(sa_family_t) > addrs_size) {
1081 err = -EINVAL;
1082 goto out_free;
1083 }
1084
1085 sa_addr = addr_buf;
1086 af = sctp_get_af_specific(sa_addr->sa.sa_family);
1087
1088 /* If the address family is not supported or if this address
1089 * causes the address buffer to overflow return EINVAL.
1090 */
1091 if (!af || (walk_size + af->sockaddr_len) > addrs_size) {
1092 err = -EINVAL;
1093 goto out_free;
1094 }
1095
1096 port = ntohs(sa_addr->v4.sin_port);
1097
1098 /* Save current address so we can work with it */
1099 memcpy(&to, sa_addr, af->sockaddr_len);
1100
1101 err = sctp_verify_addr(sk, &to, af->sockaddr_len);
1102 if (err)
1103 goto out_free;
1104
1105 /* Make sure the destination port is correctly set
1106 * in all addresses.
1107 */
1108 if (asoc && asoc->peer.port && asoc->peer.port != port) {
1109 err = -EINVAL;
1110 goto out_free;
1111 }
1112
1113 /* Check if there already is a matching association on the
1114 * endpoint (other than the one created here).
1115 */
1116 asoc2 = sctp_endpoint_lookup_assoc(ep, &to, &transport);
1117 if (asoc2 && asoc2 != asoc) {
1118 if (asoc2->state >= SCTP_STATE_ESTABLISHED)
1119 err = -EISCONN;
1120 else
1121 err = -EALREADY;
1122 goto out_free;
1123 }
1124
1125 /* If we could not find a matching association on the endpoint,
1126 * make sure that there is no peeled-off association matching
1127 * the peer address even on another socket.
1128 */
1129 if (sctp_endpoint_is_peeled_off(ep, &to)) {
1130 err = -EADDRNOTAVAIL;
1131 goto out_free;
1132 }
1133
1134 if (!asoc) {
1135 /* If a bind() or sctp_bindx() is not called prior to
1136 * an sctp_connectx() call, the system picks an
1137 * ephemeral port and will choose an address set
1138 * equivalent to binding with a wildcard address.
1139 */
1140 if (!ep->base.bind_addr.port) {
1141 if (sctp_autobind(sk)) {
1142 err = -EAGAIN;
1143 goto out_free;
1144 }
1145 } else {
1146 /*
1147 * If an unprivileged user inherits a 1-many
1148 * style socket with open associations on a
1149 * privileged port, it MAY be permitted to
1150 * accept new associations, but it SHOULD NOT
1151 * be permitted to open new associations.
1152 */
1153 if (ep->base.bind_addr.port < PROT_SOCK &&
1154 !ns_capable(net->user_ns, CAP_NET_BIND_SERVICE)) {
1155 err = -EACCES;
1156 goto out_free;
1157 }
1158 }
1159
1160 scope = sctp_scope(&to);
1161 asoc = sctp_association_new(ep, sk, scope, GFP_KERNEL);
1162 if (!asoc) {
1163 err = -ENOMEM;
1164 goto out_free;
1165 }
1166
1167 err = sctp_assoc_set_bind_addr_from_ep(asoc, scope,
1168 GFP_KERNEL);
1169 if (err < 0) {
1170 goto out_free;
1171 }
1172
1173 }
1174
1175 /* Prime the peer's transport structures. */
1176 transport = sctp_assoc_add_peer(asoc, &to, GFP_KERNEL,
1177 SCTP_UNKNOWN);
1178 if (!transport) {
1179 err = -ENOMEM;
1180 goto out_free;
1181 }
1182
1183 addrcnt++;
1184 addr_buf += af->sockaddr_len;
1185 walk_size += af->sockaddr_len;
1186 }
1187
1188 /* In case the user of sctp_connectx() wants an association
1189 * id back, assign one now.
1190 */
1191 if (assoc_id) {
1192 err = sctp_assoc_set_id(asoc, GFP_KERNEL);
1193 if (err < 0)
1194 goto out_free;
1195 }
1196
1197 err = sctp_primitive_ASSOCIATE(net, asoc, NULL);
1198 if (err < 0) {
1199 goto out_free;
1200 }
1201
1202 /* Initialize sk's dport and daddr for getpeername() */
1203 inet_sk(sk)->inet_dport = htons(asoc->peer.port);
1204 sp->pf->to_sk_daddr(sa_addr, sk);
1205 sk->sk_err = 0;
1206
1207 /* in-kernel sockets don't generally have a file allocated to them
1208 * if all they do is call sock_create_kern().
1209 */
1210 if (sk->sk_socket->file)
1211 f_flags = sk->sk_socket->file->f_flags;
1212
1213 timeo = sock_sndtimeo(sk, f_flags & O_NONBLOCK);
1214
1215 err = sctp_wait_for_connect(asoc, &timeo);
1216 if ((err == 0 || err == -EINPROGRESS) && assoc_id)
1217 *assoc_id = asoc->assoc_id;
1218
1219 /* Don't free association on exit. */
1220 asoc = NULL;
1221
1222 out_free:
1223 pr_debug("%s: took out_free path with asoc:%p kaddrs:%p err:%d\n",
1224 __func__, asoc, kaddrs, err);
1225
1226 if (asoc) {
1227 /* sctp_primitive_ASSOCIATE may have added this association
1228 * To the hash table, try to unhash it, just in case, its a noop
1229 * if it wasn't hashed so we're safe
1230 */
1231 sctp_unhash_established(asoc);
1232 sctp_association_free(asoc);
1233 }
1234 return err;
1235 }
1236
1237 /* Helper for tunneling sctp_connectx() requests through sctp_setsockopt()
1238 *
1239 * API 8.9
1240 * int sctp_connectx(int sd, struct sockaddr *addrs, int addrcnt,
1241 * sctp_assoc_t *asoc);
1242 *
1243 * If sd is an IPv4 socket, the addresses passed must be IPv4 addresses.
1244 * If the sd is an IPv6 socket, the addresses passed can either be IPv4
1245 * or IPv6 addresses.
1246 *
1247 * A single address may be specified as INADDR_ANY or IN6ADDR_ANY, see
1248 * Section 3.1.2 for this usage.
1249 *
1250 * addrs is a pointer to an array of one or more socket addresses. Each
1251 * address is contained in its appropriate structure (i.e. struct
1252 * sockaddr_in or struct sockaddr_in6) the family of the address type
1253 * must be used to distengish the address length (note that this
1254 * representation is termed a "packed array" of addresses). The caller
1255 * specifies the number of addresses in the array with addrcnt.
1256 *
1257 * On success, sctp_connectx() returns 0. It also sets the assoc_id to
1258 * the association id of the new association. On failure, sctp_connectx()
1259 * returns -1, and sets errno to the appropriate error code. The assoc_id
1260 * is not touched by the kernel.
1261 *
1262 * For SCTP, the port given in each socket address must be the same, or
1263 * sctp_connectx() will fail, setting errno to EINVAL.
1264 *
1265 * An application can use sctp_connectx to initiate an association with
1266 * an endpoint that is multi-homed. Much like sctp_bindx() this call
1267 * allows a caller to specify multiple addresses at which a peer can be
1268 * reached. The way the SCTP stack uses the list of addresses to set up
1269 * the association is implementation dependent. This function only
1270 * specifies that the stack will try to make use of all the addresses in
1271 * the list when needed.
1272 *
1273 * Note that the list of addresses passed in is only used for setting up
1274 * the association. It does not necessarily equal the set of addresses
1275 * the peer uses for the resulting association. If the caller wants to
1276 * find out the set of peer addresses, it must use sctp_getpaddrs() to
1277 * retrieve them after the association has been set up.
1278 *
1279 * Basically do nothing but copying the addresses from user to kernel
1280 * land and invoking either sctp_connectx(). This is used for tunneling
1281 * the sctp_connectx() request through sctp_setsockopt() from userspace.
1282 *
1283 * We don't use copy_from_user() for optimization: we first do the
1284 * sanity checks (buffer size -fast- and access check-healthy
1285 * pointer); if all of those succeed, then we can alloc the memory
1286 * (expensive operation) needed to copy the data to kernel. Then we do
1287 * the copying without checking the user space area
1288 * (__copy_from_user()).
1289 *
1290 * On exit there is no need to do sockfd_put(), sys_setsockopt() does
1291 * it.
1292 *
1293 * sk The sk of the socket
1294 * addrs The pointer to the addresses in user land
1295 * addrssize Size of the addrs buffer
1296 *
1297 * Returns >=0 if ok, <0 errno code on error.
1298 */
__sctp_setsockopt_connectx(struct sock * sk,struct sockaddr __user * addrs,int addrs_size,sctp_assoc_t * assoc_id)1299 static int __sctp_setsockopt_connectx(struct sock *sk,
1300 struct sockaddr __user *addrs,
1301 int addrs_size,
1302 sctp_assoc_t *assoc_id)
1303 {
1304 int err = 0;
1305 struct sockaddr *kaddrs;
1306
1307 pr_debug("%s: sk:%p addrs:%p addrs_size:%d\n",
1308 __func__, sk, addrs, addrs_size);
1309
1310 if (unlikely(addrs_size <= 0))
1311 return -EINVAL;
1312
1313 /* Check the user passed a healthy pointer. */
1314 if (unlikely(!access_ok(VERIFY_READ, addrs, addrs_size)))
1315 return -EFAULT;
1316
1317 /* Alloc space for the address array in kernel memory. */
1318 kaddrs = kmalloc(addrs_size, GFP_KERNEL);
1319 if (unlikely(!kaddrs))
1320 return -ENOMEM;
1321
1322 if (__copy_from_user(kaddrs, addrs, addrs_size)) {
1323 err = -EFAULT;
1324 } else {
1325 err = __sctp_connect(sk, kaddrs, addrs_size, assoc_id);
1326 }
1327
1328 kfree(kaddrs);
1329
1330 return err;
1331 }
1332
1333 /*
1334 * This is an older interface. It's kept for backward compatibility
1335 * to the option that doesn't provide association id.
1336 */
sctp_setsockopt_connectx_old(struct sock * sk,struct sockaddr __user * addrs,int addrs_size)1337 static int sctp_setsockopt_connectx_old(struct sock *sk,
1338 struct sockaddr __user *addrs,
1339 int addrs_size)
1340 {
1341 return __sctp_setsockopt_connectx(sk, addrs, addrs_size, NULL);
1342 }
1343
1344 /*
1345 * New interface for the API. The since the API is done with a socket
1346 * option, to make it simple we feed back the association id is as a return
1347 * indication to the call. Error is always negative and association id is
1348 * always positive.
1349 */
sctp_setsockopt_connectx(struct sock * sk,struct sockaddr __user * addrs,int addrs_size)1350 static int sctp_setsockopt_connectx(struct sock *sk,
1351 struct sockaddr __user *addrs,
1352 int addrs_size)
1353 {
1354 sctp_assoc_t assoc_id = 0;
1355 int err = 0;
1356
1357 err = __sctp_setsockopt_connectx(sk, addrs, addrs_size, &assoc_id);
1358
1359 if (err)
1360 return err;
1361 else
1362 return assoc_id;
1363 }
1364
1365 /*
1366 * New (hopefully final) interface for the API.
1367 * We use the sctp_getaddrs_old structure so that use-space library
1368 * can avoid any unnecessary allocations. The only different part
1369 * is that we store the actual length of the address buffer into the
1370 * addrs_num structure member. That way we can re-use the existing
1371 * code.
1372 */
1373 #ifdef CONFIG_COMPAT
1374 struct compat_sctp_getaddrs_old {
1375 sctp_assoc_t assoc_id;
1376 s32 addr_num;
1377 compat_uptr_t addrs; /* struct sockaddr * */
1378 };
1379 #endif
1380
sctp_getsockopt_connectx3(struct sock * sk,int len,char __user * optval,int __user * optlen)1381 static int sctp_getsockopt_connectx3(struct sock *sk, int len,
1382 char __user *optval,
1383 int __user *optlen)
1384 {
1385 struct sctp_getaddrs_old param;
1386 sctp_assoc_t assoc_id = 0;
1387 int err = 0;
1388
1389 #ifdef CONFIG_COMPAT
1390 if (is_compat_task()) {
1391 struct compat_sctp_getaddrs_old param32;
1392
1393 if (len < sizeof(param32))
1394 return -EINVAL;
1395 if (copy_from_user(¶m32, optval, sizeof(param32)))
1396 return -EFAULT;
1397
1398 param.assoc_id = param32.assoc_id;
1399 param.addr_num = param32.addr_num;
1400 param.addrs = compat_ptr(param32.addrs);
1401 } else
1402 #endif
1403 {
1404 if (len < sizeof(param))
1405 return -EINVAL;
1406 if (copy_from_user(¶m, optval, sizeof(param)))
1407 return -EFAULT;
1408 }
1409
1410 err = __sctp_setsockopt_connectx(sk, (struct sockaddr __user *)
1411 param.addrs, param.addr_num,
1412 &assoc_id);
1413 if (err == 0 || err == -EINPROGRESS) {
1414 if (copy_to_user(optval, &assoc_id, sizeof(assoc_id)))
1415 return -EFAULT;
1416 if (put_user(sizeof(assoc_id), optlen))
1417 return -EFAULT;
1418 }
1419
1420 return err;
1421 }
1422
1423 /* API 3.1.4 close() - UDP Style Syntax
1424 * Applications use close() to perform graceful shutdown (as described in
1425 * Section 10.1 of [SCTP]) on ALL the associations currently represented
1426 * by a UDP-style socket.
1427 *
1428 * The syntax is
1429 *
1430 * ret = close(int sd);
1431 *
1432 * sd - the socket descriptor of the associations to be closed.
1433 *
1434 * To gracefully shutdown a specific association represented by the
1435 * UDP-style socket, an application should use the sendmsg() call,
1436 * passing no user data, but including the appropriate flag in the
1437 * ancillary data (see Section xxxx).
1438 *
1439 * If sd in the close() call is a branched-off socket representing only
1440 * one association, the shutdown is performed on that association only.
1441 *
1442 * 4.1.6 close() - TCP Style Syntax
1443 *
1444 * Applications use close() to gracefully close down an association.
1445 *
1446 * The syntax is:
1447 *
1448 * int close(int sd);
1449 *
1450 * sd - the socket descriptor of the association to be closed.
1451 *
1452 * After an application calls close() on a socket descriptor, no further
1453 * socket operations will succeed on that descriptor.
1454 *
1455 * API 7.1.4 SO_LINGER
1456 *
1457 * An application using the TCP-style socket can use this option to
1458 * perform the SCTP ABORT primitive. The linger option structure is:
1459 *
1460 * struct linger {
1461 * int l_onoff; // option on/off
1462 * int l_linger; // linger time
1463 * };
1464 *
1465 * To enable the option, set l_onoff to 1. If the l_linger value is set
1466 * to 0, calling close() is the same as the ABORT primitive. If the
1467 * value is set to a negative value, the setsockopt() call will return
1468 * an error. If the value is set to a positive value linger_time, the
1469 * close() can be blocked for at most linger_time ms. If the graceful
1470 * shutdown phase does not finish during this period, close() will
1471 * return but the graceful shutdown phase continues in the system.
1472 */
sctp_close(struct sock * sk,long timeout)1473 static void sctp_close(struct sock *sk, long timeout)
1474 {
1475 struct net *net = sock_net(sk);
1476 struct sctp_endpoint *ep;
1477 struct sctp_association *asoc;
1478 struct list_head *pos, *temp;
1479 unsigned int data_was_unread;
1480
1481 pr_debug("%s: sk:%p, timeout:%ld\n", __func__, sk, timeout);
1482
1483 lock_sock(sk);
1484 sk->sk_shutdown = SHUTDOWN_MASK;
1485 sk->sk_state = SCTP_SS_CLOSING;
1486
1487 ep = sctp_sk(sk)->ep;
1488
1489 /* Clean up any skbs sitting on the receive queue. */
1490 data_was_unread = sctp_queue_purge_ulpevents(&sk->sk_receive_queue);
1491 data_was_unread += sctp_queue_purge_ulpevents(&sctp_sk(sk)->pd_lobby);
1492
1493 /* Walk all associations on an endpoint. */
1494 list_for_each_safe(pos, temp, &ep->asocs) {
1495 asoc = list_entry(pos, struct sctp_association, asocs);
1496
1497 if (sctp_style(sk, TCP)) {
1498 /* A closed association can still be in the list if
1499 * it belongs to a TCP-style listening socket that is
1500 * not yet accepted. If so, free it. If not, send an
1501 * ABORT or SHUTDOWN based on the linger options.
1502 */
1503 if (sctp_state(asoc, CLOSED)) {
1504 sctp_unhash_established(asoc);
1505 sctp_association_free(asoc);
1506 continue;
1507 }
1508 }
1509
1510 if (data_was_unread || !skb_queue_empty(&asoc->ulpq.lobby) ||
1511 !skb_queue_empty(&asoc->ulpq.reasm) ||
1512 (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime)) {
1513 struct sctp_chunk *chunk;
1514
1515 chunk = sctp_make_abort_user(asoc, NULL, 0);
1516 sctp_primitive_ABORT(net, asoc, chunk);
1517 } else
1518 sctp_primitive_SHUTDOWN(net, asoc, NULL);
1519 }
1520
1521 /* On a TCP-style socket, block for at most linger_time if set. */
1522 if (sctp_style(sk, TCP) && timeout)
1523 sctp_wait_for_close(sk, timeout);
1524
1525 /* This will run the backlog queue. */
1526 release_sock(sk);
1527
1528 /* Supposedly, no process has access to the socket, but
1529 * the net layers still may.
1530 * Also, sctp_destroy_sock() needs to be called with addr_wq_lock
1531 * held and that should be grabbed before socket lock.
1532 */
1533 spin_lock_bh(&net->sctp.addr_wq_lock);
1534 bh_lock_sock(sk);
1535
1536 /* Hold the sock, since sk_common_release() will put sock_put()
1537 * and we have just a little more cleanup.
1538 */
1539 sock_hold(sk);
1540 sk_common_release(sk);
1541
1542 bh_unlock_sock(sk);
1543 spin_unlock_bh(&net->sctp.addr_wq_lock);
1544
1545 sock_put(sk);
1546
1547 SCTP_DBG_OBJCNT_DEC(sock);
1548 }
1549
1550 /* Handle EPIPE error. */
sctp_error(struct sock * sk,int flags,int err)1551 static int sctp_error(struct sock *sk, int flags, int err)
1552 {
1553 if (err == -EPIPE)
1554 err = sock_error(sk) ? : -EPIPE;
1555 if (err == -EPIPE && !(flags & MSG_NOSIGNAL))
1556 send_sig(SIGPIPE, current, 0);
1557 return err;
1558 }
1559
1560 /* API 3.1.3 sendmsg() - UDP Style Syntax
1561 *
1562 * An application uses sendmsg() and recvmsg() calls to transmit data to
1563 * and receive data from its peer.
1564 *
1565 * ssize_t sendmsg(int socket, const struct msghdr *message,
1566 * int flags);
1567 *
1568 * socket - the socket descriptor of the endpoint.
1569 * message - pointer to the msghdr structure which contains a single
1570 * user message and possibly some ancillary data.
1571 *
1572 * See Section 5 for complete description of the data
1573 * structures.
1574 *
1575 * flags - flags sent or received with the user message, see Section
1576 * 5 for complete description of the flags.
1577 *
1578 * Note: This function could use a rewrite especially when explicit
1579 * connect support comes in.
1580 */
1581 /* BUG: We do not implement the equivalent of sk_stream_wait_memory(). */
1582
1583 static int sctp_msghdr_parse(const struct msghdr *, sctp_cmsgs_t *);
1584
sctp_sendmsg(struct sock * sk,struct msghdr * msg,size_t msg_len)1585 static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
1586 {
1587 struct net *net = sock_net(sk);
1588 struct sctp_sock *sp;
1589 struct sctp_endpoint *ep;
1590 struct sctp_association *new_asoc = NULL, *asoc = NULL;
1591 struct sctp_transport *transport, *chunk_tp;
1592 struct sctp_chunk *chunk;
1593 union sctp_addr to;
1594 struct sockaddr *msg_name = NULL;
1595 struct sctp_sndrcvinfo default_sinfo;
1596 struct sctp_sndrcvinfo *sinfo;
1597 struct sctp_initmsg *sinit;
1598 sctp_assoc_t associd = 0;
1599 sctp_cmsgs_t cmsgs = { NULL };
1600 sctp_scope_t scope;
1601 bool fill_sinfo_ttl = false, wait_connect = false;
1602 struct sctp_datamsg *datamsg;
1603 int msg_flags = msg->msg_flags;
1604 __u16 sinfo_flags = 0;
1605 long timeo;
1606 int err;
1607
1608 err = 0;
1609 sp = sctp_sk(sk);
1610 ep = sp->ep;
1611
1612 pr_debug("%s: sk:%p, msg:%p, msg_len:%zu ep:%p\n", __func__, sk,
1613 msg, msg_len, ep);
1614
1615 /* We cannot send a message over a TCP-style listening socket. */
1616 if (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING)) {
1617 err = -EPIPE;
1618 goto out_nounlock;
1619 }
1620
1621 /* Parse out the SCTP CMSGs. */
1622 err = sctp_msghdr_parse(msg, &cmsgs);
1623 if (err) {
1624 pr_debug("%s: msghdr parse err:%x\n", __func__, err);
1625 goto out_nounlock;
1626 }
1627
1628 /* Fetch the destination address for this packet. This
1629 * address only selects the association--it is not necessarily
1630 * the address we will send to.
1631 * For a peeled-off socket, msg_name is ignored.
1632 */
1633 if (!sctp_style(sk, UDP_HIGH_BANDWIDTH) && msg->msg_name) {
1634 int msg_namelen = msg->msg_namelen;
1635
1636 err = sctp_verify_addr(sk, (union sctp_addr *)msg->msg_name,
1637 msg_namelen);
1638 if (err)
1639 return err;
1640
1641 if (msg_namelen > sizeof(to))
1642 msg_namelen = sizeof(to);
1643 memcpy(&to, msg->msg_name, msg_namelen);
1644 msg_name = msg->msg_name;
1645 }
1646
1647 sinit = cmsgs.init;
1648 if (cmsgs.sinfo != NULL) {
1649 memset(&default_sinfo, 0, sizeof(default_sinfo));
1650 default_sinfo.sinfo_stream = cmsgs.sinfo->snd_sid;
1651 default_sinfo.sinfo_flags = cmsgs.sinfo->snd_flags;
1652 default_sinfo.sinfo_ppid = cmsgs.sinfo->snd_ppid;
1653 default_sinfo.sinfo_context = cmsgs.sinfo->snd_context;
1654 default_sinfo.sinfo_assoc_id = cmsgs.sinfo->snd_assoc_id;
1655
1656 sinfo = &default_sinfo;
1657 fill_sinfo_ttl = true;
1658 } else {
1659 sinfo = cmsgs.srinfo;
1660 }
1661 /* Did the user specify SNDINFO/SNDRCVINFO? */
1662 if (sinfo) {
1663 sinfo_flags = sinfo->sinfo_flags;
1664 associd = sinfo->sinfo_assoc_id;
1665 }
1666
1667 pr_debug("%s: msg_len:%zu, sinfo_flags:0x%x\n", __func__,
1668 msg_len, sinfo_flags);
1669
1670 /* SCTP_EOF or SCTP_ABORT cannot be set on a TCP-style socket. */
1671 if (sctp_style(sk, TCP) && (sinfo_flags & (SCTP_EOF | SCTP_ABORT))) {
1672 err = -EINVAL;
1673 goto out_nounlock;
1674 }
1675
1676 /* If SCTP_EOF is set, no data can be sent. Disallow sending zero
1677 * length messages when SCTP_EOF|SCTP_ABORT is not set.
1678 * If SCTP_ABORT is set, the message length could be non zero with
1679 * the msg_iov set to the user abort reason.
1680 */
1681 if (((sinfo_flags & SCTP_EOF) && (msg_len > 0)) ||
1682 (!(sinfo_flags & (SCTP_EOF|SCTP_ABORT)) && (msg_len == 0))) {
1683 err = -EINVAL;
1684 goto out_nounlock;
1685 }
1686
1687 /* If SCTP_ADDR_OVER is set, there must be an address
1688 * specified in msg_name.
1689 */
1690 if ((sinfo_flags & SCTP_ADDR_OVER) && (!msg->msg_name)) {
1691 err = -EINVAL;
1692 goto out_nounlock;
1693 }
1694
1695 transport = NULL;
1696
1697 pr_debug("%s: about to look up association\n", __func__);
1698
1699 lock_sock(sk);
1700
1701 /* If a msg_name has been specified, assume this is to be used. */
1702 if (msg_name) {
1703 /* Look for a matching association on the endpoint. */
1704 asoc = sctp_endpoint_lookup_assoc(ep, &to, &transport);
1705 if (!asoc) {
1706 /* If we could not find a matching association on the
1707 * endpoint, make sure that it is not a TCP-style
1708 * socket that already has an association or there is
1709 * no peeled-off association on another socket.
1710 */
1711 if ((sctp_style(sk, TCP) &&
1712 sctp_sstate(sk, ESTABLISHED)) ||
1713 sctp_endpoint_is_peeled_off(ep, &to)) {
1714 err = -EADDRNOTAVAIL;
1715 goto out_unlock;
1716 }
1717 }
1718 } else {
1719 asoc = sctp_id2assoc(sk, associd);
1720 if (!asoc) {
1721 err = -EPIPE;
1722 goto out_unlock;
1723 }
1724 }
1725
1726 if (asoc) {
1727 pr_debug("%s: just looked up association:%p\n", __func__, asoc);
1728
1729 /* We cannot send a message on a TCP-style SCTP_SS_ESTABLISHED
1730 * socket that has an association in CLOSED state. This can
1731 * happen when an accepted socket has an association that is
1732 * already CLOSED.
1733 */
1734 if (sctp_state(asoc, CLOSED) && sctp_style(sk, TCP)) {
1735 err = -EPIPE;
1736 goto out_unlock;
1737 }
1738
1739 if (sinfo_flags & SCTP_EOF) {
1740 pr_debug("%s: shutting down association:%p\n",
1741 __func__, asoc);
1742
1743 sctp_primitive_SHUTDOWN(net, asoc, NULL);
1744 err = 0;
1745 goto out_unlock;
1746 }
1747 if (sinfo_flags & SCTP_ABORT) {
1748
1749 chunk = sctp_make_abort_user(asoc, msg, msg_len);
1750 if (!chunk) {
1751 err = -ENOMEM;
1752 goto out_unlock;
1753 }
1754
1755 pr_debug("%s: aborting association:%p\n",
1756 __func__, asoc);
1757
1758 sctp_primitive_ABORT(net, asoc, chunk);
1759 err = 0;
1760 goto out_unlock;
1761 }
1762 }
1763
1764 /* Do we need to create the association? */
1765 if (!asoc) {
1766 pr_debug("%s: there is no association yet\n", __func__);
1767
1768 if (sinfo_flags & (SCTP_EOF | SCTP_ABORT)) {
1769 err = -EINVAL;
1770 goto out_unlock;
1771 }
1772
1773 /* Check for invalid stream against the stream counts,
1774 * either the default or the user specified stream counts.
1775 */
1776 if (sinfo) {
1777 if (!sinit || !sinit->sinit_num_ostreams) {
1778 /* Check against the defaults. */
1779 if (sinfo->sinfo_stream >=
1780 sp->initmsg.sinit_num_ostreams) {
1781 err = -EINVAL;
1782 goto out_unlock;
1783 }
1784 } else {
1785 /* Check against the requested. */
1786 if (sinfo->sinfo_stream >=
1787 sinit->sinit_num_ostreams) {
1788 err = -EINVAL;
1789 goto out_unlock;
1790 }
1791 }
1792 }
1793
1794 /*
1795 * API 3.1.2 bind() - UDP Style Syntax
1796 * If a bind() or sctp_bindx() is not called prior to a
1797 * sendmsg() call that initiates a new association, the
1798 * system picks an ephemeral port and will choose an address
1799 * set equivalent to binding with a wildcard address.
1800 */
1801 if (!ep->base.bind_addr.port) {
1802 if (sctp_autobind(sk)) {
1803 err = -EAGAIN;
1804 goto out_unlock;
1805 }
1806 } else {
1807 /*
1808 * If an unprivileged user inherits a one-to-many
1809 * style socket with open associations on a privileged
1810 * port, it MAY be permitted to accept new associations,
1811 * but it SHOULD NOT be permitted to open new
1812 * associations.
1813 */
1814 if (ep->base.bind_addr.port < PROT_SOCK &&
1815 !ns_capable(net->user_ns, CAP_NET_BIND_SERVICE)) {
1816 err = -EACCES;
1817 goto out_unlock;
1818 }
1819 }
1820
1821 scope = sctp_scope(&to);
1822 new_asoc = sctp_association_new(ep, sk, scope, GFP_KERNEL);
1823 if (!new_asoc) {
1824 err = -ENOMEM;
1825 goto out_unlock;
1826 }
1827 asoc = new_asoc;
1828 err = sctp_assoc_set_bind_addr_from_ep(asoc, scope, GFP_KERNEL);
1829 if (err < 0) {
1830 err = -ENOMEM;
1831 goto out_free;
1832 }
1833
1834 /* If the SCTP_INIT ancillary data is specified, set all
1835 * the association init values accordingly.
1836 */
1837 if (sinit) {
1838 if (sinit->sinit_num_ostreams) {
1839 asoc->c.sinit_num_ostreams =
1840 sinit->sinit_num_ostreams;
1841 }
1842 if (sinit->sinit_max_instreams) {
1843 asoc->c.sinit_max_instreams =
1844 sinit->sinit_max_instreams;
1845 }
1846 if (sinit->sinit_max_attempts) {
1847 asoc->max_init_attempts
1848 = sinit->sinit_max_attempts;
1849 }
1850 if (sinit->sinit_max_init_timeo) {
1851 asoc->max_init_timeo =
1852 msecs_to_jiffies(sinit->sinit_max_init_timeo);
1853 }
1854 }
1855
1856 /* Prime the peer's transport structures. */
1857 transport = sctp_assoc_add_peer(asoc, &to, GFP_KERNEL, SCTP_UNKNOWN);
1858 if (!transport) {
1859 err = -ENOMEM;
1860 goto out_free;
1861 }
1862 }
1863
1864 /* ASSERT: we have a valid association at this point. */
1865 pr_debug("%s: we have a valid association\n", __func__);
1866
1867 if (!sinfo) {
1868 /* If the user didn't specify SNDINFO/SNDRCVINFO, make up
1869 * one with some defaults.
1870 */
1871 memset(&default_sinfo, 0, sizeof(default_sinfo));
1872 default_sinfo.sinfo_stream = asoc->default_stream;
1873 default_sinfo.sinfo_flags = asoc->default_flags;
1874 default_sinfo.sinfo_ppid = asoc->default_ppid;
1875 default_sinfo.sinfo_context = asoc->default_context;
1876 default_sinfo.sinfo_timetolive = asoc->default_timetolive;
1877 default_sinfo.sinfo_assoc_id = sctp_assoc2id(asoc);
1878
1879 sinfo = &default_sinfo;
1880 } else if (fill_sinfo_ttl) {
1881 /* In case SNDINFO was specified, we still need to fill
1882 * it with a default ttl from the assoc here.
1883 */
1884 sinfo->sinfo_timetolive = asoc->default_timetolive;
1885 }
1886
1887 /* API 7.1.7, the sndbuf size per association bounds the
1888 * maximum size of data that can be sent in a single send call.
1889 */
1890 if (msg_len > sk->sk_sndbuf) {
1891 err = -EMSGSIZE;
1892 goto out_free;
1893 }
1894
1895 if (asoc->pmtu_pending)
1896 sctp_assoc_pending_pmtu(sk, asoc);
1897
1898 /* If fragmentation is disabled and the message length exceeds the
1899 * association fragmentation point, return EMSGSIZE. The I-D
1900 * does not specify what this error is, but this looks like
1901 * a great fit.
1902 */
1903 if (sctp_sk(sk)->disable_fragments && (msg_len > asoc->frag_point)) {
1904 err = -EMSGSIZE;
1905 goto out_free;
1906 }
1907
1908 /* Check for invalid stream. */
1909 if (sinfo->sinfo_stream >= asoc->c.sinit_num_ostreams) {
1910 err = -EINVAL;
1911 goto out_free;
1912 }
1913
1914 timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
1915 if (!sctp_wspace(asoc)) {
1916 err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len);
1917 if (err)
1918 goto out_free;
1919 }
1920
1921 /* If an address is passed with the sendto/sendmsg call, it is used
1922 * to override the primary destination address in the TCP model, or
1923 * when SCTP_ADDR_OVER flag is set in the UDP model.
1924 */
1925 if ((sctp_style(sk, TCP) && msg_name) ||
1926 (sinfo_flags & SCTP_ADDR_OVER)) {
1927 chunk_tp = sctp_assoc_lookup_paddr(asoc, &to);
1928 if (!chunk_tp) {
1929 err = -EINVAL;
1930 goto out_free;
1931 }
1932 } else
1933 chunk_tp = NULL;
1934
1935 /* Auto-connect, if we aren't connected already. */
1936 if (sctp_state(asoc, CLOSED)) {
1937 err = sctp_primitive_ASSOCIATE(net, asoc, NULL);
1938 if (err < 0)
1939 goto out_free;
1940
1941 wait_connect = true;
1942 pr_debug("%s: we associated primitively\n", __func__);
1943 }
1944
1945 /* Break the message into multiple chunks of maximum size. */
1946 datamsg = sctp_datamsg_from_user(asoc, sinfo, &msg->msg_iter);
1947 if (IS_ERR(datamsg)) {
1948 err = PTR_ERR(datamsg);
1949 goto out_free;
1950 }
1951
1952 /* Now send the (possibly) fragmented message. */
1953 list_for_each_entry(chunk, &datamsg->chunks, frag_list) {
1954 sctp_chunk_hold(chunk);
1955
1956 /* Do accounting for the write space. */
1957 sctp_set_owner_w(chunk);
1958
1959 chunk->transport = chunk_tp;
1960 }
1961
1962 /* Send it to the lower layers. Note: all chunks
1963 * must either fail or succeed. The lower layer
1964 * works that way today. Keep it that way or this
1965 * breaks.
1966 */
1967 err = sctp_primitive_SEND(net, asoc, datamsg);
1968 /* Did the lower layer accept the chunk? */
1969 if (err) {
1970 sctp_datamsg_free(datamsg);
1971 goto out_free;
1972 }
1973
1974 pr_debug("%s: we sent primitively\n", __func__);
1975
1976 sctp_datamsg_put(datamsg);
1977 err = msg_len;
1978
1979 if (unlikely(wait_connect)) {
1980 timeo = sock_sndtimeo(sk, msg_flags & MSG_DONTWAIT);
1981 sctp_wait_for_connect(asoc, &timeo);
1982 }
1983
1984 /* If we are already past ASSOCIATE, the lower
1985 * layers are responsible for association cleanup.
1986 */
1987 goto out_unlock;
1988
1989 out_free:
1990 if (new_asoc) {
1991 sctp_unhash_established(asoc);
1992 sctp_association_free(asoc);
1993 }
1994 out_unlock:
1995 release_sock(sk);
1996
1997 out_nounlock:
1998 return sctp_error(sk, msg_flags, err);
1999
2000 #if 0
2001 do_sock_err:
2002 if (msg_len)
2003 err = msg_len;
2004 else
2005 err = sock_error(sk);
2006 goto out;
2007
2008 do_interrupted:
2009 if (msg_len)
2010 err = msg_len;
2011 goto out;
2012 #endif /* 0 */
2013 }
2014
2015 /* This is an extended version of skb_pull() that removes the data from the
2016 * start of a skb even when data is spread across the list of skb's in the
2017 * frag_list. len specifies the total amount of data that needs to be removed.
2018 * when 'len' bytes could be removed from the skb, it returns 0.
2019 * If 'len' exceeds the total skb length, it returns the no. of bytes that
2020 * could not be removed.
2021 */
sctp_skb_pull(struct sk_buff * skb,int len)2022 static int sctp_skb_pull(struct sk_buff *skb, int len)
2023 {
2024 struct sk_buff *list;
2025 int skb_len = skb_headlen(skb);
2026 int rlen;
2027
2028 if (len <= skb_len) {
2029 __skb_pull(skb, len);
2030 return 0;
2031 }
2032 len -= skb_len;
2033 __skb_pull(skb, skb_len);
2034
2035 skb_walk_frags(skb, list) {
2036 rlen = sctp_skb_pull(list, len);
2037 skb->len -= (len-rlen);
2038 skb->data_len -= (len-rlen);
2039
2040 if (!rlen)
2041 return 0;
2042
2043 len = rlen;
2044 }
2045
2046 return len;
2047 }
2048
2049 /* API 3.1.3 recvmsg() - UDP Style Syntax
2050 *
2051 * ssize_t recvmsg(int socket, struct msghdr *message,
2052 * int flags);
2053 *
2054 * socket - the socket descriptor of the endpoint.
2055 * message - pointer to the msghdr structure which contains a single
2056 * user message and possibly some ancillary data.
2057 *
2058 * See Section 5 for complete description of the data
2059 * structures.
2060 *
2061 * flags - flags sent or received with the user message, see Section
2062 * 5 for complete description of the flags.
2063 */
sctp_recvmsg(struct sock * sk,struct msghdr * msg,size_t len,int noblock,int flags,int * addr_len)2064 static int sctp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
2065 int noblock, int flags, int *addr_len)
2066 {
2067 struct sctp_ulpevent *event = NULL;
2068 struct sctp_sock *sp = sctp_sk(sk);
2069 struct sk_buff *skb;
2070 int copied;
2071 int err = 0;
2072 int skb_len;
2073
2074 pr_debug("%s: sk:%p, msghdr:%p, len:%zd, noblock:%d, flags:0x%x, "
2075 "addr_len:%p)\n", __func__, sk, msg, len, noblock, flags,
2076 addr_len);
2077
2078 lock_sock(sk);
2079
2080 if (sctp_style(sk, TCP) && !sctp_sstate(sk, ESTABLISHED)) {
2081 err = -ENOTCONN;
2082 goto out;
2083 }
2084
2085 skb = sctp_skb_recv_datagram(sk, flags, noblock, &err);
2086 if (!skb)
2087 goto out;
2088
2089 /* Get the total length of the skb including any skb's in the
2090 * frag_list.
2091 */
2092 skb_len = skb->len;
2093
2094 copied = skb_len;
2095 if (copied > len)
2096 copied = len;
2097
2098 err = skb_copy_datagram_msg(skb, 0, msg, copied);
2099
2100 event = sctp_skb2event(skb);
2101
2102 if (err)
2103 goto out_free;
2104
2105 sock_recv_ts_and_drops(msg, sk, skb);
2106 if (sctp_ulpevent_is_notification(event)) {
2107 msg->msg_flags |= MSG_NOTIFICATION;
2108 sp->pf->event_msgname(event, msg->msg_name, addr_len);
2109 } else {
2110 sp->pf->skb_msgname(skb, msg->msg_name, addr_len);
2111 }
2112
2113 /* Check if we allow SCTP_NXTINFO. */
2114 if (sp->recvnxtinfo)
2115 sctp_ulpevent_read_nxtinfo(event, msg, sk);
2116 /* Check if we allow SCTP_RCVINFO. */
2117 if (sp->recvrcvinfo)
2118 sctp_ulpevent_read_rcvinfo(event, msg);
2119 /* Check if we allow SCTP_SNDRCVINFO. */
2120 if (sp->subscribe.sctp_data_io_event)
2121 sctp_ulpevent_read_sndrcvinfo(event, msg);
2122
2123 #if 0
2124 /* FIXME: we should be calling IP/IPv6 layers. */
2125 if (sk->sk_protinfo.af_inet.cmsg_flags)
2126 ip_cmsg_recv(msg, skb);
2127 #endif
2128
2129 err = copied;
2130
2131 /* If skb's length exceeds the user's buffer, update the skb and
2132 * push it back to the receive_queue so that the next call to
2133 * recvmsg() will return the remaining data. Don't set MSG_EOR.
2134 */
2135 if (skb_len > copied) {
2136 msg->msg_flags &= ~MSG_EOR;
2137 if (flags & MSG_PEEK)
2138 goto out_free;
2139 sctp_skb_pull(skb, copied);
2140 skb_queue_head(&sk->sk_receive_queue, skb);
2141
2142 /* When only partial message is copied to the user, increase
2143 * rwnd by that amount. If all the data in the skb is read,
2144 * rwnd is updated when the event is freed.
2145 */
2146 if (!sctp_ulpevent_is_notification(event))
2147 sctp_assoc_rwnd_increase(event->asoc, copied);
2148 goto out;
2149 } else if ((event->msg_flags & MSG_NOTIFICATION) ||
2150 (event->msg_flags & MSG_EOR))
2151 msg->msg_flags |= MSG_EOR;
2152 else
2153 msg->msg_flags &= ~MSG_EOR;
2154
2155 out_free:
2156 if (flags & MSG_PEEK) {
2157 /* Release the skb reference acquired after peeking the skb in
2158 * sctp_skb_recv_datagram().
2159 */
2160 kfree_skb(skb);
2161 } else {
2162 /* Free the event which includes releasing the reference to
2163 * the owner of the skb, freeing the skb and updating the
2164 * rwnd.
2165 */
2166 sctp_ulpevent_free(event);
2167 }
2168 out:
2169 release_sock(sk);
2170 return err;
2171 }
2172
2173 /* 7.1.12 Enable/Disable message fragmentation (SCTP_DISABLE_FRAGMENTS)
2174 *
2175 * This option is a on/off flag. If enabled no SCTP message
2176 * fragmentation will be performed. Instead if a message being sent
2177 * exceeds the current PMTU size, the message will NOT be sent and
2178 * instead a error will be indicated to the user.
2179 */
sctp_setsockopt_disable_fragments(struct sock * sk,char __user * optval,unsigned int optlen)2180 static int sctp_setsockopt_disable_fragments(struct sock *sk,
2181 char __user *optval,
2182 unsigned int optlen)
2183 {
2184 int val;
2185
2186 if (optlen < sizeof(int))
2187 return -EINVAL;
2188
2189 if (get_user(val, (int __user *)optval))
2190 return -EFAULT;
2191
2192 sctp_sk(sk)->disable_fragments = (val == 0) ? 0 : 1;
2193
2194 return 0;
2195 }
2196
sctp_setsockopt_events(struct sock * sk,char __user * optval,unsigned int optlen)2197 static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
2198 unsigned int optlen)
2199 {
2200 struct sctp_association *asoc;
2201 struct sctp_ulpevent *event;
2202
2203 if (optlen > sizeof(struct sctp_event_subscribe))
2204 return -EINVAL;
2205 if (copy_from_user(&sctp_sk(sk)->subscribe, optval, optlen))
2206 return -EFAULT;
2207
2208 if (sctp_sk(sk)->subscribe.sctp_data_io_event)
2209 pr_warn_ratelimited(DEPRECATED "%s (pid %d) "
2210 "Requested SCTP_SNDRCVINFO event.\n"
2211 "Use SCTP_RCVINFO through SCTP_RECVRCVINFO option instead.\n",
2212 current->comm, task_pid_nr(current));
2213
2214 /* At the time when a user app subscribes to SCTP_SENDER_DRY_EVENT,
2215 * if there is no data to be sent or retransmit, the stack will
2216 * immediately send up this notification.
2217 */
2218 if (sctp_ulpevent_type_enabled(SCTP_SENDER_DRY_EVENT,
2219 &sctp_sk(sk)->subscribe)) {
2220 asoc = sctp_id2assoc(sk, 0);
2221
2222 if (asoc && sctp_outq_is_empty(&asoc->outqueue)) {
2223 event = sctp_ulpevent_make_sender_dry_event(asoc,
2224 GFP_ATOMIC);
2225 if (!event)
2226 return -ENOMEM;
2227
2228 sctp_ulpq_tail_event(&asoc->ulpq, event);
2229 }
2230 }
2231
2232 return 0;
2233 }
2234
2235 /* 7.1.8 Automatic Close of associations (SCTP_AUTOCLOSE)
2236 *
2237 * This socket option is applicable to the UDP-style socket only. When
2238 * set it will cause associations that are idle for more than the
2239 * specified number of seconds to automatically close. An association
2240 * being idle is defined an association that has NOT sent or received
2241 * user data. The special value of '0' indicates that no automatic
2242 * close of any associations should be performed. The option expects an
2243 * integer defining the number of seconds of idle time before an
2244 * association is closed.
2245 */
sctp_setsockopt_autoclose(struct sock * sk,char __user * optval,unsigned int optlen)2246 static int sctp_setsockopt_autoclose(struct sock *sk, char __user *optval,
2247 unsigned int optlen)
2248 {
2249 struct sctp_sock *sp = sctp_sk(sk);
2250 struct net *net = sock_net(sk);
2251
2252 /* Applicable to UDP-style socket only */
2253 if (sctp_style(sk, TCP))
2254 return -EOPNOTSUPP;
2255 if (optlen != sizeof(int))
2256 return -EINVAL;
2257 if (copy_from_user(&sp->autoclose, optval, optlen))
2258 return -EFAULT;
2259
2260 if (sp->autoclose > net->sctp.max_autoclose)
2261 sp->autoclose = net->sctp.max_autoclose;
2262
2263 return 0;
2264 }
2265
2266 /* 7.1.13 Peer Address Parameters (SCTP_PEER_ADDR_PARAMS)
2267 *
2268 * Applications can enable or disable heartbeats for any peer address of
2269 * an association, modify an address's heartbeat interval, force a
2270 * heartbeat to be sent immediately, and adjust the address's maximum
2271 * number of retransmissions sent before an address is considered
2272 * unreachable. The following structure is used to access and modify an
2273 * address's parameters:
2274 *
2275 * struct sctp_paddrparams {
2276 * sctp_assoc_t spp_assoc_id;
2277 * struct sockaddr_storage spp_address;
2278 * uint32_t spp_hbinterval;
2279 * uint16_t spp_pathmaxrxt;
2280 * uint32_t spp_pathmtu;
2281 * uint32_t spp_sackdelay;
2282 * uint32_t spp_flags;
2283 * };
2284 *
2285 * spp_assoc_id - (one-to-many style socket) This is filled in the
2286 * application, and identifies the association for
2287 * this query.
2288 * spp_address - This specifies which address is of interest.
2289 * spp_hbinterval - This contains the value of the heartbeat interval,
2290 * in milliseconds. If a value of zero
2291 * is present in this field then no changes are to
2292 * be made to this parameter.
2293 * spp_pathmaxrxt - This contains the maximum number of
2294 * retransmissions before this address shall be
2295 * considered unreachable. If a value of zero
2296 * is present in this field then no changes are to
2297 * be made to this parameter.
2298 * spp_pathmtu - When Path MTU discovery is disabled the value
2299 * specified here will be the "fixed" path mtu.
2300 * Note that if the spp_address field is empty
2301 * then all associations on this address will
2302 * have this fixed path mtu set upon them.
2303 *
2304 * spp_sackdelay - When delayed sack is enabled, this value specifies
2305 * the number of milliseconds that sacks will be delayed
2306 * for. This value will apply to all addresses of an
2307 * association if the spp_address field is empty. Note
2308 * also, that if delayed sack is enabled and this
2309 * value is set to 0, no change is made to the last
2310 * recorded delayed sack timer value.
2311 *
2312 * spp_flags - These flags are used to control various features
2313 * on an association. The flag field may contain
2314 * zero or more of the following options.
2315 *
2316 * SPP_HB_ENABLE - Enable heartbeats on the
2317 * specified address. Note that if the address
2318 * field is empty all addresses for the association
2319 * have heartbeats enabled upon them.
2320 *
2321 * SPP_HB_DISABLE - Disable heartbeats on the
2322 * speicifed address. Note that if the address
2323 * field is empty all addresses for the association
2324 * will have their heartbeats disabled. Note also
2325 * that SPP_HB_ENABLE and SPP_HB_DISABLE are
2326 * mutually exclusive, only one of these two should
2327 * be specified. Enabling both fields will have
2328 * undetermined results.
2329 *
2330 * SPP_HB_DEMAND - Request a user initiated heartbeat
2331 * to be made immediately.
2332 *
2333 * SPP_HB_TIME_IS_ZERO - Specify's that the time for
2334 * heartbeat delayis to be set to the value of 0
2335 * milliseconds.
2336 *
2337 * SPP_PMTUD_ENABLE - This field will enable PMTU
2338 * discovery upon the specified address. Note that
2339 * if the address feild is empty then all addresses
2340 * on the association are effected.
2341 *
2342 * SPP_PMTUD_DISABLE - This field will disable PMTU
2343 * discovery upon the specified address. Note that
2344 * if the address feild is empty then all addresses
2345 * on the association are effected. Not also that
2346 * SPP_PMTUD_ENABLE and SPP_PMTUD_DISABLE are mutually
2347 * exclusive. Enabling both will have undetermined
2348 * results.
2349 *
2350 * SPP_SACKDELAY_ENABLE - Setting this flag turns
2351 * on delayed sack. The time specified in spp_sackdelay
2352 * is used to specify the sack delay for this address. Note
2353 * that if spp_address is empty then all addresses will
2354 * enable delayed sack and take on the sack delay
2355 * value specified in spp_sackdelay.
2356 * SPP_SACKDELAY_DISABLE - Setting this flag turns
2357 * off delayed sack. If the spp_address field is blank then
2358 * delayed sack is disabled for the entire association. Note
2359 * also that this field is mutually exclusive to
2360 * SPP_SACKDELAY_ENABLE, setting both will have undefined
2361 * results.
2362 */
sctp_apply_peer_addr_params(struct sctp_paddrparams * params,struct sctp_transport * trans,struct sctp_association * asoc,struct sctp_sock * sp,int hb_change,int pmtud_change,int sackdelay_change)2363 static int sctp_apply_peer_addr_params(struct sctp_paddrparams *params,
2364 struct sctp_transport *trans,
2365 struct sctp_association *asoc,
2366 struct sctp_sock *sp,
2367 int hb_change,
2368 int pmtud_change,
2369 int sackdelay_change)
2370 {
2371 int error;
2372
2373 if (params->spp_flags & SPP_HB_DEMAND && trans) {
2374 struct net *net = sock_net(trans->asoc->base.sk);
2375
2376 error = sctp_primitive_REQUESTHEARTBEAT(net, trans->asoc, trans);
2377 if (error)
2378 return error;
2379 }
2380
2381 /* Note that unless the spp_flag is set to SPP_HB_ENABLE the value of
2382 * this field is ignored. Note also that a value of zero indicates
2383 * the current setting should be left unchanged.
2384 */
2385 if (params->spp_flags & SPP_HB_ENABLE) {
2386
2387 /* Re-zero the interval if the SPP_HB_TIME_IS_ZERO is
2388 * set. This lets us use 0 value when this flag
2389 * is set.
2390 */
2391 if (params->spp_flags & SPP_HB_TIME_IS_ZERO)
2392 params->spp_hbinterval = 0;
2393
2394 if (params->spp_hbinterval ||
2395 (params->spp_flags & SPP_HB_TIME_IS_ZERO)) {
2396 if (trans) {
2397 trans->hbinterval =
2398 msecs_to_jiffies(params->spp_hbinterval);
2399 } else if (asoc) {
2400 asoc->hbinterval =
2401 msecs_to_jiffies(params->spp_hbinterval);
2402 } else {
2403 sp->hbinterval = params->spp_hbinterval;
2404 }
2405 }
2406 }
2407
2408 if (hb_change) {
2409 if (trans) {
2410 trans->param_flags =
2411 (trans->param_flags & ~SPP_HB) | hb_change;
2412 } else if (asoc) {
2413 asoc->param_flags =
2414 (asoc->param_flags & ~SPP_HB) | hb_change;
2415 } else {
2416 sp->param_flags =
2417 (sp->param_flags & ~SPP_HB) | hb_change;
2418 }
2419 }
2420
2421 /* When Path MTU discovery is disabled the value specified here will
2422 * be the "fixed" path mtu (i.e. the value of the spp_flags field must
2423 * include the flag SPP_PMTUD_DISABLE for this field to have any
2424 * effect).
2425 */
2426 if ((params->spp_flags & SPP_PMTUD_DISABLE) && params->spp_pathmtu) {
2427 if (trans) {
2428 trans->pathmtu = params->spp_pathmtu;
2429 sctp_assoc_sync_pmtu(sctp_opt2sk(sp), asoc);
2430 } else if (asoc) {
2431 asoc->pathmtu = params->spp_pathmtu;
2432 sctp_frag_point(asoc, params->spp_pathmtu);
2433 } else {
2434 sp->pathmtu = params->spp_pathmtu;
2435 }
2436 }
2437
2438 if (pmtud_change) {
2439 if (trans) {
2440 int update = (trans->param_flags & SPP_PMTUD_DISABLE) &&
2441 (params->spp_flags & SPP_PMTUD_ENABLE);
2442 trans->param_flags =
2443 (trans->param_flags & ~SPP_PMTUD) | pmtud_change;
2444 if (update) {
2445 sctp_transport_pmtu(trans, sctp_opt2sk(sp));
2446 sctp_assoc_sync_pmtu(sctp_opt2sk(sp), asoc);
2447 }
2448 } else if (asoc) {
2449 asoc->param_flags =
2450 (asoc->param_flags & ~SPP_PMTUD) | pmtud_change;
2451 } else {
2452 sp->param_flags =
2453 (sp->param_flags & ~SPP_PMTUD) | pmtud_change;
2454 }
2455 }
2456
2457 /* Note that unless the spp_flag is set to SPP_SACKDELAY_ENABLE the
2458 * value of this field is ignored. Note also that a value of zero
2459 * indicates the current setting should be left unchanged.
2460 */
2461 if ((params->spp_flags & SPP_SACKDELAY_ENABLE) && params->spp_sackdelay) {
2462 if (trans) {
2463 trans->sackdelay =
2464 msecs_to_jiffies(params->spp_sackdelay);
2465 } else if (asoc) {
2466 asoc->sackdelay =
2467 msecs_to_jiffies(params->spp_sackdelay);
2468 } else {
2469 sp->sackdelay = params->spp_sackdelay;
2470 }
2471 }
2472
2473 if (sackdelay_change) {
2474 if (trans) {
2475 trans->param_flags =
2476 (trans->param_flags & ~SPP_SACKDELAY) |
2477 sackdelay_change;
2478 } else if (asoc) {
2479 asoc->param_flags =
2480 (asoc->param_flags & ~SPP_SACKDELAY) |
2481 sackdelay_change;
2482 } else {
2483 sp->param_flags =
2484 (sp->param_flags & ~SPP_SACKDELAY) |
2485 sackdelay_change;
2486 }
2487 }
2488
2489 /* Note that a value of zero indicates the current setting should be
2490 left unchanged.
2491 */
2492 if (params->spp_pathmaxrxt) {
2493 if (trans) {
2494 trans->pathmaxrxt = params->spp_pathmaxrxt;
2495 } else if (asoc) {
2496 asoc->pathmaxrxt = params->spp_pathmaxrxt;
2497 } else {
2498 sp->pathmaxrxt = params->spp_pathmaxrxt;
2499 }
2500 }
2501
2502 return 0;
2503 }
2504
sctp_setsockopt_peer_addr_params(struct sock * sk,char __user * optval,unsigned int optlen)2505 static int sctp_setsockopt_peer_addr_params(struct sock *sk,
2506 char __user *optval,
2507 unsigned int optlen)
2508 {
2509 struct sctp_paddrparams params;
2510 struct sctp_transport *trans = NULL;
2511 struct sctp_association *asoc = NULL;
2512 struct sctp_sock *sp = sctp_sk(sk);
2513 int error;
2514 int hb_change, pmtud_change, sackdelay_change;
2515
2516 if (optlen != sizeof(struct sctp_paddrparams))
2517 return -EINVAL;
2518
2519 if (copy_from_user(¶ms, optval, optlen))
2520 return -EFAULT;
2521
2522 /* Validate flags and value parameters. */
2523 hb_change = params.spp_flags & SPP_HB;
2524 pmtud_change = params.spp_flags & SPP_PMTUD;
2525 sackdelay_change = params.spp_flags & SPP_SACKDELAY;
2526
2527 if (hb_change == SPP_HB ||
2528 pmtud_change == SPP_PMTUD ||
2529 sackdelay_change == SPP_SACKDELAY ||
2530 params.spp_sackdelay > 500 ||
2531 (params.spp_pathmtu &&
2532 params.spp_pathmtu < SCTP_DEFAULT_MINSEGMENT))
2533 return -EINVAL;
2534
2535 /* If an address other than INADDR_ANY is specified, and
2536 * no transport is found, then the request is invalid.
2537 */
2538 if (!sctp_is_any(sk, (union sctp_addr *)¶ms.spp_address)) {
2539 trans = sctp_addr_id2transport(sk, ¶ms.spp_address,
2540 params.spp_assoc_id);
2541 if (!trans)
2542 return -EINVAL;
2543 }
2544
2545 /* Get association, if assoc_id != 0 and the socket is a one
2546 * to many style socket, and an association was not found, then
2547 * the id was invalid.
2548 */
2549 asoc = sctp_id2assoc(sk, params.spp_assoc_id);
2550 if (!asoc && params.spp_assoc_id && sctp_style(sk, UDP))
2551 return -EINVAL;
2552
2553 /* Heartbeat demand can only be sent on a transport or
2554 * association, but not a socket.
2555 */
2556 if (params.spp_flags & SPP_HB_DEMAND && !trans && !asoc)
2557 return -EINVAL;
2558
2559 /* Process parameters. */
2560 error = sctp_apply_peer_addr_params(¶ms, trans, asoc, sp,
2561 hb_change, pmtud_change,
2562 sackdelay_change);
2563
2564 if (error)
2565 return error;
2566
2567 /* If changes are for association, also apply parameters to each
2568 * transport.
2569 */
2570 if (!trans && asoc) {
2571 list_for_each_entry(trans, &asoc->peer.transport_addr_list,
2572 transports) {
2573 sctp_apply_peer_addr_params(¶ms, trans, asoc, sp,
2574 hb_change, pmtud_change,
2575 sackdelay_change);
2576 }
2577 }
2578
2579 return 0;
2580 }
2581
sctp_spp_sackdelay_enable(__u32 param_flags)2582 static inline __u32 sctp_spp_sackdelay_enable(__u32 param_flags)
2583 {
2584 return (param_flags & ~SPP_SACKDELAY) | SPP_SACKDELAY_ENABLE;
2585 }
2586
sctp_spp_sackdelay_disable(__u32 param_flags)2587 static inline __u32 sctp_spp_sackdelay_disable(__u32 param_flags)
2588 {
2589 return (param_flags & ~SPP_SACKDELAY) | SPP_SACKDELAY_DISABLE;
2590 }
2591
2592 /*
2593 * 7.1.23. Get or set delayed ack timer (SCTP_DELAYED_SACK)
2594 *
2595 * This option will effect the way delayed acks are performed. This
2596 * option allows you to get or set the delayed ack time, in
2597 * milliseconds. It also allows changing the delayed ack frequency.
2598 * Changing the frequency to 1 disables the delayed sack algorithm. If
2599 * the assoc_id is 0, then this sets or gets the endpoints default
2600 * values. If the assoc_id field is non-zero, then the set or get
2601 * effects the specified association for the one to many model (the
2602 * assoc_id field is ignored by the one to one model). Note that if
2603 * sack_delay or sack_freq are 0 when setting this option, then the
2604 * current values will remain unchanged.
2605 *
2606 * struct sctp_sack_info {
2607 * sctp_assoc_t sack_assoc_id;
2608 * uint32_t sack_delay;
2609 * uint32_t sack_freq;
2610 * };
2611 *
2612 * sack_assoc_id - This parameter, indicates which association the user
2613 * is performing an action upon. Note that if this field's value is
2614 * zero then the endpoints default value is changed (effecting future
2615 * associations only).
2616 *
2617 * sack_delay - This parameter contains the number of milliseconds that
2618 * the user is requesting the delayed ACK timer be set to. Note that
2619 * this value is defined in the standard to be between 200 and 500
2620 * milliseconds.
2621 *
2622 * sack_freq - This parameter contains the number of packets that must
2623 * be received before a sack is sent without waiting for the delay
2624 * timer to expire. The default value for this is 2, setting this
2625 * value to 1 will disable the delayed sack algorithm.
2626 */
2627
sctp_setsockopt_delayed_ack(struct sock * sk,char __user * optval,unsigned int optlen)2628 static int sctp_setsockopt_delayed_ack(struct sock *sk,
2629 char __user *optval, unsigned int optlen)
2630 {
2631 struct sctp_sack_info params;
2632 struct sctp_transport *trans = NULL;
2633 struct sctp_association *asoc = NULL;
2634 struct sctp_sock *sp = sctp_sk(sk);
2635
2636 if (optlen == sizeof(struct sctp_sack_info)) {
2637 if (copy_from_user(¶ms, optval, optlen))
2638 return -EFAULT;
2639
2640 if (params.sack_delay == 0 && params.sack_freq == 0)
2641 return 0;
2642 } else if (optlen == sizeof(struct sctp_assoc_value)) {
2643 pr_warn_ratelimited(DEPRECATED
2644 "%s (pid %d) "
2645 "Use of struct sctp_assoc_value in delayed_ack socket option.\n"
2646 "Use struct sctp_sack_info instead\n",
2647 current->comm, task_pid_nr(current));
2648 if (copy_from_user(¶ms, optval, optlen))
2649 return -EFAULT;
2650
2651 if (params.sack_delay == 0)
2652 params.sack_freq = 1;
2653 else
2654 params.sack_freq = 0;
2655 } else
2656 return -EINVAL;
2657
2658 /* Validate value parameter. */
2659 if (params.sack_delay > 500)
2660 return -EINVAL;
2661
2662 /* Get association, if sack_assoc_id != 0 and the socket is a one
2663 * to many style socket, and an association was not found, then
2664 * the id was invalid.
2665 */
2666 asoc = sctp_id2assoc(sk, params.sack_assoc_id);
2667 if (!asoc && params.sack_assoc_id && sctp_style(sk, UDP))
2668 return -EINVAL;
2669
2670 if (params.sack_delay) {
2671 if (asoc) {
2672 asoc->sackdelay =
2673 msecs_to_jiffies(params.sack_delay);
2674 asoc->param_flags =
2675 sctp_spp_sackdelay_enable(asoc->param_flags);
2676 } else {
2677 sp->sackdelay = params.sack_delay;
2678 sp->param_flags =
2679 sctp_spp_sackdelay_enable(sp->param_flags);
2680 }
2681 }
2682
2683 if (params.sack_freq == 1) {
2684 if (asoc) {
2685 asoc->param_flags =
2686 sctp_spp_sackdelay_disable(asoc->param_flags);
2687 } else {
2688 sp->param_flags =
2689 sctp_spp_sackdelay_disable(sp->param_flags);
2690 }
2691 } else if (params.sack_freq > 1) {
2692 if (asoc) {
2693 asoc->sackfreq = params.sack_freq;
2694 asoc->param_flags =
2695 sctp_spp_sackdelay_enable(asoc->param_flags);
2696 } else {
2697 sp->sackfreq = params.sack_freq;
2698 sp->param_flags =
2699 sctp_spp_sackdelay_enable(sp->param_flags);
2700 }
2701 }
2702
2703 /* If change is for association, also apply to each transport. */
2704 if (asoc) {
2705 list_for_each_entry(trans, &asoc->peer.transport_addr_list,
2706 transports) {
2707 if (params.sack_delay) {
2708 trans->sackdelay =
2709 msecs_to_jiffies(params.sack_delay);
2710 trans->param_flags =
2711 sctp_spp_sackdelay_enable(trans->param_flags);
2712 }
2713 if (params.sack_freq == 1) {
2714 trans->param_flags =
2715 sctp_spp_sackdelay_disable(trans->param_flags);
2716 } else if (params.sack_freq > 1) {
2717 trans->sackfreq = params.sack_freq;
2718 trans->param_flags =
2719 sctp_spp_sackdelay_enable(trans->param_flags);
2720 }
2721 }
2722 }
2723
2724 return 0;
2725 }
2726
2727 /* 7.1.3 Initialization Parameters (SCTP_INITMSG)
2728 *
2729 * Applications can specify protocol parameters for the default association
2730 * initialization. The option name argument to setsockopt() and getsockopt()
2731 * is SCTP_INITMSG.
2732 *
2733 * Setting initialization parameters is effective only on an unconnected
2734 * socket (for UDP-style sockets only future associations are effected
2735 * by the change). With TCP-style sockets, this option is inherited by
2736 * sockets derived from a listener socket.
2737 */
sctp_setsockopt_initmsg(struct sock * sk,char __user * optval,unsigned int optlen)2738 static int sctp_setsockopt_initmsg(struct sock *sk, char __user *optval, unsigned int optlen)
2739 {
2740 struct sctp_initmsg sinit;
2741 struct sctp_sock *sp = sctp_sk(sk);
2742
2743 if (optlen != sizeof(struct sctp_initmsg))
2744 return -EINVAL;
2745 if (copy_from_user(&sinit, optval, optlen))
2746 return -EFAULT;
2747
2748 if (sinit.sinit_num_ostreams)
2749 sp->initmsg.sinit_num_ostreams = sinit.sinit_num_ostreams;
2750 if (sinit.sinit_max_instreams)
2751 sp->initmsg.sinit_max_instreams = sinit.sinit_max_instreams;
2752 if (sinit.sinit_max_attempts)
2753 sp->initmsg.sinit_max_attempts = sinit.sinit_max_attempts;
2754 if (sinit.sinit_max_init_timeo)
2755 sp->initmsg.sinit_max_init_timeo = sinit.sinit_max_init_timeo;
2756
2757 return 0;
2758 }
2759
2760 /*
2761 * 7.1.14 Set default send parameters (SCTP_DEFAULT_SEND_PARAM)
2762 *
2763 * Applications that wish to use the sendto() system call may wish to
2764 * specify a default set of parameters that would normally be supplied
2765 * through the inclusion of ancillary data. This socket option allows
2766 * such an application to set the default sctp_sndrcvinfo structure.
2767 * The application that wishes to use this socket option simply passes
2768 * in to this call the sctp_sndrcvinfo structure defined in Section
2769 * 5.2.2) The input parameters accepted by this call include
2770 * sinfo_stream, sinfo_flags, sinfo_ppid, sinfo_context,
2771 * sinfo_timetolive. The user must provide the sinfo_assoc_id field in
2772 * to this call if the caller is using the UDP model.
2773 */
sctp_setsockopt_default_send_param(struct sock * sk,char __user * optval,unsigned int optlen)2774 static int sctp_setsockopt_default_send_param(struct sock *sk,
2775 char __user *optval,
2776 unsigned int optlen)
2777 {
2778 struct sctp_sock *sp = sctp_sk(sk);
2779 struct sctp_association *asoc;
2780 struct sctp_sndrcvinfo info;
2781
2782 if (optlen != sizeof(info))
2783 return -EINVAL;
2784 if (copy_from_user(&info, optval, optlen))
2785 return -EFAULT;
2786 if (info.sinfo_flags &
2787 ~(SCTP_UNORDERED | SCTP_ADDR_OVER |
2788 SCTP_ABORT | SCTP_EOF))
2789 return -EINVAL;
2790
2791 asoc = sctp_id2assoc(sk, info.sinfo_assoc_id);
2792 if (!asoc && info.sinfo_assoc_id && sctp_style(sk, UDP))
2793 return -EINVAL;
2794 if (asoc) {
2795 asoc->default_stream = info.sinfo_stream;
2796 asoc->default_flags = info.sinfo_flags;
2797 asoc->default_ppid = info.sinfo_ppid;
2798 asoc->default_context = info.sinfo_context;
2799 asoc->default_timetolive = info.sinfo_timetolive;
2800 } else {
2801 sp->default_stream = info.sinfo_stream;
2802 sp->default_flags = info.sinfo_flags;
2803 sp->default_ppid = info.sinfo_ppid;
2804 sp->default_context = info.sinfo_context;
2805 sp->default_timetolive = info.sinfo_timetolive;
2806 }
2807
2808 return 0;
2809 }
2810
2811 /* RFC6458, Section 8.1.31. Set/get Default Send Parameters
2812 * (SCTP_DEFAULT_SNDINFO)
2813 */
sctp_setsockopt_default_sndinfo(struct sock * sk,char __user * optval,unsigned int optlen)2814 static int sctp_setsockopt_default_sndinfo(struct sock *sk,
2815 char __user *optval,
2816 unsigned int optlen)
2817 {
2818 struct sctp_sock *sp = sctp_sk(sk);
2819 struct sctp_association *asoc;
2820 struct sctp_sndinfo info;
2821
2822 if (optlen != sizeof(info))
2823 return -EINVAL;
2824 if (copy_from_user(&info, optval, optlen))
2825 return -EFAULT;
2826 if (info.snd_flags &
2827 ~(SCTP_UNORDERED | SCTP_ADDR_OVER |
2828 SCTP_ABORT | SCTP_EOF))
2829 return -EINVAL;
2830
2831 asoc = sctp_id2assoc(sk, info.snd_assoc_id);
2832 if (!asoc && info.snd_assoc_id && sctp_style(sk, UDP))
2833 return -EINVAL;
2834 if (asoc) {
2835 asoc->default_stream = info.snd_sid;
2836 asoc->default_flags = info.snd_flags;
2837 asoc->default_ppid = info.snd_ppid;
2838 asoc->default_context = info.snd_context;
2839 } else {
2840 sp->default_stream = info.snd_sid;
2841 sp->default_flags = info.snd_flags;
2842 sp->default_ppid = info.snd_ppid;
2843 sp->default_context = info.snd_context;
2844 }
2845
2846 return 0;
2847 }
2848
2849 /* 7.1.10 Set Primary Address (SCTP_PRIMARY_ADDR)
2850 *
2851 * Requests that the local SCTP stack use the enclosed peer address as
2852 * the association primary. The enclosed address must be one of the
2853 * association peer's addresses.
2854 */
sctp_setsockopt_primary_addr(struct sock * sk,char __user * optval,unsigned int optlen)2855 static int sctp_setsockopt_primary_addr(struct sock *sk, char __user *optval,
2856 unsigned int optlen)
2857 {
2858 struct sctp_prim prim;
2859 struct sctp_transport *trans;
2860
2861 if (optlen != sizeof(struct sctp_prim))
2862 return -EINVAL;
2863
2864 if (copy_from_user(&prim, optval, sizeof(struct sctp_prim)))
2865 return -EFAULT;
2866
2867 trans = sctp_addr_id2transport(sk, &prim.ssp_addr, prim.ssp_assoc_id);
2868 if (!trans)
2869 return -EINVAL;
2870
2871 sctp_assoc_set_primary(trans->asoc, trans);
2872
2873 return 0;
2874 }
2875
2876 /*
2877 * 7.1.5 SCTP_NODELAY
2878 *
2879 * Turn on/off any Nagle-like algorithm. This means that packets are
2880 * generally sent as soon as possible and no unnecessary delays are
2881 * introduced, at the cost of more packets in the network. Expects an
2882 * integer boolean flag.
2883 */
sctp_setsockopt_nodelay(struct sock * sk,char __user * optval,unsigned int optlen)2884 static int sctp_setsockopt_nodelay(struct sock *sk, char __user *optval,
2885 unsigned int optlen)
2886 {
2887 int val;
2888
2889 if (optlen < sizeof(int))
2890 return -EINVAL;
2891 if (get_user(val, (int __user *)optval))
2892 return -EFAULT;
2893
2894 sctp_sk(sk)->nodelay = (val == 0) ? 0 : 1;
2895 return 0;
2896 }
2897
2898 /*
2899 *
2900 * 7.1.1 SCTP_RTOINFO
2901 *
2902 * The protocol parameters used to initialize and bound retransmission
2903 * timeout (RTO) are tunable. sctp_rtoinfo structure is used to access
2904 * and modify these parameters.
2905 * All parameters are time values, in milliseconds. A value of 0, when
2906 * modifying the parameters, indicates that the current value should not
2907 * be changed.
2908 *
2909 */
sctp_setsockopt_rtoinfo(struct sock * sk,char __user * optval,unsigned int optlen)2910 static int sctp_setsockopt_rtoinfo(struct sock *sk, char __user *optval, unsigned int optlen)
2911 {
2912 struct sctp_rtoinfo rtoinfo;
2913 struct sctp_association *asoc;
2914 unsigned long rto_min, rto_max;
2915 struct sctp_sock *sp = sctp_sk(sk);
2916
2917 if (optlen != sizeof (struct sctp_rtoinfo))
2918 return -EINVAL;
2919
2920 if (copy_from_user(&rtoinfo, optval, optlen))
2921 return -EFAULT;
2922
2923 asoc = sctp_id2assoc(sk, rtoinfo.srto_assoc_id);
2924
2925 /* Set the values to the specific association */
2926 if (!asoc && rtoinfo.srto_assoc_id && sctp_style(sk, UDP))
2927 return -EINVAL;
2928
2929 rto_max = rtoinfo.srto_max;
2930 rto_min = rtoinfo.srto_min;
2931
2932 if (rto_max)
2933 rto_max = asoc ? msecs_to_jiffies(rto_max) : rto_max;
2934 else
2935 rto_max = asoc ? asoc->rto_max : sp->rtoinfo.srto_max;
2936
2937 if (rto_min)
2938 rto_min = asoc ? msecs_to_jiffies(rto_min) : rto_min;
2939 else
2940 rto_min = asoc ? asoc->rto_min : sp->rtoinfo.srto_min;
2941
2942 if (rto_min > rto_max)
2943 return -EINVAL;
2944
2945 if (asoc) {
2946 if (rtoinfo.srto_initial != 0)
2947 asoc->rto_initial =
2948 msecs_to_jiffies(rtoinfo.srto_initial);
2949 asoc->rto_max = rto_max;
2950 asoc->rto_min = rto_min;
2951 } else {
2952 /* If there is no association or the association-id = 0
2953 * set the values to the endpoint.
2954 */
2955 if (rtoinfo.srto_initial != 0)
2956 sp->rtoinfo.srto_initial = rtoinfo.srto_initial;
2957 sp->rtoinfo.srto_max = rto_max;
2958 sp->rtoinfo.srto_min = rto_min;
2959 }
2960
2961 return 0;
2962 }
2963
2964 /*
2965 *
2966 * 7.1.2 SCTP_ASSOCINFO
2967 *
2968 * This option is used to tune the maximum retransmission attempts
2969 * of the association.
2970 * Returns an error if the new association retransmission value is
2971 * greater than the sum of the retransmission value of the peer.
2972 * See [SCTP] for more information.
2973 *
2974 */
sctp_setsockopt_associnfo(struct sock * sk,char __user * optval,unsigned int optlen)2975 static int sctp_setsockopt_associnfo(struct sock *sk, char __user *optval, unsigned int optlen)
2976 {
2977
2978 struct sctp_assocparams assocparams;
2979 struct sctp_association *asoc;
2980
2981 if (optlen != sizeof(struct sctp_assocparams))
2982 return -EINVAL;
2983 if (copy_from_user(&assocparams, optval, optlen))
2984 return -EFAULT;
2985
2986 asoc = sctp_id2assoc(sk, assocparams.sasoc_assoc_id);
2987
2988 if (!asoc && assocparams.sasoc_assoc_id && sctp_style(sk, UDP))
2989 return -EINVAL;
2990
2991 /* Set the values to the specific association */
2992 if (asoc) {
2993 if (assocparams.sasoc_asocmaxrxt != 0) {
2994 __u32 path_sum = 0;
2995 int paths = 0;
2996 struct sctp_transport *peer_addr;
2997
2998 list_for_each_entry(peer_addr, &asoc->peer.transport_addr_list,
2999 transports) {
3000 path_sum += peer_addr->pathmaxrxt;
3001 paths++;
3002 }
3003
3004 /* Only validate asocmaxrxt if we have more than
3005 * one path/transport. We do this because path
3006 * retransmissions are only counted when we have more
3007 * then one path.
3008 */
3009 if (paths > 1 &&
3010 assocparams.sasoc_asocmaxrxt > path_sum)
3011 return -EINVAL;
3012
3013 asoc->max_retrans = assocparams.sasoc_asocmaxrxt;
3014 }
3015
3016 if (assocparams.sasoc_cookie_life != 0)
3017 asoc->cookie_life = ms_to_ktime(assocparams.sasoc_cookie_life);
3018 } else {
3019 /* Set the values to the endpoint */
3020 struct sctp_sock *sp = sctp_sk(sk);
3021
3022 if (assocparams.sasoc_asocmaxrxt != 0)
3023 sp->assocparams.sasoc_asocmaxrxt =
3024 assocparams.sasoc_asocmaxrxt;
3025 if (assocparams.sasoc_cookie_life != 0)
3026 sp->assocparams.sasoc_cookie_life =
3027 assocparams.sasoc_cookie_life;
3028 }
3029 return 0;
3030 }
3031
3032 /*
3033 * 7.1.16 Set/clear IPv4 mapped addresses (SCTP_I_WANT_MAPPED_V4_ADDR)
3034 *
3035 * This socket option is a boolean flag which turns on or off mapped V4
3036 * addresses. If this option is turned on and the socket is type
3037 * PF_INET6, then IPv4 addresses will be mapped to V6 representation.
3038 * If this option is turned off, then no mapping will be done of V4
3039 * addresses and a user will receive both PF_INET6 and PF_INET type
3040 * addresses on the socket.
3041 */
sctp_setsockopt_mappedv4(struct sock * sk,char __user * optval,unsigned int optlen)3042 static int sctp_setsockopt_mappedv4(struct sock *sk, char __user *optval, unsigned int optlen)
3043 {
3044 int val;
3045 struct sctp_sock *sp = sctp_sk(sk);
3046
3047 if (optlen < sizeof(int))
3048 return -EINVAL;
3049 if (get_user(val, (int __user *)optval))
3050 return -EFAULT;
3051 if (val)
3052 sp->v4mapped = 1;
3053 else
3054 sp->v4mapped = 0;
3055
3056 return 0;
3057 }
3058
3059 /*
3060 * 8.1.16. Get or Set the Maximum Fragmentation Size (SCTP_MAXSEG)
3061 * This option will get or set the maximum size to put in any outgoing
3062 * SCTP DATA chunk. If a message is larger than this size it will be
3063 * fragmented by SCTP into the specified size. Note that the underlying
3064 * SCTP implementation may fragment into smaller sized chunks when the
3065 * PMTU of the underlying association is smaller than the value set by
3066 * the user. The default value for this option is '0' which indicates
3067 * the user is NOT limiting fragmentation and only the PMTU will effect
3068 * SCTP's choice of DATA chunk size. Note also that values set larger
3069 * than the maximum size of an IP datagram will effectively let SCTP
3070 * control fragmentation (i.e. the same as setting this option to 0).
3071 *
3072 * The following structure is used to access and modify this parameter:
3073 *
3074 * struct sctp_assoc_value {
3075 * sctp_assoc_t assoc_id;
3076 * uint32_t assoc_value;
3077 * };
3078 *
3079 * assoc_id: This parameter is ignored for one-to-one style sockets.
3080 * For one-to-many style sockets this parameter indicates which
3081 * association the user is performing an action upon. Note that if
3082 * this field's value is zero then the endpoints default value is
3083 * changed (effecting future associations only).
3084 * assoc_value: This parameter specifies the maximum size in bytes.
3085 */
sctp_setsockopt_maxseg(struct sock * sk,char __user * optval,unsigned int optlen)3086 static int sctp_setsockopt_maxseg(struct sock *sk, char __user *optval, unsigned int optlen)
3087 {
3088 struct sctp_assoc_value params;
3089 struct sctp_association *asoc;
3090 struct sctp_sock *sp = sctp_sk(sk);
3091 int val;
3092
3093 if (optlen == sizeof(int)) {
3094 pr_warn_ratelimited(DEPRECATED
3095 "%s (pid %d) "
3096 "Use of int in maxseg socket option.\n"
3097 "Use struct sctp_assoc_value instead\n",
3098 current->comm, task_pid_nr(current));
3099 if (copy_from_user(&val, optval, optlen))
3100 return -EFAULT;
3101 params.assoc_id = 0;
3102 } else if (optlen == sizeof(struct sctp_assoc_value)) {
3103 if (copy_from_user(¶ms, optval, optlen))
3104 return -EFAULT;
3105 val = params.assoc_value;
3106 } else
3107 return -EINVAL;
3108
3109 if ((val != 0) && ((val < 8) || (val > SCTP_MAX_CHUNK_LEN)))
3110 return -EINVAL;
3111
3112 asoc = sctp_id2assoc(sk, params.assoc_id);
3113 if (!asoc && params.assoc_id && sctp_style(sk, UDP))
3114 return -EINVAL;
3115
3116 if (asoc) {
3117 if (val == 0) {
3118 val = asoc->pathmtu;
3119 val -= sp->pf->af->net_header_len;
3120 val -= sizeof(struct sctphdr) +
3121 sizeof(struct sctp_data_chunk);
3122 }
3123 asoc->user_frag = val;
3124 asoc->frag_point = sctp_frag_point(asoc, asoc->pathmtu);
3125 } else {
3126 sp->user_frag = val;
3127 }
3128
3129 return 0;
3130 }
3131
3132
3133 /*
3134 * 7.1.9 Set Peer Primary Address (SCTP_SET_PEER_PRIMARY_ADDR)
3135 *
3136 * Requests that the peer mark the enclosed address as the association
3137 * primary. The enclosed address must be one of the association's
3138 * locally bound addresses. The following structure is used to make a
3139 * set primary request:
3140 */
sctp_setsockopt_peer_primary_addr(struct sock * sk,char __user * optval,unsigned int optlen)3141 static int sctp_setsockopt_peer_primary_addr(struct sock *sk, char __user *optval,
3142 unsigned int optlen)
3143 {
3144 struct net *net = sock_net(sk);
3145 struct sctp_sock *sp;
3146 struct sctp_association *asoc = NULL;
3147 struct sctp_setpeerprim prim;
3148 struct sctp_chunk *chunk;
3149 struct sctp_af *af;
3150 int err;
3151
3152 sp = sctp_sk(sk);
3153
3154 if (!net->sctp.addip_enable)
3155 return -EPERM;
3156
3157 if (optlen != sizeof(struct sctp_setpeerprim))
3158 return -EINVAL;
3159
3160 if (copy_from_user(&prim, optval, optlen))
3161 return -EFAULT;
3162
3163 asoc = sctp_id2assoc(sk, prim.sspp_assoc_id);
3164 if (!asoc)
3165 return -EINVAL;
3166
3167 if (!asoc->peer.asconf_capable)
3168 return -EPERM;
3169
3170 if (asoc->peer.addip_disabled_mask & SCTP_PARAM_SET_PRIMARY)
3171 return -EPERM;
3172
3173 if (!sctp_state(asoc, ESTABLISHED))
3174 return -ENOTCONN;
3175
3176 af = sctp_get_af_specific(prim.sspp_addr.ss_family);
3177 if (!af)
3178 return -EINVAL;
3179
3180 if (!af->addr_valid((union sctp_addr *)&prim.sspp_addr, sp, NULL))
3181 return -EADDRNOTAVAIL;
3182
3183 if (!sctp_assoc_lookup_laddr(asoc, (union sctp_addr *)&prim.sspp_addr))
3184 return -EADDRNOTAVAIL;
3185
3186 /* Create an ASCONF chunk with SET_PRIMARY parameter */
3187 chunk = sctp_make_asconf_set_prim(asoc,
3188 (union sctp_addr *)&prim.sspp_addr);
3189 if (!chunk)
3190 return -ENOMEM;
3191
3192 err = sctp_send_asconf(asoc, chunk);
3193
3194 pr_debug("%s: we set peer primary addr primitively\n", __func__);
3195
3196 return err;
3197 }
3198
sctp_setsockopt_adaptation_layer(struct sock * sk,char __user * optval,unsigned int optlen)3199 static int sctp_setsockopt_adaptation_layer(struct sock *sk, char __user *optval,
3200 unsigned int optlen)
3201 {
3202 struct sctp_setadaptation adaptation;
3203
3204 if (optlen != sizeof(struct sctp_setadaptation))
3205 return -EINVAL;
3206 if (copy_from_user(&adaptation, optval, optlen))
3207 return -EFAULT;
3208
3209 sctp_sk(sk)->adaptation_ind = adaptation.ssb_adaptation_ind;
3210
3211 return 0;
3212 }
3213
3214 /*
3215 * 7.1.29. Set or Get the default context (SCTP_CONTEXT)
3216 *
3217 * The context field in the sctp_sndrcvinfo structure is normally only
3218 * used when a failed message is retrieved holding the value that was
3219 * sent down on the actual send call. This option allows the setting of
3220 * a default context on an association basis that will be received on
3221 * reading messages from the peer. This is especially helpful in the
3222 * one-2-many model for an application to keep some reference to an
3223 * internal state machine that is processing messages on the
3224 * association. Note that the setting of this value only effects
3225 * received messages from the peer and does not effect the value that is
3226 * saved with outbound messages.
3227 */
sctp_setsockopt_context(struct sock * sk,char __user * optval,unsigned int optlen)3228 static int sctp_setsockopt_context(struct sock *sk, char __user *optval,
3229 unsigned int optlen)
3230 {
3231 struct sctp_assoc_value params;
3232 struct sctp_sock *sp;
3233 struct sctp_association *asoc;
3234
3235 if (optlen != sizeof(struct sctp_assoc_value))
3236 return -EINVAL;
3237 if (copy_from_user(¶ms, optval, optlen))
3238 return -EFAULT;
3239
3240 sp = sctp_sk(sk);
3241
3242 if (params.assoc_id != 0) {
3243 asoc = sctp_id2assoc(sk, params.assoc_id);
3244 if (!asoc)
3245 return -EINVAL;
3246 asoc->default_rcv_context = params.assoc_value;
3247 } else {
3248 sp->default_rcv_context = params.assoc_value;
3249 }
3250
3251 return 0;
3252 }
3253
3254 /*
3255 * 7.1.24. Get or set fragmented interleave (SCTP_FRAGMENT_INTERLEAVE)
3256 *
3257 * This options will at a minimum specify if the implementation is doing
3258 * fragmented interleave. Fragmented interleave, for a one to many
3259 * socket, is when subsequent calls to receive a message may return
3260 * parts of messages from different associations. Some implementations
3261 * may allow you to turn this value on or off. If so, when turned off,
3262 * no fragment interleave will occur (which will cause a head of line
3263 * blocking amongst multiple associations sharing the same one to many
3264 * socket). When this option is turned on, then each receive call may
3265 * come from a different association (thus the user must receive data
3266 * with the extended calls (e.g. sctp_recvmsg) to keep track of which
3267 * association each receive belongs to.
3268 *
3269 * This option takes a boolean value. A non-zero value indicates that
3270 * fragmented interleave is on. A value of zero indicates that
3271 * fragmented interleave is off.
3272 *
3273 * Note that it is important that an implementation that allows this
3274 * option to be turned on, have it off by default. Otherwise an unaware
3275 * application using the one to many model may become confused and act
3276 * incorrectly.
3277 */
sctp_setsockopt_fragment_interleave(struct sock * sk,char __user * optval,unsigned int optlen)3278 static int sctp_setsockopt_fragment_interleave(struct sock *sk,
3279 char __user *optval,
3280 unsigned int optlen)
3281 {
3282 int val;
3283
3284 if (optlen != sizeof(int))
3285 return -EINVAL;
3286 if (get_user(val, (int __user *)optval))
3287 return -EFAULT;
3288
3289 sctp_sk(sk)->frag_interleave = (val == 0) ? 0 : 1;
3290
3291 return 0;
3292 }
3293
3294 /*
3295 * 8.1.21. Set or Get the SCTP Partial Delivery Point
3296 * (SCTP_PARTIAL_DELIVERY_POINT)
3297 *
3298 * This option will set or get the SCTP partial delivery point. This
3299 * point is the size of a message where the partial delivery API will be
3300 * invoked to help free up rwnd space for the peer. Setting this to a
3301 * lower value will cause partial deliveries to happen more often. The
3302 * calls argument is an integer that sets or gets the partial delivery
3303 * point. Note also that the call will fail if the user attempts to set
3304 * this value larger than the socket receive buffer size.
3305 *
3306 * Note that any single message having a length smaller than or equal to
3307 * the SCTP partial delivery point will be delivered in one single read
3308 * call as long as the user provided buffer is large enough to hold the
3309 * message.
3310 */
sctp_setsockopt_partial_delivery_point(struct sock * sk,char __user * optval,unsigned int optlen)3311 static int sctp_setsockopt_partial_delivery_point(struct sock *sk,
3312 char __user *optval,
3313 unsigned int optlen)
3314 {
3315 u32 val;
3316
3317 if (optlen != sizeof(u32))
3318 return -EINVAL;
3319 if (get_user(val, (int __user *)optval))
3320 return -EFAULT;
3321
3322 /* Note: We double the receive buffer from what the user sets
3323 * it to be, also initial rwnd is based on rcvbuf/2.
3324 */
3325 if (val > (sk->sk_rcvbuf >> 1))
3326 return -EINVAL;
3327
3328 sctp_sk(sk)->pd_point = val;
3329
3330 return 0; /* is this the right error code? */
3331 }
3332
3333 /*
3334 * 7.1.28. Set or Get the maximum burst (SCTP_MAX_BURST)
3335 *
3336 * This option will allow a user to change the maximum burst of packets
3337 * that can be emitted by this association. Note that the default value
3338 * is 4, and some implementations may restrict this setting so that it
3339 * can only be lowered.
3340 *
3341 * NOTE: This text doesn't seem right. Do this on a socket basis with
3342 * future associations inheriting the socket value.
3343 */
sctp_setsockopt_maxburst(struct sock * sk,char __user * optval,unsigned int optlen)3344 static int sctp_setsockopt_maxburst(struct sock *sk,
3345 char __user *optval,
3346 unsigned int optlen)
3347 {
3348 struct sctp_assoc_value params;
3349 struct sctp_sock *sp;
3350 struct sctp_association *asoc;
3351 int val;
3352 int assoc_id = 0;
3353
3354 if (optlen == sizeof(int)) {
3355 pr_warn_ratelimited(DEPRECATED
3356 "%s (pid %d) "
3357 "Use of int in max_burst socket option deprecated.\n"
3358 "Use struct sctp_assoc_value instead\n",
3359 current->comm, task_pid_nr(current));
3360 if (copy_from_user(&val, optval, optlen))
3361 return -EFAULT;
3362 } else if (optlen == sizeof(struct sctp_assoc_value)) {
3363 if (copy_from_user(¶ms, optval, optlen))
3364 return -EFAULT;
3365 val = params.assoc_value;
3366 assoc_id = params.assoc_id;
3367 } else
3368 return -EINVAL;
3369
3370 sp = sctp_sk(sk);
3371
3372 if (assoc_id != 0) {
3373 asoc = sctp_id2assoc(sk, assoc_id);
3374 if (!asoc)
3375 return -EINVAL;
3376 asoc->max_burst = val;
3377 } else
3378 sp->max_burst = val;
3379
3380 return 0;
3381 }
3382
3383 /*
3384 * 7.1.18. Add a chunk that must be authenticated (SCTP_AUTH_CHUNK)
3385 *
3386 * This set option adds a chunk type that the user is requesting to be
3387 * received only in an authenticated way. Changes to the list of chunks
3388 * will only effect future associations on the socket.
3389 */
sctp_setsockopt_auth_chunk(struct sock * sk,char __user * optval,unsigned int optlen)3390 static int sctp_setsockopt_auth_chunk(struct sock *sk,
3391 char __user *optval,
3392 unsigned int optlen)
3393 {
3394 struct sctp_endpoint *ep = sctp_sk(sk)->ep;
3395 struct sctp_authchunk val;
3396
3397 if (!ep->auth_enable)
3398 return -EACCES;
3399
3400 if (optlen != sizeof(struct sctp_authchunk))
3401 return -EINVAL;
3402 if (copy_from_user(&val, optval, optlen))
3403 return -EFAULT;
3404
3405 switch (val.sauth_chunk) {
3406 case SCTP_CID_INIT:
3407 case SCTP_CID_INIT_ACK:
3408 case SCTP_CID_SHUTDOWN_COMPLETE:
3409 case SCTP_CID_AUTH:
3410 return -EINVAL;
3411 }
3412
3413 /* add this chunk id to the endpoint */
3414 return sctp_auth_ep_add_chunkid(ep, val.sauth_chunk);
3415 }
3416
3417 /*
3418 * 7.1.19. Get or set the list of supported HMAC Identifiers (SCTP_HMAC_IDENT)
3419 *
3420 * This option gets or sets the list of HMAC algorithms that the local
3421 * endpoint requires the peer to use.
3422 */
sctp_setsockopt_hmac_ident(struct sock * sk,char __user * optval,unsigned int optlen)3423 static int sctp_setsockopt_hmac_ident(struct sock *sk,
3424 char __user *optval,
3425 unsigned int optlen)
3426 {
3427 struct sctp_endpoint *ep = sctp_sk(sk)->ep;
3428 struct sctp_hmacalgo *hmacs;
3429 u32 idents;
3430 int err;
3431
3432 if (!ep->auth_enable)
3433 return -EACCES;
3434
3435 if (optlen < sizeof(struct sctp_hmacalgo))
3436 return -EINVAL;
3437
3438 hmacs = memdup_user(optval, optlen);
3439 if (IS_ERR(hmacs))
3440 return PTR_ERR(hmacs);
3441
3442 idents = hmacs->shmac_num_idents;
3443 if (idents == 0 || idents > SCTP_AUTH_NUM_HMACS ||
3444 (idents * sizeof(u16)) > (optlen - sizeof(struct sctp_hmacalgo))) {
3445 err = -EINVAL;
3446 goto out;
3447 }
3448
3449 err = sctp_auth_ep_set_hmacs(ep, hmacs);
3450 out:
3451 kfree(hmacs);
3452 return err;
3453 }
3454
3455 /*
3456 * 7.1.20. Set a shared key (SCTP_AUTH_KEY)
3457 *
3458 * This option will set a shared secret key which is used to build an
3459 * association shared key.
3460 */
sctp_setsockopt_auth_key(struct sock * sk,char __user * optval,unsigned int optlen)3461 static int sctp_setsockopt_auth_key(struct sock *sk,
3462 char __user *optval,
3463 unsigned int optlen)
3464 {
3465 struct sctp_endpoint *ep = sctp_sk(sk)->ep;
3466 struct sctp_authkey *authkey;
3467 struct sctp_association *asoc;
3468 int ret;
3469
3470 if (!ep->auth_enable)
3471 return -EACCES;
3472
3473 if (optlen <= sizeof(struct sctp_authkey))
3474 return -EINVAL;
3475
3476 authkey = memdup_user(optval, optlen);
3477 if (IS_ERR(authkey))
3478 return PTR_ERR(authkey);
3479
3480 if (authkey->sca_keylength > optlen - sizeof(struct sctp_authkey)) {
3481 ret = -EINVAL;
3482 goto out;
3483 }
3484
3485 asoc = sctp_id2assoc(sk, authkey->sca_assoc_id);
3486 if (!asoc && authkey->sca_assoc_id && sctp_style(sk, UDP)) {
3487 ret = -EINVAL;
3488 goto out;
3489 }
3490
3491 ret = sctp_auth_set_key(ep, asoc, authkey);
3492 out:
3493 kzfree(authkey);
3494 return ret;
3495 }
3496
3497 /*
3498 * 7.1.21. Get or set the active shared key (SCTP_AUTH_ACTIVE_KEY)
3499 *
3500 * This option will get or set the active shared key to be used to build
3501 * the association shared key.
3502 */
sctp_setsockopt_active_key(struct sock * sk,char __user * optval,unsigned int optlen)3503 static int sctp_setsockopt_active_key(struct sock *sk,
3504 char __user *optval,
3505 unsigned int optlen)
3506 {
3507 struct sctp_endpoint *ep = sctp_sk(sk)->ep;
3508 struct sctp_authkeyid val;
3509 struct sctp_association *asoc;
3510
3511 if (!ep->auth_enable)
3512 return -EACCES;
3513
3514 if (optlen != sizeof(struct sctp_authkeyid))
3515 return -EINVAL;
3516 if (copy_from_user(&val, optval, optlen))
3517 return -EFAULT;
3518
3519 asoc = sctp_id2assoc(sk, val.scact_assoc_id);
3520 if (!asoc && val.scact_assoc_id && sctp_style(sk, UDP))
3521 return -EINVAL;
3522
3523 return sctp_auth_set_active_key(ep, asoc, val.scact_keynumber);
3524 }
3525
3526 /*
3527 * 7.1.22. Delete a shared key (SCTP_AUTH_DELETE_KEY)
3528 *
3529 * This set option will delete a shared secret key from use.
3530 */
sctp_setsockopt_del_key(struct sock * sk,char __user * optval,unsigned int optlen)3531 static int sctp_setsockopt_del_key(struct sock *sk,
3532 char __user *optval,
3533 unsigned int optlen)
3534 {
3535 struct sctp_endpoint *ep = sctp_sk(sk)->ep;
3536 struct sctp_authkeyid val;
3537 struct sctp_association *asoc;
3538
3539 if (!ep->auth_enable)
3540 return -EACCES;
3541
3542 if (optlen != sizeof(struct sctp_authkeyid))
3543 return -EINVAL;
3544 if (copy_from_user(&val, optval, optlen))
3545 return -EFAULT;
3546
3547 asoc = sctp_id2assoc(sk, val.scact_assoc_id);
3548 if (!asoc && val.scact_assoc_id && sctp_style(sk, UDP))
3549 return -EINVAL;
3550
3551 return sctp_auth_del_key_id(ep, asoc, val.scact_keynumber);
3552
3553 }
3554
3555 /*
3556 * 8.1.23 SCTP_AUTO_ASCONF
3557 *
3558 * This option will enable or disable the use of the automatic generation of
3559 * ASCONF chunks to add and delete addresses to an existing association. Note
3560 * that this option has two caveats namely: a) it only affects sockets that
3561 * are bound to all addresses available to the SCTP stack, and b) the system
3562 * administrator may have an overriding control that turns the ASCONF feature
3563 * off no matter what setting the socket option may have.
3564 * This option expects an integer boolean flag, where a non-zero value turns on
3565 * the option, and a zero value turns off the option.
3566 * Note. In this implementation, socket operation overrides default parameter
3567 * being set by sysctl as well as FreeBSD implementation
3568 */
sctp_setsockopt_auto_asconf(struct sock * sk,char __user * optval,unsigned int optlen)3569 static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
3570 unsigned int optlen)
3571 {
3572 int val;
3573 struct sctp_sock *sp = sctp_sk(sk);
3574
3575 if (optlen < sizeof(int))
3576 return -EINVAL;
3577 if (get_user(val, (int __user *)optval))
3578 return -EFAULT;
3579 if (!sctp_is_ep_boundall(sk) && val)
3580 return -EINVAL;
3581 if ((val && sp->do_auto_asconf) || (!val && !sp->do_auto_asconf))
3582 return 0;
3583
3584 spin_lock_bh(&sock_net(sk)->sctp.addr_wq_lock);
3585 if (val == 0 && sp->do_auto_asconf) {
3586 list_del(&sp->auto_asconf_list);
3587 sp->do_auto_asconf = 0;
3588 } else if (val && !sp->do_auto_asconf) {
3589 list_add_tail(&sp->auto_asconf_list,
3590 &sock_net(sk)->sctp.auto_asconf_splist);
3591 sp->do_auto_asconf = 1;
3592 }
3593 spin_unlock_bh(&sock_net(sk)->sctp.addr_wq_lock);
3594 return 0;
3595 }
3596
3597 /*
3598 * SCTP_PEER_ADDR_THLDS
3599 *
3600 * This option allows us to alter the partially failed threshold for one or all
3601 * transports in an association. See Section 6.1 of:
3602 * http://www.ietf.org/id/draft-nishida-tsvwg-sctp-failover-05.txt
3603 */
sctp_setsockopt_paddr_thresholds(struct sock * sk,char __user * optval,unsigned int optlen)3604 static int sctp_setsockopt_paddr_thresholds(struct sock *sk,
3605 char __user *optval,
3606 unsigned int optlen)
3607 {
3608 struct sctp_paddrthlds val;
3609 struct sctp_transport *trans;
3610 struct sctp_association *asoc;
3611
3612 if (optlen < sizeof(struct sctp_paddrthlds))
3613 return -EINVAL;
3614 if (copy_from_user(&val, (struct sctp_paddrthlds __user *)optval,
3615 sizeof(struct sctp_paddrthlds)))
3616 return -EFAULT;
3617
3618
3619 if (sctp_is_any(sk, (const union sctp_addr *)&val.spt_address)) {
3620 asoc = sctp_id2assoc(sk, val.spt_assoc_id);
3621 if (!asoc)
3622 return -ENOENT;
3623 list_for_each_entry(trans, &asoc->peer.transport_addr_list,
3624 transports) {
3625 if (val.spt_pathmaxrxt)
3626 trans->pathmaxrxt = val.spt_pathmaxrxt;
3627 trans->pf_retrans = val.spt_pathpfthld;
3628 }
3629
3630 if (val.spt_pathmaxrxt)
3631 asoc->pathmaxrxt = val.spt_pathmaxrxt;
3632 asoc->pf_retrans = val.spt_pathpfthld;
3633 } else {
3634 trans = sctp_addr_id2transport(sk, &val.spt_address,
3635 val.spt_assoc_id);
3636 if (!trans)
3637 return -ENOENT;
3638
3639 if (val.spt_pathmaxrxt)
3640 trans->pathmaxrxt = val.spt_pathmaxrxt;
3641 trans->pf_retrans = val.spt_pathpfthld;
3642 }
3643
3644 return 0;
3645 }
3646
sctp_setsockopt_recvrcvinfo(struct sock * sk,char __user * optval,unsigned int optlen)3647 static int sctp_setsockopt_recvrcvinfo(struct sock *sk,
3648 char __user *optval,
3649 unsigned int optlen)
3650 {
3651 int val;
3652
3653 if (optlen < sizeof(int))
3654 return -EINVAL;
3655 if (get_user(val, (int __user *) optval))
3656 return -EFAULT;
3657
3658 sctp_sk(sk)->recvrcvinfo = (val == 0) ? 0 : 1;
3659
3660 return 0;
3661 }
3662
sctp_setsockopt_recvnxtinfo(struct sock * sk,char __user * optval,unsigned int optlen)3663 static int sctp_setsockopt_recvnxtinfo(struct sock *sk,
3664 char __user *optval,
3665 unsigned int optlen)
3666 {
3667 int val;
3668
3669 if (optlen < sizeof(int))
3670 return -EINVAL;
3671 if (get_user(val, (int __user *) optval))
3672 return -EFAULT;
3673
3674 sctp_sk(sk)->recvnxtinfo = (val == 0) ? 0 : 1;
3675
3676 return 0;
3677 }
3678
3679 /* API 6.2 setsockopt(), getsockopt()
3680 *
3681 * Applications use setsockopt() and getsockopt() to set or retrieve
3682 * socket options. Socket options are used to change the default
3683 * behavior of sockets calls. They are described in Section 7.
3684 *
3685 * The syntax is:
3686 *
3687 * ret = getsockopt(int sd, int level, int optname, void __user *optval,
3688 * int __user *optlen);
3689 * ret = setsockopt(int sd, int level, int optname, const void __user *optval,
3690 * int optlen);
3691 *
3692 * sd - the socket descript.
3693 * level - set to IPPROTO_SCTP for all SCTP options.
3694 * optname - the option name.
3695 * optval - the buffer to store the value of the option.
3696 * optlen - the size of the buffer.
3697 */
sctp_setsockopt(struct sock * sk,int level,int optname,char __user * optval,unsigned int optlen)3698 static int sctp_setsockopt(struct sock *sk, int level, int optname,
3699 char __user *optval, unsigned int optlen)
3700 {
3701 int retval = 0;
3702
3703 pr_debug("%s: sk:%p, optname:%d\n", __func__, sk, optname);
3704
3705 /* I can hardly begin to describe how wrong this is. This is
3706 * so broken as to be worse than useless. The API draft
3707 * REALLY is NOT helpful here... I am not convinced that the
3708 * semantics of setsockopt() with a level OTHER THAN SOL_SCTP
3709 * are at all well-founded.
3710 */
3711 if (level != SOL_SCTP) {
3712 struct sctp_af *af = sctp_sk(sk)->pf->af;
3713 retval = af->setsockopt(sk, level, optname, optval, optlen);
3714 goto out_nounlock;
3715 }
3716
3717 lock_sock(sk);
3718
3719 switch (optname) {
3720 case SCTP_SOCKOPT_BINDX_ADD:
3721 /* 'optlen' is the size of the addresses buffer. */
3722 retval = sctp_setsockopt_bindx(sk, (struct sockaddr __user *)optval,
3723 optlen, SCTP_BINDX_ADD_ADDR);
3724 break;
3725
3726 case SCTP_SOCKOPT_BINDX_REM:
3727 /* 'optlen' is the size of the addresses buffer. */
3728 retval = sctp_setsockopt_bindx(sk, (struct sockaddr __user *)optval,
3729 optlen, SCTP_BINDX_REM_ADDR);
3730 break;
3731
3732 case SCTP_SOCKOPT_CONNECTX_OLD:
3733 /* 'optlen' is the size of the addresses buffer. */
3734 retval = sctp_setsockopt_connectx_old(sk,
3735 (struct sockaddr __user *)optval,
3736 optlen);
3737 break;
3738
3739 case SCTP_SOCKOPT_CONNECTX:
3740 /* 'optlen' is the size of the addresses buffer. */
3741 retval = sctp_setsockopt_connectx(sk,
3742 (struct sockaddr __user *)optval,
3743 optlen);
3744 break;
3745
3746 case SCTP_DISABLE_FRAGMENTS:
3747 retval = sctp_setsockopt_disable_fragments(sk, optval, optlen);
3748 break;
3749
3750 case SCTP_EVENTS:
3751 retval = sctp_setsockopt_events(sk, optval, optlen);
3752 break;
3753
3754 case SCTP_AUTOCLOSE:
3755 retval = sctp_setsockopt_autoclose(sk, optval, optlen);
3756 break;
3757
3758 case SCTP_PEER_ADDR_PARAMS:
3759 retval = sctp_setsockopt_peer_addr_params(sk, optval, optlen);
3760 break;
3761
3762 case SCTP_DELAYED_SACK:
3763 retval = sctp_setsockopt_delayed_ack(sk, optval, optlen);
3764 break;
3765 case SCTP_PARTIAL_DELIVERY_POINT:
3766 retval = sctp_setsockopt_partial_delivery_point(sk, optval, optlen);
3767 break;
3768
3769 case SCTP_INITMSG:
3770 retval = sctp_setsockopt_initmsg(sk, optval, optlen);
3771 break;
3772 case SCTP_DEFAULT_SEND_PARAM:
3773 retval = sctp_setsockopt_default_send_param(sk, optval,
3774 optlen);
3775 break;
3776 case SCTP_DEFAULT_SNDINFO:
3777 retval = sctp_setsockopt_default_sndinfo(sk, optval, optlen);
3778 break;
3779 case SCTP_PRIMARY_ADDR:
3780 retval = sctp_setsockopt_primary_addr(sk, optval, optlen);
3781 break;
3782 case SCTP_SET_PEER_PRIMARY_ADDR:
3783 retval = sctp_setsockopt_peer_primary_addr(sk, optval, optlen);
3784 break;
3785 case SCTP_NODELAY:
3786 retval = sctp_setsockopt_nodelay(sk, optval, optlen);
3787 break;
3788 case SCTP_RTOINFO:
3789 retval = sctp_setsockopt_rtoinfo(sk, optval, optlen);
3790 break;
3791 case SCTP_ASSOCINFO:
3792 retval = sctp_setsockopt_associnfo(sk, optval, optlen);
3793 break;
3794 case SCTP_I_WANT_MAPPED_V4_ADDR:
3795 retval = sctp_setsockopt_mappedv4(sk, optval, optlen);
3796 break;
3797 case SCTP_MAXSEG:
3798 retval = sctp_setsockopt_maxseg(sk, optval, optlen);
3799 break;
3800 case SCTP_ADAPTATION_LAYER:
3801 retval = sctp_setsockopt_adaptation_layer(sk, optval, optlen);
3802 break;
3803 case SCTP_CONTEXT:
3804 retval = sctp_setsockopt_context(sk, optval, optlen);
3805 break;
3806 case SCTP_FRAGMENT_INTERLEAVE:
3807 retval = sctp_setsockopt_fragment_interleave(sk, optval, optlen);
3808 break;
3809 case SCTP_MAX_BURST:
3810 retval = sctp_setsockopt_maxburst(sk, optval, optlen);
3811 break;
3812 case SCTP_AUTH_CHUNK:
3813 retval = sctp_setsockopt_auth_chunk(sk, optval, optlen);
3814 break;
3815 case SCTP_HMAC_IDENT:
3816 retval = sctp_setsockopt_hmac_ident(sk, optval, optlen);
3817 break;
3818 case SCTP_AUTH_KEY:
3819 retval = sctp_setsockopt_auth_key(sk, optval, optlen);
3820 break;
3821 case SCTP_AUTH_ACTIVE_KEY:
3822 retval = sctp_setsockopt_active_key(sk, optval, optlen);
3823 break;
3824 case SCTP_AUTH_DELETE_KEY:
3825 retval = sctp_setsockopt_del_key(sk, optval, optlen);
3826 break;
3827 case SCTP_AUTO_ASCONF:
3828 retval = sctp_setsockopt_auto_asconf(sk, optval, optlen);
3829 break;
3830 case SCTP_PEER_ADDR_THLDS:
3831 retval = sctp_setsockopt_paddr_thresholds(sk, optval, optlen);
3832 break;
3833 case SCTP_RECVRCVINFO:
3834 retval = sctp_setsockopt_recvrcvinfo(sk, optval, optlen);
3835 break;
3836 case SCTP_RECVNXTINFO:
3837 retval = sctp_setsockopt_recvnxtinfo(sk, optval, optlen);
3838 break;
3839 default:
3840 retval = -ENOPROTOOPT;
3841 break;
3842 }
3843
3844 release_sock(sk);
3845
3846 out_nounlock:
3847 return retval;
3848 }
3849
3850 /* API 3.1.6 connect() - UDP Style Syntax
3851 *
3852 * An application may use the connect() call in the UDP model to initiate an
3853 * association without sending data.
3854 *
3855 * The syntax is:
3856 *
3857 * ret = connect(int sd, const struct sockaddr *nam, socklen_t len);
3858 *
3859 * sd: the socket descriptor to have a new association added to.
3860 *
3861 * nam: the address structure (either struct sockaddr_in or struct
3862 * sockaddr_in6 defined in RFC2553 [7]).
3863 *
3864 * len: the size of the address.
3865 */
sctp_connect(struct sock * sk,struct sockaddr * addr,int addr_len)3866 static int sctp_connect(struct sock *sk, struct sockaddr *addr,
3867 int addr_len)
3868 {
3869 int err = 0;
3870 struct sctp_af *af;
3871
3872 lock_sock(sk);
3873
3874 pr_debug("%s: sk:%p, sockaddr:%p, addr_len:%d\n", __func__, sk,
3875 addr, addr_len);
3876
3877 /* Validate addr_len before calling common connect/connectx routine. */
3878 af = sctp_get_af_specific(addr->sa_family);
3879 if (!af || addr_len < af->sockaddr_len) {
3880 err = -EINVAL;
3881 } else {
3882 /* Pass correct addr len to common routine (so it knows there
3883 * is only one address being passed.
3884 */
3885 err = __sctp_connect(sk, addr, af->sockaddr_len, NULL);
3886 }
3887
3888 release_sock(sk);
3889 return err;
3890 }
3891
3892 /* FIXME: Write comments. */
sctp_disconnect(struct sock * sk,int flags)3893 static int sctp_disconnect(struct sock *sk, int flags)
3894 {
3895 return -EOPNOTSUPP; /* STUB */
3896 }
3897
3898 /* 4.1.4 accept() - TCP Style Syntax
3899 *
3900 * Applications use accept() call to remove an established SCTP
3901 * association from the accept queue of the endpoint. A new socket
3902 * descriptor will be returned from accept() to represent the newly
3903 * formed association.
3904 */
sctp_accept(struct sock * sk,int flags,int * err)3905 static struct sock *sctp_accept(struct sock *sk, int flags, int *err)
3906 {
3907 struct sctp_sock *sp;
3908 struct sctp_endpoint *ep;
3909 struct sock *newsk = NULL;
3910 struct sctp_association *asoc;
3911 long timeo;
3912 int error = 0;
3913
3914 lock_sock(sk);
3915
3916 sp = sctp_sk(sk);
3917 ep = sp->ep;
3918
3919 if (!sctp_style(sk, TCP)) {
3920 error = -EOPNOTSUPP;
3921 goto out;
3922 }
3923
3924 if (!sctp_sstate(sk, LISTENING)) {
3925 error = -EINVAL;
3926 goto out;
3927 }
3928
3929 timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
3930
3931 error = sctp_wait_for_accept(sk, timeo);
3932 if (error)
3933 goto out;
3934
3935 /* We treat the list of associations on the endpoint as the accept
3936 * queue and pick the first association on the list.
3937 */
3938 asoc = list_entry(ep->asocs.next, struct sctp_association, asocs);
3939
3940 newsk = sp->pf->create_accept_sk(sk, asoc);
3941 if (!newsk) {
3942 error = -ENOMEM;
3943 goto out;
3944 }
3945
3946 /* Populate the fields of the newsk from the oldsk and migrate the
3947 * asoc to the newsk.
3948 */
3949 sctp_sock_migrate(sk, newsk, asoc, SCTP_SOCKET_TCP);
3950
3951 out:
3952 release_sock(sk);
3953 *err = error;
3954 return newsk;
3955 }
3956
3957 /* The SCTP ioctl handler. */
sctp_ioctl(struct sock * sk,int cmd,unsigned long arg)3958 static int sctp_ioctl(struct sock *sk, int cmd, unsigned long arg)
3959 {
3960 int rc = -ENOTCONN;
3961
3962 lock_sock(sk);
3963
3964 /*
3965 * SEQPACKET-style sockets in LISTENING state are valid, for
3966 * SCTP, so only discard TCP-style sockets in LISTENING state.
3967 */
3968 if (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING))
3969 goto out;
3970
3971 switch (cmd) {
3972 case SIOCINQ: {
3973 struct sk_buff *skb;
3974 unsigned int amount = 0;
3975
3976 skb = skb_peek(&sk->sk_receive_queue);
3977 if (skb != NULL) {
3978 /*
3979 * We will only return the amount of this packet since
3980 * that is all that will be read.
3981 */
3982 amount = skb->len;
3983 }
3984 rc = put_user(amount, (int __user *)arg);
3985 break;
3986 }
3987 default:
3988 rc = -ENOIOCTLCMD;
3989 break;
3990 }
3991 out:
3992 release_sock(sk);
3993 return rc;
3994 }
3995
3996 /* This is the function which gets called during socket creation to
3997 * initialized the SCTP-specific portion of the sock.
3998 * The sock structure should already be zero-filled memory.
3999 */
sctp_init_sock(struct sock * sk)4000 static int sctp_init_sock(struct sock *sk)
4001 {
4002 struct net *net = sock_net(sk);
4003 struct sctp_sock *sp;
4004
4005 pr_debug("%s: sk:%p\n", __func__, sk);
4006
4007 sp = sctp_sk(sk);
4008
4009 /* Initialize the SCTP per socket area. */
4010 switch (sk->sk_type) {
4011 case SOCK_SEQPACKET:
4012 sp->type = SCTP_SOCKET_UDP;
4013 break;
4014 case SOCK_STREAM:
4015 sp->type = SCTP_SOCKET_TCP;
4016 break;
4017 default:
4018 return -ESOCKTNOSUPPORT;
4019 }
4020
4021 /* Initialize default send parameters. These parameters can be
4022 * modified with the SCTP_DEFAULT_SEND_PARAM socket option.
4023 */
4024 sp->default_stream = 0;
4025 sp->default_ppid = 0;
4026 sp->default_flags = 0;
4027 sp->default_context = 0;
4028 sp->default_timetolive = 0;
4029
4030 sp->default_rcv_context = 0;
4031 sp->max_burst = net->sctp.max_burst;
4032
4033 sp->sctp_hmac_alg = net->sctp.sctp_hmac_alg;
4034
4035 /* Initialize default setup parameters. These parameters
4036 * can be modified with the SCTP_INITMSG socket option or
4037 * overridden by the SCTP_INIT CMSG.
4038 */
4039 sp->initmsg.sinit_num_ostreams = sctp_max_outstreams;
4040 sp->initmsg.sinit_max_instreams = sctp_max_instreams;
4041 sp->initmsg.sinit_max_attempts = net->sctp.max_retrans_init;
4042 sp->initmsg.sinit_max_init_timeo = net->sctp.rto_max;
4043
4044 /* Initialize default RTO related parameters. These parameters can
4045 * be modified for with the SCTP_RTOINFO socket option.
4046 */
4047 sp->rtoinfo.srto_initial = net->sctp.rto_initial;
4048 sp->rtoinfo.srto_max = net->sctp.rto_max;
4049 sp->rtoinfo.srto_min = net->sctp.rto_min;
4050
4051 /* Initialize default association related parameters. These parameters
4052 * can be modified with the SCTP_ASSOCINFO socket option.
4053 */
4054 sp->assocparams.sasoc_asocmaxrxt = net->sctp.max_retrans_association;
4055 sp->assocparams.sasoc_number_peer_destinations = 0;
4056 sp->assocparams.sasoc_peer_rwnd = 0;
4057 sp->assocparams.sasoc_local_rwnd = 0;
4058 sp->assocparams.sasoc_cookie_life = net->sctp.valid_cookie_life;
4059
4060 /* Initialize default event subscriptions. By default, all the
4061 * options are off.
4062 */
4063 memset(&sp->subscribe, 0, sizeof(struct sctp_event_subscribe));
4064
4065 /* Default Peer Address Parameters. These defaults can
4066 * be modified via SCTP_PEER_ADDR_PARAMS
4067 */
4068 sp->hbinterval = net->sctp.hb_interval;
4069 sp->pathmaxrxt = net->sctp.max_retrans_path;
4070 sp->pathmtu = 0; /* allow default discovery */
4071 sp->sackdelay = net->sctp.sack_timeout;
4072 sp->sackfreq = 2;
4073 sp->param_flags = SPP_HB_ENABLE |
4074 SPP_PMTUD_ENABLE |
4075 SPP_SACKDELAY_ENABLE;
4076
4077 /* If enabled no SCTP message fragmentation will be performed.
4078 * Configure through SCTP_DISABLE_FRAGMENTS socket option.
4079 */
4080 sp->disable_fragments = 0;
4081
4082 /* Enable Nagle algorithm by default. */
4083 sp->nodelay = 0;
4084
4085 sp->recvrcvinfo = 0;
4086 sp->recvnxtinfo = 0;
4087
4088 /* Enable by default. */
4089 sp->v4mapped = 1;
4090
4091 /* Auto-close idle associations after the configured
4092 * number of seconds. A value of 0 disables this
4093 * feature. Configure through the SCTP_AUTOCLOSE socket option,
4094 * for UDP-style sockets only.
4095 */
4096 sp->autoclose = 0;
4097
4098 /* User specified fragmentation limit. */
4099 sp->user_frag = 0;
4100
4101 sp->adaptation_ind = 0;
4102
4103 sp->pf = sctp_get_pf_specific(sk->sk_family);
4104
4105 /* Control variables for partial data delivery. */
4106 atomic_set(&sp->pd_mode, 0);
4107 skb_queue_head_init(&sp->pd_lobby);
4108 sp->frag_interleave = 0;
4109
4110 /* Create a per socket endpoint structure. Even if we
4111 * change the data structure relationships, this may still
4112 * be useful for storing pre-connect address information.
4113 */
4114 sp->ep = sctp_endpoint_new(sk, GFP_KERNEL);
4115 if (!sp->ep)
4116 return -ENOMEM;
4117
4118 sp->hmac = NULL;
4119
4120 sk->sk_destruct = sctp_destruct_sock;
4121
4122 SCTP_DBG_OBJCNT_INC(sock);
4123
4124 local_bh_disable();
4125 percpu_counter_inc(&sctp_sockets_allocated);
4126 sock_prot_inuse_add(net, sk->sk_prot, 1);
4127
4128 /* Nothing can fail after this block, otherwise
4129 * sctp_destroy_sock() will be called without addr_wq_lock held
4130 */
4131 if (net->sctp.default_auto_asconf) {
4132 spin_lock(&sock_net(sk)->sctp.addr_wq_lock);
4133 list_add_tail(&sp->auto_asconf_list,
4134 &net->sctp.auto_asconf_splist);
4135 sp->do_auto_asconf = 1;
4136 spin_unlock(&sock_net(sk)->sctp.addr_wq_lock);
4137 } else {
4138 sp->do_auto_asconf = 0;
4139 }
4140
4141 local_bh_enable();
4142
4143 return 0;
4144 }
4145
4146 /* Cleanup any SCTP per socket resources. Must be called with
4147 * sock_net(sk)->sctp.addr_wq_lock held if sp->do_auto_asconf is true
4148 */
sctp_destroy_sock(struct sock * sk)4149 static void sctp_destroy_sock(struct sock *sk)
4150 {
4151 struct sctp_sock *sp;
4152
4153 pr_debug("%s: sk:%p\n", __func__, sk);
4154
4155 /* Release our hold on the endpoint. */
4156 sp = sctp_sk(sk);
4157 /* This could happen during socket init, thus we bail out
4158 * early, since the rest of the below is not setup either.
4159 */
4160 if (sp->ep == NULL)
4161 return;
4162
4163 if (sp->do_auto_asconf) {
4164 sp->do_auto_asconf = 0;
4165 list_del(&sp->auto_asconf_list);
4166 }
4167 sctp_endpoint_free(sp->ep);
4168 local_bh_disable();
4169 percpu_counter_dec(&sctp_sockets_allocated);
4170 sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
4171 local_bh_enable();
4172 }
4173
4174 /* Triggered when there are no references on the socket anymore */
sctp_destruct_sock(struct sock * sk)4175 static void sctp_destruct_sock(struct sock *sk)
4176 {
4177 struct sctp_sock *sp = sctp_sk(sk);
4178
4179 /* Free up the HMAC transform. */
4180 crypto_free_hash(sp->hmac);
4181
4182 inet_sock_destruct(sk);
4183 }
4184
4185 /* API 4.1.7 shutdown() - TCP Style Syntax
4186 * int shutdown(int socket, int how);
4187 *
4188 * sd - the socket descriptor of the association to be closed.
4189 * how - Specifies the type of shutdown. The values are
4190 * as follows:
4191 * SHUT_RD
4192 * Disables further receive operations. No SCTP
4193 * protocol action is taken.
4194 * SHUT_WR
4195 * Disables further send operations, and initiates
4196 * the SCTP shutdown sequence.
4197 * SHUT_RDWR
4198 * Disables further send and receive operations
4199 * and initiates the SCTP shutdown sequence.
4200 */
sctp_shutdown(struct sock * sk,int how)4201 static void sctp_shutdown(struct sock *sk, int how)
4202 {
4203 struct net *net = sock_net(sk);
4204 struct sctp_endpoint *ep;
4205 struct sctp_association *asoc;
4206
4207 if (!sctp_style(sk, TCP))
4208 return;
4209
4210 if (how & SEND_SHUTDOWN) {
4211 ep = sctp_sk(sk)->ep;
4212 if (!list_empty(&ep->asocs)) {
4213 asoc = list_entry(ep->asocs.next,
4214 struct sctp_association, asocs);
4215 sctp_primitive_SHUTDOWN(net, asoc, NULL);
4216 }
4217 }
4218 }
4219
4220 /* 7.2.1 Association Status (SCTP_STATUS)
4221
4222 * Applications can retrieve current status information about an
4223 * association, including association state, peer receiver window size,
4224 * number of unacked data chunks, and number of data chunks pending
4225 * receipt. This information is read-only.
4226 */
sctp_getsockopt_sctp_status(struct sock * sk,int len,char __user * optval,int __user * optlen)4227 static int sctp_getsockopt_sctp_status(struct sock *sk, int len,
4228 char __user *optval,
4229 int __user *optlen)
4230 {
4231 struct sctp_status status;
4232 struct sctp_association *asoc = NULL;
4233 struct sctp_transport *transport;
4234 sctp_assoc_t associd;
4235 int retval = 0;
4236
4237 if (len < sizeof(status)) {
4238 retval = -EINVAL;
4239 goto out;
4240 }
4241
4242 len = sizeof(status);
4243 if (copy_from_user(&status, optval, len)) {
4244 retval = -EFAULT;
4245 goto out;
4246 }
4247
4248 associd = status.sstat_assoc_id;
4249 asoc = sctp_id2assoc(sk, associd);
4250 if (!asoc) {
4251 retval = -EINVAL;
4252 goto out;
4253 }
4254
4255 transport = asoc->peer.primary_path;
4256
4257 status.sstat_assoc_id = sctp_assoc2id(asoc);
4258 status.sstat_state = sctp_assoc_to_state(asoc);
4259 status.sstat_rwnd = asoc->peer.rwnd;
4260 status.sstat_unackdata = asoc->unack_data;
4261
4262 status.sstat_penddata = sctp_tsnmap_pending(&asoc->peer.tsn_map);
4263 status.sstat_instrms = asoc->c.sinit_max_instreams;
4264 status.sstat_outstrms = asoc->c.sinit_num_ostreams;
4265 status.sstat_fragmentation_point = asoc->frag_point;
4266 status.sstat_primary.spinfo_assoc_id = sctp_assoc2id(transport->asoc);
4267 memcpy(&status.sstat_primary.spinfo_address, &transport->ipaddr,
4268 transport->af_specific->sockaddr_len);
4269 /* Map ipv4 address into v4-mapped-on-v6 address. */
4270 sctp_get_pf_specific(sk->sk_family)->addr_to_user(sctp_sk(sk),
4271 (union sctp_addr *)&status.sstat_primary.spinfo_address);
4272 status.sstat_primary.spinfo_state = transport->state;
4273 status.sstat_primary.spinfo_cwnd = transport->cwnd;
4274 status.sstat_primary.spinfo_srtt = transport->srtt;
4275 status.sstat_primary.spinfo_rto = jiffies_to_msecs(transport->rto);
4276 status.sstat_primary.spinfo_mtu = transport->pathmtu;
4277
4278 if (status.sstat_primary.spinfo_state == SCTP_UNKNOWN)
4279 status.sstat_primary.spinfo_state = SCTP_ACTIVE;
4280
4281 if (put_user(len, optlen)) {
4282 retval = -EFAULT;
4283 goto out;
4284 }
4285
4286 pr_debug("%s: len:%d, state:%d, rwnd:%d, assoc_id:%d\n",
4287 __func__, len, status.sstat_state, status.sstat_rwnd,
4288 status.sstat_assoc_id);
4289
4290 if (copy_to_user(optval, &status, len)) {
4291 retval = -EFAULT;
4292 goto out;
4293 }
4294
4295 out:
4296 return retval;
4297 }
4298
4299
4300 /* 7.2.2 Peer Address Information (SCTP_GET_PEER_ADDR_INFO)
4301 *
4302 * Applications can retrieve information about a specific peer address
4303 * of an association, including its reachability state, congestion
4304 * window, and retransmission timer values. This information is
4305 * read-only.
4306 */
sctp_getsockopt_peer_addr_info(struct sock * sk,int len,char __user * optval,int __user * optlen)4307 static int sctp_getsockopt_peer_addr_info(struct sock *sk, int len,
4308 char __user *optval,
4309 int __user *optlen)
4310 {
4311 struct sctp_paddrinfo pinfo;
4312 struct sctp_transport *transport;
4313 int retval = 0;
4314
4315 if (len < sizeof(pinfo)) {
4316 retval = -EINVAL;
4317 goto out;
4318 }
4319
4320 len = sizeof(pinfo);
4321 if (copy_from_user(&pinfo, optval, len)) {
4322 retval = -EFAULT;
4323 goto out;
4324 }
4325
4326 transport = sctp_addr_id2transport(sk, &pinfo.spinfo_address,
4327 pinfo.spinfo_assoc_id);
4328 if (!transport)
4329 return -EINVAL;
4330
4331 pinfo.spinfo_assoc_id = sctp_assoc2id(transport->asoc);
4332 pinfo.spinfo_state = transport->state;
4333 pinfo.spinfo_cwnd = transport->cwnd;
4334 pinfo.spinfo_srtt = transport->srtt;
4335 pinfo.spinfo_rto = jiffies_to_msecs(transport->rto);
4336 pinfo.spinfo_mtu = transport->pathmtu;
4337
4338 if (pinfo.spinfo_state == SCTP_UNKNOWN)
4339 pinfo.spinfo_state = SCTP_ACTIVE;
4340
4341 if (put_user(len, optlen)) {
4342 retval = -EFAULT;
4343 goto out;
4344 }
4345
4346 if (copy_to_user(optval, &pinfo, len)) {
4347 retval = -EFAULT;
4348 goto out;
4349 }
4350
4351 out:
4352 return retval;
4353 }
4354
4355 /* 7.1.12 Enable/Disable message fragmentation (SCTP_DISABLE_FRAGMENTS)
4356 *
4357 * This option is a on/off flag. If enabled no SCTP message
4358 * fragmentation will be performed. Instead if a message being sent
4359 * exceeds the current PMTU size, the message will NOT be sent and
4360 * instead a error will be indicated to the user.
4361 */
sctp_getsockopt_disable_fragments(struct sock * sk,int len,char __user * optval,int __user * optlen)4362 static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
4363 char __user *optval, int __user *optlen)
4364 {
4365 int val;
4366
4367 if (len < sizeof(int))
4368 return -EINVAL;
4369
4370 len = sizeof(int);
4371 val = (sctp_sk(sk)->disable_fragments == 1);
4372 if (put_user(len, optlen))
4373 return -EFAULT;
4374 if (copy_to_user(optval, &val, len))
4375 return -EFAULT;
4376 return 0;
4377 }
4378
4379 /* 7.1.15 Set notification and ancillary events (SCTP_EVENTS)
4380 *
4381 * This socket option is used to specify various notifications and
4382 * ancillary data the user wishes to receive.
4383 */
sctp_getsockopt_events(struct sock * sk,int len,char __user * optval,int __user * optlen)4384 static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
4385 int __user *optlen)
4386 {
4387 if (len <= 0)
4388 return -EINVAL;
4389 if (len > sizeof(struct sctp_event_subscribe))
4390 len = sizeof(struct sctp_event_subscribe);
4391 if (put_user(len, optlen))
4392 return -EFAULT;
4393 if (copy_to_user(optval, &sctp_sk(sk)->subscribe, len))
4394 return -EFAULT;
4395 return 0;
4396 }
4397
4398 /* 7.1.8 Automatic Close of associations (SCTP_AUTOCLOSE)
4399 *
4400 * This socket option is applicable to the UDP-style socket only. When
4401 * set it will cause associations that are idle for more than the
4402 * specified number of seconds to automatically close. An association
4403 * being idle is defined an association that has NOT sent or received
4404 * user data. The special value of '0' indicates that no automatic
4405 * close of any associations should be performed. The option expects an
4406 * integer defining the number of seconds of idle time before an
4407 * association is closed.
4408 */
sctp_getsockopt_autoclose(struct sock * sk,int len,char __user * optval,int __user * optlen)4409 static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optval, int __user *optlen)
4410 {
4411 /* Applicable to UDP-style socket only */
4412 if (sctp_style(sk, TCP))
4413 return -EOPNOTSUPP;
4414 if (len < sizeof(int))
4415 return -EINVAL;
4416 len = sizeof(int);
4417 if (put_user(len, optlen))
4418 return -EFAULT;
4419 if (copy_to_user(optval, &sctp_sk(sk)->autoclose, sizeof(int)))
4420 return -EFAULT;
4421 return 0;
4422 }
4423
4424 /* Helper routine to branch off an association to a new socket. */
sctp_do_peeloff(struct sock * sk,sctp_assoc_t id,struct socket ** sockp)4425 int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp)
4426 {
4427 struct sctp_association *asoc = sctp_id2assoc(sk, id);
4428 struct sctp_sock *sp = sctp_sk(sk);
4429 struct socket *sock;
4430 int err = 0;
4431
4432 if (!asoc)
4433 return -EINVAL;
4434
4435 /* An association cannot be branched off from an already peeled-off
4436 * socket, nor is this supported for tcp style sockets.
4437 */
4438 if (!sctp_style(sk, UDP))
4439 return -EINVAL;
4440
4441 /* Create a new socket. */
4442 err = sock_create(sk->sk_family, SOCK_SEQPACKET, IPPROTO_SCTP, &sock);
4443 if (err < 0)
4444 return err;
4445
4446 sctp_copy_sock(sock->sk, sk, asoc);
4447
4448 /* Make peeled-off sockets more like 1-1 accepted sockets.
4449 * Set the daddr and initialize id to something more random
4450 */
4451 sp->pf->to_sk_daddr(&asoc->peer.primary_addr, sk);
4452
4453 /* Populate the fields of the newsk from the oldsk and migrate the
4454 * asoc to the newsk.
4455 */
4456 sctp_sock_migrate(sk, sock->sk, asoc, SCTP_SOCKET_UDP_HIGH_BANDWIDTH);
4457
4458 *sockp = sock;
4459
4460 return err;
4461 }
4462 EXPORT_SYMBOL(sctp_do_peeloff);
4463
sctp_getsockopt_peeloff(struct sock * sk,int len,char __user * optval,int __user * optlen)4464 static int sctp_getsockopt_peeloff(struct sock *sk, int len, char __user *optval, int __user *optlen)
4465 {
4466 sctp_peeloff_arg_t peeloff;
4467 struct socket *newsock;
4468 struct file *newfile;
4469 int retval = 0;
4470
4471 if (len < sizeof(sctp_peeloff_arg_t))
4472 return -EINVAL;
4473 len = sizeof(sctp_peeloff_arg_t);
4474 if (copy_from_user(&peeloff, optval, len))
4475 return -EFAULT;
4476
4477 retval = sctp_do_peeloff(sk, peeloff.associd, &newsock);
4478 if (retval < 0)
4479 goto out;
4480
4481 /* Map the socket to an unused fd that can be returned to the user. */
4482 retval = get_unused_fd_flags(0);
4483 if (retval < 0) {
4484 sock_release(newsock);
4485 goto out;
4486 }
4487
4488 newfile = sock_alloc_file(newsock, 0, NULL);
4489 if (unlikely(IS_ERR(newfile))) {
4490 put_unused_fd(retval);
4491 sock_release(newsock);
4492 return PTR_ERR(newfile);
4493 }
4494
4495 pr_debug("%s: sk:%p, newsk:%p, sd:%d\n", __func__, sk, newsock->sk,
4496 retval);
4497
4498 /* Return the fd mapped to the new socket. */
4499 if (put_user(len, optlen)) {
4500 fput(newfile);
4501 put_unused_fd(retval);
4502 return -EFAULT;
4503 }
4504 peeloff.sd = retval;
4505 if (copy_to_user(optval, &peeloff, len)) {
4506 fput(newfile);
4507 put_unused_fd(retval);
4508 return -EFAULT;
4509 }
4510 fd_install(retval, newfile);
4511 out:
4512 return retval;
4513 }
4514
4515 /* 7.1.13 Peer Address Parameters (SCTP_PEER_ADDR_PARAMS)
4516 *
4517 * Applications can enable or disable heartbeats for any peer address of
4518 * an association, modify an address's heartbeat interval, force a
4519 * heartbeat to be sent immediately, and adjust the address's maximum
4520 * number of retransmissions sent before an address is considered
4521 * unreachable. The following structure is used to access and modify an
4522 * address's parameters:
4523 *
4524 * struct sctp_paddrparams {
4525 * sctp_assoc_t spp_assoc_id;
4526 * struct sockaddr_storage spp_address;
4527 * uint32_t spp_hbinterval;
4528 * uint16_t spp_pathmaxrxt;
4529 * uint32_t spp_pathmtu;
4530 * uint32_t spp_sackdelay;
4531 * uint32_t spp_flags;
4532 * };
4533 *
4534 * spp_assoc_id - (one-to-many style socket) This is filled in the
4535 * application, and identifies the association for
4536 * this query.
4537 * spp_address - This specifies which address is of interest.
4538 * spp_hbinterval - This contains the value of the heartbeat interval,
4539 * in milliseconds. If a value of zero
4540 * is present in this field then no changes are to
4541 * be made to this parameter.
4542 * spp_pathmaxrxt - This contains the maximum number of
4543 * retransmissions before this address shall be
4544 * considered unreachable. If a value of zero
4545 * is present in this field then no changes are to
4546 * be made to this parameter.
4547 * spp_pathmtu - When Path MTU discovery is disabled the value
4548 * specified here will be the "fixed" path mtu.
4549 * Note that if the spp_address field is empty
4550 * then all associations on this address will
4551 * have this fixed path mtu set upon them.
4552 *
4553 * spp_sackdelay - When delayed sack is enabled, this value specifies
4554 * the number of milliseconds that sacks will be delayed
4555 * for. This value will apply to all addresses of an
4556 * association if the spp_address field is empty. Note
4557 * also, that if delayed sack is enabled and this
4558 * value is set to 0, no change is made to the last
4559 * recorded delayed sack timer value.
4560 *
4561 * spp_flags - These flags are used to control various features
4562 * on an association. The flag field may contain
4563 * zero or more of the following options.
4564 *
4565 * SPP_HB_ENABLE - Enable heartbeats on the
4566 * specified address. Note that if the address
4567 * field is empty all addresses for the association
4568 * have heartbeats enabled upon them.
4569 *
4570 * SPP_HB_DISABLE - Disable heartbeats on the
4571 * speicifed address. Note that if the address
4572 * field is empty all addresses for the association
4573 * will have their heartbeats disabled. Note also
4574 * that SPP_HB_ENABLE and SPP_HB_DISABLE are
4575 * mutually exclusive, only one of these two should
4576 * be specified. Enabling both fields will have
4577 * undetermined results.
4578 *
4579 * SPP_HB_DEMAND - Request a user initiated heartbeat
4580 * to be made immediately.
4581 *
4582 * SPP_PMTUD_ENABLE - This field will enable PMTU
4583 * discovery upon the specified address. Note that
4584 * if the address feild is empty then all addresses
4585 * on the association are effected.
4586 *
4587 * SPP_PMTUD_DISABLE - This field will disable PMTU
4588 * discovery upon the specified address. Note that
4589 * if the address feild is empty then all addresses
4590 * on the association are effected. Not also that
4591 * SPP_PMTUD_ENABLE and SPP_PMTUD_DISABLE are mutually
4592 * exclusive. Enabling both will have undetermined
4593 * results.
4594 *
4595 * SPP_SACKDELAY_ENABLE - Setting this flag turns
4596 * on delayed sack. The time specified in spp_sackdelay
4597 * is used to specify the sack delay for this address. Note
4598 * that if spp_address is empty then all addresses will
4599 * enable delayed sack and take on the sack delay
4600 * value specified in spp_sackdelay.
4601 * SPP_SACKDELAY_DISABLE - Setting this flag turns
4602 * off delayed sack. If the spp_address field is blank then
4603 * delayed sack is disabled for the entire association. Note
4604 * also that this field is mutually exclusive to
4605 * SPP_SACKDELAY_ENABLE, setting both will have undefined
4606 * results.
4607 */
sctp_getsockopt_peer_addr_params(struct sock * sk,int len,char __user * optval,int __user * optlen)4608 static int sctp_getsockopt_peer_addr_params(struct sock *sk, int len,
4609 char __user *optval, int __user *optlen)
4610 {
4611 struct sctp_paddrparams params;
4612 struct sctp_transport *trans = NULL;
4613 struct sctp_association *asoc = NULL;
4614 struct sctp_sock *sp = sctp_sk(sk);
4615
4616 if (len < sizeof(struct sctp_paddrparams))
4617 return -EINVAL;
4618 len = sizeof(struct sctp_paddrparams);
4619 if (copy_from_user(¶ms, optval, len))
4620 return -EFAULT;
4621
4622 /* If an address other than INADDR_ANY is specified, and
4623 * no transport is found, then the request is invalid.
4624 */
4625 if (!sctp_is_any(sk, (union sctp_addr *)¶ms.spp_address)) {
4626 trans = sctp_addr_id2transport(sk, ¶ms.spp_address,
4627 params.spp_assoc_id);
4628 if (!trans) {
4629 pr_debug("%s: failed no transport\n", __func__);
4630 return -EINVAL;
4631 }
4632 }
4633
4634 /* Get association, if assoc_id != 0 and the socket is a one
4635 * to many style socket, and an association was not found, then
4636 * the id was invalid.
4637 */
4638 asoc = sctp_id2assoc(sk, params.spp_assoc_id);
4639 if (!asoc && params.spp_assoc_id && sctp_style(sk, UDP)) {
4640 pr_debug("%s: failed no association\n", __func__);
4641 return -EINVAL;
4642 }
4643
4644 if (trans) {
4645 /* Fetch transport values. */
4646 params.spp_hbinterval = jiffies_to_msecs(trans->hbinterval);
4647 params.spp_pathmtu = trans->pathmtu;
4648 params.spp_pathmaxrxt = trans->pathmaxrxt;
4649 params.spp_sackdelay = jiffies_to_msecs(trans->sackdelay);
4650
4651 /*draft-11 doesn't say what to return in spp_flags*/
4652 params.spp_flags = trans->param_flags;
4653 } else if (asoc) {
4654 /* Fetch association values. */
4655 params.spp_hbinterval = jiffies_to_msecs(asoc->hbinterval);
4656 params.spp_pathmtu = asoc->pathmtu;
4657 params.spp_pathmaxrxt = asoc->pathmaxrxt;
4658 params.spp_sackdelay = jiffies_to_msecs(asoc->sackdelay);
4659
4660 /*draft-11 doesn't say what to return in spp_flags*/
4661 params.spp_flags = asoc->param_flags;
4662 } else {
4663 /* Fetch socket values. */
4664 params.spp_hbinterval = sp->hbinterval;
4665 params.spp_pathmtu = sp->pathmtu;
4666 params.spp_sackdelay = sp->sackdelay;
4667 params.spp_pathmaxrxt = sp->pathmaxrxt;
4668
4669 /*draft-11 doesn't say what to return in spp_flags*/
4670 params.spp_flags = sp->param_flags;
4671 }
4672
4673 if (copy_to_user(optval, ¶ms, len))
4674 return -EFAULT;
4675
4676 if (put_user(len, optlen))
4677 return -EFAULT;
4678
4679 return 0;
4680 }
4681
4682 /*
4683 * 7.1.23. Get or set delayed ack timer (SCTP_DELAYED_SACK)
4684 *
4685 * This option will effect the way delayed acks are performed. This
4686 * option allows you to get or set the delayed ack time, in
4687 * milliseconds. It also allows changing the delayed ack frequency.
4688 * Changing the frequency to 1 disables the delayed sack algorithm. If
4689 * the assoc_id is 0, then this sets or gets the endpoints default
4690 * values. If the assoc_id field is non-zero, then the set or get
4691 * effects the specified association for the one to many model (the
4692 * assoc_id field is ignored by the one to one model). Note that if
4693 * sack_delay or sack_freq are 0 when setting this option, then the
4694 * current values will remain unchanged.
4695 *
4696 * struct sctp_sack_info {
4697 * sctp_assoc_t sack_assoc_id;
4698 * uint32_t sack_delay;
4699 * uint32_t sack_freq;
4700 * };
4701 *
4702 * sack_assoc_id - This parameter, indicates which association the user
4703 * is performing an action upon. Note that if this field's value is
4704 * zero then the endpoints default value is changed (effecting future
4705 * associations only).
4706 *
4707 * sack_delay - This parameter contains the number of milliseconds that
4708 * the user is requesting the delayed ACK timer be set to. Note that
4709 * this value is defined in the standard to be between 200 and 500
4710 * milliseconds.
4711 *
4712 * sack_freq - This parameter contains the number of packets that must
4713 * be received before a sack is sent without waiting for the delay
4714 * timer to expire. The default value for this is 2, setting this
4715 * value to 1 will disable the delayed sack algorithm.
4716 */
sctp_getsockopt_delayed_ack(struct sock * sk,int len,char __user * optval,int __user * optlen)4717 static int sctp_getsockopt_delayed_ack(struct sock *sk, int len,
4718 char __user *optval,
4719 int __user *optlen)
4720 {
4721 struct sctp_sack_info params;
4722 struct sctp_association *asoc = NULL;
4723 struct sctp_sock *sp = sctp_sk(sk);
4724
4725 if (len >= sizeof(struct sctp_sack_info)) {
4726 len = sizeof(struct sctp_sack_info);
4727
4728 if (copy_from_user(¶ms, optval, len))
4729 return -EFAULT;
4730 } else if (len == sizeof(struct sctp_assoc_value)) {
4731 pr_warn_ratelimited(DEPRECATED
4732 "%s (pid %d) "
4733 "Use of struct sctp_assoc_value in delayed_ack socket option.\n"
4734 "Use struct sctp_sack_info instead\n",
4735 current->comm, task_pid_nr(current));
4736 if (copy_from_user(¶ms, optval, len))
4737 return -EFAULT;
4738 } else
4739 return -EINVAL;
4740
4741 /* Get association, if sack_assoc_id != 0 and the socket is a one
4742 * to many style socket, and an association was not found, then
4743 * the id was invalid.
4744 */
4745 asoc = sctp_id2assoc(sk, params.sack_assoc_id);
4746 if (!asoc && params.sack_assoc_id && sctp_style(sk, UDP))
4747 return -EINVAL;
4748
4749 if (asoc) {
4750 /* Fetch association values. */
4751 if (asoc->param_flags & SPP_SACKDELAY_ENABLE) {
4752 params.sack_delay = jiffies_to_msecs(
4753 asoc->sackdelay);
4754 params.sack_freq = asoc->sackfreq;
4755
4756 } else {
4757 params.sack_delay = 0;
4758 params.sack_freq = 1;
4759 }
4760 } else {
4761 /* Fetch socket values. */
4762 if (sp->param_flags & SPP_SACKDELAY_ENABLE) {
4763 params.sack_delay = sp->sackdelay;
4764 params.sack_freq = sp->sackfreq;
4765 } else {
4766 params.sack_delay = 0;
4767 params.sack_freq = 1;
4768 }
4769 }
4770
4771 if (copy_to_user(optval, ¶ms, len))
4772 return -EFAULT;
4773
4774 if (put_user(len, optlen))
4775 return -EFAULT;
4776
4777 return 0;
4778 }
4779
4780 /* 7.1.3 Initialization Parameters (SCTP_INITMSG)
4781 *
4782 * Applications can specify protocol parameters for the default association
4783 * initialization. The option name argument to setsockopt() and getsockopt()
4784 * is SCTP_INITMSG.
4785 *
4786 * Setting initialization parameters is effective only on an unconnected
4787 * socket (for UDP-style sockets only future associations are effected
4788 * by the change). With TCP-style sockets, this option is inherited by
4789 * sockets derived from a listener socket.
4790 */
sctp_getsockopt_initmsg(struct sock * sk,int len,char __user * optval,int __user * optlen)4791 static int sctp_getsockopt_initmsg(struct sock *sk, int len, char __user *optval, int __user *optlen)
4792 {
4793 if (len < sizeof(struct sctp_initmsg))
4794 return -EINVAL;
4795 len = sizeof(struct sctp_initmsg);
4796 if (put_user(len, optlen))
4797 return -EFAULT;
4798 if (copy_to_user(optval, &sctp_sk(sk)->initmsg, len))
4799 return -EFAULT;
4800 return 0;
4801 }
4802
4803
sctp_getsockopt_peer_addrs(struct sock * sk,int len,char __user * optval,int __user * optlen)4804 static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
4805 char __user *optval, int __user *optlen)
4806 {
4807 struct sctp_association *asoc;
4808 int cnt = 0;
4809 struct sctp_getaddrs getaddrs;
4810 struct sctp_transport *from;
4811 void __user *to;
4812 union sctp_addr temp;
4813 struct sctp_sock *sp = sctp_sk(sk);
4814 int addrlen;
4815 size_t space_left;
4816 int bytes_copied;
4817
4818 if (len < sizeof(struct sctp_getaddrs))
4819 return -EINVAL;
4820
4821 if (copy_from_user(&getaddrs, optval, sizeof(struct sctp_getaddrs)))
4822 return -EFAULT;
4823
4824 /* For UDP-style sockets, id specifies the association to query. */
4825 asoc = sctp_id2assoc(sk, getaddrs.assoc_id);
4826 if (!asoc)
4827 return -EINVAL;
4828
4829 to = optval + offsetof(struct sctp_getaddrs, addrs);
4830 space_left = len - offsetof(struct sctp_getaddrs, addrs);
4831
4832 list_for_each_entry(from, &asoc->peer.transport_addr_list,
4833 transports) {
4834 memcpy(&temp, &from->ipaddr, sizeof(temp));
4835 addrlen = sctp_get_pf_specific(sk->sk_family)
4836 ->addr_to_user(sp, &temp);
4837 if (space_left < addrlen)
4838 return -ENOMEM;
4839 if (copy_to_user(to, &temp, addrlen))
4840 return -EFAULT;
4841 to += addrlen;
4842 cnt++;
4843 space_left -= addrlen;
4844 }
4845
4846 if (put_user(cnt, &((struct sctp_getaddrs __user *)optval)->addr_num))
4847 return -EFAULT;
4848 bytes_copied = ((char __user *)to) - optval;
4849 if (put_user(bytes_copied, optlen))
4850 return -EFAULT;
4851
4852 return 0;
4853 }
4854
sctp_copy_laddrs(struct sock * sk,__u16 port,void * to,size_t space_left,int * bytes_copied)4855 static int sctp_copy_laddrs(struct sock *sk, __u16 port, void *to,
4856 size_t space_left, int *bytes_copied)
4857 {
4858 struct sctp_sockaddr_entry *addr;
4859 union sctp_addr temp;
4860 int cnt = 0;
4861 int addrlen;
4862 struct net *net = sock_net(sk);
4863
4864 rcu_read_lock();
4865 list_for_each_entry_rcu(addr, &net->sctp.local_addr_list, list) {
4866 if (!addr->valid)
4867 continue;
4868
4869 if ((PF_INET == sk->sk_family) &&
4870 (AF_INET6 == addr->a.sa.sa_family))
4871 continue;
4872 if ((PF_INET6 == sk->sk_family) &&
4873 inet_v6_ipv6only(sk) &&
4874 (AF_INET == addr->a.sa.sa_family))
4875 continue;
4876 memcpy(&temp, &addr->a, sizeof(temp));
4877 if (!temp.v4.sin_port)
4878 temp.v4.sin_port = htons(port);
4879
4880 addrlen = sctp_get_pf_specific(sk->sk_family)
4881 ->addr_to_user(sctp_sk(sk), &temp);
4882
4883 if (space_left < addrlen) {
4884 cnt = -ENOMEM;
4885 break;
4886 }
4887 memcpy(to, &temp, addrlen);
4888
4889 to += addrlen;
4890 cnt++;
4891 space_left -= addrlen;
4892 *bytes_copied += addrlen;
4893 }
4894 rcu_read_unlock();
4895
4896 return cnt;
4897 }
4898
4899
sctp_getsockopt_local_addrs(struct sock * sk,int len,char __user * optval,int __user * optlen)4900 static int sctp_getsockopt_local_addrs(struct sock *sk, int len,
4901 char __user *optval, int __user *optlen)
4902 {
4903 struct sctp_bind_addr *bp;
4904 struct sctp_association *asoc;
4905 int cnt = 0;
4906 struct sctp_getaddrs getaddrs;
4907 struct sctp_sockaddr_entry *addr;
4908 void __user *to;
4909 union sctp_addr temp;
4910 struct sctp_sock *sp = sctp_sk(sk);
4911 int addrlen;
4912 int err = 0;
4913 size_t space_left;
4914 int bytes_copied = 0;
4915 void *addrs;
4916 void *buf;
4917
4918 if (len < sizeof(struct sctp_getaddrs))
4919 return -EINVAL;
4920
4921 if (copy_from_user(&getaddrs, optval, sizeof(struct sctp_getaddrs)))
4922 return -EFAULT;
4923
4924 /*
4925 * For UDP-style sockets, id specifies the association to query.
4926 * If the id field is set to the value '0' then the locally bound
4927 * addresses are returned without regard to any particular
4928 * association.
4929 */
4930 if (0 == getaddrs.assoc_id) {
4931 bp = &sctp_sk(sk)->ep->base.bind_addr;
4932 } else {
4933 asoc = sctp_id2assoc(sk, getaddrs.assoc_id);
4934 if (!asoc)
4935 return -EINVAL;
4936 bp = &asoc->base.bind_addr;
4937 }
4938
4939 to = optval + offsetof(struct sctp_getaddrs, addrs);
4940 space_left = len - offsetof(struct sctp_getaddrs, addrs);
4941
4942 addrs = kmalloc(space_left, GFP_KERNEL);
4943 if (!addrs)
4944 return -ENOMEM;
4945
4946 /* If the endpoint is bound to 0.0.0.0 or ::0, get the valid
4947 * addresses from the global local address list.
4948 */
4949 if (sctp_list_single_entry(&bp->address_list)) {
4950 addr = list_entry(bp->address_list.next,
4951 struct sctp_sockaddr_entry, list);
4952 if (sctp_is_any(sk, &addr->a)) {
4953 cnt = sctp_copy_laddrs(sk, bp->port, addrs,
4954 space_left, &bytes_copied);
4955 if (cnt < 0) {
4956 err = cnt;
4957 goto out;
4958 }
4959 goto copy_getaddrs;
4960 }
4961 }
4962
4963 buf = addrs;
4964 /* Protection on the bound address list is not needed since
4965 * in the socket option context we hold a socket lock and
4966 * thus the bound address list can't change.
4967 */
4968 list_for_each_entry(addr, &bp->address_list, list) {
4969 memcpy(&temp, &addr->a, sizeof(temp));
4970 addrlen = sctp_get_pf_specific(sk->sk_family)
4971 ->addr_to_user(sp, &temp);
4972 if (space_left < addrlen) {
4973 err = -ENOMEM; /*fixme: right error?*/
4974 goto out;
4975 }
4976 memcpy(buf, &temp, addrlen);
4977 buf += addrlen;
4978 bytes_copied += addrlen;
4979 cnt++;
4980 space_left -= addrlen;
4981 }
4982
4983 copy_getaddrs:
4984 if (copy_to_user(to, addrs, bytes_copied)) {
4985 err = -EFAULT;
4986 goto out;
4987 }
4988 if (put_user(cnt, &((struct sctp_getaddrs __user *)optval)->addr_num)) {
4989 err = -EFAULT;
4990 goto out;
4991 }
4992 if (put_user(bytes_copied, optlen))
4993 err = -EFAULT;
4994 out:
4995 kfree(addrs);
4996 return err;
4997 }
4998
4999 /* 7.1.10 Set Primary Address (SCTP_PRIMARY_ADDR)
5000 *
5001 * Requests that the local SCTP stack use the enclosed peer address as
5002 * the association primary. The enclosed address must be one of the
5003 * association peer's addresses.
5004 */
sctp_getsockopt_primary_addr(struct sock * sk,int len,char __user * optval,int __user * optlen)5005 static int sctp_getsockopt_primary_addr(struct sock *sk, int len,
5006 char __user *optval, int __user *optlen)
5007 {
5008 struct sctp_prim prim;
5009 struct sctp_association *asoc;
5010 struct sctp_sock *sp = sctp_sk(sk);
5011
5012 if (len < sizeof(struct sctp_prim))
5013 return -EINVAL;
5014
5015 len = sizeof(struct sctp_prim);
5016
5017 if (copy_from_user(&prim, optval, len))
5018 return -EFAULT;
5019
5020 asoc = sctp_id2assoc(sk, prim.ssp_assoc_id);
5021 if (!asoc)
5022 return -EINVAL;
5023
5024 if (!asoc->peer.primary_path)
5025 return -ENOTCONN;
5026
5027 memcpy(&prim.ssp_addr, &asoc->peer.primary_path->ipaddr,
5028 asoc->peer.primary_path->af_specific->sockaddr_len);
5029
5030 sctp_get_pf_specific(sk->sk_family)->addr_to_user(sp,
5031 (union sctp_addr *)&prim.ssp_addr);
5032
5033 if (put_user(len, optlen))
5034 return -EFAULT;
5035 if (copy_to_user(optval, &prim, len))
5036 return -EFAULT;
5037
5038 return 0;
5039 }
5040
5041 /*
5042 * 7.1.11 Set Adaptation Layer Indicator (SCTP_ADAPTATION_LAYER)
5043 *
5044 * Requests that the local endpoint set the specified Adaptation Layer
5045 * Indication parameter for all future INIT and INIT-ACK exchanges.
5046 */
sctp_getsockopt_adaptation_layer(struct sock * sk,int len,char __user * optval,int __user * optlen)5047 static int sctp_getsockopt_adaptation_layer(struct sock *sk, int len,
5048 char __user *optval, int __user *optlen)
5049 {
5050 struct sctp_setadaptation adaptation;
5051
5052 if (len < sizeof(struct sctp_setadaptation))
5053 return -EINVAL;
5054
5055 len = sizeof(struct sctp_setadaptation);
5056
5057 adaptation.ssb_adaptation_ind = sctp_sk(sk)->adaptation_ind;
5058
5059 if (put_user(len, optlen))
5060 return -EFAULT;
5061 if (copy_to_user(optval, &adaptation, len))
5062 return -EFAULT;
5063
5064 return 0;
5065 }
5066
5067 /*
5068 *
5069 * 7.1.14 Set default send parameters (SCTP_DEFAULT_SEND_PARAM)
5070 *
5071 * Applications that wish to use the sendto() system call may wish to
5072 * specify a default set of parameters that would normally be supplied
5073 * through the inclusion of ancillary data. This socket option allows
5074 * such an application to set the default sctp_sndrcvinfo structure.
5075
5076
5077 * The application that wishes to use this socket option simply passes
5078 * in to this call the sctp_sndrcvinfo structure defined in Section
5079 * 5.2.2) The input parameters accepted by this call include
5080 * sinfo_stream, sinfo_flags, sinfo_ppid, sinfo_context,
5081 * sinfo_timetolive. The user must provide the sinfo_assoc_id field in
5082 * to this call if the caller is using the UDP model.
5083 *
5084 * For getsockopt, it get the default sctp_sndrcvinfo structure.
5085 */
sctp_getsockopt_default_send_param(struct sock * sk,int len,char __user * optval,int __user * optlen)5086 static int sctp_getsockopt_default_send_param(struct sock *sk,
5087 int len, char __user *optval,
5088 int __user *optlen)
5089 {
5090 struct sctp_sock *sp = sctp_sk(sk);
5091 struct sctp_association *asoc;
5092 struct sctp_sndrcvinfo info;
5093
5094 if (len < sizeof(info))
5095 return -EINVAL;
5096
5097 len = sizeof(info);
5098
5099 if (copy_from_user(&info, optval, len))
5100 return -EFAULT;
5101
5102 asoc = sctp_id2assoc(sk, info.sinfo_assoc_id);
5103 if (!asoc && info.sinfo_assoc_id && sctp_style(sk, UDP))
5104 return -EINVAL;
5105 if (asoc) {
5106 info.sinfo_stream = asoc->default_stream;
5107 info.sinfo_flags = asoc->default_flags;
5108 info.sinfo_ppid = asoc->default_ppid;
5109 info.sinfo_context = asoc->default_context;
5110 info.sinfo_timetolive = asoc->default_timetolive;
5111 } else {
5112 info.sinfo_stream = sp->default_stream;
5113 info.sinfo_flags = sp->default_flags;
5114 info.sinfo_ppid = sp->default_ppid;
5115 info.sinfo_context = sp->default_context;
5116 info.sinfo_timetolive = sp->default_timetolive;
5117 }
5118
5119 if (put_user(len, optlen))
5120 return -EFAULT;
5121 if (copy_to_user(optval, &info, len))
5122 return -EFAULT;
5123
5124 return 0;
5125 }
5126
5127 /* RFC6458, Section 8.1.31. Set/get Default Send Parameters
5128 * (SCTP_DEFAULT_SNDINFO)
5129 */
sctp_getsockopt_default_sndinfo(struct sock * sk,int len,char __user * optval,int __user * optlen)5130 static int sctp_getsockopt_default_sndinfo(struct sock *sk, int len,
5131 char __user *optval,
5132 int __user *optlen)
5133 {
5134 struct sctp_sock *sp = sctp_sk(sk);
5135 struct sctp_association *asoc;
5136 struct sctp_sndinfo info;
5137
5138 if (len < sizeof(info))
5139 return -EINVAL;
5140
5141 len = sizeof(info);
5142
5143 if (copy_from_user(&info, optval, len))
5144 return -EFAULT;
5145
5146 asoc = sctp_id2assoc(sk, info.snd_assoc_id);
5147 if (!asoc && info.snd_assoc_id && sctp_style(sk, UDP))
5148 return -EINVAL;
5149 if (asoc) {
5150 info.snd_sid = asoc->default_stream;
5151 info.snd_flags = asoc->default_flags;
5152 info.snd_ppid = asoc->default_ppid;
5153 info.snd_context = asoc->default_context;
5154 } else {
5155 info.snd_sid = sp->default_stream;
5156 info.snd_flags = sp->default_flags;
5157 info.snd_ppid = sp->default_ppid;
5158 info.snd_context = sp->default_context;
5159 }
5160
5161 if (put_user(len, optlen))
5162 return -EFAULT;
5163 if (copy_to_user(optval, &info, len))
5164 return -EFAULT;
5165
5166 return 0;
5167 }
5168
5169 /*
5170 *
5171 * 7.1.5 SCTP_NODELAY
5172 *
5173 * Turn on/off any Nagle-like algorithm. This means that packets are
5174 * generally sent as soon as possible and no unnecessary delays are
5175 * introduced, at the cost of more packets in the network. Expects an
5176 * integer boolean flag.
5177 */
5178
sctp_getsockopt_nodelay(struct sock * sk,int len,char __user * optval,int __user * optlen)5179 static int sctp_getsockopt_nodelay(struct sock *sk, int len,
5180 char __user *optval, int __user *optlen)
5181 {
5182 int val;
5183
5184 if (len < sizeof(int))
5185 return -EINVAL;
5186
5187 len = sizeof(int);
5188 val = (sctp_sk(sk)->nodelay == 1);
5189 if (put_user(len, optlen))
5190 return -EFAULT;
5191 if (copy_to_user(optval, &val, len))
5192 return -EFAULT;
5193 return 0;
5194 }
5195
5196 /*
5197 *
5198 * 7.1.1 SCTP_RTOINFO
5199 *
5200 * The protocol parameters used to initialize and bound retransmission
5201 * timeout (RTO) are tunable. sctp_rtoinfo structure is used to access
5202 * and modify these parameters.
5203 * All parameters are time values, in milliseconds. A value of 0, when
5204 * modifying the parameters, indicates that the current value should not
5205 * be changed.
5206 *
5207 */
sctp_getsockopt_rtoinfo(struct sock * sk,int len,char __user * optval,int __user * optlen)5208 static int sctp_getsockopt_rtoinfo(struct sock *sk, int len,
5209 char __user *optval,
5210 int __user *optlen) {
5211 struct sctp_rtoinfo rtoinfo;
5212 struct sctp_association *asoc;
5213
5214 if (len < sizeof (struct sctp_rtoinfo))
5215 return -EINVAL;
5216
5217 len = sizeof(struct sctp_rtoinfo);
5218
5219 if (copy_from_user(&rtoinfo, optval, len))
5220 return -EFAULT;
5221
5222 asoc = sctp_id2assoc(sk, rtoinfo.srto_assoc_id);
5223
5224 if (!asoc && rtoinfo.srto_assoc_id && sctp_style(sk, UDP))
5225 return -EINVAL;
5226
5227 /* Values corresponding to the specific association. */
5228 if (asoc) {
5229 rtoinfo.srto_initial = jiffies_to_msecs(asoc->rto_initial);
5230 rtoinfo.srto_max = jiffies_to_msecs(asoc->rto_max);
5231 rtoinfo.srto_min = jiffies_to_msecs(asoc->rto_min);
5232 } else {
5233 /* Values corresponding to the endpoint. */
5234 struct sctp_sock *sp = sctp_sk(sk);
5235
5236 rtoinfo.srto_initial = sp->rtoinfo.srto_initial;
5237 rtoinfo.srto_max = sp->rtoinfo.srto_max;
5238 rtoinfo.srto_min = sp->rtoinfo.srto_min;
5239 }
5240
5241 if (put_user(len, optlen))
5242 return -EFAULT;
5243
5244 if (copy_to_user(optval, &rtoinfo, len))
5245 return -EFAULT;
5246
5247 return 0;
5248 }
5249
5250 /*
5251 *
5252 * 7.1.2 SCTP_ASSOCINFO
5253 *
5254 * This option is used to tune the maximum retransmission attempts
5255 * of the association.
5256 * Returns an error if the new association retransmission value is
5257 * greater than the sum of the retransmission value of the peer.
5258 * See [SCTP] for more information.
5259 *
5260 */
sctp_getsockopt_associnfo(struct sock * sk,int len,char __user * optval,int __user * optlen)5261 static int sctp_getsockopt_associnfo(struct sock *sk, int len,
5262 char __user *optval,
5263 int __user *optlen)
5264 {
5265
5266 struct sctp_assocparams assocparams;
5267 struct sctp_association *asoc;
5268 struct list_head *pos;
5269 int cnt = 0;
5270
5271 if (len < sizeof (struct sctp_assocparams))
5272 return -EINVAL;
5273
5274 len = sizeof(struct sctp_assocparams);
5275
5276 if (copy_from_user(&assocparams, optval, len))
5277 return -EFAULT;
5278
5279 asoc = sctp_id2assoc(sk, assocparams.sasoc_assoc_id);
5280
5281 if (!asoc && assocparams.sasoc_assoc_id && sctp_style(sk, UDP))
5282 return -EINVAL;
5283
5284 /* Values correspoinding to the specific association */
5285 if (asoc) {
5286 assocparams.sasoc_asocmaxrxt = asoc->max_retrans;
5287 assocparams.sasoc_peer_rwnd = asoc->peer.rwnd;
5288 assocparams.sasoc_local_rwnd = asoc->a_rwnd;
5289 assocparams.sasoc_cookie_life = ktime_to_ms(asoc->cookie_life);
5290
5291 list_for_each(pos, &asoc->peer.transport_addr_list) {
5292 cnt++;
5293 }
5294
5295 assocparams.sasoc_number_peer_destinations = cnt;
5296 } else {
5297 /* Values corresponding to the endpoint */
5298 struct sctp_sock *sp = sctp_sk(sk);
5299
5300 assocparams.sasoc_asocmaxrxt = sp->assocparams.sasoc_asocmaxrxt;
5301 assocparams.sasoc_peer_rwnd = sp->assocparams.sasoc_peer_rwnd;
5302 assocparams.sasoc_local_rwnd = sp->assocparams.sasoc_local_rwnd;
5303 assocparams.sasoc_cookie_life =
5304 sp->assocparams.sasoc_cookie_life;
5305 assocparams.sasoc_number_peer_destinations =
5306 sp->assocparams.
5307 sasoc_number_peer_destinations;
5308 }
5309
5310 if (put_user(len, optlen))
5311 return -EFAULT;
5312
5313 if (copy_to_user(optval, &assocparams, len))
5314 return -EFAULT;
5315
5316 return 0;
5317 }
5318
5319 /*
5320 * 7.1.16 Set/clear IPv4 mapped addresses (SCTP_I_WANT_MAPPED_V4_ADDR)
5321 *
5322 * This socket option is a boolean flag which turns on or off mapped V4
5323 * addresses. If this option is turned on and the socket is type
5324 * PF_INET6, then IPv4 addresses will be mapped to V6 representation.
5325 * If this option is turned off, then no mapping will be done of V4
5326 * addresses and a user will receive both PF_INET6 and PF_INET type
5327 * addresses on the socket.
5328 */
sctp_getsockopt_mappedv4(struct sock * sk,int len,char __user * optval,int __user * optlen)5329 static int sctp_getsockopt_mappedv4(struct sock *sk, int len,
5330 char __user *optval, int __user *optlen)
5331 {
5332 int val;
5333 struct sctp_sock *sp = sctp_sk(sk);
5334
5335 if (len < sizeof(int))
5336 return -EINVAL;
5337
5338 len = sizeof(int);
5339 val = sp->v4mapped;
5340 if (put_user(len, optlen))
5341 return -EFAULT;
5342 if (copy_to_user(optval, &val, len))
5343 return -EFAULT;
5344
5345 return 0;
5346 }
5347
5348 /*
5349 * 7.1.29. Set or Get the default context (SCTP_CONTEXT)
5350 * (chapter and verse is quoted at sctp_setsockopt_context())
5351 */
sctp_getsockopt_context(struct sock * sk,int len,char __user * optval,int __user * optlen)5352 static int sctp_getsockopt_context(struct sock *sk, int len,
5353 char __user *optval, int __user *optlen)
5354 {
5355 struct sctp_assoc_value params;
5356 struct sctp_sock *sp;
5357 struct sctp_association *asoc;
5358
5359 if (len < sizeof(struct sctp_assoc_value))
5360 return -EINVAL;
5361
5362 len = sizeof(struct sctp_assoc_value);
5363
5364 if (copy_from_user(¶ms, optval, len))
5365 return -EFAULT;
5366
5367 sp = sctp_sk(sk);
5368
5369 if (params.assoc_id != 0) {
5370 asoc = sctp_id2assoc(sk, params.assoc_id);
5371 if (!asoc)
5372 return -EINVAL;
5373 params.assoc_value = asoc->default_rcv_context;
5374 } else {
5375 params.assoc_value = sp->default_rcv_context;
5376 }
5377
5378 if (put_user(len, optlen))
5379 return -EFAULT;
5380 if (copy_to_user(optval, ¶ms, len))
5381 return -EFAULT;
5382
5383 return 0;
5384 }
5385
5386 /*
5387 * 8.1.16. Get or Set the Maximum Fragmentation Size (SCTP_MAXSEG)
5388 * This option will get or set the maximum size to put in any outgoing
5389 * SCTP DATA chunk. If a message is larger than this size it will be
5390 * fragmented by SCTP into the specified size. Note that the underlying
5391 * SCTP implementation may fragment into smaller sized chunks when the
5392 * PMTU of the underlying association is smaller than the value set by
5393 * the user. The default value for this option is '0' which indicates
5394 * the user is NOT limiting fragmentation and only the PMTU will effect
5395 * SCTP's choice of DATA chunk size. Note also that values set larger
5396 * than the maximum size of an IP datagram will effectively let SCTP
5397 * control fragmentation (i.e. the same as setting this option to 0).
5398 *
5399 * The following structure is used to access and modify this parameter:
5400 *
5401 * struct sctp_assoc_value {
5402 * sctp_assoc_t assoc_id;
5403 * uint32_t assoc_value;
5404 * };
5405 *
5406 * assoc_id: This parameter is ignored for one-to-one style sockets.
5407 * For one-to-many style sockets this parameter indicates which
5408 * association the user is performing an action upon. Note that if
5409 * this field's value is zero then the endpoints default value is
5410 * changed (effecting future associations only).
5411 * assoc_value: This parameter specifies the maximum size in bytes.
5412 */
sctp_getsockopt_maxseg(struct sock * sk,int len,char __user * optval,int __user * optlen)5413 static int sctp_getsockopt_maxseg(struct sock *sk, int len,
5414 char __user *optval, int __user *optlen)
5415 {
5416 struct sctp_assoc_value params;
5417 struct sctp_association *asoc;
5418
5419 if (len == sizeof(int)) {
5420 pr_warn_ratelimited(DEPRECATED
5421 "%s (pid %d) "
5422 "Use of int in maxseg socket option.\n"
5423 "Use struct sctp_assoc_value instead\n",
5424 current->comm, task_pid_nr(current));
5425 params.assoc_id = 0;
5426 } else if (len >= sizeof(struct sctp_assoc_value)) {
5427 len = sizeof(struct sctp_assoc_value);
5428 if (copy_from_user(¶ms, optval, sizeof(params)))
5429 return -EFAULT;
5430 } else
5431 return -EINVAL;
5432
5433 asoc = sctp_id2assoc(sk, params.assoc_id);
5434 if (!asoc && params.assoc_id && sctp_style(sk, UDP))
5435 return -EINVAL;
5436
5437 if (asoc)
5438 params.assoc_value = asoc->frag_point;
5439 else
5440 params.assoc_value = sctp_sk(sk)->user_frag;
5441
5442 if (put_user(len, optlen))
5443 return -EFAULT;
5444 if (len == sizeof(int)) {
5445 if (copy_to_user(optval, ¶ms.assoc_value, len))
5446 return -EFAULT;
5447 } else {
5448 if (copy_to_user(optval, ¶ms, len))
5449 return -EFAULT;
5450 }
5451
5452 return 0;
5453 }
5454
5455 /*
5456 * 7.1.24. Get or set fragmented interleave (SCTP_FRAGMENT_INTERLEAVE)
5457 * (chapter and verse is quoted at sctp_setsockopt_fragment_interleave())
5458 */
sctp_getsockopt_fragment_interleave(struct sock * sk,int len,char __user * optval,int __user * optlen)5459 static int sctp_getsockopt_fragment_interleave(struct sock *sk, int len,
5460 char __user *optval, int __user *optlen)
5461 {
5462 int val;
5463
5464 if (len < sizeof(int))
5465 return -EINVAL;
5466
5467 len = sizeof(int);
5468
5469 val = sctp_sk(sk)->frag_interleave;
5470 if (put_user(len, optlen))
5471 return -EFAULT;
5472 if (copy_to_user(optval, &val, len))
5473 return -EFAULT;
5474
5475 return 0;
5476 }
5477
5478 /*
5479 * 7.1.25. Set or Get the sctp partial delivery point
5480 * (chapter and verse is quoted at sctp_setsockopt_partial_delivery_point())
5481 */
sctp_getsockopt_partial_delivery_point(struct sock * sk,int len,char __user * optval,int __user * optlen)5482 static int sctp_getsockopt_partial_delivery_point(struct sock *sk, int len,
5483 char __user *optval,
5484 int __user *optlen)
5485 {
5486 u32 val;
5487
5488 if (len < sizeof(u32))
5489 return -EINVAL;
5490
5491 len = sizeof(u32);
5492
5493 val = sctp_sk(sk)->pd_point;
5494 if (put_user(len, optlen))
5495 return -EFAULT;
5496 if (copy_to_user(optval, &val, len))
5497 return -EFAULT;
5498
5499 return 0;
5500 }
5501
5502 /*
5503 * 7.1.28. Set or Get the maximum burst (SCTP_MAX_BURST)
5504 * (chapter and verse is quoted at sctp_setsockopt_maxburst())
5505 */
sctp_getsockopt_maxburst(struct sock * sk,int len,char __user * optval,int __user * optlen)5506 static int sctp_getsockopt_maxburst(struct sock *sk, int len,
5507 char __user *optval,
5508 int __user *optlen)
5509 {
5510 struct sctp_assoc_value params;
5511 struct sctp_sock *sp;
5512 struct sctp_association *asoc;
5513
5514 if (len == sizeof(int)) {
5515 pr_warn_ratelimited(DEPRECATED
5516 "%s (pid %d) "
5517 "Use of int in max_burst socket option.\n"
5518 "Use struct sctp_assoc_value instead\n",
5519 current->comm, task_pid_nr(current));
5520 params.assoc_id = 0;
5521 } else if (len >= sizeof(struct sctp_assoc_value)) {
5522 len = sizeof(struct sctp_assoc_value);
5523 if (copy_from_user(¶ms, optval, len))
5524 return -EFAULT;
5525 } else
5526 return -EINVAL;
5527
5528 sp = sctp_sk(sk);
5529
5530 if (params.assoc_id != 0) {
5531 asoc = sctp_id2assoc(sk, params.assoc_id);
5532 if (!asoc)
5533 return -EINVAL;
5534 params.assoc_value = asoc->max_burst;
5535 } else
5536 params.assoc_value = sp->max_burst;
5537
5538 if (len == sizeof(int)) {
5539 if (copy_to_user(optval, ¶ms.assoc_value, len))
5540 return -EFAULT;
5541 } else {
5542 if (copy_to_user(optval, ¶ms, len))
5543 return -EFAULT;
5544 }
5545
5546 return 0;
5547
5548 }
5549
sctp_getsockopt_hmac_ident(struct sock * sk,int len,char __user * optval,int __user * optlen)5550 static int sctp_getsockopt_hmac_ident(struct sock *sk, int len,
5551 char __user *optval, int __user *optlen)
5552 {
5553 struct sctp_endpoint *ep = sctp_sk(sk)->ep;
5554 struct sctp_hmacalgo __user *p = (void __user *)optval;
5555 struct sctp_hmac_algo_param *hmacs;
5556 __u16 data_len = 0;
5557 u32 num_idents;
5558 int i;
5559
5560 if (!ep->auth_enable)
5561 return -EACCES;
5562
5563 hmacs = ep->auth_hmacs_list;
5564 data_len = ntohs(hmacs->param_hdr.length) - sizeof(sctp_paramhdr_t);
5565
5566 if (len < sizeof(struct sctp_hmacalgo) + data_len)
5567 return -EINVAL;
5568
5569 len = sizeof(struct sctp_hmacalgo) + data_len;
5570 num_idents = data_len / sizeof(u16);
5571
5572 if (put_user(len, optlen))
5573 return -EFAULT;
5574 if (put_user(num_idents, &p->shmac_num_idents))
5575 return -EFAULT;
5576 for (i = 0; i < num_idents; i++) {
5577 __u16 hmacid = ntohs(hmacs->hmac_ids[i]);
5578
5579 if (copy_to_user(&p->shmac_idents[i], &hmacid, sizeof(__u16)))
5580 return -EFAULT;
5581 }
5582 return 0;
5583 }
5584
sctp_getsockopt_active_key(struct sock * sk,int len,char __user * optval,int __user * optlen)5585 static int sctp_getsockopt_active_key(struct sock *sk, int len,
5586 char __user *optval, int __user *optlen)
5587 {
5588 struct sctp_endpoint *ep = sctp_sk(sk)->ep;
5589 struct sctp_authkeyid val;
5590 struct sctp_association *asoc;
5591
5592 if (!ep->auth_enable)
5593 return -EACCES;
5594
5595 if (len < sizeof(struct sctp_authkeyid))
5596 return -EINVAL;
5597 if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid)))
5598 return -EFAULT;
5599
5600 asoc = sctp_id2assoc(sk, val.scact_assoc_id);
5601 if (!asoc && val.scact_assoc_id && sctp_style(sk, UDP))
5602 return -EINVAL;
5603
5604 if (asoc)
5605 val.scact_keynumber = asoc->active_key_id;
5606 else
5607 val.scact_keynumber = ep->active_key_id;
5608
5609 len = sizeof(struct sctp_authkeyid);
5610 if (put_user(len, optlen))
5611 return -EFAULT;
5612 if (copy_to_user(optval, &val, len))
5613 return -EFAULT;
5614
5615 return 0;
5616 }
5617
sctp_getsockopt_peer_auth_chunks(struct sock * sk,int len,char __user * optval,int __user * optlen)5618 static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
5619 char __user *optval, int __user *optlen)
5620 {
5621 struct sctp_endpoint *ep = sctp_sk(sk)->ep;
5622 struct sctp_authchunks __user *p = (void __user *)optval;
5623 struct sctp_authchunks val;
5624 struct sctp_association *asoc;
5625 struct sctp_chunks_param *ch;
5626 u32 num_chunks = 0;
5627 char __user *to;
5628
5629 if (!ep->auth_enable)
5630 return -EACCES;
5631
5632 if (len < sizeof(struct sctp_authchunks))
5633 return -EINVAL;
5634
5635 if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
5636 return -EFAULT;
5637
5638 to = p->gauth_chunks;
5639 asoc = sctp_id2assoc(sk, val.gauth_assoc_id);
5640 if (!asoc)
5641 return -EINVAL;
5642
5643 ch = asoc->peer.peer_chunks;
5644 if (!ch)
5645 goto num;
5646
5647 /* See if the user provided enough room for all the data */
5648 num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t);
5649 if (len < num_chunks)
5650 return -EINVAL;
5651
5652 if (copy_to_user(to, ch->chunks, num_chunks))
5653 return -EFAULT;
5654 num:
5655 len = sizeof(struct sctp_authchunks) + num_chunks;
5656 if (put_user(len, optlen))
5657 return -EFAULT;
5658 if (put_user(num_chunks, &p->gauth_number_of_chunks))
5659 return -EFAULT;
5660 return 0;
5661 }
5662
sctp_getsockopt_local_auth_chunks(struct sock * sk,int len,char __user * optval,int __user * optlen)5663 static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
5664 char __user *optval, int __user *optlen)
5665 {
5666 struct sctp_endpoint *ep = sctp_sk(sk)->ep;
5667 struct sctp_authchunks __user *p = (void __user *)optval;
5668 struct sctp_authchunks val;
5669 struct sctp_association *asoc;
5670 struct sctp_chunks_param *ch;
5671 u32 num_chunks = 0;
5672 char __user *to;
5673
5674 if (!ep->auth_enable)
5675 return -EACCES;
5676
5677 if (len < sizeof(struct sctp_authchunks))
5678 return -EINVAL;
5679
5680 if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
5681 return -EFAULT;
5682
5683 to = p->gauth_chunks;
5684 asoc = sctp_id2assoc(sk, val.gauth_assoc_id);
5685 if (!asoc && val.gauth_assoc_id && sctp_style(sk, UDP))
5686 return -EINVAL;
5687
5688 if (asoc)
5689 ch = (struct sctp_chunks_param *)asoc->c.auth_chunks;
5690 else
5691 ch = ep->auth_chunk_list;
5692
5693 if (!ch)
5694 goto num;
5695
5696 num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t);
5697 if (len < sizeof(struct sctp_authchunks) + num_chunks)
5698 return -EINVAL;
5699
5700 if (copy_to_user(to, ch->chunks, num_chunks))
5701 return -EFAULT;
5702 num:
5703 len = sizeof(struct sctp_authchunks) + num_chunks;
5704 if (put_user(len, optlen))
5705 return -EFAULT;
5706 if (put_user(num_chunks, &p->gauth_number_of_chunks))
5707 return -EFAULT;
5708
5709 return 0;
5710 }
5711
5712 /*
5713 * 8.2.5. Get the Current Number of Associations (SCTP_GET_ASSOC_NUMBER)
5714 * This option gets the current number of associations that are attached
5715 * to a one-to-many style socket. The option value is an uint32_t.
5716 */
sctp_getsockopt_assoc_number(struct sock * sk,int len,char __user * optval,int __user * optlen)5717 static int sctp_getsockopt_assoc_number(struct sock *sk, int len,
5718 char __user *optval, int __user *optlen)
5719 {
5720 struct sctp_sock *sp = sctp_sk(sk);
5721 struct sctp_association *asoc;
5722 u32 val = 0;
5723
5724 if (sctp_style(sk, TCP))
5725 return -EOPNOTSUPP;
5726
5727 if (len < sizeof(u32))
5728 return -EINVAL;
5729
5730 len = sizeof(u32);
5731
5732 list_for_each_entry(asoc, &(sp->ep->asocs), asocs) {
5733 val++;
5734 }
5735
5736 if (put_user(len, optlen))
5737 return -EFAULT;
5738 if (copy_to_user(optval, &val, len))
5739 return -EFAULT;
5740
5741 return 0;
5742 }
5743
5744 /*
5745 * 8.1.23 SCTP_AUTO_ASCONF
5746 * See the corresponding setsockopt entry as description
5747 */
sctp_getsockopt_auto_asconf(struct sock * sk,int len,char __user * optval,int __user * optlen)5748 static int sctp_getsockopt_auto_asconf(struct sock *sk, int len,
5749 char __user *optval, int __user *optlen)
5750 {
5751 int val = 0;
5752
5753 if (len < sizeof(int))
5754 return -EINVAL;
5755
5756 len = sizeof(int);
5757 if (sctp_sk(sk)->do_auto_asconf && sctp_is_ep_boundall(sk))
5758 val = 1;
5759 if (put_user(len, optlen))
5760 return -EFAULT;
5761 if (copy_to_user(optval, &val, len))
5762 return -EFAULT;
5763 return 0;
5764 }
5765
5766 /*
5767 * 8.2.6. Get the Current Identifiers of Associations
5768 * (SCTP_GET_ASSOC_ID_LIST)
5769 *
5770 * This option gets the current list of SCTP association identifiers of
5771 * the SCTP associations handled by a one-to-many style socket.
5772 */
sctp_getsockopt_assoc_ids(struct sock * sk,int len,char __user * optval,int __user * optlen)5773 static int sctp_getsockopt_assoc_ids(struct sock *sk, int len,
5774 char __user *optval, int __user *optlen)
5775 {
5776 struct sctp_sock *sp = sctp_sk(sk);
5777 struct sctp_association *asoc;
5778 struct sctp_assoc_ids *ids;
5779 u32 num = 0;
5780
5781 if (sctp_style(sk, TCP))
5782 return -EOPNOTSUPP;
5783
5784 if (len < sizeof(struct sctp_assoc_ids))
5785 return -EINVAL;
5786
5787 list_for_each_entry(asoc, &(sp->ep->asocs), asocs) {
5788 num++;
5789 }
5790
5791 if (len < sizeof(struct sctp_assoc_ids) + sizeof(sctp_assoc_t) * num)
5792 return -EINVAL;
5793
5794 len = sizeof(struct sctp_assoc_ids) + sizeof(sctp_assoc_t) * num;
5795
5796 ids = kmalloc(len, GFP_KERNEL);
5797 if (unlikely(!ids))
5798 return -ENOMEM;
5799
5800 ids->gaids_number_of_ids = num;
5801 num = 0;
5802 list_for_each_entry(asoc, &(sp->ep->asocs), asocs) {
5803 ids->gaids_assoc_id[num++] = asoc->assoc_id;
5804 }
5805
5806 if (put_user(len, optlen) || copy_to_user(optval, ids, len)) {
5807 kfree(ids);
5808 return -EFAULT;
5809 }
5810
5811 kfree(ids);
5812 return 0;
5813 }
5814
5815 /*
5816 * SCTP_PEER_ADDR_THLDS
5817 *
5818 * This option allows us to fetch the partially failed threshold for one or all
5819 * transports in an association. See Section 6.1 of:
5820 * http://www.ietf.org/id/draft-nishida-tsvwg-sctp-failover-05.txt
5821 */
sctp_getsockopt_paddr_thresholds(struct sock * sk,char __user * optval,int len,int __user * optlen)5822 static int sctp_getsockopt_paddr_thresholds(struct sock *sk,
5823 char __user *optval,
5824 int len,
5825 int __user *optlen)
5826 {
5827 struct sctp_paddrthlds val;
5828 struct sctp_transport *trans;
5829 struct sctp_association *asoc;
5830
5831 if (len < sizeof(struct sctp_paddrthlds))
5832 return -EINVAL;
5833 len = sizeof(struct sctp_paddrthlds);
5834 if (copy_from_user(&val, (struct sctp_paddrthlds __user *)optval, len))
5835 return -EFAULT;
5836
5837 if (sctp_is_any(sk, (const union sctp_addr *)&val.spt_address)) {
5838 asoc = sctp_id2assoc(sk, val.spt_assoc_id);
5839 if (!asoc)
5840 return -ENOENT;
5841
5842 val.spt_pathpfthld = asoc->pf_retrans;
5843 val.spt_pathmaxrxt = asoc->pathmaxrxt;
5844 } else {
5845 trans = sctp_addr_id2transport(sk, &val.spt_address,
5846 val.spt_assoc_id);
5847 if (!trans)
5848 return -ENOENT;
5849
5850 val.spt_pathmaxrxt = trans->pathmaxrxt;
5851 val.spt_pathpfthld = trans->pf_retrans;
5852 }
5853
5854 if (put_user(len, optlen) || copy_to_user(optval, &val, len))
5855 return -EFAULT;
5856
5857 return 0;
5858 }
5859
5860 /*
5861 * SCTP_GET_ASSOC_STATS
5862 *
5863 * This option retrieves local per endpoint statistics. It is modeled
5864 * after OpenSolaris' implementation
5865 */
sctp_getsockopt_assoc_stats(struct sock * sk,int len,char __user * optval,int __user * optlen)5866 static int sctp_getsockopt_assoc_stats(struct sock *sk, int len,
5867 char __user *optval,
5868 int __user *optlen)
5869 {
5870 struct sctp_assoc_stats sas;
5871 struct sctp_association *asoc = NULL;
5872
5873 /* User must provide at least the assoc id */
5874 if (len < sizeof(sctp_assoc_t))
5875 return -EINVAL;
5876
5877 /* Allow the struct to grow and fill in as much as possible */
5878 len = min_t(size_t, len, sizeof(sas));
5879
5880 if (copy_from_user(&sas, optval, len))
5881 return -EFAULT;
5882
5883 asoc = sctp_id2assoc(sk, sas.sas_assoc_id);
5884 if (!asoc)
5885 return -EINVAL;
5886
5887 sas.sas_rtxchunks = asoc->stats.rtxchunks;
5888 sas.sas_gapcnt = asoc->stats.gapcnt;
5889 sas.sas_outofseqtsns = asoc->stats.outofseqtsns;
5890 sas.sas_osacks = asoc->stats.osacks;
5891 sas.sas_isacks = asoc->stats.isacks;
5892 sas.sas_octrlchunks = asoc->stats.octrlchunks;
5893 sas.sas_ictrlchunks = asoc->stats.ictrlchunks;
5894 sas.sas_oodchunks = asoc->stats.oodchunks;
5895 sas.sas_iodchunks = asoc->stats.iodchunks;
5896 sas.sas_ouodchunks = asoc->stats.ouodchunks;
5897 sas.sas_iuodchunks = asoc->stats.iuodchunks;
5898 sas.sas_idupchunks = asoc->stats.idupchunks;
5899 sas.sas_opackets = asoc->stats.opackets;
5900 sas.sas_ipackets = asoc->stats.ipackets;
5901
5902 /* New high max rto observed, will return 0 if not a single
5903 * RTO update took place. obs_rto_ipaddr will be bogus
5904 * in such a case
5905 */
5906 sas.sas_maxrto = asoc->stats.max_obs_rto;
5907 memcpy(&sas.sas_obs_rto_ipaddr, &asoc->stats.obs_rto_ipaddr,
5908 sizeof(struct sockaddr_storage));
5909
5910 /* Mark beginning of a new observation period */
5911 asoc->stats.max_obs_rto = asoc->rto_min;
5912
5913 if (put_user(len, optlen))
5914 return -EFAULT;
5915
5916 pr_debug("%s: len:%d, assoc_id:%d\n", __func__, len, sas.sas_assoc_id);
5917
5918 if (copy_to_user(optval, &sas, len))
5919 return -EFAULT;
5920
5921 return 0;
5922 }
5923
sctp_getsockopt_recvrcvinfo(struct sock * sk,int len,char __user * optval,int __user * optlen)5924 static int sctp_getsockopt_recvrcvinfo(struct sock *sk, int len,
5925 char __user *optval,
5926 int __user *optlen)
5927 {
5928 int val = 0;
5929
5930 if (len < sizeof(int))
5931 return -EINVAL;
5932
5933 len = sizeof(int);
5934 if (sctp_sk(sk)->recvrcvinfo)
5935 val = 1;
5936 if (put_user(len, optlen))
5937 return -EFAULT;
5938 if (copy_to_user(optval, &val, len))
5939 return -EFAULT;
5940
5941 return 0;
5942 }
5943
sctp_getsockopt_recvnxtinfo(struct sock * sk,int len,char __user * optval,int __user * optlen)5944 static int sctp_getsockopt_recvnxtinfo(struct sock *sk, int len,
5945 char __user *optval,
5946 int __user *optlen)
5947 {
5948 int val = 0;
5949
5950 if (len < sizeof(int))
5951 return -EINVAL;
5952
5953 len = sizeof(int);
5954 if (sctp_sk(sk)->recvnxtinfo)
5955 val = 1;
5956 if (put_user(len, optlen))
5957 return -EFAULT;
5958 if (copy_to_user(optval, &val, len))
5959 return -EFAULT;
5960
5961 return 0;
5962 }
5963
sctp_getsockopt(struct sock * sk,int level,int optname,char __user * optval,int __user * optlen)5964 static int sctp_getsockopt(struct sock *sk, int level, int optname,
5965 char __user *optval, int __user *optlen)
5966 {
5967 int retval = 0;
5968 int len;
5969
5970 pr_debug("%s: sk:%p, optname:%d\n", __func__, sk, optname);
5971
5972 /* I can hardly begin to describe how wrong this is. This is
5973 * so broken as to be worse than useless. The API draft
5974 * REALLY is NOT helpful here... I am not convinced that the
5975 * semantics of getsockopt() with a level OTHER THAN SOL_SCTP
5976 * are at all well-founded.
5977 */
5978 if (level != SOL_SCTP) {
5979 struct sctp_af *af = sctp_sk(sk)->pf->af;
5980
5981 retval = af->getsockopt(sk, level, optname, optval, optlen);
5982 return retval;
5983 }
5984
5985 if (get_user(len, optlen))
5986 return -EFAULT;
5987
5988 lock_sock(sk);
5989
5990 switch (optname) {
5991 case SCTP_STATUS:
5992 retval = sctp_getsockopt_sctp_status(sk, len, optval, optlen);
5993 break;
5994 case SCTP_DISABLE_FRAGMENTS:
5995 retval = sctp_getsockopt_disable_fragments(sk, len, optval,
5996 optlen);
5997 break;
5998 case SCTP_EVENTS:
5999 retval = sctp_getsockopt_events(sk, len, optval, optlen);
6000 break;
6001 case SCTP_AUTOCLOSE:
6002 retval = sctp_getsockopt_autoclose(sk, len, optval, optlen);
6003 break;
6004 case SCTP_SOCKOPT_PEELOFF:
6005 retval = sctp_getsockopt_peeloff(sk, len, optval, optlen);
6006 break;
6007 case SCTP_PEER_ADDR_PARAMS:
6008 retval = sctp_getsockopt_peer_addr_params(sk, len, optval,
6009 optlen);
6010 break;
6011 case SCTP_DELAYED_SACK:
6012 retval = sctp_getsockopt_delayed_ack(sk, len, optval,
6013 optlen);
6014 break;
6015 case SCTP_INITMSG:
6016 retval = sctp_getsockopt_initmsg(sk, len, optval, optlen);
6017 break;
6018 case SCTP_GET_PEER_ADDRS:
6019 retval = sctp_getsockopt_peer_addrs(sk, len, optval,
6020 optlen);
6021 break;
6022 case SCTP_GET_LOCAL_ADDRS:
6023 retval = sctp_getsockopt_local_addrs(sk, len, optval,
6024 optlen);
6025 break;
6026 case SCTP_SOCKOPT_CONNECTX3:
6027 retval = sctp_getsockopt_connectx3(sk, len, optval, optlen);
6028 break;
6029 case SCTP_DEFAULT_SEND_PARAM:
6030 retval = sctp_getsockopt_default_send_param(sk, len,
6031 optval, optlen);
6032 break;
6033 case SCTP_DEFAULT_SNDINFO:
6034 retval = sctp_getsockopt_default_sndinfo(sk, len,
6035 optval, optlen);
6036 break;
6037 case SCTP_PRIMARY_ADDR:
6038 retval = sctp_getsockopt_primary_addr(sk, len, optval, optlen);
6039 break;
6040 case SCTP_NODELAY:
6041 retval = sctp_getsockopt_nodelay(sk, len, optval, optlen);
6042 break;
6043 case SCTP_RTOINFO:
6044 retval = sctp_getsockopt_rtoinfo(sk, len, optval, optlen);
6045 break;
6046 case SCTP_ASSOCINFO:
6047 retval = sctp_getsockopt_associnfo(sk, len, optval, optlen);
6048 break;
6049 case SCTP_I_WANT_MAPPED_V4_ADDR:
6050 retval = sctp_getsockopt_mappedv4(sk, len, optval, optlen);
6051 break;
6052 case SCTP_MAXSEG:
6053 retval = sctp_getsockopt_maxseg(sk, len, optval, optlen);
6054 break;
6055 case SCTP_GET_PEER_ADDR_INFO:
6056 retval = sctp_getsockopt_peer_addr_info(sk, len, optval,
6057 optlen);
6058 break;
6059 case SCTP_ADAPTATION_LAYER:
6060 retval = sctp_getsockopt_adaptation_layer(sk, len, optval,
6061 optlen);
6062 break;
6063 case SCTP_CONTEXT:
6064 retval = sctp_getsockopt_context(sk, len, optval, optlen);
6065 break;
6066 case SCTP_FRAGMENT_INTERLEAVE:
6067 retval = sctp_getsockopt_fragment_interleave(sk, len, optval,
6068 optlen);
6069 break;
6070 case SCTP_PARTIAL_DELIVERY_POINT:
6071 retval = sctp_getsockopt_partial_delivery_point(sk, len, optval,
6072 optlen);
6073 break;
6074 case SCTP_MAX_BURST:
6075 retval = sctp_getsockopt_maxburst(sk, len, optval, optlen);
6076 break;
6077 case SCTP_AUTH_KEY:
6078 case SCTP_AUTH_CHUNK:
6079 case SCTP_AUTH_DELETE_KEY:
6080 retval = -EOPNOTSUPP;
6081 break;
6082 case SCTP_HMAC_IDENT:
6083 retval = sctp_getsockopt_hmac_ident(sk, len, optval, optlen);
6084 break;
6085 case SCTP_AUTH_ACTIVE_KEY:
6086 retval = sctp_getsockopt_active_key(sk, len, optval, optlen);
6087 break;
6088 case SCTP_PEER_AUTH_CHUNKS:
6089 retval = sctp_getsockopt_peer_auth_chunks(sk, len, optval,
6090 optlen);
6091 break;
6092 case SCTP_LOCAL_AUTH_CHUNKS:
6093 retval = sctp_getsockopt_local_auth_chunks(sk, len, optval,
6094 optlen);
6095 break;
6096 case SCTP_GET_ASSOC_NUMBER:
6097 retval = sctp_getsockopt_assoc_number(sk, len, optval, optlen);
6098 break;
6099 case SCTP_GET_ASSOC_ID_LIST:
6100 retval = sctp_getsockopt_assoc_ids(sk, len, optval, optlen);
6101 break;
6102 case SCTP_AUTO_ASCONF:
6103 retval = sctp_getsockopt_auto_asconf(sk, len, optval, optlen);
6104 break;
6105 case SCTP_PEER_ADDR_THLDS:
6106 retval = sctp_getsockopt_paddr_thresholds(sk, optval, len, optlen);
6107 break;
6108 case SCTP_GET_ASSOC_STATS:
6109 retval = sctp_getsockopt_assoc_stats(sk, len, optval, optlen);
6110 break;
6111 case SCTP_RECVRCVINFO:
6112 retval = sctp_getsockopt_recvrcvinfo(sk, len, optval, optlen);
6113 break;
6114 case SCTP_RECVNXTINFO:
6115 retval = sctp_getsockopt_recvnxtinfo(sk, len, optval, optlen);
6116 break;
6117 default:
6118 retval = -ENOPROTOOPT;
6119 break;
6120 }
6121
6122 release_sock(sk);
6123 return retval;
6124 }
6125
sctp_hash(struct sock * sk)6126 static void sctp_hash(struct sock *sk)
6127 {
6128 /* STUB */
6129 }
6130
sctp_unhash(struct sock * sk)6131 static void sctp_unhash(struct sock *sk)
6132 {
6133 /* STUB */
6134 }
6135
6136 /* Check if port is acceptable. Possibly find first available port.
6137 *
6138 * The port hash table (contained in the 'global' SCTP protocol storage
6139 * returned by struct sctp_protocol *sctp_get_protocol()). The hash
6140 * table is an array of 4096 lists (sctp_bind_hashbucket). Each
6141 * list (the list number is the port number hashed out, so as you
6142 * would expect from a hash function, all the ports in a given list have
6143 * such a number that hashes out to the same list number; you were
6144 * expecting that, right?); so each list has a set of ports, with a
6145 * link to the socket (struct sock) that uses it, the port number and
6146 * a fastreuse flag (FIXME: NPI ipg).
6147 */
6148 static struct sctp_bind_bucket *sctp_bucket_create(
6149 struct sctp_bind_hashbucket *head, struct net *, unsigned short snum);
6150
sctp_get_port_local(struct sock * sk,union sctp_addr * addr)6151 static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
6152 {
6153 struct sctp_bind_hashbucket *head; /* hash list */
6154 struct sctp_bind_bucket *pp;
6155 unsigned short snum;
6156 int ret;
6157
6158 snum = ntohs(addr->v4.sin_port);
6159
6160 pr_debug("%s: begins, snum:%d\n", __func__, snum);
6161
6162 local_bh_disable();
6163
6164 if (snum == 0) {
6165 /* Search for an available port. */
6166 int low, high, remaining, index;
6167 unsigned int rover;
6168 struct net *net = sock_net(sk);
6169
6170 inet_get_local_port_range(net, &low, &high);
6171 remaining = (high - low) + 1;
6172 rover = prandom_u32() % remaining + low;
6173
6174 do {
6175 rover++;
6176 if ((rover < low) || (rover > high))
6177 rover = low;
6178 if (inet_is_local_reserved_port(net, rover))
6179 continue;
6180 index = sctp_phashfn(sock_net(sk), rover);
6181 head = &sctp_port_hashtable[index];
6182 spin_lock(&head->lock);
6183 sctp_for_each_hentry(pp, &head->chain)
6184 if ((pp->port == rover) &&
6185 net_eq(sock_net(sk), pp->net))
6186 goto next;
6187 break;
6188 next:
6189 spin_unlock(&head->lock);
6190 } while (--remaining > 0);
6191
6192 /* Exhausted local port range during search? */
6193 ret = 1;
6194 if (remaining <= 0)
6195 goto fail;
6196
6197 /* OK, here is the one we will use. HEAD (the port
6198 * hash table list entry) is non-NULL and we hold it's
6199 * mutex.
6200 */
6201 snum = rover;
6202 } else {
6203 /* We are given an specific port number; we verify
6204 * that it is not being used. If it is used, we will
6205 * exahust the search in the hash list corresponding
6206 * to the port number (snum) - we detect that with the
6207 * port iterator, pp being NULL.
6208 */
6209 head = &sctp_port_hashtable[sctp_phashfn(sock_net(sk), snum)];
6210 spin_lock(&head->lock);
6211 sctp_for_each_hentry(pp, &head->chain) {
6212 if ((pp->port == snum) && net_eq(pp->net, sock_net(sk)))
6213 goto pp_found;
6214 }
6215 }
6216 pp = NULL;
6217 goto pp_not_found;
6218 pp_found:
6219 if (!hlist_empty(&pp->owner)) {
6220 /* We had a port hash table hit - there is an
6221 * available port (pp != NULL) and it is being
6222 * used by other socket (pp->owner not empty); that other
6223 * socket is going to be sk2.
6224 */
6225 int reuse = sk->sk_reuse;
6226 struct sock *sk2;
6227
6228 pr_debug("%s: found a possible match\n", __func__);
6229
6230 if (pp->fastreuse && sk->sk_reuse &&
6231 sk->sk_state != SCTP_SS_LISTENING)
6232 goto success;
6233
6234 /* Run through the list of sockets bound to the port
6235 * (pp->port) [via the pointers bind_next and
6236 * bind_pprev in the struct sock *sk2 (pp->sk)]. On each one,
6237 * we get the endpoint they describe and run through
6238 * the endpoint's list of IP (v4 or v6) addresses,
6239 * comparing each of the addresses with the address of
6240 * the socket sk. If we find a match, then that means
6241 * that this port/socket (sk) combination are already
6242 * in an endpoint.
6243 */
6244 sk_for_each_bound(sk2, &pp->owner) {
6245 struct sctp_endpoint *ep2;
6246 ep2 = sctp_sk(sk2)->ep;
6247
6248 if (sk == sk2 ||
6249 (reuse && sk2->sk_reuse &&
6250 sk2->sk_state != SCTP_SS_LISTENING))
6251 continue;
6252
6253 if (sctp_bind_addr_conflict(&ep2->base.bind_addr, addr,
6254 sctp_sk(sk2), sctp_sk(sk))) {
6255 ret = (long)sk2;
6256 goto fail_unlock;
6257 }
6258 }
6259
6260 pr_debug("%s: found a match\n", __func__);
6261 }
6262 pp_not_found:
6263 /* If there was a hash table miss, create a new port. */
6264 ret = 1;
6265 if (!pp && !(pp = sctp_bucket_create(head, sock_net(sk), snum)))
6266 goto fail_unlock;
6267
6268 /* In either case (hit or miss), make sure fastreuse is 1 only
6269 * if sk->sk_reuse is too (that is, if the caller requested
6270 * SO_REUSEADDR on this socket -sk-).
6271 */
6272 if (hlist_empty(&pp->owner)) {
6273 if (sk->sk_reuse && sk->sk_state != SCTP_SS_LISTENING)
6274 pp->fastreuse = 1;
6275 else
6276 pp->fastreuse = 0;
6277 } else if (pp->fastreuse &&
6278 (!sk->sk_reuse || sk->sk_state == SCTP_SS_LISTENING))
6279 pp->fastreuse = 0;
6280
6281 /* We are set, so fill up all the data in the hash table
6282 * entry, tie the socket list information with the rest of the
6283 * sockets FIXME: Blurry, NPI (ipg).
6284 */
6285 success:
6286 if (!sctp_sk(sk)->bind_hash) {
6287 inet_sk(sk)->inet_num = snum;
6288 sk_add_bind_node(sk, &pp->owner);
6289 sctp_sk(sk)->bind_hash = pp;
6290 }
6291 ret = 0;
6292
6293 fail_unlock:
6294 spin_unlock(&head->lock);
6295
6296 fail:
6297 local_bh_enable();
6298 return ret;
6299 }
6300
6301 /* Assign a 'snum' port to the socket. If snum == 0, an ephemeral
6302 * port is requested.
6303 */
sctp_get_port(struct sock * sk,unsigned short snum)6304 static int sctp_get_port(struct sock *sk, unsigned short snum)
6305 {
6306 union sctp_addr addr;
6307 struct sctp_af *af = sctp_sk(sk)->pf->af;
6308
6309 /* Set up a dummy address struct from the sk. */
6310 af->from_sk(&addr, sk);
6311 addr.v4.sin_port = htons(snum);
6312
6313 /* Note: sk->sk_num gets filled in if ephemeral port request. */
6314 return !!sctp_get_port_local(sk, &addr);
6315 }
6316
6317 /*
6318 * Move a socket to LISTENING state.
6319 */
sctp_listen_start(struct sock * sk,int backlog)6320 static int sctp_listen_start(struct sock *sk, int backlog)
6321 {
6322 struct sctp_sock *sp = sctp_sk(sk);
6323 struct sctp_endpoint *ep = sp->ep;
6324 struct crypto_hash *tfm = NULL;
6325 char alg[32];
6326
6327 /* Allocate HMAC for generating cookie. */
6328 if (!sp->hmac && sp->sctp_hmac_alg) {
6329 sprintf(alg, "hmac(%s)", sp->sctp_hmac_alg);
6330 tfm = crypto_alloc_hash(alg, 0, CRYPTO_ALG_ASYNC);
6331 if (IS_ERR(tfm)) {
6332 net_info_ratelimited("failed to load transform for %s: %ld\n",
6333 sp->sctp_hmac_alg, PTR_ERR(tfm));
6334 return -ENOSYS;
6335 }
6336 sctp_sk(sk)->hmac = tfm;
6337 }
6338
6339 /*
6340 * If a bind() or sctp_bindx() is not called prior to a listen()
6341 * call that allows new associations to be accepted, the system
6342 * picks an ephemeral port and will choose an address set equivalent
6343 * to binding with a wildcard address.
6344 *
6345 * This is not currently spelled out in the SCTP sockets
6346 * extensions draft, but follows the practice as seen in TCP
6347 * sockets.
6348 *
6349 */
6350 sk->sk_state = SCTP_SS_LISTENING;
6351 if (!ep->base.bind_addr.port) {
6352 if (sctp_autobind(sk))
6353 return -EAGAIN;
6354 } else {
6355 if (sctp_get_port(sk, inet_sk(sk)->inet_num)) {
6356 sk->sk_state = SCTP_SS_CLOSED;
6357 return -EADDRINUSE;
6358 }
6359 }
6360
6361 sk->sk_max_ack_backlog = backlog;
6362 sctp_hash_endpoint(ep);
6363 return 0;
6364 }
6365
6366 /*
6367 * 4.1.3 / 5.1.3 listen()
6368 *
6369 * By default, new associations are not accepted for UDP style sockets.
6370 * An application uses listen() to mark a socket as being able to
6371 * accept new associations.
6372 *
6373 * On TCP style sockets, applications use listen() to ready the SCTP
6374 * endpoint for accepting inbound associations.
6375 *
6376 * On both types of endpoints a backlog of '0' disables listening.
6377 *
6378 * Move a socket to LISTENING state.
6379 */
sctp_inet_listen(struct socket * sock,int backlog)6380 int sctp_inet_listen(struct socket *sock, int backlog)
6381 {
6382 struct sock *sk = sock->sk;
6383 struct sctp_endpoint *ep = sctp_sk(sk)->ep;
6384 int err = -EINVAL;
6385
6386 if (unlikely(backlog < 0))
6387 return err;
6388
6389 lock_sock(sk);
6390
6391 /* Peeled-off sockets are not allowed to listen(). */
6392 if (sctp_style(sk, UDP_HIGH_BANDWIDTH))
6393 goto out;
6394
6395 if (sock->state != SS_UNCONNECTED)
6396 goto out;
6397
6398 /* If backlog is zero, disable listening. */
6399 if (!backlog) {
6400 if (sctp_sstate(sk, CLOSED))
6401 goto out;
6402
6403 err = 0;
6404 sctp_unhash_endpoint(ep);
6405 sk->sk_state = SCTP_SS_CLOSED;
6406 if (sk->sk_reuse)
6407 sctp_sk(sk)->bind_hash->fastreuse = 1;
6408 goto out;
6409 }
6410
6411 /* If we are already listening, just update the backlog */
6412 if (sctp_sstate(sk, LISTENING))
6413 sk->sk_max_ack_backlog = backlog;
6414 else {
6415 err = sctp_listen_start(sk, backlog);
6416 if (err)
6417 goto out;
6418 }
6419
6420 err = 0;
6421 out:
6422 release_sock(sk);
6423 return err;
6424 }
6425
6426 /*
6427 * This function is done by modeling the current datagram_poll() and the
6428 * tcp_poll(). Note that, based on these implementations, we don't
6429 * lock the socket in this function, even though it seems that,
6430 * ideally, locking or some other mechanisms can be used to ensure
6431 * the integrity of the counters (sndbuf and wmem_alloc) used
6432 * in this place. We assume that we don't need locks either until proven
6433 * otherwise.
6434 *
6435 * Another thing to note is that we include the Async I/O support
6436 * here, again, by modeling the current TCP/UDP code. We don't have
6437 * a good way to test with it yet.
6438 */
sctp_poll(struct file * file,struct socket * sock,poll_table * wait)6439 unsigned int sctp_poll(struct file *file, struct socket *sock, poll_table *wait)
6440 {
6441 struct sock *sk = sock->sk;
6442 struct sctp_sock *sp = sctp_sk(sk);
6443 unsigned int mask;
6444
6445 poll_wait(file, sk_sleep(sk), wait);
6446
6447 /* A TCP-style listening socket becomes readable when the accept queue
6448 * is not empty.
6449 */
6450 if (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING))
6451 return (!list_empty(&sp->ep->asocs)) ?
6452 (POLLIN | POLLRDNORM) : 0;
6453
6454 mask = 0;
6455
6456 /* Is there any exceptional events? */
6457 if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
6458 mask |= POLLERR |
6459 (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? POLLPRI : 0);
6460 if (sk->sk_shutdown & RCV_SHUTDOWN)
6461 mask |= POLLRDHUP | POLLIN | POLLRDNORM;
6462 if (sk->sk_shutdown == SHUTDOWN_MASK)
6463 mask |= POLLHUP;
6464
6465 /* Is it readable? Reconsider this code with TCP-style support. */
6466 if (!skb_queue_empty(&sk->sk_receive_queue))
6467 mask |= POLLIN | POLLRDNORM;
6468
6469 /* The association is either gone or not ready. */
6470 if (!sctp_style(sk, UDP) && sctp_sstate(sk, CLOSED))
6471 return mask;
6472
6473 /* Is it writable? */
6474 if (sctp_writeable(sk)) {
6475 mask |= POLLOUT | POLLWRNORM;
6476 } else {
6477 set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
6478 /*
6479 * Since the socket is not locked, the buffer
6480 * might be made available after the writeable check and
6481 * before the bit is set. This could cause a lost I/O
6482 * signal. tcp_poll() has a race breaker for this race
6483 * condition. Based on their implementation, we put
6484 * in the following code to cover it as well.
6485 */
6486 if (sctp_writeable(sk))
6487 mask |= POLLOUT | POLLWRNORM;
6488 }
6489 return mask;
6490 }
6491
6492 /********************************************************************
6493 * 2nd Level Abstractions
6494 ********************************************************************/
6495
sctp_bucket_create(struct sctp_bind_hashbucket * head,struct net * net,unsigned short snum)6496 static struct sctp_bind_bucket *sctp_bucket_create(
6497 struct sctp_bind_hashbucket *head, struct net *net, unsigned short snum)
6498 {
6499 struct sctp_bind_bucket *pp;
6500
6501 pp = kmem_cache_alloc(sctp_bucket_cachep, GFP_ATOMIC);
6502 if (pp) {
6503 SCTP_DBG_OBJCNT_INC(bind_bucket);
6504 pp->port = snum;
6505 pp->fastreuse = 0;
6506 INIT_HLIST_HEAD(&pp->owner);
6507 pp->net = net;
6508 hlist_add_head(&pp->node, &head->chain);
6509 }
6510 return pp;
6511 }
6512
6513 /* Caller must hold hashbucket lock for this tb with local BH disabled */
sctp_bucket_destroy(struct sctp_bind_bucket * pp)6514 static void sctp_bucket_destroy(struct sctp_bind_bucket *pp)
6515 {
6516 if (pp && hlist_empty(&pp->owner)) {
6517 __hlist_del(&pp->node);
6518 kmem_cache_free(sctp_bucket_cachep, pp);
6519 SCTP_DBG_OBJCNT_DEC(bind_bucket);
6520 }
6521 }
6522
6523 /* Release this socket's reference to a local port. */
__sctp_put_port(struct sock * sk)6524 static inline void __sctp_put_port(struct sock *sk)
6525 {
6526 struct sctp_bind_hashbucket *head =
6527 &sctp_port_hashtable[sctp_phashfn(sock_net(sk),
6528 inet_sk(sk)->inet_num)];
6529 struct sctp_bind_bucket *pp;
6530
6531 spin_lock(&head->lock);
6532 pp = sctp_sk(sk)->bind_hash;
6533 __sk_del_bind_node(sk);
6534 sctp_sk(sk)->bind_hash = NULL;
6535 inet_sk(sk)->inet_num = 0;
6536 sctp_bucket_destroy(pp);
6537 spin_unlock(&head->lock);
6538 }
6539
sctp_put_port(struct sock * sk)6540 void sctp_put_port(struct sock *sk)
6541 {
6542 local_bh_disable();
6543 __sctp_put_port(sk);
6544 local_bh_enable();
6545 }
6546
6547 /*
6548 * The system picks an ephemeral port and choose an address set equivalent
6549 * to binding with a wildcard address.
6550 * One of those addresses will be the primary address for the association.
6551 * This automatically enables the multihoming capability of SCTP.
6552 */
sctp_autobind(struct sock * sk)6553 static int sctp_autobind(struct sock *sk)
6554 {
6555 union sctp_addr autoaddr;
6556 struct sctp_af *af;
6557 __be16 port;
6558
6559 /* Initialize a local sockaddr structure to INADDR_ANY. */
6560 af = sctp_sk(sk)->pf->af;
6561
6562 port = htons(inet_sk(sk)->inet_num);
6563 af->inaddr_any(&autoaddr, port);
6564
6565 return sctp_do_bind(sk, &autoaddr, af->sockaddr_len);
6566 }
6567
6568 /* Parse out IPPROTO_SCTP CMSG headers. Perform only minimal validation.
6569 *
6570 * From RFC 2292
6571 * 4.2 The cmsghdr Structure *
6572 *
6573 * When ancillary data is sent or received, any number of ancillary data
6574 * objects can be specified by the msg_control and msg_controllen members of
6575 * the msghdr structure, because each object is preceded by
6576 * a cmsghdr structure defining the object's length (the cmsg_len member).
6577 * Historically Berkeley-derived implementations have passed only one object
6578 * at a time, but this API allows multiple objects to be
6579 * passed in a single call to sendmsg() or recvmsg(). The following example
6580 * shows two ancillary data objects in a control buffer.
6581 *
6582 * |<--------------------------- msg_controllen -------------------------->|
6583 * | |
6584 *
6585 * |<----- ancillary data object ----->|<----- ancillary data object ----->|
6586 *
6587 * |<---------- CMSG_SPACE() --------->|<---------- CMSG_SPACE() --------->|
6588 * | | |
6589 *
6590 * |<---------- cmsg_len ---------->| |<--------- cmsg_len ----------->| |
6591 *
6592 * |<--------- CMSG_LEN() --------->| |<-------- CMSG_LEN() ---------->| |
6593 * | | | | |
6594 *
6595 * +-----+-----+-----+--+-----------+--+-----+-----+-----+--+-----------+--+
6596 * |cmsg_|cmsg_|cmsg_|XX| |XX|cmsg_|cmsg_|cmsg_|XX| |XX|
6597 *
6598 * |len |level|type |XX|cmsg_data[]|XX|len |level|type |XX|cmsg_data[]|XX|
6599 *
6600 * +-----+-----+-----+--+-----------+--+-----+-----+-----+--+-----------+--+
6601 * ^
6602 * |
6603 *
6604 * msg_control
6605 * points here
6606 */
sctp_msghdr_parse(const struct msghdr * msg,sctp_cmsgs_t * cmsgs)6607 static int sctp_msghdr_parse(const struct msghdr *msg, sctp_cmsgs_t *cmsgs)
6608 {
6609 struct cmsghdr *cmsg;
6610 struct msghdr *my_msg = (struct msghdr *)msg;
6611
6612 for_each_cmsghdr(cmsg, my_msg) {
6613 if (!CMSG_OK(my_msg, cmsg))
6614 return -EINVAL;
6615
6616 /* Should we parse this header or ignore? */
6617 if (cmsg->cmsg_level != IPPROTO_SCTP)
6618 continue;
6619
6620 /* Strictly check lengths following example in SCM code. */
6621 switch (cmsg->cmsg_type) {
6622 case SCTP_INIT:
6623 /* SCTP Socket API Extension
6624 * 5.3.1 SCTP Initiation Structure (SCTP_INIT)
6625 *
6626 * This cmsghdr structure provides information for
6627 * initializing new SCTP associations with sendmsg().
6628 * The SCTP_INITMSG socket option uses this same data
6629 * structure. This structure is not used for
6630 * recvmsg().
6631 *
6632 * cmsg_level cmsg_type cmsg_data[]
6633 * ------------ ------------ ----------------------
6634 * IPPROTO_SCTP SCTP_INIT struct sctp_initmsg
6635 */
6636 if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct sctp_initmsg)))
6637 return -EINVAL;
6638
6639 cmsgs->init = CMSG_DATA(cmsg);
6640 break;
6641
6642 case SCTP_SNDRCV:
6643 /* SCTP Socket API Extension
6644 * 5.3.2 SCTP Header Information Structure(SCTP_SNDRCV)
6645 *
6646 * This cmsghdr structure specifies SCTP options for
6647 * sendmsg() and describes SCTP header information
6648 * about a received message through recvmsg().
6649 *
6650 * cmsg_level cmsg_type cmsg_data[]
6651 * ------------ ------------ ----------------------
6652 * IPPROTO_SCTP SCTP_SNDRCV struct sctp_sndrcvinfo
6653 */
6654 if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct sctp_sndrcvinfo)))
6655 return -EINVAL;
6656
6657 cmsgs->srinfo = CMSG_DATA(cmsg);
6658
6659 if (cmsgs->srinfo->sinfo_flags &
6660 ~(SCTP_UNORDERED | SCTP_ADDR_OVER |
6661 SCTP_SACK_IMMEDIATELY |
6662 SCTP_ABORT | SCTP_EOF))
6663 return -EINVAL;
6664 break;
6665
6666 case SCTP_SNDINFO:
6667 /* SCTP Socket API Extension
6668 * 5.3.4 SCTP Send Information Structure (SCTP_SNDINFO)
6669 *
6670 * This cmsghdr structure specifies SCTP options for
6671 * sendmsg(). This structure and SCTP_RCVINFO replaces
6672 * SCTP_SNDRCV which has been deprecated.
6673 *
6674 * cmsg_level cmsg_type cmsg_data[]
6675 * ------------ ------------ ---------------------
6676 * IPPROTO_SCTP SCTP_SNDINFO struct sctp_sndinfo
6677 */
6678 if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct sctp_sndinfo)))
6679 return -EINVAL;
6680
6681 cmsgs->sinfo = CMSG_DATA(cmsg);
6682
6683 if (cmsgs->sinfo->snd_flags &
6684 ~(SCTP_UNORDERED | SCTP_ADDR_OVER |
6685 SCTP_SACK_IMMEDIATELY |
6686 SCTP_ABORT | SCTP_EOF))
6687 return -EINVAL;
6688 break;
6689 default:
6690 return -EINVAL;
6691 }
6692 }
6693
6694 return 0;
6695 }
6696
6697 /*
6698 * Wait for a packet..
6699 * Note: This function is the same function as in core/datagram.c
6700 * with a few modifications to make lksctp work.
6701 */
sctp_wait_for_packet(struct sock * sk,int * err,long * timeo_p)6702 static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p)
6703 {
6704 int error;
6705 DEFINE_WAIT(wait);
6706
6707 prepare_to_wait_exclusive(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
6708
6709 /* Socket errors? */
6710 error = sock_error(sk);
6711 if (error)
6712 goto out;
6713
6714 if (!skb_queue_empty(&sk->sk_receive_queue))
6715 goto ready;
6716
6717 /* Socket shut down? */
6718 if (sk->sk_shutdown & RCV_SHUTDOWN)
6719 goto out;
6720
6721 /* Sequenced packets can come disconnected. If so we report the
6722 * problem.
6723 */
6724 error = -ENOTCONN;
6725
6726 /* Is there a good reason to think that we may receive some data? */
6727 if (list_empty(&sctp_sk(sk)->ep->asocs) && !sctp_sstate(sk, LISTENING))
6728 goto out;
6729
6730 /* Handle signals. */
6731 if (signal_pending(current))
6732 goto interrupted;
6733
6734 /* Let another process have a go. Since we are going to sleep
6735 * anyway. Note: This may cause odd behaviors if the message
6736 * does not fit in the user's buffer, but this seems to be the
6737 * only way to honor MSG_DONTWAIT realistically.
6738 */
6739 release_sock(sk);
6740 *timeo_p = schedule_timeout(*timeo_p);
6741 lock_sock(sk);
6742
6743 ready:
6744 finish_wait(sk_sleep(sk), &wait);
6745 return 0;
6746
6747 interrupted:
6748 error = sock_intr_errno(*timeo_p);
6749
6750 out:
6751 finish_wait(sk_sleep(sk), &wait);
6752 *err = error;
6753 return error;
6754 }
6755
6756 /* Receive a datagram.
6757 * Note: This is pretty much the same routine as in core/datagram.c
6758 * with a few changes to make lksctp work.
6759 */
sctp_skb_recv_datagram(struct sock * sk,int flags,int noblock,int * err)6760 struct sk_buff *sctp_skb_recv_datagram(struct sock *sk, int flags,
6761 int noblock, int *err)
6762 {
6763 int error;
6764 struct sk_buff *skb;
6765 long timeo;
6766
6767 timeo = sock_rcvtimeo(sk, noblock);
6768
6769 pr_debug("%s: timeo:%ld, max:%ld\n", __func__, timeo,
6770 MAX_SCHEDULE_TIMEOUT);
6771
6772 do {
6773 /* Again only user level code calls this function,
6774 * so nothing interrupt level
6775 * will suddenly eat the receive_queue.
6776 *
6777 * Look at current nfs client by the way...
6778 * However, this function was correct in any case. 8)
6779 */
6780 if (flags & MSG_PEEK) {
6781 spin_lock_bh(&sk->sk_receive_queue.lock);
6782 skb = skb_peek(&sk->sk_receive_queue);
6783 if (skb)
6784 atomic_inc(&skb->users);
6785 spin_unlock_bh(&sk->sk_receive_queue.lock);
6786 } else {
6787 skb = skb_dequeue(&sk->sk_receive_queue);
6788 }
6789
6790 if (skb)
6791 return skb;
6792
6793 /* Caller is allowed not to check sk->sk_err before calling. */
6794 error = sock_error(sk);
6795 if (error)
6796 goto no_packet;
6797
6798 if (sk->sk_shutdown & RCV_SHUTDOWN)
6799 break;
6800
6801 if (sk_can_busy_loop(sk) &&
6802 sk_busy_loop(sk, noblock))
6803 continue;
6804
6805 /* User doesn't want to wait. */
6806 error = -EAGAIN;
6807 if (!timeo)
6808 goto no_packet;
6809 } while (sctp_wait_for_packet(sk, err, &timeo) == 0);
6810
6811 return NULL;
6812
6813 no_packet:
6814 *err = error;
6815 return NULL;
6816 }
6817
6818 /* If sndbuf has changed, wake up per association sndbuf waiters. */
__sctp_write_space(struct sctp_association * asoc)6819 static void __sctp_write_space(struct sctp_association *asoc)
6820 {
6821 struct sock *sk = asoc->base.sk;
6822 struct socket *sock = sk->sk_socket;
6823
6824 if ((sctp_wspace(asoc) > 0) && sock) {
6825 if (waitqueue_active(&asoc->wait))
6826 wake_up_interruptible(&asoc->wait);
6827
6828 if (sctp_writeable(sk)) {
6829 wait_queue_head_t *wq = sk_sleep(sk);
6830
6831 if (wq && waitqueue_active(wq))
6832 wake_up_interruptible(wq);
6833
6834 /* Note that we try to include the Async I/O support
6835 * here by modeling from the current TCP/UDP code.
6836 * We have not tested with it yet.
6837 */
6838 if (!(sk->sk_shutdown & SEND_SHUTDOWN))
6839 sock_wake_async(sock,
6840 SOCK_WAKE_SPACE, POLL_OUT);
6841 }
6842 }
6843 }
6844
sctp_wake_up_waiters(struct sock * sk,struct sctp_association * asoc)6845 static void sctp_wake_up_waiters(struct sock *sk,
6846 struct sctp_association *asoc)
6847 {
6848 struct sctp_association *tmp = asoc;
6849
6850 /* We do accounting for the sndbuf space per association,
6851 * so we only need to wake our own association.
6852 */
6853 if (asoc->ep->sndbuf_policy)
6854 return __sctp_write_space(asoc);
6855
6856 /* If association goes down and is just flushing its
6857 * outq, then just normally notify others.
6858 */
6859 if (asoc->base.dead)
6860 return sctp_write_space(sk);
6861
6862 /* Accounting for the sndbuf space is per socket, so we
6863 * need to wake up others, try to be fair and in case of
6864 * other associations, let them have a go first instead
6865 * of just doing a sctp_write_space() call.
6866 *
6867 * Note that we reach sctp_wake_up_waiters() only when
6868 * associations free up queued chunks, thus we are under
6869 * lock and the list of associations on a socket is
6870 * guaranteed not to change.
6871 */
6872 for (tmp = list_next_entry(tmp, asocs); 1;
6873 tmp = list_next_entry(tmp, asocs)) {
6874 /* Manually skip the head element. */
6875 if (&tmp->asocs == &((sctp_sk(sk))->ep->asocs))
6876 continue;
6877 /* Wake up association. */
6878 __sctp_write_space(tmp);
6879 /* We've reached the end. */
6880 if (tmp == asoc)
6881 break;
6882 }
6883 }
6884
6885 /* Do accounting for the sndbuf space.
6886 * Decrement the used sndbuf space of the corresponding association by the
6887 * data size which was just transmitted(freed).
6888 */
sctp_wfree(struct sk_buff * skb)6889 static void sctp_wfree(struct sk_buff *skb)
6890 {
6891 struct sctp_chunk *chunk = skb_shinfo(skb)->destructor_arg;
6892 struct sctp_association *asoc = chunk->asoc;
6893 struct sock *sk = asoc->base.sk;
6894
6895 asoc->sndbuf_used -= SCTP_DATA_SNDSIZE(chunk) +
6896 sizeof(struct sk_buff) +
6897 sizeof(struct sctp_chunk);
6898
6899 atomic_sub(sizeof(struct sctp_chunk), &sk->sk_wmem_alloc);
6900
6901 /*
6902 * This undoes what is done via sctp_set_owner_w and sk_mem_charge
6903 */
6904 sk->sk_wmem_queued -= skb->truesize;
6905 sk_mem_uncharge(sk, skb->truesize);
6906
6907 sock_wfree(skb);
6908 sctp_wake_up_waiters(sk, asoc);
6909
6910 sctp_association_put(asoc);
6911 }
6912
6913 /* Do accounting for the receive space on the socket.
6914 * Accounting for the association is done in ulpevent.c
6915 * We set this as a destructor for the cloned data skbs so that
6916 * accounting is done at the correct time.
6917 */
sctp_sock_rfree(struct sk_buff * skb)6918 void sctp_sock_rfree(struct sk_buff *skb)
6919 {
6920 struct sock *sk = skb->sk;
6921 struct sctp_ulpevent *event = sctp_skb2event(skb);
6922
6923 atomic_sub(event->rmem_len, &sk->sk_rmem_alloc);
6924
6925 /*
6926 * Mimic the behavior of sock_rfree
6927 */
6928 sk_mem_uncharge(sk, event->rmem_len);
6929 }
6930
6931
6932 /* Helper function to wait for space in the sndbuf. */
sctp_wait_for_sndbuf(struct sctp_association * asoc,long * timeo_p,size_t msg_len)6933 static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
6934 size_t msg_len)
6935 {
6936 struct sock *sk = asoc->base.sk;
6937 int err = 0;
6938 long current_timeo = *timeo_p;
6939 DEFINE_WAIT(wait);
6940
6941 pr_debug("%s: asoc:%p, timeo:%ld, msg_len:%zu\n", __func__, asoc,
6942 *timeo_p, msg_len);
6943
6944 /* Increment the association's refcnt. */
6945 sctp_association_hold(asoc);
6946
6947 /* Wait on the association specific sndbuf space. */
6948 for (;;) {
6949 prepare_to_wait_exclusive(&asoc->wait, &wait,
6950 TASK_INTERRUPTIBLE);
6951 if (!*timeo_p)
6952 goto do_nonblock;
6953 if (sk->sk_err || asoc->state >= SCTP_STATE_SHUTDOWN_PENDING ||
6954 asoc->base.dead)
6955 goto do_error;
6956 if (signal_pending(current))
6957 goto do_interrupted;
6958 if (msg_len <= sctp_wspace(asoc))
6959 break;
6960
6961 /* Let another process have a go. Since we are going
6962 * to sleep anyway.
6963 */
6964 release_sock(sk);
6965 current_timeo = schedule_timeout(current_timeo);
6966 BUG_ON(sk != asoc->base.sk);
6967 lock_sock(sk);
6968
6969 *timeo_p = current_timeo;
6970 }
6971
6972 out:
6973 finish_wait(&asoc->wait, &wait);
6974
6975 /* Release the association's refcnt. */
6976 sctp_association_put(asoc);
6977
6978 return err;
6979
6980 do_error:
6981 err = -EPIPE;
6982 goto out;
6983
6984 do_interrupted:
6985 err = sock_intr_errno(*timeo_p);
6986 goto out;
6987
6988 do_nonblock:
6989 err = -EAGAIN;
6990 goto out;
6991 }
6992
sctp_data_ready(struct sock * sk)6993 void sctp_data_ready(struct sock *sk)
6994 {
6995 struct socket_wq *wq;
6996
6997 rcu_read_lock();
6998 wq = rcu_dereference(sk->sk_wq);
6999 if (wq_has_sleeper(wq))
7000 wake_up_interruptible_sync_poll(&wq->wait, POLLIN |
7001 POLLRDNORM | POLLRDBAND);
7002 sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
7003 rcu_read_unlock();
7004 }
7005
7006 /* If socket sndbuf has changed, wake up all per association waiters. */
sctp_write_space(struct sock * sk)7007 void sctp_write_space(struct sock *sk)
7008 {
7009 struct sctp_association *asoc;
7010
7011 /* Wake up the tasks in each wait queue. */
7012 list_for_each_entry(asoc, &((sctp_sk(sk))->ep->asocs), asocs) {
7013 __sctp_write_space(asoc);
7014 }
7015 }
7016
7017 /* Is there any sndbuf space available on the socket?
7018 *
7019 * Note that sk_wmem_alloc is the sum of the send buffers on all of the
7020 * associations on the same socket. For a UDP-style socket with
7021 * multiple associations, it is possible for it to be "unwriteable"
7022 * prematurely. I assume that this is acceptable because
7023 * a premature "unwriteable" is better than an accidental "writeable" which
7024 * would cause an unwanted block under certain circumstances. For the 1-1
7025 * UDP-style sockets or TCP-style sockets, this code should work.
7026 * - Daisy
7027 */
sctp_writeable(struct sock * sk)7028 static int sctp_writeable(struct sock *sk)
7029 {
7030 int amt = 0;
7031
7032 amt = sk->sk_sndbuf - sk_wmem_alloc_get(sk);
7033 if (amt < 0)
7034 amt = 0;
7035 return amt;
7036 }
7037
7038 /* Wait for an association to go into ESTABLISHED state. If timeout is 0,
7039 * returns immediately with EINPROGRESS.
7040 */
sctp_wait_for_connect(struct sctp_association * asoc,long * timeo_p)7041 static int sctp_wait_for_connect(struct sctp_association *asoc, long *timeo_p)
7042 {
7043 struct sock *sk = asoc->base.sk;
7044 int err = 0;
7045 long current_timeo = *timeo_p;
7046 DEFINE_WAIT(wait);
7047
7048 pr_debug("%s: asoc:%p, timeo:%ld\n", __func__, asoc, *timeo_p);
7049
7050 /* Increment the association's refcnt. */
7051 sctp_association_hold(asoc);
7052
7053 for (;;) {
7054 prepare_to_wait_exclusive(&asoc->wait, &wait,
7055 TASK_INTERRUPTIBLE);
7056 if (!*timeo_p)
7057 goto do_nonblock;
7058 if (sk->sk_shutdown & RCV_SHUTDOWN)
7059 break;
7060 if (sk->sk_err || asoc->state >= SCTP_STATE_SHUTDOWN_PENDING ||
7061 asoc->base.dead)
7062 goto do_error;
7063 if (signal_pending(current))
7064 goto do_interrupted;
7065
7066 if (sctp_state(asoc, ESTABLISHED))
7067 break;
7068
7069 /* Let another process have a go. Since we are going
7070 * to sleep anyway.
7071 */
7072 release_sock(sk);
7073 current_timeo = schedule_timeout(current_timeo);
7074 lock_sock(sk);
7075
7076 *timeo_p = current_timeo;
7077 }
7078
7079 out:
7080 finish_wait(&asoc->wait, &wait);
7081
7082 /* Release the association's refcnt. */
7083 sctp_association_put(asoc);
7084
7085 return err;
7086
7087 do_error:
7088 if (asoc->init_err_counter + 1 > asoc->max_init_attempts)
7089 err = -ETIMEDOUT;
7090 else
7091 err = -ECONNREFUSED;
7092 goto out;
7093
7094 do_interrupted:
7095 err = sock_intr_errno(*timeo_p);
7096 goto out;
7097
7098 do_nonblock:
7099 err = -EINPROGRESS;
7100 goto out;
7101 }
7102
sctp_wait_for_accept(struct sock * sk,long timeo)7103 static int sctp_wait_for_accept(struct sock *sk, long timeo)
7104 {
7105 struct sctp_endpoint *ep;
7106 int err = 0;
7107 DEFINE_WAIT(wait);
7108
7109 ep = sctp_sk(sk)->ep;
7110
7111
7112 for (;;) {
7113 prepare_to_wait_exclusive(sk_sleep(sk), &wait,
7114 TASK_INTERRUPTIBLE);
7115
7116 if (list_empty(&ep->asocs)) {
7117 release_sock(sk);
7118 timeo = schedule_timeout(timeo);
7119 lock_sock(sk);
7120 }
7121
7122 err = -EINVAL;
7123 if (!sctp_sstate(sk, LISTENING))
7124 break;
7125
7126 err = 0;
7127 if (!list_empty(&ep->asocs))
7128 break;
7129
7130 err = sock_intr_errno(timeo);
7131 if (signal_pending(current))
7132 break;
7133
7134 err = -EAGAIN;
7135 if (!timeo)
7136 break;
7137 }
7138
7139 finish_wait(sk_sleep(sk), &wait);
7140
7141 return err;
7142 }
7143
sctp_wait_for_close(struct sock * sk,long timeout)7144 static void sctp_wait_for_close(struct sock *sk, long timeout)
7145 {
7146 DEFINE_WAIT(wait);
7147
7148 do {
7149 prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
7150 if (list_empty(&sctp_sk(sk)->ep->asocs))
7151 break;
7152 release_sock(sk);
7153 timeout = schedule_timeout(timeout);
7154 lock_sock(sk);
7155 } while (!signal_pending(current) && timeout);
7156
7157 finish_wait(sk_sleep(sk), &wait);
7158 }
7159
sctp_skb_set_owner_r_frag(struct sk_buff * skb,struct sock * sk)7160 static void sctp_skb_set_owner_r_frag(struct sk_buff *skb, struct sock *sk)
7161 {
7162 struct sk_buff *frag;
7163
7164 if (!skb->data_len)
7165 goto done;
7166
7167 /* Don't forget the fragments. */
7168 skb_walk_frags(skb, frag)
7169 sctp_skb_set_owner_r_frag(frag, sk);
7170
7171 done:
7172 sctp_skb_set_owner_r(skb, sk);
7173 }
7174
sctp_copy_sock(struct sock * newsk,struct sock * sk,struct sctp_association * asoc)7175 void sctp_copy_sock(struct sock *newsk, struct sock *sk,
7176 struct sctp_association *asoc)
7177 {
7178 struct inet_sock *inet = inet_sk(sk);
7179 struct inet_sock *newinet;
7180
7181 newsk->sk_type = sk->sk_type;
7182 newsk->sk_bound_dev_if = sk->sk_bound_dev_if;
7183 newsk->sk_flags = sk->sk_flags;
7184 newsk->sk_tsflags = sk->sk_tsflags;
7185 newsk->sk_no_check_tx = sk->sk_no_check_tx;
7186 newsk->sk_no_check_rx = sk->sk_no_check_rx;
7187 newsk->sk_reuse = sk->sk_reuse;
7188
7189 newsk->sk_shutdown = sk->sk_shutdown;
7190 newsk->sk_destruct = sctp_destruct_sock;
7191 newsk->sk_family = sk->sk_family;
7192 newsk->sk_protocol = IPPROTO_SCTP;
7193 newsk->sk_backlog_rcv = sk->sk_prot->backlog_rcv;
7194 newsk->sk_sndbuf = sk->sk_sndbuf;
7195 newsk->sk_rcvbuf = sk->sk_rcvbuf;
7196 newsk->sk_lingertime = sk->sk_lingertime;
7197 newsk->sk_rcvtimeo = sk->sk_rcvtimeo;
7198 newsk->sk_sndtimeo = sk->sk_sndtimeo;
7199
7200 newinet = inet_sk(newsk);
7201
7202 /* Initialize sk's sport, dport, rcv_saddr and daddr for
7203 * getsockname() and getpeername()
7204 */
7205 newinet->inet_sport = inet->inet_sport;
7206 newinet->inet_saddr = inet->inet_saddr;
7207 newinet->inet_rcv_saddr = inet->inet_rcv_saddr;
7208 newinet->inet_dport = htons(asoc->peer.port);
7209 newinet->pmtudisc = inet->pmtudisc;
7210 newinet->inet_id = asoc->next_tsn ^ jiffies;
7211
7212 newinet->uc_ttl = inet->uc_ttl;
7213 newinet->mc_loop = 1;
7214 newinet->mc_ttl = 1;
7215 newinet->mc_index = 0;
7216 newinet->mc_list = NULL;
7217
7218 if (newsk->sk_flags & SK_FLAGS_TIMESTAMP)
7219 net_enable_timestamp();
7220 }
7221
sctp_copy_descendant(struct sock * sk_to,const struct sock * sk_from)7222 static inline void sctp_copy_descendant(struct sock *sk_to,
7223 const struct sock *sk_from)
7224 {
7225 int ancestor_size = sizeof(struct inet_sock) +
7226 sizeof(struct sctp_sock) -
7227 offsetof(struct sctp_sock, auto_asconf_list);
7228
7229 if (sk_from->sk_family == PF_INET6)
7230 ancestor_size += sizeof(struct ipv6_pinfo);
7231
7232 __inet_sk_copy_descendant(sk_to, sk_from, ancestor_size);
7233 }
7234
7235 /* Populate the fields of the newsk from the oldsk and migrate the assoc
7236 * and its messages to the newsk.
7237 */
sctp_sock_migrate(struct sock * oldsk,struct sock * newsk,struct sctp_association * assoc,sctp_socket_type_t type)7238 static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
7239 struct sctp_association *assoc,
7240 sctp_socket_type_t type)
7241 {
7242 struct sctp_sock *oldsp = sctp_sk(oldsk);
7243 struct sctp_sock *newsp = sctp_sk(newsk);
7244 struct sctp_bind_bucket *pp; /* hash list port iterator */
7245 struct sctp_endpoint *newep = newsp->ep;
7246 struct sk_buff *skb, *tmp;
7247 struct sctp_ulpevent *event;
7248 struct sctp_bind_hashbucket *head;
7249
7250 /* Migrate socket buffer sizes and all the socket level options to the
7251 * new socket.
7252 */
7253 newsk->sk_sndbuf = oldsk->sk_sndbuf;
7254 newsk->sk_rcvbuf = oldsk->sk_rcvbuf;
7255 /* Brute force copy old sctp opt. */
7256 sctp_copy_descendant(newsk, oldsk);
7257
7258 /* Restore the ep value that was overwritten with the above structure
7259 * copy.
7260 */
7261 newsp->ep = newep;
7262 newsp->hmac = NULL;
7263
7264 /* Hook this new socket in to the bind_hash list. */
7265 head = &sctp_port_hashtable[sctp_phashfn(sock_net(oldsk),
7266 inet_sk(oldsk)->inet_num)];
7267 local_bh_disable();
7268 spin_lock(&head->lock);
7269 pp = sctp_sk(oldsk)->bind_hash;
7270 sk_add_bind_node(newsk, &pp->owner);
7271 sctp_sk(newsk)->bind_hash = pp;
7272 inet_sk(newsk)->inet_num = inet_sk(oldsk)->inet_num;
7273 spin_unlock(&head->lock);
7274 local_bh_enable();
7275
7276 /* Copy the bind_addr list from the original endpoint to the new
7277 * endpoint so that we can handle restarts properly
7278 */
7279 sctp_bind_addr_dup(&newsp->ep->base.bind_addr,
7280 &oldsp->ep->base.bind_addr, GFP_KERNEL);
7281
7282 /* Move any messages in the old socket's receive queue that are for the
7283 * peeled off association to the new socket's receive queue.
7284 */
7285 sctp_skb_for_each(skb, &oldsk->sk_receive_queue, tmp) {
7286 event = sctp_skb2event(skb);
7287 if (event->asoc == assoc) {
7288 __skb_unlink(skb, &oldsk->sk_receive_queue);
7289 __skb_queue_tail(&newsk->sk_receive_queue, skb);
7290 sctp_skb_set_owner_r_frag(skb, newsk);
7291 }
7292 }
7293
7294 /* Clean up any messages pending delivery due to partial
7295 * delivery. Three cases:
7296 * 1) No partial deliver; no work.
7297 * 2) Peeling off partial delivery; keep pd_lobby in new pd_lobby.
7298 * 3) Peeling off non-partial delivery; move pd_lobby to receive_queue.
7299 */
7300 skb_queue_head_init(&newsp->pd_lobby);
7301 atomic_set(&sctp_sk(newsk)->pd_mode, assoc->ulpq.pd_mode);
7302
7303 if (atomic_read(&sctp_sk(oldsk)->pd_mode)) {
7304 struct sk_buff_head *queue;
7305
7306 /* Decide which queue to move pd_lobby skbs to. */
7307 if (assoc->ulpq.pd_mode) {
7308 queue = &newsp->pd_lobby;
7309 } else
7310 queue = &newsk->sk_receive_queue;
7311
7312 /* Walk through the pd_lobby, looking for skbs that
7313 * need moved to the new socket.
7314 */
7315 sctp_skb_for_each(skb, &oldsp->pd_lobby, tmp) {
7316 event = sctp_skb2event(skb);
7317 if (event->asoc == assoc) {
7318 __skb_unlink(skb, &oldsp->pd_lobby);
7319 __skb_queue_tail(queue, skb);
7320 sctp_skb_set_owner_r_frag(skb, newsk);
7321 }
7322 }
7323
7324 /* Clear up any skbs waiting for the partial
7325 * delivery to finish.
7326 */
7327 if (assoc->ulpq.pd_mode)
7328 sctp_clear_pd(oldsk, NULL);
7329
7330 }
7331
7332 sctp_skb_for_each(skb, &assoc->ulpq.reasm, tmp)
7333 sctp_skb_set_owner_r_frag(skb, newsk);
7334
7335 sctp_skb_for_each(skb, &assoc->ulpq.lobby, tmp)
7336 sctp_skb_set_owner_r_frag(skb, newsk);
7337
7338 /* Set the type of socket to indicate that it is peeled off from the
7339 * original UDP-style socket or created with the accept() call on a
7340 * TCP-style socket..
7341 */
7342 newsp->type = type;
7343
7344 /* Mark the new socket "in-use" by the user so that any packets
7345 * that may arrive on the association after we've moved it are
7346 * queued to the backlog. This prevents a potential race between
7347 * backlog processing on the old socket and new-packet processing
7348 * on the new socket.
7349 *
7350 * The caller has just allocated newsk so we can guarantee that other
7351 * paths won't try to lock it and then oldsk.
7352 */
7353 lock_sock_nested(newsk, SINGLE_DEPTH_NESTING);
7354 sctp_assoc_migrate(assoc, newsk);
7355
7356 /* If the association on the newsk is already closed before accept()
7357 * is called, set RCV_SHUTDOWN flag.
7358 */
7359 if (sctp_state(assoc, CLOSED) && sctp_style(newsk, TCP))
7360 newsk->sk_shutdown |= RCV_SHUTDOWN;
7361
7362 newsk->sk_state = SCTP_SS_ESTABLISHED;
7363 release_sock(newsk);
7364 }
7365
7366
7367 /* This proto struct describes the ULP interface for SCTP. */
7368 struct proto sctp_prot = {
7369 .name = "SCTP",
7370 .owner = THIS_MODULE,
7371 .close = sctp_close,
7372 .connect = sctp_connect,
7373 .disconnect = sctp_disconnect,
7374 .accept = sctp_accept,
7375 .ioctl = sctp_ioctl,
7376 .init = sctp_init_sock,
7377 .destroy = sctp_destroy_sock,
7378 .shutdown = sctp_shutdown,
7379 .setsockopt = sctp_setsockopt,
7380 .getsockopt = sctp_getsockopt,
7381 .sendmsg = sctp_sendmsg,
7382 .recvmsg = sctp_recvmsg,
7383 .bind = sctp_bind,
7384 .backlog_rcv = sctp_backlog_rcv,
7385 .hash = sctp_hash,
7386 .unhash = sctp_unhash,
7387 .get_port = sctp_get_port,
7388 .obj_size = sizeof(struct sctp_sock),
7389 .sysctl_mem = sysctl_sctp_mem,
7390 .sysctl_rmem = sysctl_sctp_rmem,
7391 .sysctl_wmem = sysctl_sctp_wmem,
7392 .memory_pressure = &sctp_memory_pressure,
7393 .enter_memory_pressure = sctp_enter_memory_pressure,
7394 .memory_allocated = &sctp_memory_allocated,
7395 .sockets_allocated = &sctp_sockets_allocated,
7396 };
7397
7398 #if IS_ENABLED(CONFIG_IPV6)
7399
7400 #include <net/transp_v6.h>
sctp_v6_destroy_sock(struct sock * sk)7401 static void sctp_v6_destroy_sock(struct sock *sk)
7402 {
7403 sctp_destroy_sock(sk);
7404 inet6_destroy_sock(sk);
7405 }
7406
7407 struct proto sctpv6_prot = {
7408 .name = "SCTPv6",
7409 .owner = THIS_MODULE,
7410 .close = sctp_close,
7411 .connect = sctp_connect,
7412 .disconnect = sctp_disconnect,
7413 .accept = sctp_accept,
7414 .ioctl = sctp_ioctl,
7415 .init = sctp_init_sock,
7416 .destroy = sctp_v6_destroy_sock,
7417 .shutdown = sctp_shutdown,
7418 .setsockopt = sctp_setsockopt,
7419 .getsockopt = sctp_getsockopt,
7420 .sendmsg = sctp_sendmsg,
7421 .recvmsg = sctp_recvmsg,
7422 .bind = sctp_bind,
7423 .backlog_rcv = sctp_backlog_rcv,
7424 .hash = sctp_hash,
7425 .unhash = sctp_unhash,
7426 .get_port = sctp_get_port,
7427 .obj_size = sizeof(struct sctp6_sock),
7428 .sysctl_mem = sysctl_sctp_mem,
7429 .sysctl_rmem = sysctl_sctp_rmem,
7430 .sysctl_wmem = sysctl_sctp_wmem,
7431 .memory_pressure = &sctp_memory_pressure,
7432 .enter_memory_pressure = sctp_enter_memory_pressure,
7433 .memory_allocated = &sctp_memory_allocated,
7434 .sockets_allocated = &sctp_sockets_allocated,
7435 };
7436 #endif /* IS_ENABLED(CONFIG_IPV6) */
7437