This source file includes following definitions.
- sctp_chunk_length_valid
- sctp_err_chunk_valid
- sctp_sf_do_4_C
- sctp_sf_do_5_1B_init
- sctp_sf_do_5_1C_ack
- sctp_auth_chunk_verify
- sctp_sf_do_5_1D_ce
- sctp_sf_do_5_1E_ca
- sctp_sf_heartbeat
- sctp_sf_sendbeat_8_3
- sctp_sf_send_reconf
- sctp_sf_beat_8_3
- sctp_sf_backbeat_8_3
- sctp_sf_send_restart_abort
- list_has_sctp_addr
- sctp_sf_check_restart_addrs
- sctp_tietags_populate
- sctp_tietags_compare
- sctp_sf_do_unexpected_init
- sctp_sf_do_5_2_1_siminit
- sctp_sf_do_5_2_2_dupinit
- sctp_sf_do_5_2_3_initack
- sctp_sf_do_dupcook_a
- sctp_sf_do_dupcook_b
- sctp_sf_do_dupcook_c
- sctp_sf_do_dupcook_d
- sctp_sf_do_5_2_4_dupcook
- sctp_sf_shutdown_pending_abort
- sctp_sf_shutdown_sent_abort
- sctp_sf_shutdown_ack_sent_abort
- sctp_sf_cookie_echoed_err
- sctp_sf_do_5_2_6_stale
- sctp_sf_do_9_1_abort
- __sctp_sf_do_9_1_abort
- sctp_sf_cookie_wait_abort
- sctp_sf_cookie_wait_icmp_abort
- sctp_sf_cookie_echoed_abort
- sctp_stop_t1_and_abort
- sctp_sf_do_9_2_shutdown
- sctp_sf_do_9_2_shut_ctsn
- sctp_sf_do_9_2_reshutack
- sctp_sf_do_ecn_cwr
- sctp_sf_do_ecne
- sctp_sf_eat_data_6_2
- sctp_sf_eat_data_fast_4_4
- sctp_sf_eat_sack_6_2
- sctp_sf_tabort_8_4_8
- sctp_sf_operr_notify
- sctp_sf_do_9_2_final
- sctp_sf_ootb
- sctp_sf_shut_8_4_5
- sctp_sf_do_8_5_1_E_sa
- sctp_sf_do_asconf
- sctp_send_next_asconf
- sctp_sf_do_asconf_ack
- sctp_sf_do_reconf
- sctp_sf_eat_fwd_tsn
- sctp_sf_eat_fwd_tsn_fast
- sctp_sf_authenticate
- sctp_sf_eat_auth
- sctp_sf_unk_chunk
- sctp_sf_discard_chunk
- sctp_sf_pdiscard
- sctp_sf_violation
- sctp_sf_abort_violation
- sctp_sf_violation_chunklen
- sctp_sf_violation_paramlen
- sctp_sf_violation_ctsn
- sctp_sf_violation_chunk
- sctp_sf_do_prm_asoc
- sctp_sf_do_prm_send
- sctp_sf_do_9_2_prm_shutdown
- sctp_sf_do_9_1_prm_abort
- sctp_sf_error_closed
- sctp_sf_error_shutdown
- sctp_sf_cookie_wait_prm_shutdown
- sctp_sf_cookie_echoed_prm_shutdown
- sctp_sf_cookie_wait_prm_abort
- sctp_sf_cookie_echoed_prm_abort
- sctp_sf_shutdown_pending_prm_abort
- sctp_sf_shutdown_sent_prm_abort
- sctp_sf_shutdown_ack_sent_prm_abort
- sctp_sf_do_prm_requestheartbeat
- sctp_sf_do_prm_asconf
- sctp_sf_do_prm_reconf
- sctp_sf_ignore_primitive
- sctp_sf_do_no_pending_tsn
- sctp_sf_do_9_2_start_shutdown
- sctp_sf_do_9_2_shutdown_ack
- sctp_sf_ignore_other
- sctp_sf_do_6_3_3_rtx
- sctp_sf_do_6_2_sack
- sctp_sf_t1_init_timer_expire
- sctp_sf_t1_cookie_timer_expire
- sctp_sf_t2_timer_expire
- sctp_sf_t4_timer_expire
- sctp_sf_t5_timer_expire
- sctp_sf_autoclose_timer_expire
- sctp_sf_not_impl
- sctp_sf_bug
- sctp_sf_timer_ignore
- sctp_sm_pull_sack
- sctp_abort_pkt_new
- sctp_ootb_pkt_new
- sctp_ootb_pkt_free
- sctp_send_stale_cookie_err
- sctp_eat_data
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
32
33 #include <linux/types.h>
34 #include <linux/kernel.h>
35 #include <linux/ip.h>
36 #include <linux/ipv6.h>
37 #include <linux/net.h>
38 #include <linux/inet.h>
39 #include <linux/slab.h>
40 #include <net/sock.h>
41 #include <net/inet_ecn.h>
42 #include <linux/skbuff.h>
43 #include <net/sctp/sctp.h>
44 #include <net/sctp/sm.h>
45 #include <net/sctp/structs.h>
46
47 #define CREATE_TRACE_POINTS
48 #include <trace/events/sctp.h>
49
50 static struct sctp_packet *sctp_abort_pkt_new(
51 struct net *net,
52 const struct sctp_endpoint *ep,
53 const struct sctp_association *asoc,
54 struct sctp_chunk *chunk,
55 const void *payload, size_t paylen);
56 static int sctp_eat_data(const struct sctp_association *asoc,
57 struct sctp_chunk *chunk,
58 struct sctp_cmd_seq *commands);
59 static struct sctp_packet *sctp_ootb_pkt_new(
60 struct net *net,
61 const struct sctp_association *asoc,
62 const struct sctp_chunk *chunk);
63 static void sctp_send_stale_cookie_err(struct net *net,
64 const struct sctp_endpoint *ep,
65 const struct sctp_association *asoc,
66 const struct sctp_chunk *chunk,
67 struct sctp_cmd_seq *commands,
68 struct sctp_chunk *err_chunk);
69 static enum sctp_disposition sctp_sf_do_5_2_6_stale(
70 struct net *net,
71 const struct sctp_endpoint *ep,
72 const struct sctp_association *asoc,
73 const union sctp_subtype type,
74 void *arg,
75 struct sctp_cmd_seq *commands);
76 static enum sctp_disposition sctp_sf_shut_8_4_5(
77 struct net *net,
78 const struct sctp_endpoint *ep,
79 const struct sctp_association *asoc,
80 const union sctp_subtype type,
81 void *arg,
82 struct sctp_cmd_seq *commands);
83 static enum sctp_disposition sctp_sf_tabort_8_4_8(
84 struct net *net,
85 const struct sctp_endpoint *ep,
86 const struct sctp_association *asoc,
87 const union sctp_subtype type,
88 void *arg,
89 struct sctp_cmd_seq *commands);
90 static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk);
91
92 static enum sctp_disposition sctp_stop_t1_and_abort(
93 struct net *net,
94 struct sctp_cmd_seq *commands,
95 __be16 error, int sk_err,
96 const struct sctp_association *asoc,
97 struct sctp_transport *transport);
98
99 static enum sctp_disposition sctp_sf_abort_violation(
100 struct net *net,
101 const struct sctp_endpoint *ep,
102 const struct sctp_association *asoc,
103 void *arg,
104 struct sctp_cmd_seq *commands,
105 const __u8 *payload,
106 const size_t paylen);
107
108 static enum sctp_disposition sctp_sf_violation_chunklen(
109 struct net *net,
110 const struct sctp_endpoint *ep,
111 const struct sctp_association *asoc,
112 const union sctp_subtype type,
113 void *arg,
114 struct sctp_cmd_seq *commands);
115
116 static enum sctp_disposition sctp_sf_violation_paramlen(
117 struct net *net,
118 const struct sctp_endpoint *ep,
119 const struct sctp_association *asoc,
120 const union sctp_subtype type,
121 void *arg, void *ext,
122 struct sctp_cmd_seq *commands);
123
124 static enum sctp_disposition sctp_sf_violation_ctsn(
125 struct net *net,
126 const struct sctp_endpoint *ep,
127 const struct sctp_association *asoc,
128 const union sctp_subtype type,
129 void *arg,
130 struct sctp_cmd_seq *commands);
131
132 static enum sctp_disposition sctp_sf_violation_chunk(
133 struct net *net,
134 const struct sctp_endpoint *ep,
135 const struct sctp_association *asoc,
136 const union sctp_subtype type,
137 void *arg,
138 struct sctp_cmd_seq *commands);
139
140 static enum sctp_ierror sctp_sf_authenticate(
141 const struct sctp_association *asoc,
142 struct sctp_chunk *chunk);
143
144 static enum sctp_disposition __sctp_sf_do_9_1_abort(
145 struct net *net,
146 const struct sctp_endpoint *ep,
147 const struct sctp_association *asoc,
148 const union sctp_subtype type,
149 void *arg,
150 struct sctp_cmd_seq *commands);
151
152
153
154
155
156
157
158
159 static inline bool sctp_chunk_length_valid(struct sctp_chunk *chunk,
160 __u16 required_length)
161 {
162 __u16 chunk_length = ntohs(chunk->chunk_hdr->length);
163
164
165 if (unlikely(chunk->pdiscard))
166 return false;
167 if (unlikely(chunk_length < required_length))
168 return false;
169
170 return true;
171 }
172
173
174 static inline bool sctp_err_chunk_valid(struct sctp_chunk *chunk)
175 {
176 struct sctp_errhdr *err;
177
178 sctp_walk_errors(err, chunk->chunk_hdr);
179
180 return (void *)err == (void *)chunk->chunk_end;
181 }
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218 enum sctp_disposition sctp_sf_do_4_C(struct net *net,
219 const struct sctp_endpoint *ep,
220 const struct sctp_association *asoc,
221 const union sctp_subtype type,
222 void *arg, struct sctp_cmd_seq *commands)
223 {
224 struct sctp_chunk *chunk = arg;
225 struct sctp_ulpevent *ev;
226
227 if (!sctp_vtag_verify_either(chunk, asoc))
228 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
229
230
231
232
233
234
235 if (!chunk->singleton)
236 return sctp_sf_violation_chunk(net, ep, asoc, type, arg, commands);
237
238
239 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
240 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
241 commands);
242
243
244
245
246
247
248
249
250 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_SHUTDOWN_COMP,
251 0, 0, 0, NULL, GFP_ATOMIC);
252 if (ev)
253 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
254 SCTP_ULPEVENT(ev));
255
256
257
258
259
260
261
262
263
264 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
265 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
266
267 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
268 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
269
270 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
271 SCTP_STATE(SCTP_STATE_CLOSED));
272
273 SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS);
274 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
275
276 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
277
278 return SCTP_DISPOSITION_DELETE_TCB;
279 }
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303 enum sctp_disposition sctp_sf_do_5_1B_init(struct net *net,
304 const struct sctp_endpoint *ep,
305 const struct sctp_association *asoc,
306 const union sctp_subtype type,
307 void *arg,
308 struct sctp_cmd_seq *commands)
309 {
310 struct sctp_chunk *chunk = arg, *repl, *err_chunk;
311 struct sctp_unrecognized_param *unk_param;
312 struct sctp_association *new_asoc;
313 struct sctp_packet *packet;
314 int len;
315
316
317 if (security_sctp_assoc_request((struct sctp_endpoint *)ep,
318 chunk->skb))
319 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
320
321
322
323
324
325
326
327
328
329
330 if (!chunk->singleton)
331 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
332
333
334
335
336 if (ep == sctp_sk(net->sctp.ctl_sock)->ep) {
337 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
338 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
339 }
340
341
342
343
344 if (chunk->sctp_hdr->vtag != 0)
345 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
346
347
348
349
350
351
352 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
353 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
354
355
356
357
358
359
360
361 if (sctp_sstate(ep->base.sk, CLOSING))
362 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
363
364
365 err_chunk = NULL;
366 if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type,
367 (struct sctp_init_chunk *)chunk->chunk_hdr, chunk,
368 &err_chunk)) {
369
370
371
372 if (err_chunk) {
373 packet = sctp_abort_pkt_new(net, ep, asoc, arg,
374 (__u8 *)(err_chunk->chunk_hdr) +
375 sizeof(struct sctp_chunkhdr),
376 ntohs(err_chunk->chunk_hdr->length) -
377 sizeof(struct sctp_chunkhdr));
378
379 sctp_chunk_free(err_chunk);
380
381 if (packet) {
382 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
383 SCTP_PACKET(packet));
384 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
385 return SCTP_DISPOSITION_CONSUME;
386 } else {
387 return SCTP_DISPOSITION_NOMEM;
388 }
389 } else {
390 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg,
391 commands);
392 }
393 }
394
395
396 chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data;
397
398
399 chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(struct sctp_inithdr));
400
401 new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC);
402 if (!new_asoc)
403 goto nomem;
404
405 if (sctp_assoc_set_bind_addr_from_ep(new_asoc,
406 sctp_scope(sctp_source(chunk)),
407 GFP_ATOMIC) < 0)
408 goto nomem_init;
409
410
411 if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk),
412 (struct sctp_init_chunk *)chunk->chunk_hdr,
413 GFP_ATOMIC))
414 goto nomem_init;
415
416
417
418
419
420
421 len = 0;
422 if (err_chunk)
423 len = ntohs(err_chunk->chunk_hdr->length) -
424 sizeof(struct sctp_chunkhdr);
425
426 repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
427 if (!repl)
428 goto nomem_init;
429
430
431
432
433
434 if (err_chunk) {
435
436
437
438
439
440
441
442 unk_param = (struct sctp_unrecognized_param *)
443 ((__u8 *)(err_chunk->chunk_hdr) +
444 sizeof(struct sctp_chunkhdr));
445
446
447
448 sctp_addto_chunk(repl, len, unk_param);
449 sctp_chunk_free(err_chunk);
450 }
451
452 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
453
454 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
455
456
457
458
459
460
461
462 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
463
464 return SCTP_DISPOSITION_DELETE_TCB;
465
466 nomem_init:
467 sctp_association_free(new_asoc);
468 nomem:
469 if (err_chunk)
470 sctp_chunk_free(err_chunk);
471 return SCTP_DISPOSITION_NOMEM;
472 }
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502 enum sctp_disposition sctp_sf_do_5_1C_ack(struct net *net,
503 const struct sctp_endpoint *ep,
504 const struct sctp_association *asoc,
505 const union sctp_subtype type,
506 void *arg,
507 struct sctp_cmd_seq *commands)
508 {
509 struct sctp_init_chunk *initchunk;
510 struct sctp_chunk *chunk = arg;
511 struct sctp_chunk *err_chunk;
512 struct sctp_packet *packet;
513
514 if (!sctp_vtag_verify(chunk, asoc))
515 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
516
517
518
519
520
521 if (!chunk->singleton)
522 return sctp_sf_violation_chunk(net, ep, asoc, type, arg, commands);
523
524
525 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_initack_chunk)))
526 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
527 commands);
528
529 chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data;
530
531
532 err_chunk = NULL;
533 if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type,
534 (struct sctp_init_chunk *)chunk->chunk_hdr, chunk,
535 &err_chunk)) {
536
537 enum sctp_error error = SCTP_ERROR_NO_RESOURCE;
538
539
540
541
542
543
544 if (err_chunk) {
545 packet = sctp_abort_pkt_new(net, ep, asoc, arg,
546 (__u8 *)(err_chunk->chunk_hdr) +
547 sizeof(struct sctp_chunkhdr),
548 ntohs(err_chunk->chunk_hdr->length) -
549 sizeof(struct sctp_chunkhdr));
550
551 sctp_chunk_free(err_chunk);
552
553 if (packet) {
554 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
555 SCTP_PACKET(packet));
556 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
557 error = SCTP_ERROR_INV_PARAM;
558 }
559 }
560
561
562
563
564
565
566
567
568
569
570
571
572 if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
573 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
574
575 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
576 return sctp_stop_t1_and_abort(net, commands, error, ECONNREFUSED,
577 asoc, chunk->transport);
578 }
579
580
581
582
583 chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(struct sctp_inithdr));
584
585 initchunk = (struct sctp_init_chunk *)chunk->chunk_hdr;
586
587 sctp_add_cmd_sf(commands, SCTP_CMD_PEER_INIT,
588 SCTP_PEER_INIT(initchunk));
589
590
591 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());
592
593
594
595
596
597 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
598 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
599 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
600 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
601 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
602 SCTP_STATE(SCTP_STATE_COOKIE_ECHOED));
603
604
605
606
607 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_SHKEY, SCTP_NULL());
608
609
610
611
612
613
614
615 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_COOKIE_ECHO,
616 SCTP_CHUNK(err_chunk));
617
618 return SCTP_DISPOSITION_CONSUME;
619 }
620
621 static bool sctp_auth_chunk_verify(struct net *net, struct sctp_chunk *chunk,
622 const struct sctp_association *asoc)
623 {
624 struct sctp_chunk auth;
625
626 if (!chunk->auth_chunk)
627 return true;
628
629
630
631
632
633
634
635
636
637 if (!net->sctp.auth_enable || !asoc->peer.auth_capable)
638 return false;
639
640
641 auth.skb = chunk->auth_chunk;
642 auth.asoc = chunk->asoc;
643 auth.sctp_hdr = chunk->sctp_hdr;
644 auth.chunk_hdr = (struct sctp_chunkhdr *)
645 skb_push(chunk->auth_chunk,
646 sizeof(struct sctp_chunkhdr));
647 skb_pull(chunk->auth_chunk, sizeof(struct sctp_chunkhdr));
648 auth.transport = chunk->transport;
649
650 return sctp_sf_authenticate(asoc, &auth) == SCTP_IERROR_NO_ERROR;
651 }
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684 enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,
685 const struct sctp_endpoint *ep,
686 const struct sctp_association *asoc,
687 const union sctp_subtype type,
688 void *arg,
689 struct sctp_cmd_seq *commands)
690 {
691 struct sctp_ulpevent *ev, *ai_ev = NULL, *auth_ev = NULL;
692 struct sctp_association *new_asoc;
693 struct sctp_init_chunk *peer_init;
694 struct sctp_chunk *chunk = arg;
695 struct sctp_chunk *err_chk_p;
696 struct sctp_chunk *repl;
697 struct sock *sk;
698 int error = 0;
699
700
701
702
703 if (ep == sctp_sk(net->sctp.ctl_sock)->ep) {
704 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
705 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
706 }
707
708
709
710
711
712
713 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
714 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
715
716
717
718
719
720 sk = ep->base.sk;
721 if (!sctp_sstate(sk, LISTENING) ||
722 (sctp_style(sk, TCP) && sk_acceptq_is_full(sk)))
723 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
724
725
726
727
728 chunk->subh.cookie_hdr =
729 (struct sctp_signed_cookie *)chunk->skb->data;
730 if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
731 sizeof(struct sctp_chunkhdr)))
732 goto nomem;
733
734
735
736
737
738 new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, &error,
739 &err_chk_p);
740
741
742
743
744
745
746
747 if (!new_asoc) {
748
749
750
751 switch (error) {
752 case -SCTP_IERROR_NOMEM:
753 goto nomem;
754
755 case -SCTP_IERROR_STALE_COOKIE:
756 sctp_send_stale_cookie_err(net, ep, asoc, chunk, commands,
757 err_chk_p);
758 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
759
760 case -SCTP_IERROR_BAD_SIG:
761 default:
762 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
763 }
764 }
765
766
767
768
769
770
771
772
773
774
775 peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
776
777 if (!sctp_process_init(new_asoc, chunk,
778 &chunk->subh.cookie_hdr->c.peer_addr,
779 peer_init, GFP_ATOMIC))
780 goto nomem_init;
781
782
783
784
785
786 error = sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC);
787 if (error)
788 goto nomem_init;
789
790 if (!sctp_auth_chunk_verify(net, chunk, new_asoc)) {
791 sctp_association_free(new_asoc);
792 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
793 }
794
795 repl = sctp_make_cookie_ack(new_asoc, chunk);
796 if (!repl)
797 goto nomem_init;
798
799
800
801
802
803
804
805 ev = sctp_ulpevent_make_assoc_change(new_asoc, 0, SCTP_COMM_UP, 0,
806 new_asoc->c.sinit_num_ostreams,
807 new_asoc->c.sinit_max_instreams,
808 NULL, GFP_ATOMIC);
809 if (!ev)
810 goto nomem_ev;
811
812
813
814
815
816
817 if (new_asoc->peer.adaptation_ind) {
818 ai_ev = sctp_ulpevent_make_adaptation_indication(new_asoc,
819 GFP_ATOMIC);
820 if (!ai_ev)
821 goto nomem_aiev;
822 }
823
824 if (!new_asoc->peer.auth_capable) {
825 auth_ev = sctp_ulpevent_make_authkey(new_asoc, 0,
826 SCTP_AUTH_NO_AUTH,
827 GFP_ATOMIC);
828 if (!auth_ev)
829 goto nomem_authev;
830 }
831
832
833
834
835
836
837 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
838 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
839 SCTP_STATE(SCTP_STATE_ESTABLISHED));
840 SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
841 SCTP_INC_STATS(net, SCTP_MIB_PASSIVEESTABS);
842 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
843
844 if (new_asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
845 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
846 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
847
848
849 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
850
851
852 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
853
854
855 if (ai_ev)
856 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
857 SCTP_ULPEVENT(ai_ev));
858
859 if (auth_ev)
860 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
861 SCTP_ULPEVENT(auth_ev));
862
863 return SCTP_DISPOSITION_CONSUME;
864
865 nomem_authev:
866 sctp_ulpevent_free(ai_ev);
867 nomem_aiev:
868 sctp_ulpevent_free(ev);
869 nomem_ev:
870 sctp_chunk_free(repl);
871 nomem_init:
872 sctp_association_free(new_asoc);
873 nomem:
874 return SCTP_DISPOSITION_NOMEM;
875 }
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898 enum sctp_disposition sctp_sf_do_5_1E_ca(struct net *net,
899 const struct sctp_endpoint *ep,
900 const struct sctp_association *asoc,
901 const union sctp_subtype type,
902 void *arg,
903 struct sctp_cmd_seq *commands)
904 {
905 struct sctp_chunk *chunk = arg;
906 struct sctp_ulpevent *ev;
907
908 if (!sctp_vtag_verify(chunk, asoc))
909 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
910
911
912
913
914 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
915 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
916 commands);
917
918
919
920
921
922
923
924 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());
925
926
927 security_inet_conn_established(ep->base.sk, chunk->skb);
928
929
930
931
932
933
934
935 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
936 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
937 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
938 SCTP_STATE(SCTP_STATE_ESTABLISHED));
939 SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
940 SCTP_INC_STATS(net, SCTP_MIB_ACTIVEESTABS);
941 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
942 if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
943 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
944 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
945
946
947
948
949
950 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_COMM_UP,
951 0, asoc->c.sinit_num_ostreams,
952 asoc->c.sinit_max_instreams,
953 NULL, GFP_ATOMIC);
954
955 if (!ev)
956 goto nomem;
957
958 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
959
960
961
962
963
964
965 if (asoc->peer.adaptation_ind) {
966 ev = sctp_ulpevent_make_adaptation_indication(asoc, GFP_ATOMIC);
967 if (!ev)
968 goto nomem;
969
970 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
971 SCTP_ULPEVENT(ev));
972 }
973
974 if (!asoc->peer.auth_capable) {
975 ev = sctp_ulpevent_make_authkey(asoc, 0, SCTP_AUTH_NO_AUTH,
976 GFP_ATOMIC);
977 if (!ev)
978 goto nomem;
979 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
980 SCTP_ULPEVENT(ev));
981 }
982
983 return SCTP_DISPOSITION_CONSUME;
984 nomem:
985 return SCTP_DISPOSITION_NOMEM;
986 }
987
988
989 static enum sctp_disposition sctp_sf_heartbeat(
990 const struct sctp_endpoint *ep,
991 const struct sctp_association *asoc,
992 const union sctp_subtype type,
993 void *arg,
994 struct sctp_cmd_seq *commands)
995 {
996 struct sctp_transport *transport = (struct sctp_transport *) arg;
997 struct sctp_chunk *reply;
998
999
1000 reply = sctp_make_heartbeat(asoc, transport);
1001 if (!reply)
1002 return SCTP_DISPOSITION_NOMEM;
1003
1004
1005
1006
1007 sctp_add_cmd_sf(commands, SCTP_CMD_RTO_PENDING,
1008 SCTP_TRANSPORT(transport));
1009
1010 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
1011 return SCTP_DISPOSITION_CONSUME;
1012 }
1013
1014
1015 enum sctp_disposition sctp_sf_sendbeat_8_3(struct net *net,
1016 const struct sctp_endpoint *ep,
1017 const struct sctp_association *asoc,
1018 const union sctp_subtype type,
1019 void *arg,
1020 struct sctp_cmd_seq *commands)
1021 {
1022 struct sctp_transport *transport = (struct sctp_transport *) arg;
1023
1024 if (asoc->overall_error_count >= asoc->max_retrans) {
1025 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
1026 SCTP_ERROR(ETIMEDOUT));
1027
1028 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
1029 SCTP_PERR(SCTP_ERROR_NO_ERROR));
1030 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
1031 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
1032 return SCTP_DISPOSITION_DELETE_TCB;
1033 }
1034
1035
1036
1037
1038
1039
1040
1041
1042 if (transport->param_flags & SPP_HB_ENABLE) {
1043 if (SCTP_DISPOSITION_NOMEM ==
1044 sctp_sf_heartbeat(ep, asoc, type, arg,
1045 commands))
1046 return SCTP_DISPOSITION_NOMEM;
1047
1048
1049
1050
1051 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_HB_SENT,
1052 SCTP_TRANSPORT(transport));
1053 }
1054 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_IDLE,
1055 SCTP_TRANSPORT(transport));
1056 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMER_UPDATE,
1057 SCTP_TRANSPORT(transport));
1058
1059 return SCTP_DISPOSITION_CONSUME;
1060 }
1061
1062
1063 enum sctp_disposition sctp_sf_send_reconf(struct net *net,
1064 const struct sctp_endpoint *ep,
1065 const struct sctp_association *asoc,
1066 const union sctp_subtype type,
1067 void *arg,
1068 struct sctp_cmd_seq *commands)
1069 {
1070 struct sctp_transport *transport = arg;
1071
1072 if (asoc->overall_error_count >= asoc->max_retrans) {
1073 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
1074 SCTP_ERROR(ETIMEDOUT));
1075
1076 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
1077 SCTP_PERR(SCTP_ERROR_NO_ERROR));
1078 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
1079 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
1080 return SCTP_DISPOSITION_DELETE_TCB;
1081 }
1082
1083 sctp_chunk_hold(asoc->strreset_chunk);
1084 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
1085 SCTP_CHUNK(asoc->strreset_chunk));
1086 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE, SCTP_TRANSPORT(transport));
1087
1088 return SCTP_DISPOSITION_CONSUME;
1089 }
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115 enum sctp_disposition sctp_sf_beat_8_3(struct net *net,
1116 const struct sctp_endpoint *ep,
1117 const struct sctp_association *asoc,
1118 const union sctp_subtype type,
1119 void *arg, struct sctp_cmd_seq *commands)
1120 {
1121 struct sctp_paramhdr *param_hdr;
1122 struct sctp_chunk *chunk = arg;
1123 struct sctp_chunk *reply;
1124 size_t paylen = 0;
1125
1126 if (!sctp_vtag_verify(chunk, asoc))
1127 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1128
1129
1130 if (!sctp_chunk_length_valid(chunk,
1131 sizeof(struct sctp_heartbeat_chunk)))
1132 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1133 commands);
1134
1135
1136
1137
1138
1139 chunk->subh.hb_hdr = (struct sctp_heartbeathdr *)chunk->skb->data;
1140 param_hdr = (struct sctp_paramhdr *)chunk->subh.hb_hdr;
1141 paylen = ntohs(chunk->chunk_hdr->length) - sizeof(struct sctp_chunkhdr);
1142
1143 if (ntohs(param_hdr->length) > paylen)
1144 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
1145 param_hdr, commands);
1146
1147 if (!pskb_pull(chunk->skb, paylen))
1148 goto nomem;
1149
1150 reply = sctp_make_heartbeat_ack(asoc, chunk, param_hdr, paylen);
1151 if (!reply)
1152 goto nomem;
1153
1154 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
1155 return SCTP_DISPOSITION_CONSUME;
1156
1157 nomem:
1158 return SCTP_DISPOSITION_NOMEM;
1159 }
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189 enum sctp_disposition sctp_sf_backbeat_8_3(struct net *net,
1190 const struct sctp_endpoint *ep,
1191 const struct sctp_association *asoc,
1192 const union sctp_subtype type,
1193 void *arg,
1194 struct sctp_cmd_seq *commands)
1195 {
1196 struct sctp_sender_hb_info *hbinfo;
1197 struct sctp_chunk *chunk = arg;
1198 struct sctp_transport *link;
1199 unsigned long max_interval;
1200 union sctp_addr from_addr;
1201
1202 if (!sctp_vtag_verify(chunk, asoc))
1203 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1204
1205
1206 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr) +
1207 sizeof(*hbinfo)))
1208 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1209 commands);
1210
1211 hbinfo = (struct sctp_sender_hb_info *)chunk->skb->data;
1212
1213 if (ntohs(hbinfo->param_hdr.length) != sizeof(*hbinfo))
1214 return SCTP_DISPOSITION_DISCARD;
1215
1216 from_addr = hbinfo->daddr;
1217 link = sctp_assoc_lookup_paddr(asoc, &from_addr);
1218
1219
1220 if (unlikely(!link)) {
1221 if (from_addr.sa.sa_family == AF_INET6) {
1222 net_warn_ratelimited("%s association %p could not find address %pI6\n",
1223 __func__,
1224 asoc,
1225 &from_addr.v6.sin6_addr);
1226 } else {
1227 net_warn_ratelimited("%s association %p could not find address %pI4\n",
1228 __func__,
1229 asoc,
1230 &from_addr.v4.sin_addr.s_addr);
1231 }
1232 return SCTP_DISPOSITION_DISCARD;
1233 }
1234
1235
1236 if (hbinfo->hb_nonce != link->hb_nonce)
1237 return SCTP_DISPOSITION_DISCARD;
1238
1239 max_interval = link->hbinterval + link->rto;
1240
1241
1242 if (time_after(hbinfo->sent_at, jiffies) ||
1243 time_after(jiffies, hbinfo->sent_at + max_interval)) {
1244 pr_debug("%s: HEARTBEAT ACK with invalid timestamp received "
1245 "for transport:%p\n", __func__, link);
1246
1247 return SCTP_DISPOSITION_DISCARD;
1248 }
1249
1250
1251
1252
1253
1254
1255
1256 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_ON, SCTP_TRANSPORT(link));
1257
1258 return SCTP_DISPOSITION_CONSUME;
1259 }
1260
1261
1262
1263
1264 static int sctp_sf_send_restart_abort(struct net *net, union sctp_addr *ssa,
1265 struct sctp_chunk *init,
1266 struct sctp_cmd_seq *commands)
1267 {
1268 struct sctp_af *af = sctp_get_af_specific(ssa->v4.sin_family);
1269 union sctp_addr_param *addrparm;
1270 struct sctp_errhdr *errhdr;
1271 char buffer[sizeof(*errhdr) + sizeof(*addrparm)];
1272 struct sctp_endpoint *ep;
1273 struct sctp_packet *pkt;
1274 int len;
1275
1276
1277
1278
1279 errhdr = (struct sctp_errhdr *)buffer;
1280 addrparm = (union sctp_addr_param *)errhdr->variable;
1281
1282
1283 len = af->to_addr_param(ssa, addrparm);
1284 len += sizeof(*errhdr);
1285
1286 errhdr->cause = SCTP_ERROR_RESTART;
1287 errhdr->length = htons(len);
1288
1289
1290 ep = sctp_sk(net->sctp.ctl_sock)->ep;
1291
1292
1293
1294
1295 pkt = sctp_abort_pkt_new(net, ep, NULL, init, errhdr, len);
1296
1297 if (!pkt)
1298 goto out;
1299 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT, SCTP_PACKET(pkt));
1300
1301 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
1302
1303
1304 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
1305
1306 out:
1307
1308
1309
1310 return 0;
1311 }
1312
1313 static bool list_has_sctp_addr(const struct list_head *list,
1314 union sctp_addr *ipaddr)
1315 {
1316 struct sctp_transport *addr;
1317
1318 list_for_each_entry(addr, list, transports) {
1319 if (sctp_cmp_addr_exact(ipaddr, &addr->ipaddr))
1320 return true;
1321 }
1322
1323 return false;
1324 }
1325
1326
1327
1328 static int sctp_sf_check_restart_addrs(const struct sctp_association *new_asoc,
1329 const struct sctp_association *asoc,
1330 struct sctp_chunk *init,
1331 struct sctp_cmd_seq *commands)
1332 {
1333 struct net *net = sock_net(new_asoc->base.sk);
1334 struct sctp_transport *new_addr;
1335 int ret = 1;
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348 list_for_each_entry(new_addr, &new_asoc->peer.transport_addr_list,
1349 transports) {
1350 if (!list_has_sctp_addr(&asoc->peer.transport_addr_list,
1351 &new_addr->ipaddr)) {
1352 sctp_sf_send_restart_abort(net, &new_addr->ipaddr, init,
1353 commands);
1354 ret = 0;
1355 break;
1356 }
1357 }
1358
1359
1360 return ret;
1361 }
1362
1363
1364
1365
1366
1367
1368 static void sctp_tietags_populate(struct sctp_association *new_asoc,
1369 const struct sctp_association *asoc)
1370 {
1371 switch (asoc->state) {
1372
1373
1374
1375 case SCTP_STATE_COOKIE_WAIT:
1376 new_asoc->c.my_vtag = asoc->c.my_vtag;
1377 new_asoc->c.my_ttag = asoc->c.my_vtag;
1378 new_asoc->c.peer_ttag = 0;
1379 break;
1380
1381 case SCTP_STATE_COOKIE_ECHOED:
1382 new_asoc->c.my_vtag = asoc->c.my_vtag;
1383 new_asoc->c.my_ttag = asoc->c.my_vtag;
1384 new_asoc->c.peer_ttag = asoc->c.peer_vtag;
1385 break;
1386
1387
1388
1389
1390 default:
1391 new_asoc->c.my_ttag = asoc->c.my_vtag;
1392 new_asoc->c.peer_ttag = asoc->c.peer_vtag;
1393 break;
1394 }
1395
1396
1397
1398
1399
1400 new_asoc->rwnd = asoc->rwnd;
1401 new_asoc->c.sinit_num_ostreams = asoc->c.sinit_num_ostreams;
1402 new_asoc->c.sinit_max_instreams = asoc->c.sinit_max_instreams;
1403 new_asoc->c.initial_tsn = asoc->c.initial_tsn;
1404 }
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415 static char sctp_tietags_compare(struct sctp_association *new_asoc,
1416 const struct sctp_association *asoc)
1417 {
1418
1419 if ((asoc->c.my_vtag != new_asoc->c.my_vtag) &&
1420 (asoc->c.peer_vtag != new_asoc->c.peer_vtag) &&
1421 (asoc->c.my_vtag == new_asoc->c.my_ttag) &&
1422 (asoc->c.peer_vtag == new_asoc->c.peer_ttag))
1423 return 'A';
1424
1425
1426 if ((asoc->c.my_vtag == new_asoc->c.my_vtag) &&
1427 ((asoc->c.peer_vtag != new_asoc->c.peer_vtag) ||
1428 (0 == asoc->c.peer_vtag))) {
1429 return 'B';
1430 }
1431
1432
1433 if ((asoc->c.my_vtag == new_asoc->c.my_vtag) &&
1434 (asoc->c.peer_vtag == new_asoc->c.peer_vtag))
1435 return 'D';
1436
1437
1438 if ((asoc->c.my_vtag != new_asoc->c.my_vtag) &&
1439 (asoc->c.peer_vtag == new_asoc->c.peer_vtag) &&
1440 (0 == new_asoc->c.my_ttag) &&
1441 (0 == new_asoc->c.peer_ttag))
1442 return 'C';
1443
1444
1445 return 'E';
1446 }
1447
1448
1449
1450
1451 static enum sctp_disposition sctp_sf_do_unexpected_init(
1452 struct net *net,
1453 const struct sctp_endpoint *ep,
1454 const struct sctp_association *asoc,
1455 const union sctp_subtype type,
1456 void *arg,
1457 struct sctp_cmd_seq *commands)
1458 {
1459 struct sctp_chunk *chunk = arg, *repl, *err_chunk;
1460 struct sctp_unrecognized_param *unk_param;
1461 struct sctp_association *new_asoc;
1462 enum sctp_disposition retval;
1463 struct sctp_packet *packet;
1464 int len;
1465
1466
1467 if (security_sctp_assoc_request((struct sctp_endpoint *)ep,
1468 chunk->skb))
1469 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480 if (!chunk->singleton)
1481 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1482
1483
1484
1485
1486 if (chunk->sctp_hdr->vtag != 0)
1487 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
1488
1489
1490
1491
1492
1493 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
1494 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1495 commands);
1496
1497 chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data;
1498
1499
1500 chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(struct sctp_inithdr));
1501
1502
1503 err_chunk = NULL;
1504 if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type,
1505 (struct sctp_init_chunk *)chunk->chunk_hdr, chunk,
1506 &err_chunk)) {
1507
1508
1509
1510 if (err_chunk) {
1511 packet = sctp_abort_pkt_new(net, ep, asoc, arg,
1512 (__u8 *)(err_chunk->chunk_hdr) +
1513 sizeof(struct sctp_chunkhdr),
1514 ntohs(err_chunk->chunk_hdr->length) -
1515 sizeof(struct sctp_chunkhdr));
1516
1517 if (packet) {
1518 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
1519 SCTP_PACKET(packet));
1520 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
1521 retval = SCTP_DISPOSITION_CONSUME;
1522 } else {
1523 retval = SCTP_DISPOSITION_NOMEM;
1524 }
1525 goto cleanup;
1526 } else {
1527 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg,
1528 commands);
1529 }
1530 }
1531
1532
1533
1534
1535
1536
1537
1538
1539 new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC);
1540 if (!new_asoc)
1541 goto nomem;
1542
1543 if (sctp_assoc_set_bind_addr_from_ep(new_asoc,
1544 sctp_scope(sctp_source(chunk)), GFP_ATOMIC) < 0)
1545 goto nomem;
1546
1547
1548
1549
1550
1551 if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk),
1552 (struct sctp_init_chunk *)chunk->chunk_hdr,
1553 GFP_ATOMIC))
1554 goto nomem;
1555
1556
1557
1558
1559
1560
1561 if (!sctp_state(asoc, COOKIE_WAIT)) {
1562 if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk,
1563 commands)) {
1564 retval = SCTP_DISPOSITION_CONSUME;
1565 goto nomem_retval;
1566 }
1567 }
1568
1569 sctp_tietags_populate(new_asoc, asoc);
1570
1571
1572
1573
1574
1575
1576 len = 0;
1577 if (err_chunk) {
1578 len = ntohs(err_chunk->chunk_hdr->length) -
1579 sizeof(struct sctp_chunkhdr);
1580 }
1581
1582 repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
1583 if (!repl)
1584 goto nomem;
1585
1586
1587
1588
1589
1590 if (err_chunk) {
1591
1592
1593
1594
1595
1596
1597
1598 unk_param = (struct sctp_unrecognized_param *)
1599 ((__u8 *)(err_chunk->chunk_hdr) +
1600 sizeof(struct sctp_chunkhdr));
1601
1602
1603
1604 sctp_addto_chunk(repl, len, unk_param);
1605 }
1606
1607 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
1608 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1609
1610
1611
1612
1613
1614
1615 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
1616 retval = SCTP_DISPOSITION_CONSUME;
1617
1618 return retval;
1619
1620 nomem:
1621 retval = SCTP_DISPOSITION_NOMEM;
1622 nomem_retval:
1623 if (new_asoc)
1624 sctp_association_free(new_asoc);
1625 cleanup:
1626 if (err_chunk)
1627 sctp_chunk_free(err_chunk);
1628 return retval;
1629 }
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669 enum sctp_disposition sctp_sf_do_5_2_1_siminit(
1670 struct net *net,
1671 const struct sctp_endpoint *ep,
1672 const struct sctp_association *asoc,
1673 const union sctp_subtype type,
1674 void *arg,
1675 struct sctp_cmd_seq *commands)
1676 {
1677
1678
1679
1680 return sctp_sf_do_unexpected_init(net, ep, asoc, type, arg, commands);
1681 }
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724 enum sctp_disposition sctp_sf_do_5_2_2_dupinit(
1725 struct net *net,
1726 const struct sctp_endpoint *ep,
1727 const struct sctp_association *asoc,
1728 const union sctp_subtype type,
1729 void *arg,
1730 struct sctp_cmd_seq *commands)
1731 {
1732
1733
1734
1735 return sctp_sf_do_unexpected_init(net, ep, asoc, type, arg, commands);
1736 }
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748 enum sctp_disposition sctp_sf_do_5_2_3_initack(
1749 struct net *net,
1750 const struct sctp_endpoint *ep,
1751 const struct sctp_association *asoc,
1752 const union sctp_subtype type,
1753 void *arg,
1754 struct sctp_cmd_seq *commands)
1755 {
1756
1757
1758
1759 if (ep == sctp_sk(net->sctp.ctl_sock)->ep)
1760 return sctp_sf_ootb(net, ep, asoc, type, arg, commands);
1761 else
1762 return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
1763 }
1764
1765
1766
1767
1768
1769
1770 static enum sctp_disposition sctp_sf_do_dupcook_a(
1771 struct net *net,
1772 const struct sctp_endpoint *ep,
1773 const struct sctp_association *asoc,
1774 struct sctp_chunk *chunk,
1775 struct sctp_cmd_seq *commands,
1776 struct sctp_association *new_asoc)
1777 {
1778 struct sctp_init_chunk *peer_init;
1779 enum sctp_disposition disposition;
1780 struct sctp_ulpevent *ev;
1781 struct sctp_chunk *repl;
1782 struct sctp_chunk *err;
1783
1784
1785
1786
1787 peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
1788
1789 if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk), peer_init,
1790 GFP_ATOMIC))
1791 goto nomem;
1792
1793 if (sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC))
1794 goto nomem;
1795
1796 if (!sctp_auth_chunk_verify(net, chunk, new_asoc))
1797 return SCTP_DISPOSITION_DISCARD;
1798
1799
1800
1801
1802
1803 if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk, commands))
1804 return SCTP_DISPOSITION_CONSUME;
1805
1806
1807
1808
1809
1810
1811
1812 if (sctp_state(asoc, SHUTDOWN_ACK_SENT)) {
1813 disposition = sctp_sf_do_9_2_reshutack(net, ep, asoc,
1814 SCTP_ST_CHUNK(chunk->chunk_hdr->type),
1815 chunk, commands);
1816 if (SCTP_DISPOSITION_NOMEM == disposition)
1817 goto nomem;
1818
1819 err = sctp_make_op_error(asoc, chunk,
1820 SCTP_ERROR_COOKIE_IN_SHUTDOWN,
1821 NULL, 0, 0);
1822 if (err)
1823 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
1824 SCTP_CHUNK(err));
1825
1826 return SCTP_DISPOSITION_CONSUME;
1827 }
1828
1829
1830
1831
1832 sctp_add_cmd_sf(commands, SCTP_CMD_T3_RTX_TIMERS_STOP, SCTP_NULL());
1833 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
1834 SCTP_TO(SCTP_EVENT_TIMEOUT_SACK));
1835 sctp_add_cmd_sf(commands, SCTP_CMD_PURGE_OUTQUEUE, SCTP_NULL());
1836
1837
1838
1839
1840 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
1841 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
1842 sctp_add_cmd_sf(commands, SCTP_CMD_PURGE_ASCONF_QUEUE, SCTP_NULL());
1843
1844 repl = sctp_make_cookie_ack(new_asoc, chunk);
1845 if (!repl)
1846 goto nomem;
1847
1848
1849 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_RESTART, 0,
1850 new_asoc->c.sinit_num_ostreams,
1851 new_asoc->c.sinit_max_instreams,
1852 NULL, GFP_ATOMIC);
1853 if (!ev)
1854 goto nomem_ev;
1855
1856
1857 sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
1858 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
1859 if ((sctp_state(asoc, SHUTDOWN_PENDING) ||
1860 sctp_state(asoc, SHUTDOWN_SENT)) &&
1861 (sctp_sstate(asoc->base.sk, CLOSING) ||
1862 sock_flag(asoc->base.sk, SOCK_DEAD))) {
1863
1864
1865
1866
1867 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1868 return sctp_sf_do_9_2_start_shutdown(net, ep, asoc,
1869 SCTP_ST_CHUNK(0), repl,
1870 commands);
1871 } else {
1872 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
1873 SCTP_STATE(SCTP_STATE_ESTABLISHED));
1874 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1875 }
1876 return SCTP_DISPOSITION_CONSUME;
1877
1878 nomem_ev:
1879 sctp_chunk_free(repl);
1880 nomem:
1881 return SCTP_DISPOSITION_NOMEM;
1882 }
1883
1884
1885
1886
1887
1888
1889
1890
1891
1892 static enum sctp_disposition sctp_sf_do_dupcook_b(
1893 struct net *net,
1894 const struct sctp_endpoint *ep,
1895 const struct sctp_association *asoc,
1896 struct sctp_chunk *chunk,
1897 struct sctp_cmd_seq *commands,
1898 struct sctp_association *new_asoc)
1899 {
1900 struct sctp_init_chunk *peer_init;
1901 struct sctp_chunk *repl;
1902
1903
1904
1905
1906 peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
1907 if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk), peer_init,
1908 GFP_ATOMIC))
1909 goto nomem;
1910
1911 if (sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC))
1912 goto nomem;
1913
1914 if (!sctp_auth_chunk_verify(net, chunk, new_asoc))
1915 return SCTP_DISPOSITION_DISCARD;
1916
1917
1918 sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
1919 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
1920 SCTP_STATE(SCTP_STATE_ESTABLISHED));
1921 SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
1922 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
1923
1924 repl = sctp_make_cookie_ack(new_asoc, chunk);
1925 if (!repl)
1926 goto nomem;
1927
1928 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1929
1930
1931
1932
1933
1934
1935
1936
1937
1938
1939
1940
1941
1942 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_CHANGE, SCTP_U8(SCTP_COMM_UP));
1943
1944
1945
1946
1947
1948
1949
1950
1951
1952 if (asoc->peer.adaptation_ind)
1953 sctp_add_cmd_sf(commands, SCTP_CMD_ADAPTATION_IND, SCTP_NULL());
1954
1955 if (!asoc->peer.auth_capable)
1956 sctp_add_cmd_sf(commands, SCTP_CMD_PEER_NO_AUTH, SCTP_NULL());
1957
1958 return SCTP_DISPOSITION_CONSUME;
1959
1960 nomem:
1961 return SCTP_DISPOSITION_NOMEM;
1962 }
1963
1964
1965
1966
1967
1968
1969
1970
1971
1972
1973 static enum sctp_disposition sctp_sf_do_dupcook_c(
1974 struct net *net,
1975 const struct sctp_endpoint *ep,
1976 const struct sctp_association *asoc,
1977 struct sctp_chunk *chunk,
1978 struct sctp_cmd_seq *commands,
1979 struct sctp_association *new_asoc)
1980 {
1981
1982
1983
1984
1985 return SCTP_DISPOSITION_DISCARD;
1986 }
1987
1988
1989
1990
1991
1992
1993
1994
1995
1996 static enum sctp_disposition sctp_sf_do_dupcook_d(
1997 struct net *net,
1998 const struct sctp_endpoint *ep,
1999 const struct sctp_association *asoc,
2000 struct sctp_chunk *chunk,
2001 struct sctp_cmd_seq *commands,
2002 struct sctp_association *new_asoc)
2003 {
2004 struct sctp_ulpevent *ev = NULL, *ai_ev = NULL, *auth_ev = NULL;
2005 struct sctp_chunk *repl;
2006
2007
2008
2009
2010
2011
2012
2013
2014 if (!sctp_auth_chunk_verify(net, chunk, asoc))
2015 return SCTP_DISPOSITION_DISCARD;
2016
2017
2018 if (asoc->state < SCTP_STATE_ESTABLISHED) {
2019 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2020 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
2021 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2022 SCTP_STATE(SCTP_STATE_ESTABLISHED));
2023 SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
2024 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START,
2025 SCTP_NULL());
2026
2027
2028
2029
2030
2031
2032
2033
2034 ev = sctp_ulpevent_make_assoc_change(asoc, 0,
2035 SCTP_COMM_UP, 0,
2036 asoc->c.sinit_num_ostreams,
2037 asoc->c.sinit_max_instreams,
2038 NULL, GFP_ATOMIC);
2039 if (!ev)
2040 goto nomem;
2041
2042
2043
2044
2045
2046
2047 if (asoc->peer.adaptation_ind) {
2048 ai_ev = sctp_ulpevent_make_adaptation_indication(asoc,
2049 GFP_ATOMIC);
2050 if (!ai_ev)
2051 goto nomem;
2052
2053 }
2054
2055 if (!asoc->peer.auth_capable) {
2056 auth_ev = sctp_ulpevent_make_authkey(asoc, 0,
2057 SCTP_AUTH_NO_AUTH,
2058 GFP_ATOMIC);
2059 if (!auth_ev)
2060 goto nomem;
2061 }
2062 }
2063
2064 repl = sctp_make_cookie_ack(asoc, chunk);
2065 if (!repl)
2066 goto nomem;
2067
2068 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
2069
2070 if (ev)
2071 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
2072 SCTP_ULPEVENT(ev));
2073 if (ai_ev)
2074 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
2075 SCTP_ULPEVENT(ai_ev));
2076 if (auth_ev)
2077 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
2078 SCTP_ULPEVENT(auth_ev));
2079
2080 return SCTP_DISPOSITION_CONSUME;
2081
2082 nomem:
2083 if (auth_ev)
2084 sctp_ulpevent_free(auth_ev);
2085 if (ai_ev)
2086 sctp_ulpevent_free(ai_ev);
2087 if (ev)
2088 sctp_ulpevent_free(ev);
2089 return SCTP_DISPOSITION_NOMEM;
2090 }
2091
2092
2093
2094
2095
2096
2097
2098
2099
2100
2101
2102
2103
2104
2105
2106
2107
2108 enum sctp_disposition sctp_sf_do_5_2_4_dupcook(
2109 struct net *net,
2110 const struct sctp_endpoint *ep,
2111 const struct sctp_association *asoc,
2112 const union sctp_subtype type,
2113 void *arg,
2114 struct sctp_cmd_seq *commands)
2115 {
2116 struct sctp_association *new_asoc;
2117 struct sctp_chunk *chunk = arg;
2118 enum sctp_disposition retval;
2119 struct sctp_chunk *err_chk_p;
2120 int error = 0;
2121 char action;
2122
2123
2124
2125
2126
2127
2128 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
2129 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2130 commands);
2131
2132
2133
2134
2135 chunk->subh.cookie_hdr = (struct sctp_signed_cookie *)chunk->skb->data;
2136 if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
2137 sizeof(struct sctp_chunkhdr)))
2138 goto nomem;
2139
2140
2141
2142
2143
2144
2145 new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, &error,
2146 &err_chk_p);
2147
2148
2149
2150
2151
2152
2153
2154 if (!new_asoc) {
2155
2156
2157
2158 switch (error) {
2159 case -SCTP_IERROR_NOMEM:
2160 goto nomem;
2161
2162 case -SCTP_IERROR_STALE_COOKIE:
2163 sctp_send_stale_cookie_err(net, ep, asoc, chunk, commands,
2164 err_chk_p);
2165 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2166 case -SCTP_IERROR_BAD_SIG:
2167 default:
2168 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2169 }
2170 }
2171
2172
2173 if (security_sctp_assoc_request((struct sctp_endpoint *)ep,
2174 chunk->skb)) {
2175 sctp_association_free(new_asoc);
2176 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2177 }
2178
2179
2180 new_asoc->temp = 1;
2181
2182
2183
2184
2185 action = sctp_tietags_compare(new_asoc, asoc);
2186
2187 switch (action) {
2188 case 'A':
2189 retval = sctp_sf_do_dupcook_a(net, ep, asoc, chunk, commands,
2190 new_asoc);
2191 break;
2192
2193 case 'B':
2194 retval = sctp_sf_do_dupcook_b(net, ep, asoc, chunk, commands,
2195 new_asoc);
2196 break;
2197
2198 case 'C':
2199 retval = sctp_sf_do_dupcook_c(net, ep, asoc, chunk, commands,
2200 new_asoc);
2201 break;
2202
2203 case 'D':
2204 retval = sctp_sf_do_dupcook_d(net, ep, asoc, chunk, commands,
2205 new_asoc);
2206 break;
2207
2208 default:
2209 retval = sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2210 break;
2211 }
2212
2213
2214 sctp_add_cmd_sf(commands, SCTP_CMD_SET_ASOC, SCTP_ASOC(new_asoc));
2215 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
2216
2217
2218
2219
2220 sctp_add_cmd_sf(commands, SCTP_CMD_SET_ASOC,
2221 SCTP_ASOC((struct sctp_association *)asoc));
2222
2223 return retval;
2224
2225 nomem:
2226 return SCTP_DISPOSITION_NOMEM;
2227 }
2228
2229
2230
2231
2232
2233
2234 enum sctp_disposition sctp_sf_shutdown_pending_abort(
2235 struct net *net,
2236 const struct sctp_endpoint *ep,
2237 const struct sctp_association *asoc,
2238 const union sctp_subtype type,
2239 void *arg,
2240 struct sctp_cmd_seq *commands)
2241 {
2242 struct sctp_chunk *chunk = arg;
2243
2244 if (!sctp_vtag_verify_either(chunk, asoc))
2245 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2246
2247
2248
2249
2250
2251
2252
2253
2254
2255
2256
2257 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_abort_chunk)))
2258 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2259
2260
2261
2262
2263
2264
2265 if (SCTP_ADDR_DEL ==
2266 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2267 return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
2268
2269 if (!sctp_err_chunk_valid(chunk))
2270 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2271
2272 return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
2273 }
2274
2275
2276
2277
2278
2279
2280 enum sctp_disposition sctp_sf_shutdown_sent_abort(
2281 struct net *net,
2282 const struct sctp_endpoint *ep,
2283 const struct sctp_association *asoc,
2284 const union sctp_subtype type,
2285 void *arg,
2286 struct sctp_cmd_seq *commands)
2287 {
2288 struct sctp_chunk *chunk = arg;
2289
2290 if (!sctp_vtag_verify_either(chunk, asoc))
2291 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2292
2293
2294
2295
2296
2297
2298
2299
2300
2301
2302
2303 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_abort_chunk)))
2304 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2305
2306
2307
2308
2309
2310
2311 if (SCTP_ADDR_DEL ==
2312 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2313 return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
2314
2315 if (!sctp_err_chunk_valid(chunk))
2316 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2317
2318
2319 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2320 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
2321
2322
2323 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2324 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
2325
2326 return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
2327 }
2328
2329
2330
2331
2332
2333
2334 enum sctp_disposition sctp_sf_shutdown_ack_sent_abort(
2335 struct net *net,
2336 const struct sctp_endpoint *ep,
2337 const struct sctp_association *asoc,
2338 const union sctp_subtype type,
2339 void *arg,
2340 struct sctp_cmd_seq *commands)
2341 {
2342
2343
2344
2345 return sctp_sf_shutdown_sent_abort(net, ep, asoc, type, arg, commands);
2346 }
2347
2348
2349
2350
2351
2352
2353
2354
2355
2356
2357
2358
2359
2360
2361
2362 enum sctp_disposition sctp_sf_cookie_echoed_err(
2363 struct net *net,
2364 const struct sctp_endpoint *ep,
2365 const struct sctp_association *asoc,
2366 const union sctp_subtype type,
2367 void *arg,
2368 struct sctp_cmd_seq *commands)
2369 {
2370 struct sctp_chunk *chunk = arg;
2371 struct sctp_errhdr *err;
2372
2373 if (!sctp_vtag_verify(chunk, asoc))
2374 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2375
2376
2377
2378
2379 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_operr_chunk)))
2380 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2381 commands);
2382
2383
2384
2385
2386
2387
2388 sctp_walk_errors(err, chunk->chunk_hdr) {
2389 if (SCTP_ERROR_STALE_COOKIE == err->cause)
2390 return sctp_sf_do_5_2_6_stale(net, ep, asoc, type,
2391 arg, commands);
2392 }
2393
2394
2395
2396
2397
2398
2399 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2400 }
2401
2402
2403
2404
2405
2406
2407
2408
2409
2410
2411
2412
2413
2414
2415
2416
2417
2418
2419
2420
2421
2422
2423
2424
2425
2426
2427 static enum sctp_disposition sctp_sf_do_5_2_6_stale(
2428 struct net *net,
2429 const struct sctp_endpoint *ep,
2430 const struct sctp_association *asoc,
2431 const union sctp_subtype type,
2432 void *arg,
2433 struct sctp_cmd_seq *commands)
2434 {
2435 int attempts = asoc->init_err_counter + 1;
2436 struct sctp_chunk *chunk = arg, *reply;
2437 struct sctp_cookie_preserve_param bht;
2438 struct sctp_bind_addr *bp;
2439 struct sctp_errhdr *err;
2440 u32 stale;
2441
2442 if (attempts > asoc->max_init_attempts) {
2443 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
2444 SCTP_ERROR(ETIMEDOUT));
2445 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
2446 SCTP_PERR(SCTP_ERROR_STALE_COOKIE));
2447 return SCTP_DISPOSITION_DELETE_TCB;
2448 }
2449
2450 err = (struct sctp_errhdr *)(chunk->skb->data);
2451
2452
2453
2454
2455
2456
2457
2458
2459
2460
2461
2462
2463
2464
2465
2466 stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err)));
2467 stale = (stale * 2) / 1000;
2468
2469 bht.param_hdr.type = SCTP_PARAM_COOKIE_PRESERVATIVE;
2470 bht.param_hdr.length = htons(sizeof(bht));
2471 bht.lifespan_increment = htonl(stale);
2472
2473
2474 bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
2475 reply = sctp_make_init(asoc, bp, GFP_ATOMIC, sizeof(bht));
2476 if (!reply)
2477 goto nomem;
2478
2479 sctp_addto_chunk(reply, sizeof(bht), &bht);
2480
2481
2482 sctp_add_cmd_sf(commands, SCTP_CMD_CLEAR_INIT_TAG, SCTP_NULL());
2483
2484
2485 sctp_add_cmd_sf(commands, SCTP_CMD_T3_RTX_TIMERS_STOP, SCTP_NULL());
2486 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
2487
2488
2489
2490
2491 sctp_add_cmd_sf(commands, SCTP_CMD_DEL_NON_PRIMARY, SCTP_NULL());
2492
2493
2494
2495
2496 sctp_add_cmd_sf(commands, SCTP_CMD_T1_RETRAN,
2497 SCTP_TRANSPORT(asoc->peer.primary_path));
2498
2499
2500
2501
2502 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_INC, SCTP_NULL());
2503
2504 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2505 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
2506 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2507 SCTP_STATE(SCTP_STATE_COOKIE_WAIT));
2508 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
2509 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
2510
2511 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
2512
2513 return SCTP_DISPOSITION_CONSUME;
2514
2515 nomem:
2516 return SCTP_DISPOSITION_NOMEM;
2517 }
2518
2519
2520
2521
2522
2523
2524
2525
2526
2527
2528
2529
2530
2531
2532
2533
2534
2535
2536
2537
2538
2539
2540
2541
2542
2543
2544
2545
2546
2547
2548
2549
2550 enum sctp_disposition sctp_sf_do_9_1_abort(
2551 struct net *net,
2552 const struct sctp_endpoint *ep,
2553 const struct sctp_association *asoc,
2554 const union sctp_subtype type,
2555 void *arg,
2556 struct sctp_cmd_seq *commands)
2557 {
2558 struct sctp_chunk *chunk = arg;
2559
2560 if (!sctp_vtag_verify_either(chunk, asoc))
2561 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2562
2563
2564
2565
2566
2567
2568
2569
2570
2571
2572
2573 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_abort_chunk)))
2574 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2575
2576
2577
2578
2579
2580
2581 if (SCTP_ADDR_DEL ==
2582 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2583 return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
2584
2585 if (!sctp_err_chunk_valid(chunk))
2586 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2587
2588 return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
2589 }
2590
2591 static enum sctp_disposition __sctp_sf_do_9_1_abort(
2592 struct net *net,
2593 const struct sctp_endpoint *ep,
2594 const struct sctp_association *asoc,
2595 const union sctp_subtype type,
2596 void *arg,
2597 struct sctp_cmd_seq *commands)
2598 {
2599 __be16 error = SCTP_ERROR_NO_ERROR;
2600 struct sctp_chunk *chunk = arg;
2601 unsigned int len;
2602
2603
2604 len = ntohs(chunk->chunk_hdr->length);
2605 if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
2606 error = ((struct sctp_errhdr *)chunk->skb->data)->cause;
2607
2608 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(ECONNRESET));
2609
2610 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, SCTP_PERR(error));
2611 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
2612 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
2613
2614 return SCTP_DISPOSITION_ABORT;
2615 }
2616
2617
2618
2619
2620
2621
2622 enum sctp_disposition sctp_sf_cookie_wait_abort(
2623 struct net *net,
2624 const struct sctp_endpoint *ep,
2625 const struct sctp_association *asoc,
2626 const union sctp_subtype type,
2627 void *arg,
2628 struct sctp_cmd_seq *commands)
2629 {
2630 __be16 error = SCTP_ERROR_NO_ERROR;
2631 struct sctp_chunk *chunk = arg;
2632 unsigned int len;
2633
2634 if (!sctp_vtag_verify_either(chunk, asoc))
2635 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2636
2637
2638
2639
2640
2641
2642
2643
2644
2645
2646
2647 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_abort_chunk)))
2648 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2649
2650
2651 len = ntohs(chunk->chunk_hdr->length);
2652 if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
2653 error = ((struct sctp_errhdr *)chunk->skb->data)->cause;
2654
2655 return sctp_stop_t1_and_abort(net, commands, error, ECONNREFUSED, asoc,
2656 chunk->transport);
2657 }
2658
2659
2660
2661
2662 enum sctp_disposition sctp_sf_cookie_wait_icmp_abort(
2663 struct net *net,
2664 const struct sctp_endpoint *ep,
2665 const struct sctp_association *asoc,
2666 const union sctp_subtype type,
2667 void *arg,
2668 struct sctp_cmd_seq *commands)
2669 {
2670 return sctp_stop_t1_and_abort(net, commands, SCTP_ERROR_NO_ERROR,
2671 ENOPROTOOPT, asoc,
2672 (struct sctp_transport *)arg);
2673 }
2674
2675
2676
2677
2678 enum sctp_disposition sctp_sf_cookie_echoed_abort(
2679 struct net *net,
2680 const struct sctp_endpoint *ep,
2681 const struct sctp_association *asoc,
2682 const union sctp_subtype type,
2683 void *arg,
2684 struct sctp_cmd_seq *commands)
2685 {
2686
2687
2688
2689 return sctp_sf_cookie_wait_abort(net, ep, asoc, type, arg, commands);
2690 }
2691
2692
2693
2694
2695
2696
2697 static enum sctp_disposition sctp_stop_t1_and_abort(
2698 struct net *net,
2699 struct sctp_cmd_seq *commands,
2700 __be16 error, int sk_err,
2701 const struct sctp_association *asoc,
2702 struct sctp_transport *transport)
2703 {
2704 pr_debug("%s: ABORT received (INIT)\n", __func__);
2705
2706 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2707 SCTP_STATE(SCTP_STATE_CLOSED));
2708 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
2709 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2710 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
2711 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(sk_err));
2712
2713 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
2714 SCTP_PERR(error));
2715
2716 return SCTP_DISPOSITION_ABORT;
2717 }
2718
2719
2720
2721
2722
2723
2724
2725
2726
2727
2728
2729
2730
2731
2732
2733
2734
2735
2736
2737
2738
2739
2740
2741
2742
2743
2744
2745
2746
2747
2748
2749
2750
2751
2752 enum sctp_disposition sctp_sf_do_9_2_shutdown(
2753 struct net *net,
2754 const struct sctp_endpoint *ep,
2755 const struct sctp_association *asoc,
2756 const union sctp_subtype type,
2757 void *arg,
2758 struct sctp_cmd_seq *commands)
2759 {
2760 enum sctp_disposition disposition;
2761 struct sctp_chunk *chunk = arg;
2762 struct sctp_shutdownhdr *sdh;
2763 struct sctp_ulpevent *ev;
2764 __u32 ctsn;
2765
2766 if (!sctp_vtag_verify(chunk, asoc))
2767 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2768
2769
2770 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_shutdown_chunk)))
2771 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2772 commands);
2773
2774
2775 sdh = (struct sctp_shutdownhdr *)chunk->skb->data;
2776 skb_pull(chunk->skb, sizeof(*sdh));
2777 chunk->subh.shutdown_hdr = sdh;
2778 ctsn = ntohl(sdh->cum_tsn_ack);
2779
2780 if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
2781 pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn,
2782 asoc->ctsn_ack_point);
2783
2784 return SCTP_DISPOSITION_DISCARD;
2785 }
2786
2787
2788
2789
2790
2791 if (!TSN_lt(ctsn, asoc->next_tsn))
2792 return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands);
2793
2794
2795
2796
2797
2798 ev = sctp_ulpevent_make_shutdown_event(asoc, 0, GFP_ATOMIC);
2799 if (!ev) {
2800 disposition = SCTP_DISPOSITION_NOMEM;
2801 goto out;
2802 }
2803 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
2804
2805
2806
2807
2808
2809
2810
2811 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2812 SCTP_STATE(SCTP_STATE_SHUTDOWN_RECEIVED));
2813 disposition = SCTP_DISPOSITION_CONSUME;
2814
2815 if (sctp_outq_is_empty(&asoc->outqueue)) {
2816 disposition = sctp_sf_do_9_2_shutdown_ack(net, ep, asoc, type,
2817 arg, commands);
2818 }
2819
2820 if (SCTP_DISPOSITION_NOMEM == disposition)
2821 goto out;
2822
2823
2824
2825
2826
2827 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_CTSN,
2828 SCTP_BE32(chunk->subh.shutdown_hdr->cum_tsn_ack));
2829
2830 out:
2831 return disposition;
2832 }
2833
2834
2835
2836
2837
2838
2839
2840
2841
2842 enum sctp_disposition sctp_sf_do_9_2_shut_ctsn(
2843 struct net *net,
2844 const struct sctp_endpoint *ep,
2845 const struct sctp_association *asoc,
2846 const union sctp_subtype type,
2847 void *arg,
2848 struct sctp_cmd_seq *commands)
2849 {
2850 struct sctp_chunk *chunk = arg;
2851 struct sctp_shutdownhdr *sdh;
2852 __u32 ctsn;
2853
2854 if (!sctp_vtag_verify(chunk, asoc))
2855 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2856
2857
2858 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_shutdown_chunk)))
2859 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2860 commands);
2861
2862 sdh = (struct sctp_shutdownhdr *)chunk->skb->data;
2863 ctsn = ntohl(sdh->cum_tsn_ack);
2864
2865 if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
2866 pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn,
2867 asoc->ctsn_ack_point);
2868
2869 return SCTP_DISPOSITION_DISCARD;
2870 }
2871
2872
2873
2874
2875
2876 if (!TSN_lt(ctsn, asoc->next_tsn))
2877 return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands);
2878
2879
2880
2881
2882
2883 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_CTSN,
2884 SCTP_BE32(sdh->cum_tsn_ack));
2885
2886 return SCTP_DISPOSITION_CONSUME;
2887 }
2888
2889
2890
2891
2892
2893
2894
2895
2896 enum sctp_disposition sctp_sf_do_9_2_reshutack(
2897 struct net *net,
2898 const struct sctp_endpoint *ep,
2899 const struct sctp_association *asoc,
2900 const union sctp_subtype type,
2901 void *arg,
2902 struct sctp_cmd_seq *commands)
2903 {
2904 struct sctp_chunk *chunk = arg;
2905 struct sctp_chunk *reply;
2906
2907
2908 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
2909 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2910 commands);
2911
2912
2913
2914
2915
2916 reply = sctp_make_shutdown_ack(asoc, chunk);
2917 if (NULL == reply)
2918 goto nomem;
2919
2920
2921
2922
2923 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
2924
2925
2926 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
2927 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
2928
2929 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
2930
2931 return SCTP_DISPOSITION_CONSUME;
2932 nomem:
2933 return SCTP_DISPOSITION_NOMEM;
2934 }
2935
2936
2937
2938
2939
2940
2941
2942
2943
2944
2945
2946
2947
2948
2949
2950
2951
2952
2953
2954
2955
2956
2957
2958
2959
2960
2961 enum sctp_disposition sctp_sf_do_ecn_cwr(struct net *net,
2962 const struct sctp_endpoint *ep,
2963 const struct sctp_association *asoc,
2964 const union sctp_subtype type,
2965 void *arg,
2966 struct sctp_cmd_seq *commands)
2967 {
2968 struct sctp_chunk *chunk = arg;
2969 struct sctp_cwrhdr *cwr;
2970 u32 lowest_tsn;
2971
2972 if (!sctp_vtag_verify(chunk, asoc))
2973 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2974
2975 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_ecne_chunk)))
2976 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2977 commands);
2978
2979 cwr = (struct sctp_cwrhdr *)chunk->skb->data;
2980 skb_pull(chunk->skb, sizeof(*cwr));
2981
2982 lowest_tsn = ntohl(cwr->lowest_tsn);
2983
2984
2985 if (TSN_lte(asoc->last_ecne_tsn, lowest_tsn)) {
2986
2987 sctp_add_cmd_sf(commands,
2988 SCTP_CMD_ECN_CWR,
2989 SCTP_U32(lowest_tsn));
2990 }
2991 return SCTP_DISPOSITION_CONSUME;
2992 }
2993
2994
2995
2996
2997
2998
2999
3000
3001
3002
3003
3004
3005
3006
3007
3008
3009
3010
3011
3012
3013
3014
3015
3016
3017 enum sctp_disposition sctp_sf_do_ecne(struct net *net,
3018 const struct sctp_endpoint *ep,
3019 const struct sctp_association *asoc,
3020 const union sctp_subtype type,
3021 void *arg, struct sctp_cmd_seq *commands)
3022 {
3023 struct sctp_chunk *chunk = arg;
3024 struct sctp_ecnehdr *ecne;
3025
3026 if (!sctp_vtag_verify(chunk, asoc))
3027 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3028
3029 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_ecne_chunk)))
3030 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3031 commands);
3032
3033 ecne = (struct sctp_ecnehdr *)chunk->skb->data;
3034 skb_pull(chunk->skb, sizeof(*ecne));
3035
3036
3037 sctp_add_cmd_sf(commands, SCTP_CMD_ECN_ECNE,
3038 SCTP_U32(ntohl(ecne->lowest_tsn)));
3039
3040 return SCTP_DISPOSITION_CONSUME;
3041 }
3042
3043
3044
3045
3046
3047
3048
3049
3050
3051
3052
3053
3054
3055
3056
3057
3058
3059
3060
3061
3062
3063
3064
3065
3066
3067
3068
3069
3070
3071
3072
3073 enum sctp_disposition sctp_sf_eat_data_6_2(struct net *net,
3074 const struct sctp_endpoint *ep,
3075 const struct sctp_association *asoc,
3076 const union sctp_subtype type,
3077 void *arg,
3078 struct sctp_cmd_seq *commands)
3079 {
3080 union sctp_arg force = SCTP_NOFORCE();
3081 struct sctp_chunk *chunk = arg;
3082 int error;
3083
3084 if (!sctp_vtag_verify(chunk, asoc)) {
3085 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3086 SCTP_NULL());
3087 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3088 }
3089
3090 if (!sctp_chunk_length_valid(chunk, sctp_datachk_len(&asoc->stream)))
3091 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3092 commands);
3093
3094 error = sctp_eat_data(asoc, chunk, commands);
3095 switch (error) {
3096 case SCTP_IERROR_NO_ERROR:
3097 break;
3098 case SCTP_IERROR_HIGH_TSN:
3099 case SCTP_IERROR_BAD_STREAM:
3100 SCTP_INC_STATS(net, SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
3101 goto discard_noforce;
3102 case SCTP_IERROR_DUP_TSN:
3103 case SCTP_IERROR_IGNORE_TSN:
3104 SCTP_INC_STATS(net, SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
3105 goto discard_force;
3106 case SCTP_IERROR_NO_DATA:
3107 return SCTP_DISPOSITION_ABORT;
3108 case SCTP_IERROR_PROTO_VIOLATION:
3109 return sctp_sf_abort_violation(net, ep, asoc, chunk, commands,
3110 (u8 *)chunk->subh.data_hdr,
3111 sctp_datahdr_len(&asoc->stream));
3112 default:
3113 BUG();
3114 }
3115
3116 if (chunk->chunk_hdr->flags & SCTP_DATA_SACK_IMM)
3117 force = SCTP_FORCE();
3118
3119 if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) {
3120 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
3121 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
3122 }
3123
3124
3125
3126
3127
3128
3129
3130
3131
3132
3133
3134
3135
3136
3137
3138
3139
3140
3141
3142
3143
3144
3145
3146 if (chunk->end_of_packet)
3147 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, force);
3148
3149 return SCTP_DISPOSITION_CONSUME;
3150
3151 discard_force:
3152
3153
3154
3155
3156
3157
3158
3159
3160
3161
3162
3163
3164
3165
3166 if (chunk->end_of_packet)
3167 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
3168 return SCTP_DISPOSITION_DISCARD;
3169
3170 discard_noforce:
3171 if (chunk->end_of_packet)
3172 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, force);
3173
3174 return SCTP_DISPOSITION_DISCARD;
3175 }
3176
3177
3178
3179
3180
3181
3182
3183
3184
3185
3186
3187
3188
3189
3190
3191
3192
3193 enum sctp_disposition sctp_sf_eat_data_fast_4_4(
3194 struct net *net,
3195 const struct sctp_endpoint *ep,
3196 const struct sctp_association *asoc,
3197 const union sctp_subtype type,
3198 void *arg,
3199 struct sctp_cmd_seq *commands)
3200 {
3201 struct sctp_chunk *chunk = arg;
3202 int error;
3203
3204 if (!sctp_vtag_verify(chunk, asoc)) {
3205 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3206 SCTP_NULL());
3207 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3208 }
3209
3210 if (!sctp_chunk_length_valid(chunk, sctp_datachk_len(&asoc->stream)))
3211 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3212 commands);
3213
3214 error = sctp_eat_data(asoc, chunk, commands);
3215 switch (error) {
3216 case SCTP_IERROR_NO_ERROR:
3217 case SCTP_IERROR_HIGH_TSN:
3218 case SCTP_IERROR_DUP_TSN:
3219 case SCTP_IERROR_IGNORE_TSN:
3220 case SCTP_IERROR_BAD_STREAM:
3221 break;
3222 case SCTP_IERROR_NO_DATA:
3223 return SCTP_DISPOSITION_ABORT;
3224 case SCTP_IERROR_PROTO_VIOLATION:
3225 return sctp_sf_abort_violation(net, ep, asoc, chunk, commands,
3226 (u8 *)chunk->subh.data_hdr,
3227 sctp_datahdr_len(&asoc->stream));
3228 default:
3229 BUG();
3230 }
3231
3232
3233
3234
3235
3236
3237
3238
3239
3240 if (chunk->end_of_packet) {
3241
3242
3243
3244 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SHUTDOWN, SCTP_NULL());
3245 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
3246 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
3247 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
3248 }
3249
3250 return SCTP_DISPOSITION_CONSUME;
3251 }
3252
3253
3254
3255
3256
3257
3258
3259
3260
3261
3262
3263
3264
3265
3266
3267
3268
3269
3270
3271
3272
3273
3274
3275
3276
3277
3278
3279
3280
3281
3282
3283
3284
3285 enum sctp_disposition sctp_sf_eat_sack_6_2(struct net *net,
3286 const struct sctp_endpoint *ep,
3287 const struct sctp_association *asoc,
3288 const union sctp_subtype type,
3289 void *arg,
3290 struct sctp_cmd_seq *commands)
3291 {
3292 struct sctp_chunk *chunk = arg;
3293 struct sctp_sackhdr *sackh;
3294 __u32 ctsn;
3295
3296 trace_sctp_probe(ep, asoc, chunk);
3297
3298 if (!sctp_vtag_verify(chunk, asoc))
3299 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3300
3301
3302 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_sack_chunk)))
3303 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3304 commands);
3305
3306
3307 sackh = sctp_sm_pull_sack(chunk);
3308
3309 if (!sackh)
3310 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3311 chunk->subh.sack_hdr = sackh;
3312 ctsn = ntohl(sackh->cum_tsn_ack);
3313
3314
3315
3316
3317
3318
3319
3320 if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
3321 pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn,
3322 asoc->ctsn_ack_point);
3323
3324 return SCTP_DISPOSITION_DISCARD;
3325 }
3326
3327
3328
3329
3330
3331 if (!TSN_lt(ctsn, asoc->next_tsn))
3332 return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands);
3333
3334
3335 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_SACK, SCTP_CHUNK(chunk));
3336
3337
3338
3339
3340 return SCTP_DISPOSITION_CONSUME;
3341 }
3342
3343
3344
3345
3346
3347
3348
3349
3350
3351
3352
3353
3354
3355
3356
3357
3358
3359
3360
3361 static enum sctp_disposition sctp_sf_tabort_8_4_8(
3362 struct net *net,
3363 const struct sctp_endpoint *ep,
3364 const struct sctp_association *asoc,
3365 const union sctp_subtype type,
3366 void *arg,
3367 struct sctp_cmd_seq *commands)
3368 {
3369 struct sctp_packet *packet = NULL;
3370 struct sctp_chunk *chunk = arg;
3371 struct sctp_chunk *abort;
3372
3373 packet = sctp_ootb_pkt_new(net, asoc, chunk);
3374 if (!packet)
3375 return SCTP_DISPOSITION_NOMEM;
3376
3377
3378
3379
3380 abort = sctp_make_abort(asoc, chunk, 0);
3381 if (!abort) {
3382 sctp_ootb_pkt_free(packet);
3383 return SCTP_DISPOSITION_NOMEM;
3384 }
3385
3386
3387 if (sctp_test_T_bit(abort))
3388 packet->vtag = ntohl(chunk->sctp_hdr->vtag);
3389
3390
3391 abort->skb->sk = ep->base.sk;
3392
3393 sctp_packet_append_chunk(packet, abort);
3394
3395 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
3396 SCTP_PACKET(packet));
3397
3398 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
3399
3400 sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3401 return SCTP_DISPOSITION_CONSUME;
3402 }
3403
3404
3405
3406
3407
3408
3409
3410
3411
3412 enum sctp_disposition sctp_sf_operr_notify(struct net *net,
3413 const struct sctp_endpoint *ep,
3414 const struct sctp_association *asoc,
3415 const union sctp_subtype type,
3416 void *arg,
3417 struct sctp_cmd_seq *commands)
3418 {
3419 struct sctp_chunk *chunk = arg;
3420 struct sctp_errhdr *err;
3421
3422 if (!sctp_vtag_verify(chunk, asoc))
3423 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3424
3425
3426 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_operr_chunk)))
3427 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3428 commands);
3429 sctp_walk_errors(err, chunk->chunk_hdr);
3430 if ((void *)err != (void *)chunk->chunk_end)
3431 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
3432 (void *)err, commands);
3433
3434 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,
3435 SCTP_CHUNK(chunk));
3436
3437 return SCTP_DISPOSITION_CONSUME;
3438 }
3439
3440
3441
3442
3443
3444
3445
3446
3447
3448
3449
3450 enum sctp_disposition sctp_sf_do_9_2_final(struct net *net,
3451 const struct sctp_endpoint *ep,
3452 const struct sctp_association *asoc,
3453 const union sctp_subtype type,
3454 void *arg,
3455 struct sctp_cmd_seq *commands)
3456 {
3457 struct sctp_chunk *chunk = arg;
3458 struct sctp_chunk *reply;
3459 struct sctp_ulpevent *ev;
3460
3461 if (!sctp_vtag_verify(chunk, asoc))
3462 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3463
3464
3465 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
3466 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3467 commands);
3468
3469
3470
3471
3472
3473 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_SHUTDOWN_COMP,
3474 0, 0, 0, NULL, GFP_ATOMIC);
3475 if (!ev)
3476 goto nomem;
3477
3478
3479 reply = sctp_make_shutdown_complete(asoc, chunk);
3480 if (!reply)
3481 goto nomem_chunk;
3482
3483
3484
3485
3486 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
3487
3488
3489
3490
3491 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3492 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
3493
3494 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3495 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
3496
3497 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
3498 SCTP_STATE(SCTP_STATE_CLOSED));
3499 SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS);
3500 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
3501 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
3502
3503
3504 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
3505 return SCTP_DISPOSITION_DELETE_TCB;
3506
3507 nomem_chunk:
3508 sctp_ulpevent_free(ev);
3509 nomem:
3510 return SCTP_DISPOSITION_NOMEM;
3511 }
3512
3513
3514
3515
3516
3517
3518
3519
3520
3521
3522
3523
3524
3525
3526
3527
3528
3529
3530
3531
3532
3533 enum sctp_disposition sctp_sf_ootb(struct net *net,
3534 const struct sctp_endpoint *ep,
3535 const struct sctp_association *asoc,
3536 const union sctp_subtype type,
3537 void *arg, struct sctp_cmd_seq *commands)
3538 {
3539 struct sctp_chunk *chunk = arg;
3540 struct sk_buff *skb = chunk->skb;
3541 struct sctp_chunkhdr *ch;
3542 struct sctp_errhdr *err;
3543 int ootb_cookie_ack = 0;
3544 int ootb_shut_ack = 0;
3545 __u8 *ch_end;
3546
3547 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
3548
3549 ch = (struct sctp_chunkhdr *)chunk->chunk_hdr;
3550 do {
3551
3552 if (ntohs(ch->length) < sizeof(*ch))
3553 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3554 commands);
3555
3556
3557 ch_end = ((__u8 *)ch) + SCTP_PAD4(ntohs(ch->length));
3558 if (ch_end > skb_tail_pointer(skb))
3559 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3560 commands);
3561
3562
3563
3564
3565 if (SCTP_CID_SHUTDOWN_ACK == ch->type)
3566 ootb_shut_ack = 1;
3567
3568
3569
3570
3571
3572
3573 if (SCTP_CID_ABORT == ch->type)
3574 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3575
3576
3577
3578
3579
3580
3581 if (SCTP_CID_COOKIE_ACK == ch->type)
3582 ootb_cookie_ack = 1;
3583
3584 if (SCTP_CID_ERROR == ch->type) {
3585 sctp_walk_errors(err, ch) {
3586 if (SCTP_ERROR_STALE_COOKIE == err->cause) {
3587 ootb_cookie_ack = 1;
3588 break;
3589 }
3590 }
3591 }
3592
3593 ch = (struct sctp_chunkhdr *)ch_end;
3594 } while (ch_end < skb_tail_pointer(skb));
3595
3596 if (ootb_shut_ack)
3597 return sctp_sf_shut_8_4_5(net, ep, asoc, type, arg, commands);
3598 else if (ootb_cookie_ack)
3599 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3600 else
3601 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
3602 }
3603
3604
3605
3606
3607
3608
3609
3610
3611
3612
3613
3614
3615
3616
3617
3618
3619
3620
3621
3622
3623
3624
3625 static enum sctp_disposition sctp_sf_shut_8_4_5(
3626 struct net *net,
3627 const struct sctp_endpoint *ep,
3628 const struct sctp_association *asoc,
3629 const union sctp_subtype type,
3630 void *arg,
3631 struct sctp_cmd_seq *commands)
3632 {
3633 struct sctp_packet *packet = NULL;
3634 struct sctp_chunk *chunk = arg;
3635 struct sctp_chunk *shut;
3636
3637 packet = sctp_ootb_pkt_new(net, asoc, chunk);
3638 if (!packet)
3639 return SCTP_DISPOSITION_NOMEM;
3640
3641
3642
3643
3644 shut = sctp_make_shutdown_complete(asoc, chunk);
3645 if (!shut) {
3646 sctp_ootb_pkt_free(packet);
3647 return SCTP_DISPOSITION_NOMEM;
3648 }
3649
3650
3651 if (sctp_test_T_bit(shut))
3652 packet->vtag = ntohl(chunk->sctp_hdr->vtag);
3653
3654
3655 shut->skb->sk = ep->base.sk;
3656
3657 sctp_packet_append_chunk(packet, shut);
3658
3659 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
3660 SCTP_PACKET(packet));
3661
3662 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
3663
3664
3665
3666
3667 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
3668 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3669
3670
3671
3672
3673
3674 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3675 }
3676
3677
3678
3679
3680
3681
3682
3683
3684
3685
3686
3687
3688 enum sctp_disposition sctp_sf_do_8_5_1_E_sa(struct net *net,
3689 const struct sctp_endpoint *ep,
3690 const struct sctp_association *asoc,
3691 const union sctp_subtype type,
3692 void *arg,
3693 struct sctp_cmd_seq *commands)
3694 {
3695 struct sctp_chunk *chunk = arg;
3696
3697
3698 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
3699 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3700 commands);
3701
3702
3703
3704
3705
3706
3707 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
3708
3709 return sctp_sf_shut_8_4_5(net, ep, NULL, type, arg, commands);
3710 }
3711
3712
3713 enum sctp_disposition sctp_sf_do_asconf(struct net *net,
3714 const struct sctp_endpoint *ep,
3715 const struct sctp_association *asoc,
3716 const union sctp_subtype type,
3717 void *arg,
3718 struct sctp_cmd_seq *commands)
3719 {
3720 struct sctp_paramhdr *err_param = NULL;
3721 struct sctp_chunk *asconf_ack = NULL;
3722 struct sctp_chunk *chunk = arg;
3723 struct sctp_addiphdr *hdr;
3724 __u32 serial;
3725
3726 if (!sctp_vtag_verify(chunk, asoc)) {
3727 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3728 SCTP_NULL());
3729 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3730 }
3731
3732
3733
3734
3735
3736
3737
3738 if (!asoc->peer.asconf_capable ||
3739 (!net->sctp.addip_noauth && !chunk->auth))
3740 return sctp_sf_discard_chunk(net, ep, asoc, type, arg,
3741 commands);
3742
3743
3744 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_addip_chunk)))
3745 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3746 commands);
3747
3748 hdr = (struct sctp_addiphdr *)chunk->skb->data;
3749 serial = ntohl(hdr->serial);
3750
3751
3752 if (!sctp_verify_asconf(asoc, chunk, true, &err_param))
3753 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
3754 (void *)err_param, commands);
3755
3756
3757
3758
3759
3760 if (serial == asoc->peer.addip_serial + 1) {
3761
3762
3763
3764 if (!chunk->has_asconf)
3765 sctp_assoc_clean_asconf_ack_cache(asoc);
3766
3767
3768
3769
3770
3771
3772
3773
3774
3775 asconf_ack = sctp_process_asconf((struct sctp_association *)
3776 asoc, chunk);
3777 if (!asconf_ack)
3778 return SCTP_DISPOSITION_NOMEM;
3779 } else if (serial < asoc->peer.addip_serial + 1) {
3780
3781
3782
3783
3784
3785
3786
3787
3788
3789
3790
3791
3792 asconf_ack = sctp_assoc_lookup_asconf_ack(asoc, hdr->serial);
3793 if (!asconf_ack)
3794 return SCTP_DISPOSITION_DISCARD;
3795
3796
3797
3798
3799
3800 asconf_ack->transport = NULL;
3801 } else {
3802
3803
3804
3805 return SCTP_DISPOSITION_DISCARD;
3806 }
3807
3808
3809
3810
3811
3812
3813
3814
3815
3816
3817 asconf_ack->dest = chunk->source;
3818 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(asconf_ack));
3819 if (asoc->new_transport) {
3820 sctp_sf_heartbeat(ep, asoc, type, asoc->new_transport, commands);
3821 ((struct sctp_association *)asoc)->new_transport = NULL;
3822 }
3823
3824 return SCTP_DISPOSITION_CONSUME;
3825 }
3826
3827 static enum sctp_disposition sctp_send_next_asconf(
3828 struct net *net,
3829 const struct sctp_endpoint *ep,
3830 struct sctp_association *asoc,
3831 const union sctp_subtype type,
3832 struct sctp_cmd_seq *commands)
3833 {
3834 struct sctp_chunk *asconf;
3835 struct list_head *entry;
3836
3837 if (list_empty(&asoc->addip_chunk_list))
3838 return SCTP_DISPOSITION_CONSUME;
3839
3840 entry = asoc->addip_chunk_list.next;
3841 asconf = list_entry(entry, struct sctp_chunk, list);
3842
3843 list_del_init(entry);
3844 sctp_chunk_hold(asconf);
3845 asoc->addip_last_asconf = asconf;
3846
3847 return sctp_sf_do_prm_asconf(net, ep, asoc, type, asconf, commands);
3848 }
3849
3850
3851
3852
3853
3854
3855 enum sctp_disposition sctp_sf_do_asconf_ack(struct net *net,
3856 const struct sctp_endpoint *ep,
3857 const struct sctp_association *asoc,
3858 const union sctp_subtype type,
3859 void *arg,
3860 struct sctp_cmd_seq *commands)
3861 {
3862 struct sctp_chunk *last_asconf = asoc->addip_last_asconf;
3863 struct sctp_paramhdr *err_param = NULL;
3864 struct sctp_chunk *asconf_ack = arg;
3865 struct sctp_addiphdr *addip_hdr;
3866 __u32 sent_serial, rcvd_serial;
3867 struct sctp_chunk *abort;
3868
3869 if (!sctp_vtag_verify(asconf_ack, asoc)) {
3870 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3871 SCTP_NULL());
3872 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3873 }
3874
3875
3876
3877
3878
3879
3880
3881 if (!asoc->peer.asconf_capable ||
3882 (!net->sctp.addip_noauth && !asconf_ack->auth))
3883 return sctp_sf_discard_chunk(net, ep, asoc, type, arg,
3884 commands);
3885
3886
3887 if (!sctp_chunk_length_valid(asconf_ack,
3888 sizeof(struct sctp_addip_chunk)))
3889 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3890 commands);
3891
3892 addip_hdr = (struct sctp_addiphdr *)asconf_ack->skb->data;
3893 rcvd_serial = ntohl(addip_hdr->serial);
3894
3895
3896 if (!sctp_verify_asconf(asoc, asconf_ack, false, &err_param))
3897 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
3898 (void *)err_param, commands);
3899
3900 if (last_asconf) {
3901 addip_hdr = (struct sctp_addiphdr *)last_asconf->subh.addip_hdr;
3902 sent_serial = ntohl(addip_hdr->serial);
3903 } else {
3904 sent_serial = asoc->addip_serial - 1;
3905 }
3906
3907
3908
3909
3910
3911
3912
3913 if (ADDIP_SERIAL_gte(rcvd_serial, sent_serial + 1) &&
3914 !(asoc->addip_last_asconf)) {
3915 abort = sctp_make_abort(asoc, asconf_ack,
3916 sizeof(struct sctp_errhdr));
3917 if (abort) {
3918 sctp_init_cause(abort, SCTP_ERROR_ASCONF_ACK, 0);
3919 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
3920 SCTP_CHUNK(abort));
3921 }
3922
3923
3924
3925 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3926 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
3927 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
3928 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
3929 SCTP_ERROR(ECONNABORTED));
3930 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
3931 SCTP_PERR(SCTP_ERROR_ASCONF_ACK));
3932 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
3933 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
3934 return SCTP_DISPOSITION_ABORT;
3935 }
3936
3937 if ((rcvd_serial == sent_serial) && asoc->addip_last_asconf) {
3938 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3939 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
3940
3941 if (!sctp_process_asconf_ack((struct sctp_association *)asoc,
3942 asconf_ack))
3943 return sctp_send_next_asconf(net, ep,
3944 (struct sctp_association *)asoc,
3945 type, commands);
3946
3947 abort = sctp_make_abort(asoc, asconf_ack,
3948 sizeof(struct sctp_errhdr));
3949 if (abort) {
3950 sctp_init_cause(abort, SCTP_ERROR_RSRC_LOW, 0);
3951 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
3952 SCTP_CHUNK(abort));
3953 }
3954
3955
3956
3957 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
3958 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
3959 SCTP_ERROR(ECONNABORTED));
3960 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
3961 SCTP_PERR(SCTP_ERROR_ASCONF_ACK));
3962 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
3963 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
3964 return SCTP_DISPOSITION_ABORT;
3965 }
3966
3967 return SCTP_DISPOSITION_DISCARD;
3968 }
3969
3970
3971 enum sctp_disposition sctp_sf_do_reconf(struct net *net,
3972 const struct sctp_endpoint *ep,
3973 const struct sctp_association *asoc,
3974 const union sctp_subtype type,
3975 void *arg,
3976 struct sctp_cmd_seq *commands)
3977 {
3978 struct sctp_paramhdr *err_param = NULL;
3979 struct sctp_chunk *chunk = arg;
3980 struct sctp_reconf_chunk *hdr;
3981 union sctp_params param;
3982
3983 if (!sctp_vtag_verify(chunk, asoc)) {
3984 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3985 SCTP_NULL());
3986 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3987 }
3988
3989
3990 if (!sctp_chunk_length_valid(chunk, sizeof(*hdr)))
3991 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3992 commands);
3993
3994 if (!sctp_verify_reconf(asoc, chunk, &err_param))
3995 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
3996 (void *)err_param, commands);
3997
3998 hdr = (struct sctp_reconf_chunk *)chunk->chunk_hdr;
3999 sctp_walk_params(param, hdr, params) {
4000 struct sctp_chunk *reply = NULL;
4001 struct sctp_ulpevent *ev = NULL;
4002
4003 if (param.p->type == SCTP_PARAM_RESET_OUT_REQUEST)
4004 reply = sctp_process_strreset_outreq(
4005 (struct sctp_association *)asoc, param, &ev);
4006 else if (param.p->type == SCTP_PARAM_RESET_IN_REQUEST)
4007 reply = sctp_process_strreset_inreq(
4008 (struct sctp_association *)asoc, param, &ev);
4009 else if (param.p->type == SCTP_PARAM_RESET_TSN_REQUEST)
4010 reply = sctp_process_strreset_tsnreq(
4011 (struct sctp_association *)asoc, param, &ev);
4012 else if (param.p->type == SCTP_PARAM_RESET_ADD_OUT_STREAMS)
4013 reply = sctp_process_strreset_addstrm_out(
4014 (struct sctp_association *)asoc, param, &ev);
4015 else if (param.p->type == SCTP_PARAM_RESET_ADD_IN_STREAMS)
4016 reply = sctp_process_strreset_addstrm_in(
4017 (struct sctp_association *)asoc, param, &ev);
4018 else if (param.p->type == SCTP_PARAM_RESET_RESPONSE)
4019 reply = sctp_process_strreset_resp(
4020 (struct sctp_association *)asoc, param, &ev);
4021
4022 if (ev)
4023 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
4024 SCTP_ULPEVENT(ev));
4025
4026 if (reply)
4027 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
4028 SCTP_CHUNK(reply));
4029 }
4030
4031 return SCTP_DISPOSITION_CONSUME;
4032 }
4033
4034
4035
4036
4037
4038
4039
4040
4041
4042
4043
4044
4045
4046
4047
4048 enum sctp_disposition sctp_sf_eat_fwd_tsn(struct net *net,
4049 const struct sctp_endpoint *ep,
4050 const struct sctp_association *asoc,
4051 const union sctp_subtype type,
4052 void *arg,
4053 struct sctp_cmd_seq *commands)
4054 {
4055 struct sctp_fwdtsn_hdr *fwdtsn_hdr;
4056 struct sctp_chunk *chunk = arg;
4057 __u16 len;
4058 __u32 tsn;
4059
4060 if (!sctp_vtag_verify(chunk, asoc)) {
4061 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
4062 SCTP_NULL());
4063 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4064 }
4065
4066 if (!asoc->peer.prsctp_capable)
4067 return sctp_sf_unk_chunk(net, ep, asoc, type, arg, commands);
4068
4069
4070 if (!sctp_chunk_length_valid(chunk, sctp_ftsnchk_len(&asoc->stream)))
4071 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4072 commands);
4073
4074 fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data;
4075 chunk->subh.fwdtsn_hdr = fwdtsn_hdr;
4076 len = ntohs(chunk->chunk_hdr->length);
4077 len -= sizeof(struct sctp_chunkhdr);
4078 skb_pull(chunk->skb, len);
4079
4080 tsn = ntohl(fwdtsn_hdr->new_cum_tsn);
4081 pr_debug("%s: TSN 0x%x\n", __func__, tsn);
4082
4083
4084
4085
4086 if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
4087 goto discard_noforce;
4088
4089 if (!asoc->stream.si->validate_ftsn(chunk))
4090 goto discard_noforce;
4091
4092 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
4093 if (len > sctp_ftsnhdr_len(&asoc->stream))
4094 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
4095 SCTP_CHUNK(chunk));
4096
4097
4098 if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) {
4099 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
4100 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
4101 }
4102
4103
4104
4105
4106 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_NOFORCE());
4107
4108 return SCTP_DISPOSITION_CONSUME;
4109
4110 discard_noforce:
4111 return SCTP_DISPOSITION_DISCARD;
4112 }
4113
4114 enum sctp_disposition sctp_sf_eat_fwd_tsn_fast(
4115 struct net *net,
4116 const struct sctp_endpoint *ep,
4117 const struct sctp_association *asoc,
4118 const union sctp_subtype type,
4119 void *arg,
4120 struct sctp_cmd_seq *commands)
4121 {
4122 struct sctp_fwdtsn_hdr *fwdtsn_hdr;
4123 struct sctp_chunk *chunk = arg;
4124 __u16 len;
4125 __u32 tsn;
4126
4127 if (!sctp_vtag_verify(chunk, asoc)) {
4128 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
4129 SCTP_NULL());
4130 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4131 }
4132
4133 if (!asoc->peer.prsctp_capable)
4134 return sctp_sf_unk_chunk(net, ep, asoc, type, arg, commands);
4135
4136
4137 if (!sctp_chunk_length_valid(chunk, sctp_ftsnchk_len(&asoc->stream)))
4138 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4139 commands);
4140
4141 fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data;
4142 chunk->subh.fwdtsn_hdr = fwdtsn_hdr;
4143 len = ntohs(chunk->chunk_hdr->length);
4144 len -= sizeof(struct sctp_chunkhdr);
4145 skb_pull(chunk->skb, len);
4146
4147 tsn = ntohl(fwdtsn_hdr->new_cum_tsn);
4148 pr_debug("%s: TSN 0x%x\n", __func__, tsn);
4149
4150
4151
4152
4153 if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
4154 goto gen_shutdown;
4155
4156 if (!asoc->stream.si->validate_ftsn(chunk))
4157 goto gen_shutdown;
4158
4159 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
4160 if (len > sctp_ftsnhdr_len(&asoc->stream))
4161 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
4162 SCTP_CHUNK(chunk));
4163
4164
4165 gen_shutdown:
4166
4167
4168
4169
4170
4171
4172 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SHUTDOWN, SCTP_NULL());
4173 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
4174 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
4175 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
4176
4177 return SCTP_DISPOSITION_CONSUME;
4178 }
4179
4180
4181
4182
4183
4184
4185
4186
4187
4188
4189
4190
4191
4192
4193
4194
4195
4196
4197
4198
4199
4200
4201
4202 static enum sctp_ierror sctp_sf_authenticate(
4203 const struct sctp_association *asoc,
4204 struct sctp_chunk *chunk)
4205 {
4206 struct sctp_shared_key *sh_key = NULL;
4207 struct sctp_authhdr *auth_hdr;
4208 __u8 *save_digest, *digest;
4209 struct sctp_hmac *hmac;
4210 unsigned int sig_len;
4211 __u16 key_id;
4212
4213
4214 auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
4215 chunk->subh.auth_hdr = auth_hdr;
4216 skb_pull(chunk->skb, sizeof(*auth_hdr));
4217
4218
4219
4220
4221 if (!sctp_auth_asoc_verify_hmac_id(asoc, auth_hdr->hmac_id))
4222 return SCTP_IERROR_AUTH_BAD_HMAC;
4223
4224
4225
4226
4227 key_id = ntohs(auth_hdr->shkey_id);
4228 if (key_id != asoc->active_key_id) {
4229 sh_key = sctp_auth_get_shkey(asoc, key_id);
4230 if (!sh_key)
4231 return SCTP_IERROR_AUTH_BAD_KEYID;
4232 }
4233
4234
4235
4236
4237 sig_len = ntohs(chunk->chunk_hdr->length) -
4238 sizeof(struct sctp_auth_chunk);
4239 hmac = sctp_auth_get_hmac(ntohs(auth_hdr->hmac_id));
4240 if (sig_len != hmac->hmac_len)
4241 return SCTP_IERROR_PROTO_VIOLATION;
4242
4243
4244
4245
4246
4247
4248
4249
4250 digest = auth_hdr->hmac;
4251 skb_pull(chunk->skb, sig_len);
4252
4253 save_digest = kmemdup(digest, sig_len, GFP_ATOMIC);
4254 if (!save_digest)
4255 goto nomem;
4256
4257 memset(digest, 0, sig_len);
4258
4259 sctp_auth_calculate_hmac(asoc, chunk->skb,
4260 (struct sctp_auth_chunk *)chunk->chunk_hdr,
4261 sh_key, GFP_ATOMIC);
4262
4263
4264 if (memcmp(save_digest, digest, sig_len)) {
4265 kfree(save_digest);
4266 return SCTP_IERROR_BAD_SIG;
4267 }
4268
4269 kfree(save_digest);
4270 chunk->auth = 1;
4271
4272 return SCTP_IERROR_NO_ERROR;
4273 nomem:
4274 return SCTP_IERROR_NOMEM;
4275 }
4276
4277 enum sctp_disposition sctp_sf_eat_auth(struct net *net,
4278 const struct sctp_endpoint *ep,
4279 const struct sctp_association *asoc,
4280 const union sctp_subtype type,
4281 void *arg, struct sctp_cmd_seq *commands)
4282 {
4283 struct sctp_chunk *chunk = arg;
4284 struct sctp_authhdr *auth_hdr;
4285 struct sctp_chunk *err_chunk;
4286 enum sctp_ierror error;
4287
4288
4289 if (!asoc->peer.auth_capable)
4290 return sctp_sf_unk_chunk(net, ep, asoc, type, arg, commands);
4291
4292 if (!sctp_vtag_verify(chunk, asoc)) {
4293 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
4294 SCTP_NULL());
4295 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4296 }
4297
4298
4299 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_auth_chunk)))
4300 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4301 commands);
4302
4303 auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
4304 error = sctp_sf_authenticate(asoc, chunk);
4305 switch (error) {
4306 case SCTP_IERROR_AUTH_BAD_HMAC:
4307
4308
4309
4310 err_chunk = sctp_make_op_error(asoc, chunk,
4311 SCTP_ERROR_UNSUP_HMAC,
4312 &auth_hdr->hmac_id,
4313 sizeof(__u16), 0);
4314 if (err_chunk) {
4315 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
4316 SCTP_CHUNK(err_chunk));
4317 }
4318
4319 case SCTP_IERROR_AUTH_BAD_KEYID:
4320 case SCTP_IERROR_BAD_SIG:
4321 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4322
4323 case SCTP_IERROR_PROTO_VIOLATION:
4324 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4325 commands);
4326
4327 case SCTP_IERROR_NOMEM:
4328 return SCTP_DISPOSITION_NOMEM;
4329
4330 default:
4331 break;
4332 }
4333
4334 if (asoc->active_key_id != ntohs(auth_hdr->shkey_id)) {
4335 struct sctp_ulpevent *ev;
4336
4337 ev = sctp_ulpevent_make_authkey(asoc, ntohs(auth_hdr->shkey_id),
4338 SCTP_AUTH_NEW_KEY, GFP_ATOMIC);
4339
4340 if (!ev)
4341 return -ENOMEM;
4342
4343 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
4344 SCTP_ULPEVENT(ev));
4345 }
4346
4347 return SCTP_DISPOSITION_CONSUME;
4348 }
4349
4350
4351
4352
4353
4354
4355
4356
4357
4358
4359
4360
4361
4362
4363
4364
4365
4366
4367
4368
4369
4370
4371
4372
4373 enum sctp_disposition sctp_sf_unk_chunk(struct net *net,
4374 const struct sctp_endpoint *ep,
4375 const struct sctp_association *asoc,
4376 const union sctp_subtype type,
4377 void *arg,
4378 struct sctp_cmd_seq *commands)
4379 {
4380 struct sctp_chunk *unk_chunk = arg;
4381 struct sctp_chunk *err_chunk;
4382 struct sctp_chunkhdr *hdr;
4383
4384 pr_debug("%s: processing unknown chunk id:%d\n", __func__, type.chunk);
4385
4386 if (!sctp_vtag_verify(unk_chunk, asoc))
4387 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4388
4389
4390
4391
4392
4393 if (!sctp_chunk_length_valid(unk_chunk, sizeof(*hdr)))
4394 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4395 commands);
4396
4397 switch (type.chunk & SCTP_CID_ACTION_MASK) {
4398 case SCTP_CID_ACTION_DISCARD:
4399
4400 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4401 case SCTP_CID_ACTION_DISCARD_ERR:
4402
4403 hdr = unk_chunk->chunk_hdr;
4404 err_chunk = sctp_make_op_error(asoc, unk_chunk,
4405 SCTP_ERROR_UNKNOWN_CHUNK, hdr,
4406 SCTP_PAD4(ntohs(hdr->length)),
4407 0);
4408 if (err_chunk) {
4409 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
4410 SCTP_CHUNK(err_chunk));
4411 }
4412
4413
4414 sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4415 return SCTP_DISPOSITION_CONSUME;
4416 case SCTP_CID_ACTION_SKIP:
4417
4418 return SCTP_DISPOSITION_DISCARD;
4419 case SCTP_CID_ACTION_SKIP_ERR:
4420
4421 hdr = unk_chunk->chunk_hdr;
4422 err_chunk = sctp_make_op_error(asoc, unk_chunk,
4423 SCTP_ERROR_UNKNOWN_CHUNK, hdr,
4424 SCTP_PAD4(ntohs(hdr->length)),
4425 0);
4426 if (err_chunk) {
4427 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
4428 SCTP_CHUNK(err_chunk));
4429 }
4430
4431 return SCTP_DISPOSITION_CONSUME;
4432 default:
4433 break;
4434 }
4435
4436 return SCTP_DISPOSITION_DISCARD;
4437 }
4438
4439
4440
4441
4442
4443
4444
4445
4446
4447
4448
4449
4450
4451
4452
4453 enum sctp_disposition sctp_sf_discard_chunk(struct net *net,
4454 const struct sctp_endpoint *ep,
4455 const struct sctp_association *asoc,
4456 const union sctp_subtype type,
4457 void *arg,
4458 struct sctp_cmd_seq *commands)
4459 {
4460 struct sctp_chunk *chunk = arg;
4461
4462
4463
4464
4465
4466 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
4467 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4468 commands);
4469
4470 pr_debug("%s: chunk:%d is discarded\n", __func__, type.chunk);
4471
4472 return SCTP_DISPOSITION_DISCARD;
4473 }
4474
4475
4476
4477
4478
4479
4480
4481
4482
4483
4484
4485
4486
4487
4488
4489
4490
4491
4492
4493 enum sctp_disposition sctp_sf_pdiscard(struct net *net,
4494 const struct sctp_endpoint *ep,
4495 const struct sctp_association *asoc,
4496 const union sctp_subtype type,
4497 void *arg, struct sctp_cmd_seq *commands)
4498 {
4499 SCTP_INC_STATS(net, SCTP_MIB_IN_PKT_DISCARDS);
4500 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
4501
4502 return SCTP_DISPOSITION_CONSUME;
4503 }
4504
4505
4506
4507
4508
4509
4510
4511
4512
4513
4514
4515
4516
4517
4518
4519
4520 enum sctp_disposition sctp_sf_violation(struct net *net,
4521 const struct sctp_endpoint *ep,
4522 const struct sctp_association *asoc,
4523 const union sctp_subtype type,
4524 void *arg,
4525 struct sctp_cmd_seq *commands)
4526 {
4527 struct sctp_chunk *chunk = arg;
4528
4529
4530 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
4531 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4532 commands);
4533
4534 return SCTP_DISPOSITION_VIOLATION;
4535 }
4536
4537
4538
4539
4540 static enum sctp_disposition sctp_sf_abort_violation(
4541 struct net *net,
4542 const struct sctp_endpoint *ep,
4543 const struct sctp_association *asoc,
4544 void *arg,
4545 struct sctp_cmd_seq *commands,
4546 const __u8 *payload,
4547 const size_t paylen)
4548 {
4549 struct sctp_packet *packet = NULL;
4550 struct sctp_chunk *chunk = arg;
4551 struct sctp_chunk *abort = NULL;
4552
4553
4554
4555
4556
4557
4558
4559
4560
4561
4562
4563
4564 if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
4565 goto discard;
4566
4567
4568 abort = sctp_make_abort_violation(asoc, chunk, payload, paylen);
4569 if (!abort)
4570 goto nomem;
4571
4572 if (asoc) {
4573
4574 if (chunk->chunk_hdr->type == SCTP_CID_INIT_ACK &&
4575 !asoc->peer.i.init_tag) {
4576 struct sctp_initack_chunk *initack;
4577
4578 initack = (struct sctp_initack_chunk *)chunk->chunk_hdr;
4579 if (!sctp_chunk_length_valid(chunk, sizeof(*initack)))
4580 abort->chunk_hdr->flags |= SCTP_CHUNK_FLAG_T;
4581 else {
4582 unsigned int inittag;
4583
4584 inittag = ntohl(initack->init_hdr.init_tag);
4585 sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_INITTAG,
4586 SCTP_U32(inittag));
4587 }
4588 }
4589
4590 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
4591 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
4592
4593 if (asoc->state <= SCTP_STATE_COOKIE_ECHOED) {
4594 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4595 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
4596 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4597 SCTP_ERROR(ECONNREFUSED));
4598 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
4599 SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
4600 } else {
4601 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4602 SCTP_ERROR(ECONNABORTED));
4603 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
4604 SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
4605 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
4606 }
4607 } else {
4608 packet = sctp_ootb_pkt_new(net, asoc, chunk);
4609
4610 if (!packet)
4611 goto nomem_pkt;
4612
4613 if (sctp_test_T_bit(abort))
4614 packet->vtag = ntohl(chunk->sctp_hdr->vtag);
4615
4616 abort->skb->sk = ep->base.sk;
4617
4618 sctp_packet_append_chunk(packet, abort);
4619
4620 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
4621 SCTP_PACKET(packet));
4622
4623 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
4624 }
4625
4626 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
4627
4628 discard:
4629 sctp_sf_pdiscard(net, ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
4630 return SCTP_DISPOSITION_ABORT;
4631
4632 nomem_pkt:
4633 sctp_chunk_free(abort);
4634 nomem:
4635 return SCTP_DISPOSITION_NOMEM;
4636 }
4637
4638
4639
4640
4641
4642
4643
4644
4645
4646
4647
4648
4649
4650
4651
4652
4653
4654
4655
4656
4657 static enum sctp_disposition sctp_sf_violation_chunklen(
4658 struct net *net,
4659 const struct sctp_endpoint *ep,
4660 const struct sctp_association *asoc,
4661 const union sctp_subtype type,
4662 void *arg,
4663 struct sctp_cmd_seq *commands)
4664 {
4665 static const char err_str[] = "The following chunk had invalid length:";
4666
4667 return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str,
4668 sizeof(err_str));
4669 }
4670
4671
4672
4673
4674
4675
4676
4677 static enum sctp_disposition sctp_sf_violation_paramlen(
4678 struct net *net,
4679 const struct sctp_endpoint *ep,
4680 const struct sctp_association *asoc,
4681 const union sctp_subtype type,
4682 void *arg, void *ext,
4683 struct sctp_cmd_seq *commands)
4684 {
4685 struct sctp_paramhdr *param = ext;
4686 struct sctp_chunk *abort = NULL;
4687 struct sctp_chunk *chunk = arg;
4688
4689 if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
4690 goto discard;
4691
4692
4693 abort = sctp_make_violation_paramlen(asoc, chunk, param);
4694 if (!abort)
4695 goto nomem;
4696
4697 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
4698 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
4699
4700 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4701 SCTP_ERROR(ECONNABORTED));
4702 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
4703 SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
4704 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
4705 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
4706
4707 discard:
4708 sctp_sf_pdiscard(net, ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
4709 return SCTP_DISPOSITION_ABORT;
4710 nomem:
4711 return SCTP_DISPOSITION_NOMEM;
4712 }
4713
4714
4715
4716
4717
4718
4719
4720 static enum sctp_disposition sctp_sf_violation_ctsn(
4721 struct net *net,
4722 const struct sctp_endpoint *ep,
4723 const struct sctp_association *asoc,
4724 const union sctp_subtype type,
4725 void *arg,
4726 struct sctp_cmd_seq *commands)
4727 {
4728 static const char err_str[] = "The cumulative tsn ack beyond the max tsn currently sent:";
4729
4730 return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str,
4731 sizeof(err_str));
4732 }
4733
4734
4735
4736
4737
4738
4739
4740 static enum sctp_disposition sctp_sf_violation_chunk(
4741 struct net *net,
4742 const struct sctp_endpoint *ep,
4743 const struct sctp_association *asoc,
4744 const union sctp_subtype type,
4745 void *arg,
4746 struct sctp_cmd_seq *commands)
4747 {
4748 static const char err_str[] = "The following chunk violates protocol:";
4749
4750 if (!asoc)
4751 return sctp_sf_violation(net, ep, asoc, type, arg, commands);
4752
4753 return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str,
4754 sizeof(err_str));
4755 }
4756
4757
4758
4759
4760
4761
4762
4763
4764
4765
4766
4767
4768
4769
4770
4771
4772
4773
4774
4775
4776
4777
4778
4779
4780
4781
4782
4783
4784
4785
4786
4787
4788
4789
4790
4791
4792
4793
4794
4795
4796
4797
4798
4799
4800
4801
4802
4803
4804
4805
4806
4807
4808
4809
4810
4811
4812
4813
4814
4815
4816 enum sctp_disposition sctp_sf_do_prm_asoc(struct net *net,
4817 const struct sctp_endpoint *ep,
4818 const struct sctp_association *asoc,
4819 const union sctp_subtype type,
4820 void *arg,
4821 struct sctp_cmd_seq *commands)
4822 {
4823 struct sctp_association *my_asoc;
4824 struct sctp_chunk *repl;
4825
4826
4827
4828
4829
4830 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
4831 SCTP_STATE(SCTP_STATE_COOKIE_WAIT));
4832
4833
4834
4835
4836
4837
4838
4839
4840
4841 repl = sctp_make_init(asoc, &asoc->base.bind_addr, GFP_ATOMIC, 0);
4842 if (!repl)
4843 goto nomem;
4844
4845
4846 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
4847 SCTP_CHUNK(repl));
4848
4849
4850
4851
4852 my_asoc = (struct sctp_association *)asoc;
4853 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(my_asoc));
4854
4855
4856
4857
4858 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
4859 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
4860 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
4861 return SCTP_DISPOSITION_CONSUME;
4862
4863 nomem:
4864 return SCTP_DISPOSITION_NOMEM;
4865 }
4866
4867
4868
4869
4870
4871
4872
4873
4874
4875
4876
4877
4878
4879
4880
4881
4882
4883
4884
4885
4886
4887
4888
4889
4890
4891
4892
4893
4894
4895
4896
4897
4898
4899
4900
4901
4902
4903
4904
4905
4906
4907
4908
4909
4910
4911
4912
4913
4914
4915
4916
4917
4918
4919
4920
4921
4922
4923
4924
4925
4926
4927
4928 enum sctp_disposition sctp_sf_do_prm_send(struct net *net,
4929 const struct sctp_endpoint *ep,
4930 const struct sctp_association *asoc,
4931 const union sctp_subtype type,
4932 void *arg,
4933 struct sctp_cmd_seq *commands)
4934 {
4935 struct sctp_datamsg *msg = arg;
4936
4937 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_MSG, SCTP_DATAMSG(msg));
4938 return SCTP_DISPOSITION_CONSUME;
4939 }
4940
4941
4942
4943
4944
4945
4946
4947
4948
4949
4950
4951
4952
4953
4954
4955
4956
4957
4958
4959
4960
4961
4962
4963
4964
4965
4966
4967 enum sctp_disposition sctp_sf_do_9_2_prm_shutdown(
4968 struct net *net,
4969 const struct sctp_endpoint *ep,
4970 const struct sctp_association *asoc,
4971 const union sctp_subtype type,
4972 void *arg,
4973 struct sctp_cmd_seq *commands)
4974 {
4975 enum sctp_disposition disposition;
4976
4977
4978
4979
4980
4981
4982
4983
4984
4985 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
4986 SCTP_STATE(SCTP_STATE_SHUTDOWN_PENDING));
4987
4988 disposition = SCTP_DISPOSITION_CONSUME;
4989 if (sctp_outq_is_empty(&asoc->outqueue)) {
4990 disposition = sctp_sf_do_9_2_start_shutdown(net, ep, asoc, type,
4991 arg, commands);
4992 }
4993
4994 return disposition;
4995 }
4996
4997
4998
4999
5000
5001
5002
5003
5004
5005
5006
5007
5008
5009
5010
5011
5012
5013
5014
5015
5016
5017
5018
5019
5020
5021
5022
5023
5024 enum sctp_disposition sctp_sf_do_9_1_prm_abort(
5025 struct net *net,
5026 const struct sctp_endpoint *ep,
5027 const struct sctp_association *asoc,
5028 const union sctp_subtype type,
5029 void *arg,
5030 struct sctp_cmd_seq *commands)
5031 {
5032
5033
5034
5035
5036
5037
5038
5039
5040 struct sctp_chunk *abort = arg;
5041
5042 if (abort)
5043 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
5044
5045
5046
5047
5048
5049 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5050 SCTP_ERROR(ECONNABORTED));
5051
5052 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5053 SCTP_PERR(SCTP_ERROR_USER_ABORT));
5054
5055 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
5056 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
5057
5058 return SCTP_DISPOSITION_ABORT;
5059 }
5060
5061
5062 enum sctp_disposition sctp_sf_error_closed(struct net *net,
5063 const struct sctp_endpoint *ep,
5064 const struct sctp_association *asoc,
5065 const union sctp_subtype type,
5066 void *arg,
5067 struct sctp_cmd_seq *commands)
5068 {
5069 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_ERROR, SCTP_ERROR(-EINVAL));
5070 return SCTP_DISPOSITION_CONSUME;
5071 }
5072
5073
5074
5075
5076 enum sctp_disposition sctp_sf_error_shutdown(
5077 struct net *net,
5078 const struct sctp_endpoint *ep,
5079 const struct sctp_association *asoc,
5080 const union sctp_subtype type,
5081 void *arg,
5082 struct sctp_cmd_seq *commands)
5083 {
5084 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_ERROR,
5085 SCTP_ERROR(-ESHUTDOWN));
5086 return SCTP_DISPOSITION_CONSUME;
5087 }
5088
5089
5090
5091
5092
5093
5094
5095
5096
5097
5098
5099
5100
5101
5102
5103 enum sctp_disposition sctp_sf_cookie_wait_prm_shutdown(
5104 struct net *net,
5105 const struct sctp_endpoint *ep,
5106 const struct sctp_association *asoc,
5107 const union sctp_subtype type,
5108 void *arg,
5109 struct sctp_cmd_seq *commands)
5110 {
5111 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5112 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
5113
5114 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
5115 SCTP_STATE(SCTP_STATE_CLOSED));
5116
5117 SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS);
5118
5119 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
5120
5121 return SCTP_DISPOSITION_DELETE_TCB;
5122 }
5123
5124
5125
5126
5127
5128
5129
5130
5131
5132
5133
5134
5135
5136
5137
5138 enum sctp_disposition sctp_sf_cookie_echoed_prm_shutdown(
5139 struct net *net,
5140 const struct sctp_endpoint *ep,
5141 const struct sctp_association *asoc,
5142 const union sctp_subtype type,
5143 void *arg,
5144 struct sctp_cmd_seq *commands)
5145 {
5146
5147
5148
5149 return sctp_sf_cookie_wait_prm_shutdown(net, ep, asoc, type, arg, commands);
5150 }
5151
5152
5153
5154
5155
5156
5157
5158
5159
5160
5161
5162
5163
5164
5165
5166 enum sctp_disposition sctp_sf_cookie_wait_prm_abort(
5167 struct net *net,
5168 const struct sctp_endpoint *ep,
5169 const struct sctp_association *asoc,
5170 const union sctp_subtype type,
5171 void *arg,
5172 struct sctp_cmd_seq *commands)
5173 {
5174 struct sctp_chunk *abort = arg;
5175
5176
5177 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5178 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
5179
5180 if (abort)
5181 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
5182
5183 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
5184 SCTP_STATE(SCTP_STATE_CLOSED));
5185
5186 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
5187
5188
5189
5190
5191
5192 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5193 SCTP_ERROR(ECONNREFUSED));
5194
5195 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
5196 SCTP_PERR(SCTP_ERROR_USER_ABORT));
5197
5198 return SCTP_DISPOSITION_ABORT;
5199 }
5200
5201
5202
5203
5204
5205
5206
5207
5208
5209
5210
5211
5212
5213
5214
5215 enum sctp_disposition sctp_sf_cookie_echoed_prm_abort(
5216 struct net *net,
5217 const struct sctp_endpoint *ep,
5218 const struct sctp_association *asoc,
5219 const union sctp_subtype type,
5220 void *arg,
5221 struct sctp_cmd_seq *commands)
5222 {
5223
5224
5225
5226 return sctp_sf_cookie_wait_prm_abort(net, ep, asoc, type, arg, commands);
5227 }
5228
5229
5230
5231
5232
5233
5234
5235
5236
5237
5238
5239
5240
5241 enum sctp_disposition sctp_sf_shutdown_pending_prm_abort(
5242 struct net *net,
5243 const struct sctp_endpoint *ep,
5244 const struct sctp_association *asoc,
5245 const union sctp_subtype type,
5246 void *arg,
5247 struct sctp_cmd_seq *commands)
5248 {
5249
5250 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5251 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5252
5253 return sctp_sf_do_9_1_prm_abort(net, ep, asoc, type, arg, commands);
5254 }
5255
5256
5257
5258
5259
5260
5261
5262
5263
5264
5265
5266
5267
5268 enum sctp_disposition sctp_sf_shutdown_sent_prm_abort(
5269 struct net *net,
5270 const struct sctp_endpoint *ep,
5271 const struct sctp_association *asoc,
5272 const union sctp_subtype type,
5273 void *arg,
5274 struct sctp_cmd_seq *commands)
5275 {
5276
5277 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5278 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5279
5280
5281 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5282 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5283
5284 return sctp_sf_do_9_1_prm_abort(net, ep, asoc, type, arg, commands);
5285 }
5286
5287
5288
5289
5290
5291
5292
5293
5294
5295
5296
5297
5298
5299 enum sctp_disposition sctp_sf_shutdown_ack_sent_prm_abort(
5300 struct net *net,
5301 const struct sctp_endpoint *ep,
5302 const struct sctp_association *asoc,
5303 const union sctp_subtype type,
5304 void *arg,
5305 struct sctp_cmd_seq *commands)
5306 {
5307
5308
5309
5310 return sctp_sf_shutdown_sent_prm_abort(net, ep, asoc, type, arg, commands);
5311 }
5312
5313
5314
5315
5316
5317
5318
5319
5320
5321
5322
5323
5324
5325
5326
5327
5328
5329
5330
5331
5332
5333
5334
5335 enum sctp_disposition sctp_sf_do_prm_requestheartbeat(
5336 struct net *net,
5337 const struct sctp_endpoint *ep,
5338 const struct sctp_association *asoc,
5339 const union sctp_subtype type,
5340 void *arg,
5341 struct sctp_cmd_seq *commands)
5342 {
5343 if (SCTP_DISPOSITION_NOMEM == sctp_sf_heartbeat(ep, asoc, type,
5344 (struct sctp_transport *)arg, commands))
5345 return SCTP_DISPOSITION_NOMEM;
5346
5347
5348
5349
5350
5351
5352
5353
5354
5355
5356
5357
5358 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_HB_SENT,
5359 SCTP_TRANSPORT(arg));
5360 return SCTP_DISPOSITION_CONSUME;
5361 }
5362
5363
5364
5365
5366
5367
5368 enum sctp_disposition sctp_sf_do_prm_asconf(struct net *net,
5369 const struct sctp_endpoint *ep,
5370 const struct sctp_association *asoc,
5371 const union sctp_subtype type,
5372 void *arg,
5373 struct sctp_cmd_seq *commands)
5374 {
5375 struct sctp_chunk *chunk = arg;
5376
5377 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T4, SCTP_CHUNK(chunk));
5378 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
5379 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
5380 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(chunk));
5381 return SCTP_DISPOSITION_CONSUME;
5382 }
5383
5384
5385 enum sctp_disposition sctp_sf_do_prm_reconf(struct net *net,
5386 const struct sctp_endpoint *ep,
5387 const struct sctp_association *asoc,
5388 const union sctp_subtype type,
5389 void *arg,
5390 struct sctp_cmd_seq *commands)
5391 {
5392 struct sctp_chunk *chunk = arg;
5393
5394 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(chunk));
5395 return SCTP_DISPOSITION_CONSUME;
5396 }
5397
5398
5399
5400
5401
5402
5403 enum sctp_disposition sctp_sf_ignore_primitive(
5404 struct net *net,
5405 const struct sctp_endpoint *ep,
5406 const struct sctp_association *asoc,
5407 const union sctp_subtype type,
5408 void *arg,
5409 struct sctp_cmd_seq *commands)
5410 {
5411 pr_debug("%s: primitive type:%d is ignored\n", __func__,
5412 type.primitive);
5413
5414 return SCTP_DISPOSITION_DISCARD;
5415 }
5416
5417
5418
5419
5420
5421
5422
5423
5424
5425
5426
5427 enum sctp_disposition sctp_sf_do_no_pending_tsn(
5428 struct net *net,
5429 const struct sctp_endpoint *ep,
5430 const struct sctp_association *asoc,
5431 const union sctp_subtype type,
5432 void *arg,
5433 struct sctp_cmd_seq *commands)
5434 {
5435 struct sctp_ulpevent *event;
5436
5437 event = sctp_ulpevent_make_sender_dry_event(asoc, GFP_ATOMIC);
5438 if (!event)
5439 return SCTP_DISPOSITION_NOMEM;
5440
5441 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(event));
5442
5443 return SCTP_DISPOSITION_CONSUME;
5444 }
5445
5446
5447
5448
5449
5450
5451
5452
5453
5454
5455
5456
5457
5458
5459 enum sctp_disposition sctp_sf_do_9_2_start_shutdown(
5460 struct net *net,
5461 const struct sctp_endpoint *ep,
5462 const struct sctp_association *asoc,
5463 const union sctp_subtype type,
5464 void *arg,
5465 struct sctp_cmd_seq *commands)
5466 {
5467 struct sctp_chunk *reply;
5468
5469
5470
5471
5472
5473
5474 reply = sctp_make_shutdown(asoc, arg);
5475 if (!reply)
5476 goto nomem;
5477
5478
5479
5480
5481 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
5482
5483
5484 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
5485 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5486
5487
5488
5489
5490
5491 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
5492 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5493
5494 if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
5495 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5496 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
5497
5498
5499 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
5500 SCTP_STATE(SCTP_STATE_SHUTDOWN_SENT));
5501
5502
5503
5504
5505
5506
5507 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
5508
5509 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
5510
5511 return SCTP_DISPOSITION_CONSUME;
5512
5513 nomem:
5514 return SCTP_DISPOSITION_NOMEM;
5515 }
5516
5517
5518
5519
5520
5521
5522
5523
5524
5525
5526
5527
5528
5529 enum sctp_disposition sctp_sf_do_9_2_shutdown_ack(
5530 struct net *net,
5531 const struct sctp_endpoint *ep,
5532 const struct sctp_association *asoc,
5533 const union sctp_subtype type,
5534 void *arg,
5535 struct sctp_cmd_seq *commands)
5536 {
5537 struct sctp_chunk *chunk = arg;
5538 struct sctp_chunk *reply;
5539
5540
5541
5542
5543
5544
5545
5546
5547 if (chunk) {
5548 if (!sctp_vtag_verify(chunk, asoc))
5549 return sctp_sf_pdiscard(net, ep, asoc, type, arg,
5550 commands);
5551
5552
5553 if (!sctp_chunk_length_valid(
5554 chunk, sizeof(struct sctp_shutdown_chunk)))
5555 return sctp_sf_violation_chunklen(net, ep, asoc, type,
5556 arg, commands);
5557 }
5558
5559
5560
5561
5562 reply = sctp_make_shutdown_ack(asoc, chunk);
5563 if (!reply)
5564 goto nomem;
5565
5566
5567
5568
5569 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
5570
5571
5572 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
5573 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5574
5575 if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
5576 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5577 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
5578
5579
5580 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
5581 SCTP_STATE(SCTP_STATE_SHUTDOWN_ACK_SENT));
5582
5583
5584
5585
5586
5587
5588 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
5589
5590 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
5591
5592 return SCTP_DISPOSITION_CONSUME;
5593
5594 nomem:
5595 return SCTP_DISPOSITION_NOMEM;
5596 }
5597
5598
5599
5600
5601
5602
5603 enum sctp_disposition sctp_sf_ignore_other(struct net *net,
5604 const struct sctp_endpoint *ep,
5605 const struct sctp_association *asoc,
5606 const union sctp_subtype type,
5607 void *arg,
5608 struct sctp_cmd_seq *commands)
5609 {
5610 pr_debug("%s: the event other type:%d is ignored\n",
5611 __func__, type.other);
5612
5613 return SCTP_DISPOSITION_DISCARD;
5614 }
5615
5616
5617
5618
5619
5620
5621
5622
5623
5624
5625
5626
5627
5628
5629
5630
5631 enum sctp_disposition sctp_sf_do_6_3_3_rtx(struct net *net,
5632 const struct sctp_endpoint *ep,
5633 const struct sctp_association *asoc,
5634 const union sctp_subtype type,
5635 void *arg,
5636 struct sctp_cmd_seq *commands)
5637 {
5638 struct sctp_transport *transport = arg;
5639
5640 SCTP_INC_STATS(net, SCTP_MIB_T3_RTX_EXPIREDS);
5641
5642 if (asoc->overall_error_count >= asoc->max_retrans) {
5643 if (asoc->peer.zero_window_announced &&
5644 asoc->state == SCTP_STATE_SHUTDOWN_PENDING) {
5645
5646
5647
5648
5649
5650
5651
5652
5653
5654 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START_ONCE,
5655 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5656 } else {
5657 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5658 SCTP_ERROR(ETIMEDOUT));
5659
5660 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5661 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5662 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
5663 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
5664 return SCTP_DISPOSITION_DELETE_TCB;
5665 }
5666 }
5667
5668
5669
5670
5671
5672
5673
5674
5675
5676
5677
5678
5679
5680
5681
5682
5683
5684
5685
5686
5687
5688
5689
5690
5691
5692
5693
5694
5695
5696 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE, SCTP_TRANSPORT(transport));
5697
5698
5699 sctp_add_cmd_sf(commands, SCTP_CMD_RETRAN, SCTP_TRANSPORT(transport));
5700
5701 return SCTP_DISPOSITION_CONSUME;
5702 }
5703
5704
5705
5706
5707
5708
5709
5710
5711
5712
5713
5714
5715
5716
5717
5718
5719 enum sctp_disposition sctp_sf_do_6_2_sack(struct net *net,
5720 const struct sctp_endpoint *ep,
5721 const struct sctp_association *asoc,
5722 const union sctp_subtype type,
5723 void *arg,
5724 struct sctp_cmd_seq *commands)
5725 {
5726 SCTP_INC_STATS(net, SCTP_MIB_DELAY_SACK_EXPIREDS);
5727 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
5728 return SCTP_DISPOSITION_CONSUME;
5729 }
5730
5731
5732
5733
5734
5735
5736
5737
5738
5739
5740
5741
5742
5743
5744
5745
5746
5747
5748
5749
5750 enum sctp_disposition sctp_sf_t1_init_timer_expire(
5751 struct net *net,
5752 const struct sctp_endpoint *ep,
5753 const struct sctp_association *asoc,
5754 const union sctp_subtype type,
5755 void *arg,
5756 struct sctp_cmd_seq *commands)
5757 {
5758 int attempts = asoc->init_err_counter + 1;
5759 struct sctp_chunk *repl = NULL;
5760 struct sctp_bind_addr *bp;
5761
5762 pr_debug("%s: timer T1 expired (INIT)\n", __func__);
5763
5764 SCTP_INC_STATS(net, SCTP_MIB_T1_INIT_EXPIREDS);
5765
5766 if (attempts <= asoc->max_init_attempts) {
5767 bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
5768 repl = sctp_make_init(asoc, bp, GFP_ATOMIC, 0);
5769 if (!repl)
5770 return SCTP_DISPOSITION_NOMEM;
5771
5772
5773 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
5774 SCTP_CHUNK(repl));
5775
5776
5777 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_RESTART,
5778 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
5779
5780 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
5781 } else {
5782 pr_debug("%s: giving up on INIT, attempts:%d "
5783 "max_init_attempts:%d\n", __func__, attempts,
5784 asoc->max_init_attempts);
5785
5786 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5787 SCTP_ERROR(ETIMEDOUT));
5788 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
5789 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5790 return SCTP_DISPOSITION_DELETE_TCB;
5791 }
5792
5793 return SCTP_DISPOSITION_CONSUME;
5794 }
5795
5796
5797
5798
5799
5800
5801
5802
5803
5804
5805
5806
5807
5808
5809
5810
5811
5812
5813
5814
5815 enum sctp_disposition sctp_sf_t1_cookie_timer_expire(
5816 struct net *net,
5817 const struct sctp_endpoint *ep,
5818 const struct sctp_association *asoc,
5819 const union sctp_subtype type,
5820 void *arg,
5821 struct sctp_cmd_seq *commands)
5822 {
5823 int attempts = asoc->init_err_counter + 1;
5824 struct sctp_chunk *repl = NULL;
5825
5826 pr_debug("%s: timer T1 expired (COOKIE-ECHO)\n", __func__);
5827
5828 SCTP_INC_STATS(net, SCTP_MIB_T1_COOKIE_EXPIREDS);
5829
5830 if (attempts <= asoc->max_init_attempts) {
5831 repl = sctp_make_cookie_echo(asoc, NULL);
5832 if (!repl)
5833 return SCTP_DISPOSITION_NOMEM;
5834
5835 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
5836 SCTP_CHUNK(repl));
5837
5838 sctp_add_cmd_sf(commands, SCTP_CMD_COOKIEECHO_RESTART,
5839 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
5840
5841 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
5842 } else {
5843 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5844 SCTP_ERROR(ETIMEDOUT));
5845 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
5846 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5847 return SCTP_DISPOSITION_DELETE_TCB;
5848 }
5849
5850 return SCTP_DISPOSITION_CONSUME;
5851 }
5852
5853
5854
5855
5856
5857
5858
5859
5860
5861
5862
5863
5864
5865
5866 enum sctp_disposition sctp_sf_t2_timer_expire(
5867 struct net *net,
5868 const struct sctp_endpoint *ep,
5869 const struct sctp_association *asoc,
5870 const union sctp_subtype type,
5871 void *arg,
5872 struct sctp_cmd_seq *commands)
5873 {
5874 struct sctp_chunk *reply = NULL;
5875
5876 pr_debug("%s: timer T2 expired\n", __func__);
5877
5878 SCTP_INC_STATS(net, SCTP_MIB_T2_SHUTDOWN_EXPIREDS);
5879
5880 ((struct sctp_association *)asoc)->shutdown_retries++;
5881
5882 if (asoc->overall_error_count >= asoc->max_retrans) {
5883 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5884 SCTP_ERROR(ETIMEDOUT));
5885
5886 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5887 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5888 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
5889 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
5890 return SCTP_DISPOSITION_DELETE_TCB;
5891 }
5892
5893 switch (asoc->state) {
5894 case SCTP_STATE_SHUTDOWN_SENT:
5895 reply = sctp_make_shutdown(asoc, NULL);
5896 break;
5897
5898 case SCTP_STATE_SHUTDOWN_ACK_SENT:
5899 reply = sctp_make_shutdown_ack(asoc, NULL);
5900 break;
5901
5902 default:
5903 BUG();
5904 break;
5905 }
5906
5907 if (!reply)
5908 goto nomem;
5909
5910
5911
5912
5913
5914 if (asoc->shutdown_last_sent_to)
5915 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE,
5916 SCTP_TRANSPORT(asoc->shutdown_last_sent_to));
5917
5918
5919
5920
5921 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
5922
5923
5924 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
5925 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5926 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
5927 return SCTP_DISPOSITION_CONSUME;
5928
5929 nomem:
5930 return SCTP_DISPOSITION_NOMEM;
5931 }
5932
5933
5934
5935
5936
5937 enum sctp_disposition sctp_sf_t4_timer_expire(
5938 struct net *net,
5939 const struct sctp_endpoint *ep,
5940 const struct sctp_association *asoc,
5941 const union sctp_subtype type,
5942 void *arg,
5943 struct sctp_cmd_seq *commands)
5944 {
5945 struct sctp_chunk *chunk = asoc->addip_last_asconf;
5946 struct sctp_transport *transport = chunk->transport;
5947
5948 SCTP_INC_STATS(net, SCTP_MIB_T4_RTO_EXPIREDS);
5949
5950
5951
5952
5953
5954 if (transport)
5955 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE,
5956 SCTP_TRANSPORT(transport));
5957
5958
5959 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T4, SCTP_CHUNK(chunk));
5960
5961
5962
5963
5964
5965
5966 if (asoc->overall_error_count >= asoc->max_retrans) {
5967 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5968 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
5969 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5970 SCTP_ERROR(ETIMEDOUT));
5971 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5972 SCTP_PERR(SCTP_ERROR_NO_ERROR));
5973 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
5974 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
5975 return SCTP_DISPOSITION_ABORT;
5976 }
5977
5978
5979
5980
5981
5982
5983
5984
5985
5986
5987
5988
5989 sctp_chunk_hold(asoc->addip_last_asconf);
5990 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
5991 SCTP_CHUNK(asoc->addip_last_asconf));
5992
5993
5994
5995
5996
5997 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
5998 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
5999
6000 return SCTP_DISPOSITION_CONSUME;
6001 }
6002
6003
6004
6005
6006
6007
6008
6009 enum sctp_disposition sctp_sf_t5_timer_expire(
6010 struct net *net,
6011 const struct sctp_endpoint *ep,
6012 const struct sctp_association *asoc,
6013 const union sctp_subtype type,
6014 void *arg,
6015 struct sctp_cmd_seq *commands)
6016 {
6017 struct sctp_chunk *reply = NULL;
6018
6019 pr_debug("%s: timer T5 expired\n", __func__);
6020
6021 SCTP_INC_STATS(net, SCTP_MIB_T5_SHUTDOWN_GUARD_EXPIREDS);
6022
6023 reply = sctp_make_abort(asoc, NULL, 0);
6024 if (!reply)
6025 goto nomem;
6026
6027 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
6028 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
6029 SCTP_ERROR(ETIMEDOUT));
6030 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
6031 SCTP_PERR(SCTP_ERROR_NO_ERROR));
6032
6033 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
6034 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
6035
6036 return SCTP_DISPOSITION_DELETE_TCB;
6037 nomem:
6038 return SCTP_DISPOSITION_NOMEM;
6039 }
6040
6041
6042
6043
6044
6045
6046 enum sctp_disposition sctp_sf_autoclose_timer_expire(
6047 struct net *net,
6048 const struct sctp_endpoint *ep,
6049 const struct sctp_association *asoc,
6050 const union sctp_subtype type,
6051 void *arg,
6052 struct sctp_cmd_seq *commands)
6053 {
6054 enum sctp_disposition disposition;
6055
6056 SCTP_INC_STATS(net, SCTP_MIB_AUTOCLOSE_EXPIREDS);
6057
6058
6059
6060
6061
6062
6063
6064
6065
6066 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
6067 SCTP_STATE(SCTP_STATE_SHUTDOWN_PENDING));
6068
6069 disposition = SCTP_DISPOSITION_CONSUME;
6070 if (sctp_outq_is_empty(&asoc->outqueue)) {
6071 disposition = sctp_sf_do_9_2_start_shutdown(net, ep, asoc, type,
6072 NULL, commands);
6073 }
6074
6075 return disposition;
6076 }
6077
6078
6079
6080
6081
6082
6083
6084
6085
6086
6087
6088
6089
6090 enum sctp_disposition sctp_sf_not_impl(struct net *net,
6091 const struct sctp_endpoint *ep,
6092 const struct sctp_association *asoc,
6093 const union sctp_subtype type,
6094 void *arg, struct sctp_cmd_seq *commands)
6095 {
6096 return SCTP_DISPOSITION_NOT_IMPL;
6097 }
6098
6099
6100
6101
6102
6103
6104
6105
6106
6107 enum sctp_disposition sctp_sf_bug(struct net *net,
6108 const struct sctp_endpoint *ep,
6109 const struct sctp_association *asoc,
6110 const union sctp_subtype type,
6111 void *arg, struct sctp_cmd_seq *commands)
6112 {
6113 return SCTP_DISPOSITION_BUG;
6114 }
6115
6116
6117
6118
6119
6120
6121
6122
6123
6124
6125
6126
6127 enum sctp_disposition sctp_sf_timer_ignore(struct net *net,
6128 const struct sctp_endpoint *ep,
6129 const struct sctp_association *asoc,
6130 const union sctp_subtype type,
6131 void *arg,
6132 struct sctp_cmd_seq *commands)
6133 {
6134 pr_debug("%s: timer %d ignored\n", __func__, type.chunk);
6135
6136 return SCTP_DISPOSITION_CONSUME;
6137 }
6138
6139
6140
6141
6142
6143
6144 static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk)
6145 {
6146 struct sctp_sackhdr *sack;
6147 __u16 num_dup_tsns;
6148 unsigned int len;
6149 __u16 num_blocks;
6150
6151
6152
6153
6154 sack = (struct sctp_sackhdr *) chunk->skb->data;
6155
6156 num_blocks = ntohs(sack->num_gap_ack_blocks);
6157 num_dup_tsns = ntohs(sack->num_dup_tsns);
6158 len = sizeof(struct sctp_sackhdr);
6159 len += (num_blocks + num_dup_tsns) * sizeof(__u32);
6160 if (len > chunk->skb->len)
6161 return NULL;
6162
6163 skb_pull(chunk->skb, len);
6164
6165 return sack;
6166 }
6167
6168
6169
6170
6171 static struct sctp_packet *sctp_abort_pkt_new(
6172 struct net *net,
6173 const struct sctp_endpoint *ep,
6174 const struct sctp_association *asoc,
6175 struct sctp_chunk *chunk,
6176 const void *payload, size_t paylen)
6177 {
6178 struct sctp_packet *packet;
6179 struct sctp_chunk *abort;
6180
6181 packet = sctp_ootb_pkt_new(net, asoc, chunk);
6182
6183 if (packet) {
6184
6185
6186
6187 abort = sctp_make_abort(asoc, chunk, paylen);
6188 if (!abort) {
6189 sctp_ootb_pkt_free(packet);
6190 return NULL;
6191 }
6192
6193
6194 if (sctp_test_T_bit(abort))
6195 packet->vtag = ntohl(chunk->sctp_hdr->vtag);
6196
6197
6198
6199
6200 sctp_addto_chunk(abort, paylen, payload);
6201
6202
6203 abort->skb->sk = ep->base.sk;
6204
6205 sctp_packet_append_chunk(packet, abort);
6206
6207 }
6208
6209 return packet;
6210 }
6211
6212
6213 static struct sctp_packet *sctp_ootb_pkt_new(
6214 struct net *net,
6215 const struct sctp_association *asoc,
6216 const struct sctp_chunk *chunk)
6217 {
6218 struct sctp_transport *transport;
6219 struct sctp_packet *packet;
6220 __u16 sport, dport;
6221 __u32 vtag;
6222
6223
6224 sport = ntohs(chunk->sctp_hdr->dest);
6225 dport = ntohs(chunk->sctp_hdr->source);
6226
6227
6228
6229
6230 if (asoc) {
6231
6232
6233
6234 switch (chunk->chunk_hdr->type) {
6235 case SCTP_CID_INIT_ACK:
6236 {
6237 struct sctp_initack_chunk *initack;
6238
6239 initack = (struct sctp_initack_chunk *)chunk->chunk_hdr;
6240 vtag = ntohl(initack->init_hdr.init_tag);
6241 break;
6242 }
6243 default:
6244 vtag = asoc->peer.i.init_tag;
6245 break;
6246 }
6247 } else {
6248
6249
6250
6251 switch (chunk->chunk_hdr->type) {
6252 case SCTP_CID_INIT:
6253 {
6254 struct sctp_init_chunk *init;
6255
6256 init = (struct sctp_init_chunk *)chunk->chunk_hdr;
6257 vtag = ntohl(init->init_hdr.init_tag);
6258 break;
6259 }
6260 default:
6261 vtag = ntohl(chunk->sctp_hdr->vtag);
6262 break;
6263 }
6264 }
6265
6266
6267 transport = sctp_transport_new(net, sctp_source(chunk), GFP_ATOMIC);
6268 if (!transport)
6269 goto nomem;
6270
6271
6272
6273
6274 sctp_transport_route(transport, (union sctp_addr *)&chunk->dest,
6275 sctp_sk(net->sctp.ctl_sock));
6276
6277 packet = &transport->packet;
6278 sctp_packet_init(packet, transport, sport, dport);
6279 sctp_packet_config(packet, vtag, 0);
6280
6281 return packet;
6282
6283 nomem:
6284 return NULL;
6285 }
6286
6287
6288 void sctp_ootb_pkt_free(struct sctp_packet *packet)
6289 {
6290 sctp_transport_free(packet->transport);
6291 }
6292
6293
6294 static void sctp_send_stale_cookie_err(struct net *net,
6295 const struct sctp_endpoint *ep,
6296 const struct sctp_association *asoc,
6297 const struct sctp_chunk *chunk,
6298 struct sctp_cmd_seq *commands,
6299 struct sctp_chunk *err_chunk)
6300 {
6301 struct sctp_packet *packet;
6302
6303 if (err_chunk) {
6304 packet = sctp_ootb_pkt_new(net, asoc, chunk);
6305 if (packet) {
6306 struct sctp_signed_cookie *cookie;
6307
6308
6309 cookie = chunk->subh.cookie_hdr;
6310 packet->vtag = cookie->c.peer_vtag;
6311
6312
6313 err_chunk->skb->sk = ep->base.sk;
6314 sctp_packet_append_chunk(packet, err_chunk);
6315 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
6316 SCTP_PACKET(packet));
6317 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
6318 } else
6319 sctp_chunk_free (err_chunk);
6320 }
6321 }
6322
6323
6324
6325 static int sctp_eat_data(const struct sctp_association *asoc,
6326 struct sctp_chunk *chunk,
6327 struct sctp_cmd_seq *commands)
6328 {
6329 struct sctp_tsnmap *map = (struct sctp_tsnmap *)&asoc->peer.tsn_map;
6330 struct sock *sk = asoc->base.sk;
6331 struct net *net = sock_net(sk);
6332 struct sctp_datahdr *data_hdr;
6333 struct sctp_chunk *err;
6334 enum sctp_verb deliver;
6335 size_t datalen;
6336 __u32 tsn;
6337 int tmp;
6338
6339 data_hdr = (struct sctp_datahdr *)chunk->skb->data;
6340 chunk->subh.data_hdr = data_hdr;
6341 skb_pull(chunk->skb, sctp_datahdr_len(&asoc->stream));
6342
6343 tsn = ntohl(data_hdr->tsn);
6344 pr_debug("%s: TSN 0x%x\n", __func__, tsn);
6345
6346
6347
6348
6349
6350
6351
6352
6353
6354
6355
6356
6357
6358 if (asoc->peer.ecn_capable && !chunk->ecn_ce_done) {
6359 struct sctp_af *af = SCTP_INPUT_CB(chunk->skb)->af;
6360 chunk->ecn_ce_done = 1;
6361
6362 if (af->is_ce(sctp_gso_headskb(chunk->skb))) {
6363
6364 sctp_add_cmd_sf(commands, SCTP_CMD_ECN_CE,
6365 SCTP_U32(tsn));
6366 }
6367 }
6368
6369 tmp = sctp_tsnmap_check(&asoc->peer.tsn_map, tsn);
6370 if (tmp < 0) {
6371
6372
6373
6374 if (chunk->asoc)
6375 chunk->asoc->stats.outofseqtsns++;
6376 return SCTP_IERROR_HIGH_TSN;
6377 } else if (tmp > 0) {
6378
6379 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_DUP, SCTP_U32(tsn));
6380 return SCTP_IERROR_DUP_TSN;
6381 }
6382
6383
6384
6385
6386
6387
6388 datalen = ntohs(chunk->chunk_hdr->length);
6389 datalen -= sctp_datachk_len(&asoc->stream);
6390
6391 deliver = SCTP_CMD_CHUNK_ULP;
6392
6393
6394 if ((datalen >= asoc->rwnd) && (!asoc->ulpq.pd_mode)) {
6395
6396
6397
6398
6399 sctp_add_cmd_sf(commands, SCTP_CMD_PART_DELIVER, SCTP_NULL());
6400 }
6401
6402
6403
6404
6405
6406
6407 if ((!chunk->data_accepted) && (!asoc->rwnd || asoc->rwnd_over ||
6408 (datalen > asoc->rwnd + asoc->frag_point))) {
6409
6410
6411
6412
6413
6414
6415
6416 if (sctp_tsnmap_has_gap(map) &&
6417 (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
6418 pr_debug("%s: reneging for tsn:%u\n", __func__, tsn);
6419 deliver = SCTP_CMD_RENEGE;
6420 } else {
6421 pr_debug("%s: discard tsn:%u len:%zu, rwnd:%d\n",
6422 __func__, tsn, datalen, asoc->rwnd);
6423
6424 return SCTP_IERROR_IGNORE_TSN;
6425 }
6426 }
6427
6428
6429
6430
6431
6432
6433
6434
6435 if (sk_under_memory_pressure(sk)) {
6436 if (sctp_tsnmap_has_gap(map) &&
6437 (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
6438 pr_debug("%s: under pressure, reneging for tsn:%u\n",
6439 __func__, tsn);
6440 deliver = SCTP_CMD_RENEGE;
6441 } else {
6442 sk_mem_reclaim(sk);
6443 }
6444 }
6445
6446
6447
6448
6449
6450
6451
6452
6453
6454 if (unlikely(0 == datalen)) {
6455 err = sctp_make_abort_no_data(asoc, chunk, tsn);
6456 if (err) {
6457 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
6458 SCTP_CHUNK(err));
6459 }
6460
6461
6462
6463 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
6464 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
6465 SCTP_ERROR(ECONNABORTED));
6466 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
6467 SCTP_PERR(SCTP_ERROR_NO_DATA));
6468 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
6469 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
6470 return SCTP_IERROR_NO_DATA;
6471 }
6472
6473 chunk->data_accepted = 1;
6474
6475
6476
6477
6478 if (chunk->chunk_hdr->flags & SCTP_DATA_UNORDERED) {
6479 SCTP_INC_STATS(net, SCTP_MIB_INUNORDERCHUNKS);
6480 if (chunk->asoc)
6481 chunk->asoc->stats.iuodchunks++;
6482 } else {
6483 SCTP_INC_STATS(net, SCTP_MIB_INORDERCHUNKS);
6484 if (chunk->asoc)
6485 chunk->asoc->stats.iodchunks++;
6486 }
6487
6488
6489
6490
6491
6492
6493
6494
6495
6496 if (ntohs(data_hdr->stream) >= asoc->stream.incnt) {
6497
6498 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_TSN, SCTP_U32(tsn));
6499
6500 err = sctp_make_op_error(asoc, chunk, SCTP_ERROR_INV_STRM,
6501 &data_hdr->stream,
6502 sizeof(data_hdr->stream),
6503 sizeof(u16));
6504 if (err)
6505 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
6506 SCTP_CHUNK(err));
6507 return SCTP_IERROR_BAD_STREAM;
6508 }
6509
6510
6511
6512
6513
6514
6515
6516
6517 if (!asoc->stream.si->validate_data(chunk))
6518 return SCTP_IERROR_PROTO_VIOLATION;
6519
6520
6521
6522
6523
6524 sctp_add_cmd_sf(commands, deliver, SCTP_CHUNK(chunk));
6525
6526 return SCTP_IERROR_NO_ERROR;
6527 }