aboutsummaryrefslogtreecommitdiffstats
path: root/net/sctp/sm_statefuns.c
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@ppc970.osdl.org>2005-04-16 18:20:36 -0400
committerLinus Torvalds <torvalds@ppc970.osdl.org>2005-04-16 18:20:36 -0400
commit1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 (patch)
tree0bba044c4ce775e45a88a51686b5d9f90697ea9d /net/sctp/sm_statefuns.c
Linux-2.6.12-rc2
Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
Diffstat (limited to 'net/sctp/sm_statefuns.c')
-rw-r--r--net/sctp/sm_statefuns.c5238
1 files changed, 5238 insertions, 0 deletions
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
new file mode 100644
index 000000000000..278c56a2d076
--- /dev/null
+++ b/net/sctp/sm_statefuns.c
@@ -0,0 +1,5238 @@
1/* SCTP kernel reference Implementation
2 * (C) Copyright IBM Corp. 2001, 2004
3 * Copyright (c) 1999-2000 Cisco, Inc.
4 * Copyright (c) 1999-2001 Motorola, Inc.
5 * Copyright (c) 2001-2002 Intel Corp.
6 * Copyright (c) 2002 Nokia Corp.
7 *
8 * This file is part of the SCTP kernel reference Implementation
9 *
10 * This is part of the SCTP Linux Kernel Reference Implementation.
11 *
12 * These are the state functions for the state machine.
13 *
14 * The SCTP reference implementation is free software;
15 * you can redistribute it and/or modify it under the terms of
16 * the GNU General Public License as published by
17 * the Free Software Foundation; either version 2, or (at your option)
18 * any later version.
19 *
20 * The SCTP reference implementation is distributed in the hope that it
21 * will be useful, but WITHOUT ANY WARRANTY; without even the implied
22 * ************************
23 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
24 * See the GNU General Public License for more details.
25 *
26 * You should have received a copy of the GNU General Public License
27 * along with GNU CC; see the file COPYING. If not, write to
28 * the Free Software Foundation, 59 Temple Place - Suite 330,
29 * Boston, MA 02111-1307, USA.
30 *
31 * Please send any bug reports or fixes you make to the
32 * email address(es):
33 * lksctp developers <lksctp-developers@lists.sourceforge.net>
34 *
35 * Or submit a bug report through the following website:
36 * http://www.sf.net/projects/lksctp
37 *
38 * Written or modified by:
39 * La Monte H.P. Yarroll <piggy@acm.org>
40 * Karl Knutson <karl@athena.chicago.il.us>
41 * Mathew Kotowsky <kotowsky@sctp.org>
42 * Sridhar Samudrala <samudrala@us.ibm.com>
43 * Jon Grimm <jgrimm@us.ibm.com>
44 * Hui Huang <hui.huang@nokia.com>
45 * Dajiang Zhang <dajiang.zhang@nokia.com>
46 * Daisy Chang <daisyc@us.ibm.com>
47 * Ardelle Fan <ardelle.fan@intel.com>
48 * Ryan Layer <rmlayer@us.ibm.com>
49 * Kevin Gao <kevin.gao@intel.com>
50 *
51 * Any bugs reported given to us we will try to fix... any fixes shared will
52 * be incorporated into the next SCTP release.
53 */
54
55#include <linux/types.h>
56#include <linux/kernel.h>
57#include <linux/ip.h>
58#include <linux/ipv6.h>
59#include <linux/net.h>
60#include <linux/inet.h>
61#include <net/sock.h>
62#include <net/inet_ecn.h>
63#include <linux/skbuff.h>
64#include <net/sctp/sctp.h>
65#include <net/sctp/sm.h>
66#include <net/sctp/structs.h>
67
68static struct sctp_packet *sctp_abort_pkt_new(const struct sctp_endpoint *ep,
69 const struct sctp_association *asoc,
70 struct sctp_chunk *chunk,
71 const void *payload,
72 size_t paylen);
73static int sctp_eat_data(const struct sctp_association *asoc,
74 struct sctp_chunk *chunk,
75 sctp_cmd_seq_t *commands);
76static struct sctp_packet *sctp_ootb_pkt_new(const struct sctp_association *asoc,
77 const struct sctp_chunk *chunk);
78static void sctp_send_stale_cookie_err(const struct sctp_endpoint *ep,
79 const struct sctp_association *asoc,
80 const struct sctp_chunk *chunk,
81 sctp_cmd_seq_t *commands,
82 struct sctp_chunk *err_chunk);
83static sctp_disposition_t sctp_sf_do_5_2_6_stale(const struct sctp_endpoint *ep,
84 const struct sctp_association *asoc,
85 const sctp_subtype_t type,
86 void *arg,
87 sctp_cmd_seq_t *commands);
88static sctp_disposition_t sctp_sf_shut_8_4_5(const struct sctp_endpoint *ep,
89 const struct sctp_association *asoc,
90 const sctp_subtype_t type,
91 void *arg,
92 sctp_cmd_seq_t *commands);
93static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk);
94
95
96/* Small helper function that checks if the chunk length
97 * is of the appropriate length. The 'required_length' argument
98 * is set to be the size of a specific chunk we are testing.
99 * Return Values: 1 = Valid length
100 * 0 = Invalid length
101 *
102 */
103static inline int
104sctp_chunk_length_valid(struct sctp_chunk *chunk,
105 __u16 required_length)
106{
107 __u16 chunk_length = ntohs(chunk->chunk_hdr->length);
108
109 if (unlikely(chunk_length < required_length))
110 return 0;
111
112 return 1;
113}
114
115/**********************************************************
116 * These are the state functions for handling chunk events.
117 **********************************************************/
118
119/*
120 * Process the final SHUTDOWN COMPLETE.
121 *
122 * Section: 4 (C) (diagram), 9.2
123 * Upon reception of the SHUTDOWN COMPLETE chunk the endpoint will verify
124 * that it is in SHUTDOWN-ACK-SENT state, if it is not the chunk should be
125 * discarded. If the endpoint is in the SHUTDOWN-ACK-SENT state the endpoint
126 * should stop the T2-shutdown timer and remove all knowledge of the
127 * association (and thus the association enters the CLOSED state).
128 *
129 * Verification Tag: 8.5.1(C)
130 * C) Rules for packet carrying SHUTDOWN COMPLETE:
131 * ...
132 * - The receiver of a SHUTDOWN COMPLETE shall accept the packet if the
133 * Verification Tag field of the packet matches its own tag OR it is
134 * set to its peer's tag and the T bit is set in the Chunk Flags.
135 * Otherwise, the receiver MUST silently discard the packet and take
136 * no further action. An endpoint MUST ignore the SHUTDOWN COMPLETE if
137 * it is not in the SHUTDOWN-ACK-SENT state.
138 *
139 * Inputs
140 * (endpoint, asoc, chunk)
141 *
142 * Outputs
143 * (asoc, reply_msg, msg_up, timers, counters)
144 *
145 * The return value is the disposition of the chunk.
146 */
147sctp_disposition_t sctp_sf_do_4_C(const struct sctp_endpoint *ep,
148 const struct sctp_association *asoc,
149 const sctp_subtype_t type,
150 void *arg,
151 sctp_cmd_seq_t *commands)
152{
153 struct sctp_chunk *chunk = arg;
154 struct sctp_ulpevent *ev;
155
156 /* RFC 2960 6.10 Bundling
157 *
158 * An endpoint MUST NOT bundle INIT, INIT ACK or
159 * SHUTDOWN COMPLETE with any other chunks.
160 */
161 if (!chunk->singleton)
162 return SCTP_DISPOSITION_VIOLATION;
163
164 if (!sctp_vtag_verify_either(chunk, asoc))
165 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
166
167 /* RFC 2960 10.2 SCTP-to-ULP
168 *
169 * H) SHUTDOWN COMPLETE notification
170 *
171 * When SCTP completes the shutdown procedures (section 9.2) this
172 * notification is passed to the upper layer.
173 */
174 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_SHUTDOWN_COMP,
175 0, 0, 0, GFP_ATOMIC);
176 if (!ev)
177 goto nomem;
178
179 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
180
181 /* Upon reception of the SHUTDOWN COMPLETE chunk the endpoint
182 * will verify that it is in SHUTDOWN-ACK-SENT state, if it is
183 * not the chunk should be discarded. If the endpoint is in
184 * the SHUTDOWN-ACK-SENT state the endpoint should stop the
185 * T2-shutdown timer and remove all knowledge of the
186 * association (and thus the association enters the CLOSED
187 * state).
188 */
189 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
190 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
191
192 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
193 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
194
195 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
196 SCTP_STATE(SCTP_STATE_CLOSED));
197
198 SCTP_INC_STATS(SCTP_MIB_SHUTDOWNS);
199 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
200
201 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
202
203 return SCTP_DISPOSITION_DELETE_TCB;
204
205nomem:
206 return SCTP_DISPOSITION_NOMEM;
207}
208
209/*
210 * Respond to a normal INIT chunk.
211 * We are the side that is being asked for an association.
212 *
213 * Section: 5.1 Normal Establishment of an Association, B
214 * B) "Z" shall respond immediately with an INIT ACK chunk. The
215 * destination IP address of the INIT ACK MUST be set to the source
216 * IP address of the INIT to which this INIT ACK is responding. In
217 * the response, besides filling in other parameters, "Z" must set the
218 * Verification Tag field to Tag_A, and also provide its own
219 * Verification Tag (Tag_Z) in the Initiate Tag field.
220 *
221 * Verification Tag: Must be 0.
222 *
223 * Inputs
224 * (endpoint, asoc, chunk)
225 *
226 * Outputs
227 * (asoc, reply_msg, msg_up, timers, counters)
228 *
229 * The return value is the disposition of the chunk.
230 */
231sctp_disposition_t sctp_sf_do_5_1B_init(const struct sctp_endpoint *ep,
232 const struct sctp_association *asoc,
233 const sctp_subtype_t type,
234 void *arg,
235 sctp_cmd_seq_t *commands)
236{
237 struct sctp_chunk *chunk = arg;
238 struct sctp_chunk *repl;
239 struct sctp_association *new_asoc;
240 struct sctp_chunk *err_chunk;
241 struct sctp_packet *packet;
242 sctp_unrecognized_param_t *unk_param;
243 struct sock *sk;
244 int len;
245
246 /* 6.10 Bundling
247 * An endpoint MUST NOT bundle INIT, INIT ACK or
248 * SHUTDOWN COMPLETE with any other chunks.
249 *
250 * IG Section 2.11.2
251 * Furthermore, we require that the receiver of an INIT chunk MUST
252 * enforce these rules by silently discarding an arriving packet
253 * with an INIT chunk that is bundled with other chunks.
254 */
255 if (!chunk->singleton)
256 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
257
258 /* If the packet is an OOTB packet which is temporarily on the
259 * control endpoint, respond with an ABORT.
260 */
261 if (ep == sctp_sk((sctp_get_ctl_sock()))->ep)
262 return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
263
264 sk = ep->base.sk;
265 /* If the endpoint is not listening or if the number of associations
266 * on the TCP-style socket exceed the max backlog, respond with an
267 * ABORT.
268 */
269 if (!sctp_sstate(sk, LISTENING) ||
270 (sctp_style(sk, TCP) &&
271 sk_acceptq_is_full(sk)))
272 return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
273
274 /* 3.1 A packet containing an INIT chunk MUST have a zero Verification
275 * Tag.
276 */
277 if (chunk->sctp_hdr->vtag != 0)
278 return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
279
280 /* Make sure that the INIT chunk has a valid length.
281 * Normally, this would cause an ABORT with a Protocol Violation
282 * error, but since we don't have an association, we'll
283 * just discard the packet.
284 */
285 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_init_chunk_t)))
286 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
287
288 /* Verify the INIT chunk before processing it. */
289 err_chunk = NULL;
290 if (!sctp_verify_init(asoc, chunk->chunk_hdr->type,
291 (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
292 &err_chunk)) {
293 /* This chunk contains fatal error. It is to be discarded.
294 * Send an ABORT, with causes if there is any.
295 */
296 if (err_chunk) {
297 packet = sctp_abort_pkt_new(ep, asoc, arg,
298 (__u8 *)(err_chunk->chunk_hdr) +
299 sizeof(sctp_chunkhdr_t),
300 ntohs(err_chunk->chunk_hdr->length) -
301 sizeof(sctp_chunkhdr_t));
302
303 sctp_chunk_free(err_chunk);
304
305 if (packet) {
306 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
307 SCTP_PACKET(packet));
308 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
309 return SCTP_DISPOSITION_CONSUME;
310 } else {
311 return SCTP_DISPOSITION_NOMEM;
312 }
313 } else {
314 return sctp_sf_tabort_8_4_8(ep, asoc, type, arg,
315 commands);
316 }
317 }
318
319 /* Grab the INIT header. */
320 chunk->subh.init_hdr = (sctp_inithdr_t *)chunk->skb->data;
321
322 /* Tag the variable length parameters. */
323 chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(sctp_inithdr_t));
324
325 new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC);
326 if (!new_asoc)
327 goto nomem;
328
329 /* The call, sctp_process_init(), can fail on memory allocation. */
330 if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
331 sctp_source(chunk),
332 (sctp_init_chunk_t *)chunk->chunk_hdr,
333 GFP_ATOMIC))
334 goto nomem_init;
335
336 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
337
338 /* B) "Z" shall respond immediately with an INIT ACK chunk. */
339
340 /* If there are errors need to be reported for unknown parameters,
341 * make sure to reserve enough room in the INIT ACK for them.
342 */
343 len = 0;
344 if (err_chunk)
345 len = ntohs(err_chunk->chunk_hdr->length) -
346 sizeof(sctp_chunkhdr_t);
347
348 if (sctp_assoc_set_bind_addr_from_ep(new_asoc, GFP_ATOMIC) < 0)
349 goto nomem_ack;
350
351 repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
352 if (!repl)
353 goto nomem_ack;
354
355 /* If there are errors need to be reported for unknown parameters,
356 * include them in the outgoing INIT ACK as "Unrecognized parameter"
357 * parameter.
358 */
359 if (err_chunk) {
360 /* Get the "Unrecognized parameter" parameter(s) out of the
361 * ERROR chunk generated by sctp_verify_init(). Since the
362 * error cause code for "unknown parameter" and the
363 * "Unrecognized parameter" type is the same, we can
364 * construct the parameters in INIT ACK by copying the
365 * ERROR causes over.
366 */
367 unk_param = (sctp_unrecognized_param_t *)
368 ((__u8 *)(err_chunk->chunk_hdr) +
369 sizeof(sctp_chunkhdr_t));
370 /* Replace the cause code with the "Unrecognized parameter"
371 * parameter type.
372 */
373 sctp_addto_chunk(repl, len, unk_param);
374 sctp_chunk_free(err_chunk);
375 }
376
377 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
378
379 /*
380 * Note: After sending out INIT ACK with the State Cookie parameter,
381 * "Z" MUST NOT allocate any resources, nor keep any states for the
382 * new association. Otherwise, "Z" will be vulnerable to resource
383 * attacks.
384 */
385 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
386
387 return SCTP_DISPOSITION_DELETE_TCB;
388
389nomem_ack:
390 if (err_chunk)
391 sctp_chunk_free(err_chunk);
392nomem_init:
393 sctp_association_free(new_asoc);
394nomem:
395 return SCTP_DISPOSITION_NOMEM;
396}
397
398/*
399 * Respond to a normal INIT ACK chunk.
400 * We are the side that is initiating the association.
401 *
402 * Section: 5.1 Normal Establishment of an Association, C
403 * C) Upon reception of the INIT ACK from "Z", "A" shall stop the T1-init
404 * timer and leave COOKIE-WAIT state. "A" shall then send the State
405 * Cookie received in the INIT ACK chunk in a COOKIE ECHO chunk, start
406 * the T1-cookie timer, and enter the COOKIE-ECHOED state.
407 *
408 * Note: The COOKIE ECHO chunk can be bundled with any pending outbound
409 * DATA chunks, but it MUST be the first chunk in the packet and
410 * until the COOKIE ACK is returned the sender MUST NOT send any
411 * other packets to the peer.
412 *
413 * Verification Tag: 3.3.3
414 * If the value of the Initiate Tag in a received INIT ACK chunk is
415 * found to be 0, the receiver MUST treat it as an error and close the
416 * association by transmitting an ABORT.
417 *
418 * Inputs
419 * (endpoint, asoc, chunk)
420 *
421 * Outputs
422 * (asoc, reply_msg, msg_up, timers, counters)
423 *
424 * The return value is the disposition of the chunk.
425 */
426sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
427 const struct sctp_association *asoc,
428 const sctp_subtype_t type,
429 void *arg,
430 sctp_cmd_seq_t *commands)
431{
432 struct sctp_chunk *chunk = arg;
433 sctp_init_chunk_t *initchunk;
434 __u32 init_tag;
435 struct sctp_chunk *err_chunk;
436 struct sctp_packet *packet;
437 sctp_disposition_t ret;
438
439 if (!sctp_vtag_verify(chunk, asoc))
440 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
441
442 /* Make sure that the INIT-ACK chunk has a valid length */
443 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_initack_chunk_t)))
444 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
445 commands);
446 /* 6.10 Bundling
447 * An endpoint MUST NOT bundle INIT, INIT ACK or
448 * SHUTDOWN COMPLETE with any other chunks.
449 */
450 if (!chunk->singleton)
451 return SCTP_DISPOSITION_VIOLATION;
452
453 /* Grab the INIT header. */
454 chunk->subh.init_hdr = (sctp_inithdr_t *) chunk->skb->data;
455
456 init_tag = ntohl(chunk->subh.init_hdr->init_tag);
457
458 /* Verification Tag: 3.3.3
459 * If the value of the Initiate Tag in a received INIT ACK
460 * chunk is found to be 0, the receiver MUST treat it as an
461 * error and close the association by transmitting an ABORT.
462 */
463 if (!init_tag) {
464 struct sctp_chunk *reply = sctp_make_abort(asoc, chunk, 0);
465 if (!reply)
466 goto nomem;
467
468 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
469 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
470 SCTP_STATE(SCTP_STATE_CLOSED));
471 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
472 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
473 return SCTP_DISPOSITION_DELETE_TCB;
474 }
475
476 /* Verify the INIT chunk before processing it. */
477 err_chunk = NULL;
478 if (!sctp_verify_init(asoc, chunk->chunk_hdr->type,
479 (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
480 &err_chunk)) {
481
482 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
483
484 /* This chunk contains fatal error. It is to be discarded.
485 * Send an ABORT, with causes if there is any.
486 */
487 if (err_chunk) {
488 packet = sctp_abort_pkt_new(ep, asoc, arg,
489 (__u8 *)(err_chunk->chunk_hdr) +
490 sizeof(sctp_chunkhdr_t),
491 ntohs(err_chunk->chunk_hdr->length) -
492 sizeof(sctp_chunkhdr_t));
493
494 sctp_chunk_free(err_chunk);
495
496 if (packet) {
497 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
498 SCTP_PACKET(packet));
499 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
500 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
501 SCTP_STATE(SCTP_STATE_CLOSED));
502 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB,
503 SCTP_NULL());
504 return SCTP_DISPOSITION_CONSUME;
505 } else {
506 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
507 SCTP_STATE(SCTP_STATE_CLOSED));
508 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB,
509 SCTP_NULL());
510 return SCTP_DISPOSITION_NOMEM;
511 }
512 } else {
513 ret = sctp_sf_tabort_8_4_8(ep, asoc, type, arg,
514 commands);
515 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
516 SCTP_STATE(SCTP_STATE_CLOSED));
517 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB,
518 SCTP_NULL());
519 return ret;
520 }
521 }
522
523 /* Tag the variable length parameters. Note that we never
524 * convert the parameters in an INIT chunk.
525 */
526 chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(sctp_inithdr_t));
527
528 initchunk = (sctp_init_chunk_t *) chunk->chunk_hdr;
529
530 sctp_add_cmd_sf(commands, SCTP_CMD_PEER_INIT,
531 SCTP_PEER_INIT(initchunk));
532
533 /* 5.1 C) "A" shall stop the T1-init timer and leave
534 * COOKIE-WAIT state. "A" shall then ... start the T1-cookie
535 * timer, and enter the COOKIE-ECHOED state.
536 */
537 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
538 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
539 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
540 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
541 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
542 SCTP_STATE(SCTP_STATE_COOKIE_ECHOED));
543
544 /* 5.1 C) "A" shall then send the State Cookie received in the
545 * INIT ACK chunk in a COOKIE ECHO chunk, ...
546 */
547 /* If there is any errors to report, send the ERROR chunk generated
548 * for unknown parameters as well.
549 */
550 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_COOKIE_ECHO,
551 SCTP_CHUNK(err_chunk));
552
553 return SCTP_DISPOSITION_CONSUME;
554
555nomem:
556 return SCTP_DISPOSITION_NOMEM;
557}
558
559/*
560 * Respond to a normal COOKIE ECHO chunk.
561 * We are the side that is being asked for an association.
562 *
563 * Section: 5.1 Normal Establishment of an Association, D
564 * D) Upon reception of the COOKIE ECHO chunk, Endpoint "Z" will reply
565 * with a COOKIE ACK chunk after building a TCB and moving to
566 * the ESTABLISHED state. A COOKIE ACK chunk may be bundled with
567 * any pending DATA chunks (and/or SACK chunks), but the COOKIE ACK
568 * chunk MUST be the first chunk in the packet.
569 *
570 * IMPLEMENTATION NOTE: An implementation may choose to send the
571 * Communication Up notification to the SCTP user upon reception
572 * of a valid COOKIE ECHO chunk.
573 *
574 * Verification Tag: 8.5.1 Exceptions in Verification Tag Rules
575 * D) Rules for packet carrying a COOKIE ECHO
576 *
577 * - When sending a COOKIE ECHO, the endpoint MUST use the value of the
578 * Initial Tag received in the INIT ACK.
579 *
580 * - The receiver of a COOKIE ECHO follows the procedures in Section 5.
581 *
582 * Inputs
583 * (endpoint, asoc, chunk)
584 *
585 * Outputs
586 * (asoc, reply_msg, msg_up, timers, counters)
587 *
588 * The return value is the disposition of the chunk.
589 */
590sctp_disposition_t sctp_sf_do_5_1D_ce(const struct sctp_endpoint *ep,
591 const struct sctp_association *asoc,
592 const sctp_subtype_t type, void *arg,
593 sctp_cmd_seq_t *commands)
594{
595 struct sctp_chunk *chunk = arg;
596 struct sctp_association *new_asoc;
597 sctp_init_chunk_t *peer_init;
598 struct sctp_chunk *repl;
599 struct sctp_ulpevent *ev;
600 int error = 0;
601 struct sctp_chunk *err_chk_p;
602
603 /* If the packet is an OOTB packet which is temporarily on the
604 * control endpoint, respond with an ABORT.
605 */
606 if (ep == sctp_sk((sctp_get_ctl_sock()))->ep)
607 return sctp_sf_ootb(ep, asoc, type, arg, commands);
608
609 /* Make sure that the COOKIE_ECHO chunk has a valid length.
610 * In this case, we check that we have enough for at least a
611 * chunk header. More detailed verification is done
612 * in sctp_unpack_cookie().
613 */
614 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
615 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
616
617 /* "Decode" the chunk. We have no optional parameters so we
618 * are in good shape.
619 */
620 chunk->subh.cookie_hdr =
621 (struct sctp_signed_cookie *)chunk->skb->data;
622 skb_pull(chunk->skb,
623 ntohs(chunk->chunk_hdr->length) - sizeof(sctp_chunkhdr_t));
624
625 /* 5.1 D) Upon reception of the COOKIE ECHO chunk, Endpoint
626 * "Z" will reply with a COOKIE ACK chunk after building a TCB
627 * and moving to the ESTABLISHED state.
628 */
629 new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, &error,
630 &err_chk_p);
631
632 /* FIXME:
633 * If the re-build failed, what is the proper error path
634 * from here?
635 *
636 * [We should abort the association. --piggy]
637 */
638 if (!new_asoc) {
639 /* FIXME: Several errors are possible. A bad cookie should
640 * be silently discarded, but think about logging it too.
641 */
642 switch (error) {
643 case -SCTP_IERROR_NOMEM:
644 goto nomem;
645
646 case -SCTP_IERROR_STALE_COOKIE:
647 sctp_send_stale_cookie_err(ep, asoc, chunk, commands,
648 err_chk_p);
649 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
650
651 case -SCTP_IERROR_BAD_SIG:
652 default:
653 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
654 };
655 }
656
657 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
658 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
659 SCTP_STATE(SCTP_STATE_ESTABLISHED));
660 SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
661 SCTP_INC_STATS(SCTP_MIB_PASSIVEESTABS);
662 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
663
664 if (new_asoc->autoclose)
665 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
666 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
667
668 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSMIT, SCTP_NULL());
669
670 /* Re-build the bind address for the association is done in
671 * the sctp_unpack_cookie() already.
672 */
673 /* This is a brand-new association, so these are not yet side
674 * effects--it is safe to run them here.
675 */
676 peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
677
678 if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
679 &chunk->subh.cookie_hdr->c.peer_addr,
680 peer_init, GFP_ATOMIC))
681 goto nomem_init;
682
683 repl = sctp_make_cookie_ack(new_asoc, chunk);
684 if (!repl)
685 goto nomem_repl;
686
687 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
688
689 /* RFC 2960 5.1 Normal Establishment of an Association
690 *
691 * D) IMPLEMENTATION NOTE: An implementation may choose to
692 * send the Communication Up notification to the SCTP user
693 * upon reception of a valid COOKIE ECHO chunk.
694 */
695 ev = sctp_ulpevent_make_assoc_change(new_asoc, 0, SCTP_COMM_UP, 0,
696 new_asoc->c.sinit_num_ostreams,
697 new_asoc->c.sinit_max_instreams,
698 GFP_ATOMIC);
699 if (!ev)
700 goto nomem_ev;
701
702 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
703
704 /* Sockets API Draft Section 5.3.1.6
705 * When a peer sends a Adaption Layer Indication parameter , SCTP
706 * delivers this notification to inform the application that of the
707 * peers requested adaption layer.
708 */
709 if (new_asoc->peer.adaption_ind) {
710 ev = sctp_ulpevent_make_adaption_indication(new_asoc,
711 GFP_ATOMIC);
712 if (!ev)
713 goto nomem_ev;
714
715 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
716 SCTP_ULPEVENT(ev));
717 }
718
719 return SCTP_DISPOSITION_CONSUME;
720
721nomem_ev:
722 sctp_chunk_free(repl);
723nomem_repl:
724nomem_init:
725 sctp_association_free(new_asoc);
726nomem:
727 return SCTP_DISPOSITION_NOMEM;
728}
729
730/*
731 * Respond to a normal COOKIE ACK chunk.
732 * We are the side that is being asked for an association.
733 *
734 * RFC 2960 5.1 Normal Establishment of an Association
735 *
736 * E) Upon reception of the COOKIE ACK, endpoint "A" will move from the
737 * COOKIE-ECHOED state to the ESTABLISHED state, stopping the T1-cookie
738 * timer. It may also notify its ULP about the successful
739 * establishment of the association with a Communication Up
740 * notification (see Section 10).
741 *
742 * Verification Tag:
743 * Inputs
744 * (endpoint, asoc, chunk)
745 *
746 * Outputs
747 * (asoc, reply_msg, msg_up, timers, counters)
748 *
749 * The return value is the disposition of the chunk.
750 */
751sctp_disposition_t sctp_sf_do_5_1E_ca(const struct sctp_endpoint *ep,
752 const struct sctp_association *asoc,
753 const sctp_subtype_t type, void *arg,
754 sctp_cmd_seq_t *commands)
755{
756 struct sctp_chunk *chunk = arg;
757 struct sctp_ulpevent *ev;
758
759 if (!sctp_vtag_verify(chunk, asoc))
760 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
761
762 /* Verify that the chunk length for the COOKIE-ACK is OK.
763 * If we don't do this, any bundled chunks may be junked.
764 */
765 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
766 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
767 commands);
768
769 /* Reset init error count upon receipt of COOKIE-ACK,
770 * to avoid problems with the managemement of this
771 * counter in stale cookie situations when a transition back
772 * from the COOKIE-ECHOED state to the COOKIE-WAIT
773 * state is performed.
774 */
775 sctp_add_cmd_sf(commands, SCTP_CMD_COUNTER_RESET,
776 SCTP_COUNTER(SCTP_COUNTER_INIT_ERROR));
777
778 /* RFC 2960 5.1 Normal Establishment of an Association
779 *
780 * E) Upon reception of the COOKIE ACK, endpoint "A" will move
781 * from the COOKIE-ECHOED state to the ESTABLISHED state,
782 * stopping the T1-cookie timer.
783 */
784 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
785 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
786 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
787 SCTP_STATE(SCTP_STATE_ESTABLISHED));
788 SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
789 SCTP_INC_STATS(SCTP_MIB_ACTIVEESTABS);
790 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
791 if (asoc->autoclose)
792 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
793 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
794 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSMIT, SCTP_NULL());
795
796 /* It may also notify its ULP about the successful
797 * establishment of the association with a Communication Up
798 * notification (see Section 10).
799 */
800 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_COMM_UP,
801 0, asoc->c.sinit_num_ostreams,
802 asoc->c.sinit_max_instreams,
803 GFP_ATOMIC);
804
805 if (!ev)
806 goto nomem;
807
808 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
809
810 /* Sockets API Draft Section 5.3.1.6
811 * When a peer sends a Adaption Layer Indication parameter , SCTP
812 * delivers this notification to inform the application that of the
813 * peers requested adaption layer.
814 */
815 if (asoc->peer.adaption_ind) {
816 ev = sctp_ulpevent_make_adaption_indication(asoc, GFP_ATOMIC);
817 if (!ev)
818 goto nomem;
819
820 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
821 SCTP_ULPEVENT(ev));
822 }
823
824 return SCTP_DISPOSITION_CONSUME;
825nomem:
826 return SCTP_DISPOSITION_NOMEM;
827}
828
829/* Generate and sendout a heartbeat packet. */
830static sctp_disposition_t sctp_sf_heartbeat(const struct sctp_endpoint *ep,
831 const struct sctp_association *asoc,
832 const sctp_subtype_t type,
833 void *arg,
834 sctp_cmd_seq_t *commands)
835{
836 struct sctp_transport *transport = (struct sctp_transport *) arg;
837 struct sctp_chunk *reply;
838 sctp_sender_hb_info_t hbinfo;
839 size_t paylen = 0;
840
841 hbinfo.param_hdr.type = SCTP_PARAM_HEARTBEAT_INFO;
842 hbinfo.param_hdr.length = htons(sizeof(sctp_sender_hb_info_t));
843 hbinfo.daddr = transport->ipaddr;
844 hbinfo.sent_at = jiffies;
845
846 /* Send a heartbeat to our peer. */
847 paylen = sizeof(sctp_sender_hb_info_t);
848 reply = sctp_make_heartbeat(asoc, transport, &hbinfo, paylen);
849 if (!reply)
850 return SCTP_DISPOSITION_NOMEM;
851
852 /* Set rto_pending indicating that an RTT measurement
853 * is started with this heartbeat chunk.
854 */
855 sctp_add_cmd_sf(commands, SCTP_CMD_RTO_PENDING,
856 SCTP_TRANSPORT(transport));
857
858 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
859 return SCTP_DISPOSITION_CONSUME;
860}
861
862/* Generate a HEARTBEAT packet on the given transport. */
863sctp_disposition_t sctp_sf_sendbeat_8_3(const struct sctp_endpoint *ep,
864 const struct sctp_association *asoc,
865 const sctp_subtype_t type,
866 void *arg,
867 sctp_cmd_seq_t *commands)
868{
869 struct sctp_transport *transport = (struct sctp_transport *) arg;
870
871 if (asoc->overall_error_count > asoc->max_retrans) {
872 /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
873 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
874 SCTP_U32(SCTP_ERROR_NO_ERROR));
875 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
876 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
877 return SCTP_DISPOSITION_DELETE_TCB;
878 }
879
880 /* Section 3.3.5.
881 * The Sender-specific Heartbeat Info field should normally include
882 * information about the sender's current time when this HEARTBEAT
883 * chunk is sent and the destination transport address to which this
884 * HEARTBEAT is sent (see Section 8.3).
885 */
886
887 if (transport->hb_allowed) {
888 if (SCTP_DISPOSITION_NOMEM ==
889 sctp_sf_heartbeat(ep, asoc, type, arg,
890 commands))
891 return SCTP_DISPOSITION_NOMEM;
892 /* Set transport error counter and association error counter
893 * when sending heartbeat.
894 */
895 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_RESET,
896 SCTP_TRANSPORT(transport));
897 }
898 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMER_UPDATE,
899 SCTP_TRANSPORT(transport));
900
901 return SCTP_DISPOSITION_CONSUME;
902}
903
904/*
905 * Process an heartbeat request.
906 *
907 * Section: 8.3 Path Heartbeat
908 * The receiver of the HEARTBEAT should immediately respond with a
909 * HEARTBEAT ACK that contains the Heartbeat Information field copied
910 * from the received HEARTBEAT chunk.
911 *
912 * Verification Tag: 8.5 Verification Tag [Normal verification]
913 * When receiving an SCTP packet, the endpoint MUST ensure that the
914 * value in the Verification Tag field of the received SCTP packet
915 * matches its own Tag. If the received Verification Tag value does not
916 * match the receiver's own tag value, the receiver shall silently
917 * discard the packet and shall not process it any further except for
918 * those cases listed in Section 8.5.1 below.
919 *
920 * Inputs
921 * (endpoint, asoc, chunk)
922 *
923 * Outputs
924 * (asoc, reply_msg, msg_up, timers, counters)
925 *
926 * The return value is the disposition of the chunk.
927 */
928sctp_disposition_t sctp_sf_beat_8_3(const struct sctp_endpoint *ep,
929 const struct sctp_association *asoc,
930 const sctp_subtype_t type,
931 void *arg,
932 sctp_cmd_seq_t *commands)
933{
934 struct sctp_chunk *chunk = arg;
935 struct sctp_chunk *reply;
936 size_t paylen = 0;
937
938 if (!sctp_vtag_verify(chunk, asoc))
939 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
940
941 /* Make sure that the HEARTBEAT chunk has a valid length. */
942 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_heartbeat_chunk_t)))
943 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
944 commands);
945
946 /* 8.3 The receiver of the HEARTBEAT should immediately
947 * respond with a HEARTBEAT ACK that contains the Heartbeat
948 * Information field copied from the received HEARTBEAT chunk.
949 */
950 chunk->subh.hb_hdr = (sctp_heartbeathdr_t *) chunk->skb->data;
951 paylen = ntohs(chunk->chunk_hdr->length) - sizeof(sctp_chunkhdr_t);
952 skb_pull(chunk->skb, paylen);
953
954 reply = sctp_make_heartbeat_ack(asoc, chunk,
955 chunk->subh.hb_hdr, paylen);
956 if (!reply)
957 goto nomem;
958
959 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
960 return SCTP_DISPOSITION_CONSUME;
961
962nomem:
963 return SCTP_DISPOSITION_NOMEM;
964}
965
966/*
967 * Process the returning HEARTBEAT ACK.
968 *
969 * Section: 8.3 Path Heartbeat
970 * Upon the receipt of the HEARTBEAT ACK, the sender of the HEARTBEAT
971 * should clear the error counter of the destination transport
972 * address to which the HEARTBEAT was sent, and mark the destination
973 * transport address as active if it is not so marked. The endpoint may
974 * optionally report to the upper layer when an inactive destination
975 * address is marked as active due to the reception of the latest
976 * HEARTBEAT ACK. The receiver of the HEARTBEAT ACK must also
977 * clear the association overall error count as well (as defined
978 * in section 8.1).
979 *
980 * The receiver of the HEARTBEAT ACK should also perform an RTT
981 * measurement for that destination transport address using the time
982 * value carried in the HEARTBEAT ACK chunk.
983 *
984 * Verification Tag: 8.5 Verification Tag [Normal verification]
985 *
986 * Inputs
987 * (endpoint, asoc, chunk)
988 *
989 * Outputs
990 * (asoc, reply_msg, msg_up, timers, counters)
991 *
992 * The return value is the disposition of the chunk.
993 */
994sctp_disposition_t sctp_sf_backbeat_8_3(const struct sctp_endpoint *ep,
995 const struct sctp_association *asoc,
996 const sctp_subtype_t type,
997 void *arg,
998 sctp_cmd_seq_t *commands)
999{
1000 struct sctp_chunk *chunk = arg;
1001 union sctp_addr from_addr;
1002 struct sctp_transport *link;
1003 sctp_sender_hb_info_t *hbinfo;
1004 unsigned long max_interval;
1005
1006 if (!sctp_vtag_verify(chunk, asoc))
1007 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
1008
1009 /* Make sure that the HEARTBEAT-ACK chunk has a valid length. */
1010 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_heartbeat_chunk_t)))
1011 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
1012 commands);
1013
1014 hbinfo = (sctp_sender_hb_info_t *) chunk->skb->data;
1015 from_addr = hbinfo->daddr;
1016 link = sctp_assoc_lookup_paddr(asoc, &from_addr);
1017
1018 /* This should never happen, but lets log it if so. */
1019 if (!link) {
1020 printk(KERN_WARNING
1021 "%s: Could not find address %d.%d.%d.%d\n",
1022 __FUNCTION__, NIPQUAD(from_addr.v4.sin_addr));
1023 return SCTP_DISPOSITION_DISCARD;
1024 }
1025
1026 max_interval = link->hb_interval + link->rto;
1027
1028 /* Check if the timestamp looks valid. */
1029 if (time_after(hbinfo->sent_at, jiffies) ||
1030 time_after(jiffies, hbinfo->sent_at + max_interval)) {
1031 SCTP_DEBUG_PRINTK("%s: HEARTBEAT ACK with invalid timestamp"
1032 "received for transport: %p\n",
1033 __FUNCTION__, link);
1034 return SCTP_DISPOSITION_DISCARD;
1035 }
1036
1037 /* 8.3 Upon the receipt of the HEARTBEAT ACK, the sender of
1038 * the HEARTBEAT should clear the error counter of the
1039 * destination transport address to which the HEARTBEAT was
1040 * sent and mark the destination transport address as active if
1041 * it is not so marked.
1042 */
1043 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_ON, SCTP_TRANSPORT(link));
1044
1045 return SCTP_DISPOSITION_CONSUME;
1046}
1047
1048/* Helper function to send out an abort for the restart
1049 * condition.
1050 */
1051static int sctp_sf_send_restart_abort(union sctp_addr *ssa,
1052 struct sctp_chunk *init,
1053 sctp_cmd_seq_t *commands)
1054{
1055 int len;
1056 struct sctp_packet *pkt;
1057 union sctp_addr_param *addrparm;
1058 struct sctp_errhdr *errhdr;
1059 struct sctp_endpoint *ep;
1060 char buffer[sizeof(struct sctp_errhdr)+sizeof(union sctp_addr_param)];
1061 struct sctp_af *af = sctp_get_af_specific(ssa->v4.sin_family);
1062
1063 /* Build the error on the stack. We are way to malloc crazy
1064 * throughout the code today.
1065 */
1066 errhdr = (struct sctp_errhdr *)buffer;
1067 addrparm = (union sctp_addr_param *)errhdr->variable;
1068
1069 /* Copy into a parm format. */
1070 len = af->to_addr_param(ssa, addrparm);
1071 len += sizeof(sctp_errhdr_t);
1072
1073 errhdr->cause = SCTP_ERROR_RESTART;
1074 errhdr->length = htons(len);
1075
1076 /* Assign to the control socket. */
1077 ep = sctp_sk((sctp_get_ctl_sock()))->ep;
1078
1079 /* Association is NULL since this may be a restart attack and we
1080 * want to send back the attacker's vtag.
1081 */
1082 pkt = sctp_abort_pkt_new(ep, NULL, init, errhdr, len);
1083
1084 if (!pkt)
1085 goto out;
1086 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT, SCTP_PACKET(pkt));
1087
1088 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
1089
1090 /* Discard the rest of the inbound packet. */
1091 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
1092
1093out:
1094 /* Even if there is no memory, treat as a failure so
1095 * the packet will get dropped.
1096 */
1097 return 0;
1098}
1099
1100/* A restart is occurring, check to make sure no new addresses
1101 * are being added as we may be under a takeover attack.
1102 */
1103static int sctp_sf_check_restart_addrs(const struct sctp_association *new_asoc,
1104 const struct sctp_association *asoc,
1105 struct sctp_chunk *init,
1106 sctp_cmd_seq_t *commands)
1107{
1108 struct sctp_transport *new_addr, *addr;
1109 struct list_head *pos, *pos2;
1110 int found;
1111
1112 /* Implementor's Guide - Sectin 5.2.2
1113 * ...
1114 * Before responding the endpoint MUST check to see if the
1115 * unexpected INIT adds new addresses to the association. If new
1116 * addresses are added to the association, the endpoint MUST respond
1117 * with an ABORT..
1118 */
1119
1120 /* Search through all current addresses and make sure
1121 * we aren't adding any new ones.
1122 */
1123 new_addr = NULL;
1124 found = 0;
1125
1126 list_for_each(pos, &new_asoc->peer.transport_addr_list) {
1127 new_addr = list_entry(pos, struct sctp_transport, transports);
1128 found = 0;
1129 list_for_each(pos2, &asoc->peer.transport_addr_list) {
1130 addr = list_entry(pos2, struct sctp_transport,
1131 transports);
1132 if (sctp_cmp_addr_exact(&new_addr->ipaddr,
1133 &addr->ipaddr)) {
1134 found = 1;
1135 break;
1136 }
1137 }
1138 if (!found)
1139 break;
1140 }
1141
1142 /* If a new address was added, ABORT the sender. */
1143 if (!found && new_addr) {
1144 sctp_sf_send_restart_abort(&new_addr->ipaddr, init, commands);
1145 }
1146
1147 /* Return success if all addresses were found. */
1148 return found;
1149}
1150
1151/* Populate the verification/tie tags based on overlapping INIT
1152 * scenario.
1153 *
1154 * Note: Do not use in CLOSED or SHUTDOWN-ACK-SENT state.
1155 */
1156static void sctp_tietags_populate(struct sctp_association *new_asoc,
1157 const struct sctp_association *asoc)
1158{
1159 switch (asoc->state) {
1160
1161 /* 5.2.1 INIT received in COOKIE-WAIT or COOKIE-ECHOED State */
1162
1163 case SCTP_STATE_COOKIE_WAIT:
1164 new_asoc->c.my_vtag = asoc->c.my_vtag;
1165 new_asoc->c.my_ttag = asoc->c.my_vtag;
1166 new_asoc->c.peer_ttag = 0;
1167 break;
1168
1169 case SCTP_STATE_COOKIE_ECHOED:
1170 new_asoc->c.my_vtag = asoc->c.my_vtag;
1171 new_asoc->c.my_ttag = asoc->c.my_vtag;
1172 new_asoc->c.peer_ttag = asoc->c.peer_vtag;
1173 break;
1174
1175 /* 5.2.2 Unexpected INIT in States Other than CLOSED, COOKIE-ECHOED,
1176 * COOKIE-WAIT and SHUTDOWN-ACK-SENT
1177 */
1178 default:
1179 new_asoc->c.my_ttag = asoc->c.my_vtag;
1180 new_asoc->c.peer_ttag = asoc->c.peer_vtag;
1181 break;
1182 };
1183
1184 /* Other parameters for the endpoint SHOULD be copied from the
1185 * existing parameters of the association (e.g. number of
1186 * outbound streams) into the INIT ACK and cookie.
1187 */
1188 new_asoc->rwnd = asoc->rwnd;
1189 new_asoc->c.sinit_num_ostreams = asoc->c.sinit_num_ostreams;
1190 new_asoc->c.sinit_max_instreams = asoc->c.sinit_max_instreams;
1191 new_asoc->c.initial_tsn = asoc->c.initial_tsn;
1192}
1193
1194/*
1195 * Compare vtag/tietag values to determine unexpected COOKIE-ECHO
1196 * handling action.
1197 *
1198 * RFC 2960 5.2.4 Handle a COOKIE ECHO when a TCB exists.
1199 *
1200 * Returns value representing action to be taken. These action values
1201 * correspond to Action/Description values in RFC 2960, Table 2.
1202 */
1203static char sctp_tietags_compare(struct sctp_association *new_asoc,
1204 const struct sctp_association *asoc)
1205{
1206 /* In this case, the peer may have restarted. */
1207 if ((asoc->c.my_vtag != new_asoc->c.my_vtag) &&
1208 (asoc->c.peer_vtag != new_asoc->c.peer_vtag) &&
1209 (asoc->c.my_vtag == new_asoc->c.my_ttag) &&
1210 (asoc->c.peer_vtag == new_asoc->c.peer_ttag))
1211 return 'A';
1212
1213 /* Collision case B. */
1214 if ((asoc->c.my_vtag == new_asoc->c.my_vtag) &&
1215 ((asoc->c.peer_vtag != new_asoc->c.peer_vtag) ||
1216 (0 == asoc->c.peer_vtag))) {
1217 return 'B';
1218 }
1219
1220 /* Collision case D. */
1221 if ((asoc->c.my_vtag == new_asoc->c.my_vtag) &&
1222 (asoc->c.peer_vtag == new_asoc->c.peer_vtag))
1223 return 'D';
1224
1225 /* Collision case C. */
1226 if ((asoc->c.my_vtag != new_asoc->c.my_vtag) &&
1227 (asoc->c.peer_vtag == new_asoc->c.peer_vtag) &&
1228 (0 == new_asoc->c.my_ttag) &&
1229 (0 == new_asoc->c.peer_ttag))
1230 return 'C';
1231
1232 /* No match to any of the special cases; discard this packet. */
1233 return 'E';
1234}
1235
1236/* Common helper routine for both duplicate and simulataneous INIT
1237 * chunk handling.
1238 */
1239static sctp_disposition_t sctp_sf_do_unexpected_init(
1240 const struct sctp_endpoint *ep,
1241 const struct sctp_association *asoc,
1242 const sctp_subtype_t type,
1243 void *arg, sctp_cmd_seq_t *commands)
1244{
1245 sctp_disposition_t retval;
1246 struct sctp_chunk *chunk = arg;
1247 struct sctp_chunk *repl;
1248 struct sctp_association *new_asoc;
1249 struct sctp_chunk *err_chunk;
1250 struct sctp_packet *packet;
1251 sctp_unrecognized_param_t *unk_param;
1252 int len;
1253
1254 /* 6.10 Bundling
1255 * An endpoint MUST NOT bundle INIT, INIT ACK or
1256 * SHUTDOWN COMPLETE with any other chunks.
1257 *
1258 * IG Section 2.11.2
1259 * Furthermore, we require that the receiver of an INIT chunk MUST
1260 * enforce these rules by silently discarding an arriving packet
1261 * with an INIT chunk that is bundled with other chunks.
1262 */
1263 if (!chunk->singleton)
1264 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
1265
1266 /* 3.1 A packet containing an INIT chunk MUST have a zero Verification
1267 * Tag.
1268 */
1269 if (chunk->sctp_hdr->vtag != 0)
1270 return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
1271
1272 /* Make sure that the INIT chunk has a valid length.
1273 * In this case, we generate a protocol violation since we have
1274 * an association established.
1275 */
1276 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_init_chunk_t)))
1277 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
1278 commands);
1279 /* Grab the INIT header. */
1280 chunk->subh.init_hdr = (sctp_inithdr_t *) chunk->skb->data;
1281
1282 /* Tag the variable length parameters. */
1283 chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(sctp_inithdr_t));
1284
1285 /* Verify the INIT chunk before processing it. */
1286 err_chunk = NULL;
1287 if (!sctp_verify_init(asoc, chunk->chunk_hdr->type,
1288 (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
1289 &err_chunk)) {
1290 /* This chunk contains fatal error. It is to be discarded.
1291 * Send an ABORT, with causes if there is any.
1292 */
1293 if (err_chunk) {
1294 packet = sctp_abort_pkt_new(ep, asoc, arg,
1295 (__u8 *)(err_chunk->chunk_hdr) +
1296 sizeof(sctp_chunkhdr_t),
1297 ntohs(err_chunk->chunk_hdr->length) -
1298 sizeof(sctp_chunkhdr_t));
1299
1300 if (packet) {
1301 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
1302 SCTP_PACKET(packet));
1303 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
1304 retval = SCTP_DISPOSITION_CONSUME;
1305 } else {
1306 retval = SCTP_DISPOSITION_NOMEM;
1307 }
1308 goto cleanup;
1309 } else {
1310 return sctp_sf_tabort_8_4_8(ep, asoc, type, arg,
1311 commands);
1312 }
1313 }
1314
1315 /*
1316 * Other parameters for the endpoint SHOULD be copied from the
1317 * existing parameters of the association (e.g. number of
1318 * outbound streams) into the INIT ACK and cookie.
1319 * FIXME: We are copying parameters from the endpoint not the
1320 * association.
1321 */
1322 new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC);
1323 if (!new_asoc)
1324 goto nomem;
1325
1326 /* In the outbound INIT ACK the endpoint MUST copy its current
1327 * Verification Tag and Peers Verification tag into a reserved
1328 * place (local tie-tag and per tie-tag) within the state cookie.
1329 */
1330 if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
1331 sctp_source(chunk),
1332 (sctp_init_chunk_t *)chunk->chunk_hdr,
1333 GFP_ATOMIC)) {
1334 retval = SCTP_DISPOSITION_NOMEM;
1335 goto nomem_init;
1336 }
1337
1338 /* Make sure no new addresses are being added during the
1339 * restart. Do not do this check for COOKIE-WAIT state,
1340 * since there are no peer addresses to check against.
1341 * Upon return an ABORT will have been sent if needed.
1342 */
1343 if (!sctp_state(asoc, COOKIE_WAIT)) {
1344 if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk,
1345 commands)) {
1346 retval = SCTP_DISPOSITION_CONSUME;
1347 goto cleanup_asoc;
1348 }
1349 }
1350
1351 sctp_tietags_populate(new_asoc, asoc);
1352
1353 /* B) "Z" shall respond immediately with an INIT ACK chunk. */
1354
1355 /* If there are errors need to be reported for unknown parameters,
1356 * make sure to reserve enough room in the INIT ACK for them.
1357 */
1358 len = 0;
1359 if (err_chunk) {
1360 len = ntohs(err_chunk->chunk_hdr->length) -
1361 sizeof(sctp_chunkhdr_t);
1362 }
1363
1364 if (sctp_assoc_set_bind_addr_from_ep(new_asoc, GFP_ATOMIC) < 0)
1365 goto nomem;
1366
1367 repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
1368 if (!repl)
1369 goto nomem;
1370
1371 /* If there are errors need to be reported for unknown parameters,
1372 * include them in the outgoing INIT ACK as "Unrecognized parameter"
1373 * parameter.
1374 */
1375 if (err_chunk) {
1376 /* Get the "Unrecognized parameter" parameter(s) out of the
1377 * ERROR chunk generated by sctp_verify_init(). Since the
1378 * error cause code for "unknown parameter" and the
1379 * "Unrecognized parameter" type is the same, we can
1380 * construct the parameters in INIT ACK by copying the
1381 * ERROR causes over.
1382 */
1383 unk_param = (sctp_unrecognized_param_t *)
1384 ((__u8 *)(err_chunk->chunk_hdr) +
1385 sizeof(sctp_chunkhdr_t));
1386 /* Replace the cause code with the "Unrecognized parameter"
1387 * parameter type.
1388 */
1389 sctp_addto_chunk(repl, len, unk_param);
1390 }
1391
1392 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
1393 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1394
1395 /*
1396 * Note: After sending out INIT ACK with the State Cookie parameter,
1397 * "Z" MUST NOT allocate any resources for this new association.
1398 * Otherwise, "Z" will be vulnerable to resource attacks.
1399 */
1400 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
1401 retval = SCTP_DISPOSITION_CONSUME;
1402
1403cleanup:
1404 if (err_chunk)
1405 sctp_chunk_free(err_chunk);
1406 return retval;
1407nomem:
1408 retval = SCTP_DISPOSITION_NOMEM;
1409 goto cleanup;
1410nomem_init:
1411cleanup_asoc:
1412 sctp_association_free(new_asoc);
1413 goto cleanup;
1414}
1415
1416/*
1417 * Handle simultanous INIT.
1418 * This means we started an INIT and then we got an INIT request from
1419 * our peer.
1420 *
1421 * Section: 5.2.1 INIT received in COOKIE-WAIT or COOKIE-ECHOED State (Item B)
1422 * This usually indicates an initialization collision, i.e., each
1423 * endpoint is attempting, at about the same time, to establish an
1424 * association with the other endpoint.
1425 *
1426 * Upon receipt of an INIT in the COOKIE-WAIT or COOKIE-ECHOED state, an
1427 * endpoint MUST respond with an INIT ACK using the same parameters it
1428 * sent in its original INIT chunk (including its Verification Tag,
1429 * unchanged). These original parameters are combined with those from the
1430 * newly received INIT chunk. The endpoint shall also generate a State
1431 * Cookie with the INIT ACK. The endpoint uses the parameters sent in its
1432 * INIT to calculate the State Cookie.
1433 *
1434 * After that, the endpoint MUST NOT change its state, the T1-init
1435 * timer shall be left running and the corresponding TCB MUST NOT be
1436 * destroyed. The normal procedures for handling State Cookies when
1437 * a TCB exists will resolve the duplicate INITs to a single association.
1438 *
1439 * For an endpoint that is in the COOKIE-ECHOED state it MUST populate
1440 * its Tie-Tags with the Tag information of itself and its peer (see
1441 * section 5.2.2 for a description of the Tie-Tags).
1442 *
1443 * Verification Tag: Not explicit, but an INIT can not have a valid
1444 * verification tag, so we skip the check.
1445 *
1446 * Inputs
1447 * (endpoint, asoc, chunk)
1448 *
1449 * Outputs
1450 * (asoc, reply_msg, msg_up, timers, counters)
1451 *
1452 * The return value is the disposition of the chunk.
1453 */
1454sctp_disposition_t sctp_sf_do_5_2_1_siminit(const struct sctp_endpoint *ep,
1455 const struct sctp_association *asoc,
1456 const sctp_subtype_t type,
1457 void *arg,
1458 sctp_cmd_seq_t *commands)
1459{
1460 /* Call helper to do the real work for both simulataneous and
1461 * duplicate INIT chunk handling.
1462 */
1463 return sctp_sf_do_unexpected_init(ep, asoc, type, arg, commands);
1464}
1465
1466/*
1467 * Handle duplicated INIT messages. These are usually delayed
1468 * restransmissions.
1469 *
1470 * Section: 5.2.2 Unexpected INIT in States Other than CLOSED,
1471 * COOKIE-ECHOED and COOKIE-WAIT
1472 *
1473 * Unless otherwise stated, upon reception of an unexpected INIT for
1474 * this association, the endpoint shall generate an INIT ACK with a
1475 * State Cookie. In the outbound INIT ACK the endpoint MUST copy its
1476 * current Verification Tag and peer's Verification Tag into a reserved
1477 * place within the state cookie. We shall refer to these locations as
1478 * the Peer's-Tie-Tag and the Local-Tie-Tag. The outbound SCTP packet
1479 * containing this INIT ACK MUST carry a Verification Tag value equal to
1480 * the Initiation Tag found in the unexpected INIT. And the INIT ACK
1481 * MUST contain a new Initiation Tag (randomly generated see Section
1482 * 5.3.1). Other parameters for the endpoint SHOULD be copied from the
1483 * existing parameters of the association (e.g. number of outbound
1484 * streams) into the INIT ACK and cookie.
1485 *
1486 * After sending out the INIT ACK, the endpoint shall take no further
1487 * actions, i.e., the existing association, including its current state,
1488 * and the corresponding TCB MUST NOT be changed.
1489 *
1490 * Note: Only when a TCB exists and the association is not in a COOKIE-
1491 * WAIT state are the Tie-Tags populated. For a normal association INIT
1492 * (i.e. the endpoint is in a COOKIE-WAIT state), the Tie-Tags MUST be
1493 * set to 0 (indicating that no previous TCB existed). The INIT ACK and
1494 * State Cookie are populated as specified in section 5.2.1.
1495 *
1496 * Verification Tag: Not specified, but an INIT has no way of knowing
1497 * what the verification tag could be, so we ignore it.
1498 *
1499 * Inputs
1500 * (endpoint, asoc, chunk)
1501 *
1502 * Outputs
1503 * (asoc, reply_msg, msg_up, timers, counters)
1504 *
1505 * The return value is the disposition of the chunk.
1506 */
1507sctp_disposition_t sctp_sf_do_5_2_2_dupinit(const struct sctp_endpoint *ep,
1508 const struct sctp_association *asoc,
1509 const sctp_subtype_t type,
1510 void *arg,
1511 sctp_cmd_seq_t *commands)
1512{
1513 /* Call helper to do the real work for both simulataneous and
1514 * duplicate INIT chunk handling.
1515 */
1516 return sctp_sf_do_unexpected_init(ep, asoc, type, arg, commands);
1517}
1518
1519
1520
1521/* Unexpected COOKIE-ECHO handler for peer restart (Table 2, action 'A')
1522 *
1523 * Section 5.2.4
1524 * A) In this case, the peer may have restarted.
1525 */
1526static sctp_disposition_t sctp_sf_do_dupcook_a(const struct sctp_endpoint *ep,
1527 const struct sctp_association *asoc,
1528 struct sctp_chunk *chunk,
1529 sctp_cmd_seq_t *commands,
1530 struct sctp_association *new_asoc)
1531{
1532 sctp_init_chunk_t *peer_init;
1533 struct sctp_ulpevent *ev;
1534 struct sctp_chunk *repl;
1535 struct sctp_chunk *err;
1536 sctp_disposition_t disposition;
1537
1538 /* new_asoc is a brand-new association, so these are not yet
1539 * side effects--it is safe to run them here.
1540 */
1541 peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
1542
1543 if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
1544 sctp_source(chunk), peer_init,
1545 GFP_ATOMIC))
1546 goto nomem;
1547
1548 /* Make sure no new addresses are being added during the
1549 * restart. Though this is a pretty complicated attack
1550 * since you'd have to get inside the cookie.
1551 */
1552 if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk, commands)) {
1553 return SCTP_DISPOSITION_CONSUME;
1554 }
1555
1556 /* If the endpoint is in the SHUTDOWN-ACK-SENT state and recognizes
1557 * the peer has restarted (Action A), it MUST NOT setup a new
1558 * association but instead resend the SHUTDOWN ACK and send an ERROR
1559 * chunk with a "Cookie Received while Shutting Down" error cause to
1560 * its peer.
1561 */
1562 if (sctp_state(asoc, SHUTDOWN_ACK_SENT)) {
1563 disposition = sctp_sf_do_9_2_reshutack(ep, asoc,
1564 SCTP_ST_CHUNK(chunk->chunk_hdr->type),
1565 chunk, commands);
1566 if (SCTP_DISPOSITION_NOMEM == disposition)
1567 goto nomem;
1568
1569 err = sctp_make_op_error(asoc, chunk,
1570 SCTP_ERROR_COOKIE_IN_SHUTDOWN,
1571 NULL, 0);
1572 if (err)
1573 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
1574 SCTP_CHUNK(err));
1575
1576 return SCTP_DISPOSITION_CONSUME;
1577 }
1578
1579 /* For now, fail any unsent/unacked data. Consider the optional
1580 * choice of resending of this data.
1581 */
1582 sctp_add_cmd_sf(commands, SCTP_CMD_PURGE_OUTQUEUE, SCTP_NULL());
1583
1584 /* Update the content of current association. */
1585 sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
1586
1587 repl = sctp_make_cookie_ack(new_asoc, chunk);
1588 if (!repl)
1589 goto nomem;
1590
1591 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1592
1593 /* Report association restart to upper layer. */
1594 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_RESTART, 0,
1595 new_asoc->c.sinit_num_ostreams,
1596 new_asoc->c.sinit_max_instreams,
1597 GFP_ATOMIC);
1598 if (!ev)
1599 goto nomem_ev;
1600
1601 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
1602 return SCTP_DISPOSITION_CONSUME;
1603
1604nomem_ev:
1605 sctp_chunk_free(repl);
1606nomem:
1607 return SCTP_DISPOSITION_NOMEM;
1608}
1609
1610/* Unexpected COOKIE-ECHO handler for setup collision (Table 2, action 'B')
1611 *
1612 * Section 5.2.4
1613 * B) In this case, both sides may be attempting to start an association
1614 * at about the same time but the peer endpoint started its INIT
1615 * after responding to the local endpoint's INIT
1616 */
1617/* This case represents an initialization collision. */
1618static sctp_disposition_t sctp_sf_do_dupcook_b(const struct sctp_endpoint *ep,
1619 const struct sctp_association *asoc,
1620 struct sctp_chunk *chunk,
1621 sctp_cmd_seq_t *commands,
1622 struct sctp_association *new_asoc)
1623{
1624 sctp_init_chunk_t *peer_init;
1625 struct sctp_ulpevent *ev;
1626 struct sctp_chunk *repl;
1627
1628 /* new_asoc is a brand-new association, so these are not yet
1629 * side effects--it is safe to run them here.
1630 */
1631 peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
1632 if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
1633 sctp_source(chunk), peer_init,
1634 GFP_ATOMIC))
1635 goto nomem;
1636
1637 /* Update the content of current association. */
1638 sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
1639 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
1640 SCTP_STATE(SCTP_STATE_ESTABLISHED));
1641 SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
1642 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
1643
1644 repl = sctp_make_cookie_ack(new_asoc, chunk);
1645 if (!repl)
1646 goto nomem;
1647
1648 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1649 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSMIT, SCTP_NULL());
1650
1651 /* RFC 2960 5.1 Normal Establishment of an Association
1652 *
1653 * D) IMPLEMENTATION NOTE: An implementation may choose to
1654 * send the Communication Up notification to the SCTP user
1655 * upon reception of a valid COOKIE ECHO chunk.
1656 */
1657 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_COMM_UP, 0,
1658 new_asoc->c.sinit_num_ostreams,
1659 new_asoc->c.sinit_max_instreams,
1660 GFP_ATOMIC);
1661 if (!ev)
1662 goto nomem_ev;
1663
1664 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
1665
1666 /* Sockets API Draft Section 5.3.1.6
1667 * When a peer sends a Adaption Layer Indication parameter , SCTP
1668 * delivers this notification to inform the application that of the
1669 * peers requested adaption layer.
1670 */
1671 if (asoc->peer.adaption_ind) {
1672 ev = sctp_ulpevent_make_adaption_indication(asoc, GFP_ATOMIC);
1673 if (!ev)
1674 goto nomem_ev;
1675
1676 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
1677 SCTP_ULPEVENT(ev));
1678 }
1679
1680 return SCTP_DISPOSITION_CONSUME;
1681
1682nomem_ev:
1683 sctp_chunk_free(repl);
1684nomem:
1685 return SCTP_DISPOSITION_NOMEM;
1686}
1687
1688/* Unexpected COOKIE-ECHO handler for setup collision (Table 2, action 'C')
1689 *
1690 * Section 5.2.4
1691 * C) In this case, the local endpoint's cookie has arrived late.
1692 * Before it arrived, the local endpoint sent an INIT and received an
1693 * INIT-ACK and finally sent a COOKIE ECHO with the peer's same tag
1694 * but a new tag of its own.
1695 */
1696/* This case represents an initialization collision. */
1697static sctp_disposition_t sctp_sf_do_dupcook_c(const struct sctp_endpoint *ep,
1698 const struct sctp_association *asoc,
1699 struct sctp_chunk *chunk,
1700 sctp_cmd_seq_t *commands,
1701 struct sctp_association *new_asoc)
1702{
1703 /* The cookie should be silently discarded.
1704 * The endpoint SHOULD NOT change states and should leave
1705 * any timers running.
1706 */
1707 return SCTP_DISPOSITION_DISCARD;
1708}
1709
1710/* Unexpected COOKIE-ECHO handler lost chunk (Table 2, action 'D')
1711 *
1712 * Section 5.2.4
1713 *
1714 * D) When both local and remote tags match the endpoint should always
1715 * enter the ESTABLISHED state, if it has not already done so.
1716 */
1717/* This case represents an initialization collision. */
1718static sctp_disposition_t sctp_sf_do_dupcook_d(const struct sctp_endpoint *ep,
1719 const struct sctp_association *asoc,
1720 struct sctp_chunk *chunk,
1721 sctp_cmd_seq_t *commands,
1722 struct sctp_association *new_asoc)
1723{
1724 struct sctp_ulpevent *ev = NULL;
1725 struct sctp_chunk *repl;
1726
1727 /* Clarification from Implementor's Guide:
1728 * D) When both local and remote tags match the endpoint should
1729 * enter the ESTABLISHED state, if it is in the COOKIE-ECHOED state.
1730 * It should stop any cookie timer that may be running and send
1731 * a COOKIE ACK.
1732 */
1733
1734 /* Don't accidentally move back into established state. */
1735 if (asoc->state < SCTP_STATE_ESTABLISHED) {
1736 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
1737 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
1738 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
1739 SCTP_STATE(SCTP_STATE_ESTABLISHED));
1740 SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
1741 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START,
1742 SCTP_NULL());
1743
1744 /* RFC 2960 5.1 Normal Establishment of an Association
1745 *
1746 * D) IMPLEMENTATION NOTE: An implementation may choose
1747 * to send the Communication Up notification to the
1748 * SCTP user upon reception of a valid COOKIE
1749 * ECHO chunk.
1750 */
1751 ev = sctp_ulpevent_make_assoc_change(new_asoc, 0,
1752 SCTP_COMM_UP, 0,
1753 new_asoc->c.sinit_num_ostreams,
1754 new_asoc->c.sinit_max_instreams,
1755 GFP_ATOMIC);
1756 if (!ev)
1757 goto nomem;
1758 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
1759 SCTP_ULPEVENT(ev));
1760
1761 /* Sockets API Draft Section 5.3.1.6
1762 * When a peer sends a Adaption Layer Indication parameter,
1763 * SCTP delivers this notification to inform the application
1764 * that of the peers requested adaption layer.
1765 */
1766 if (new_asoc->peer.adaption_ind) {
1767 ev = sctp_ulpevent_make_adaption_indication(new_asoc,
1768 GFP_ATOMIC);
1769 if (!ev)
1770 goto nomem;
1771
1772 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
1773 SCTP_ULPEVENT(ev));
1774 }
1775 }
1776 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSMIT, SCTP_NULL());
1777
1778 repl = sctp_make_cookie_ack(new_asoc, chunk);
1779 if (!repl)
1780 goto nomem;
1781
1782 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1783 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSMIT, SCTP_NULL());
1784
1785 return SCTP_DISPOSITION_CONSUME;
1786
1787nomem:
1788 if (ev)
1789 sctp_ulpevent_free(ev);
1790 return SCTP_DISPOSITION_NOMEM;
1791}
1792
1793/*
1794 * Handle a duplicate COOKIE-ECHO. This usually means a cookie-carrying
1795 * chunk was retransmitted and then delayed in the network.
1796 *
1797 * Section: 5.2.4 Handle a COOKIE ECHO when a TCB exists
1798 *
1799 * Verification Tag: None. Do cookie validation.
1800 *
1801 * Inputs
1802 * (endpoint, asoc, chunk)
1803 *
1804 * Outputs
1805 * (asoc, reply_msg, msg_up, timers, counters)
1806 *
1807 * The return value is the disposition of the chunk.
1808 */
1809sctp_disposition_t sctp_sf_do_5_2_4_dupcook(const struct sctp_endpoint *ep,
1810 const struct sctp_association *asoc,
1811 const sctp_subtype_t type,
1812 void *arg,
1813 sctp_cmd_seq_t *commands)
1814{
1815 sctp_disposition_t retval;
1816 struct sctp_chunk *chunk = arg;
1817 struct sctp_association *new_asoc;
1818 int error = 0;
1819 char action;
1820 struct sctp_chunk *err_chk_p;
1821
1822 /* Make sure that the chunk has a valid length from the protocol
1823 * perspective. In this case check to make sure we have at least
1824 * enough for the chunk header. Cookie length verification is
1825 * done later.
1826 */
1827 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
1828 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
1829 commands);
1830
1831 /* "Decode" the chunk. We have no optional parameters so we
1832 * are in good shape.
1833 */
1834 chunk->subh.cookie_hdr = (struct sctp_signed_cookie *)chunk->skb->data;
1835 skb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
1836 sizeof(sctp_chunkhdr_t));
1837
1838 /* In RFC 2960 5.2.4 3, if both Verification Tags in the State Cookie
1839 * of a duplicate COOKIE ECHO match the Verification Tags of the
1840 * current association, consider the State Cookie valid even if
1841 * the lifespan is exceeded.
1842 */
1843 new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, &error,
1844 &err_chk_p);
1845
1846 /* FIXME:
1847 * If the re-build failed, what is the proper error path
1848 * from here?
1849 *
1850 * [We should abort the association. --piggy]
1851 */
1852 if (!new_asoc) {
1853 /* FIXME: Several errors are possible. A bad cookie should
1854 * be silently discarded, but think about logging it too.
1855 */
1856 switch (error) {
1857 case -SCTP_IERROR_NOMEM:
1858 goto nomem;
1859
1860 case -SCTP_IERROR_STALE_COOKIE:
1861 sctp_send_stale_cookie_err(ep, asoc, chunk, commands,
1862 err_chk_p);
1863 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
1864 case -SCTP_IERROR_BAD_SIG:
1865 default:
1866 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
1867 };
1868 }
1869
1870 /* Compare the tie_tag in cookie with the verification tag of
1871 * current association.
1872 */
1873 action = sctp_tietags_compare(new_asoc, asoc);
1874
1875 switch (action) {
1876 case 'A': /* Association restart. */
1877 retval = sctp_sf_do_dupcook_a(ep, asoc, chunk, commands,
1878 new_asoc);
1879 break;
1880
1881 case 'B': /* Collision case B. */
1882 retval = sctp_sf_do_dupcook_b(ep, asoc, chunk, commands,
1883 new_asoc);
1884 break;
1885
1886 case 'C': /* Collision case C. */
1887 retval = sctp_sf_do_dupcook_c(ep, asoc, chunk, commands,
1888 new_asoc);
1889 break;
1890
1891 case 'D': /* Collision case D. */
1892 retval = sctp_sf_do_dupcook_d(ep, asoc, chunk, commands,
1893 new_asoc);
1894 break;
1895
1896 default: /* Discard packet for all others. */
1897 retval = sctp_sf_pdiscard(ep, asoc, type, arg, commands);
1898 break;
1899 };
1900
1901 /* Delete the tempory new association. */
1902 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
1903 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
1904
1905 return retval;
1906
1907nomem:
1908 return SCTP_DISPOSITION_NOMEM;
1909}
1910
1911/*
1912 * Process an ABORT. (SHUTDOWN-PENDING state)
1913 *
1914 * See sctp_sf_do_9_1_abort().
1915 */
1916sctp_disposition_t sctp_sf_shutdown_pending_abort(
1917 const struct sctp_endpoint *ep,
1918 const struct sctp_association *asoc,
1919 const sctp_subtype_t type,
1920 void *arg,
1921 sctp_cmd_seq_t *commands)
1922{
1923 struct sctp_chunk *chunk = arg;
1924
1925 if (!sctp_vtag_verify_either(chunk, asoc))
1926 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
1927
1928 /* Make sure that the ABORT chunk has a valid length.
1929 * Since this is an ABORT chunk, we have to discard it
1930 * because of the following text:
1931 * RFC 2960, Section 3.3.7
1932 * If an endpoint receives an ABORT with a format error or for an
1933 * association that doesn't exist, it MUST silently discard it.
1934 * Becasue the length is "invalid", we can't really discard just
1935 * as we do not know its true length. So, to be safe, discard the
1936 * packet.
1937 */
1938 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
1939 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
1940
1941 /* Stop the T5-shutdown guard timer. */
1942 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
1943 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
1944
1945 return sctp_sf_do_9_1_abort(ep, asoc, type, arg, commands);
1946}
1947
1948/*
1949 * Process an ABORT. (SHUTDOWN-SENT state)
1950 *
1951 * See sctp_sf_do_9_1_abort().
1952 */
1953sctp_disposition_t sctp_sf_shutdown_sent_abort(const struct sctp_endpoint *ep,
1954 const struct sctp_association *asoc,
1955 const sctp_subtype_t type,
1956 void *arg,
1957 sctp_cmd_seq_t *commands)
1958{
1959 struct sctp_chunk *chunk = arg;
1960
1961 if (!sctp_vtag_verify_either(chunk, asoc))
1962 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
1963
1964 /* Make sure that the ABORT chunk has a valid length.
1965 * Since this is an ABORT chunk, we have to discard it
1966 * because of the following text:
1967 * RFC 2960, Section 3.3.7
1968 * If an endpoint receives an ABORT with a format error or for an
1969 * association that doesn't exist, it MUST silently discard it.
1970 * Becasue the length is "invalid", we can't really discard just
1971 * as we do not know its true length. So, to be safe, discard the
1972 * packet.
1973 */
1974 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
1975 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
1976
1977 /* Stop the T2-shutdown timer. */
1978 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
1979 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
1980
1981 /* Stop the T5-shutdown guard timer. */
1982 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
1983 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
1984
1985 return sctp_sf_do_9_1_abort(ep, asoc, type, arg, commands);
1986}
1987
1988/*
1989 * Process an ABORT. (SHUTDOWN-ACK-SENT state)
1990 *
1991 * See sctp_sf_do_9_1_abort().
1992 */
1993sctp_disposition_t sctp_sf_shutdown_ack_sent_abort(
1994 const struct sctp_endpoint *ep,
1995 const struct sctp_association *asoc,
1996 const sctp_subtype_t type,
1997 void *arg,
1998 sctp_cmd_seq_t *commands)
1999{
2000 /* The same T2 timer, so we should be able to use
2001 * common function with the SHUTDOWN-SENT state.
2002 */
2003 return sctp_sf_shutdown_sent_abort(ep, asoc, type, arg, commands);
2004}
2005
2006/*
2007 * Handle an Error received in COOKIE_ECHOED state.
2008 *
2009 * Only handle the error type of stale COOKIE Error, the other errors will
2010 * be ignored.
2011 *
2012 * Inputs
2013 * (endpoint, asoc, chunk)
2014 *
2015 * Outputs
2016 * (asoc, reply_msg, msg_up, timers, counters)
2017 *
2018 * The return value is the disposition of the chunk.
2019 */
2020sctp_disposition_t sctp_sf_cookie_echoed_err(const struct sctp_endpoint *ep,
2021 const struct sctp_association *asoc,
2022 const sctp_subtype_t type,
2023 void *arg,
2024 sctp_cmd_seq_t *commands)
2025{
2026 struct sctp_chunk *chunk = arg;
2027 sctp_errhdr_t *err;
2028
2029 if (!sctp_vtag_verify(chunk, asoc))
2030 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2031
2032 /* Make sure that the ERROR chunk has a valid length.
2033 * The parameter walking depends on this as well.
2034 */
2035 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_operr_chunk_t)))
2036 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
2037 commands);
2038
2039 /* Process the error here */
2040 /* FUTURE FIXME: When PR-SCTP related and other optional
2041 * parms are emitted, this will have to change to handle multiple
2042 * errors.
2043 */
2044 sctp_walk_errors(err, chunk->chunk_hdr) {
2045 if (SCTP_ERROR_STALE_COOKIE == err->cause)
2046 return sctp_sf_do_5_2_6_stale(ep, asoc, type,
2047 arg, commands);
2048 }
2049
2050 /* It is possible to have malformed error causes, and that
2051 * will cause us to end the walk early. However, since
2052 * we are discarding the packet, there should be no adverse
2053 * affects.
2054 */
2055 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2056}
2057
2058/*
2059 * Handle a Stale COOKIE Error
2060 *
2061 * Section: 5.2.6 Handle Stale COOKIE Error
2062 * If the association is in the COOKIE-ECHOED state, the endpoint may elect
2063 * one of the following three alternatives.
2064 * ...
2065 * 3) Send a new INIT chunk to the endpoint, adding a Cookie
2066 * Preservative parameter requesting an extension to the lifetime of
2067 * the State Cookie. When calculating the time extension, an
2068 * implementation SHOULD use the RTT information measured based on the
2069 * previous COOKIE ECHO / ERROR exchange, and should add no more
2070 * than 1 second beyond the measured RTT, due to long State Cookie
2071 * lifetimes making the endpoint more subject to a replay attack.
2072 *
2073 * Verification Tag: Not explicit, but safe to ignore.
2074 *
2075 * Inputs
2076 * (endpoint, asoc, chunk)
2077 *
2078 * Outputs
2079 * (asoc, reply_msg, msg_up, timers, counters)
2080 *
2081 * The return value is the disposition of the chunk.
2082 */
2083static sctp_disposition_t sctp_sf_do_5_2_6_stale(const struct sctp_endpoint *ep,
2084 const struct sctp_association *asoc,
2085 const sctp_subtype_t type,
2086 void *arg,
2087 sctp_cmd_seq_t *commands)
2088{
2089 struct sctp_chunk *chunk = arg;
2090 time_t stale;
2091 sctp_cookie_preserve_param_t bht;
2092 sctp_errhdr_t *err;
2093 struct sctp_chunk *reply;
2094 struct sctp_bind_addr *bp;
2095 int attempts;
2096
2097 attempts = asoc->counters[SCTP_COUNTER_INIT_ERROR] + 1;
2098
2099 if (attempts >= asoc->max_init_attempts) {
2100 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
2101 SCTP_U32(SCTP_ERROR_STALE_COOKIE));
2102 return SCTP_DISPOSITION_DELETE_TCB;
2103 }
2104
2105 err = (sctp_errhdr_t *)(chunk->skb->data);
2106
2107 /* When calculating the time extension, an implementation
2108 * SHOULD use the RTT information measured based on the
2109 * previous COOKIE ECHO / ERROR exchange, and should add no
2110 * more than 1 second beyond the measured RTT, due to long
2111 * State Cookie lifetimes making the endpoint more subject to
2112 * a replay attack.
2113 * Measure of Staleness's unit is usec. (1/1000000 sec)
2114 * Suggested Cookie Life-span Increment's unit is msec.
2115 * (1/1000 sec)
2116 * In general, if you use the suggested cookie life, the value
2117 * found in the field of measure of staleness should be doubled
2118 * to give ample time to retransmit the new cookie and thus
2119 * yield a higher probability of success on the reattempt.
2120 */
2121 stale = ntohl(*(suseconds_t *)((u8 *)err + sizeof(sctp_errhdr_t)));
2122 stale = (stale * 2) / 1000;
2123
2124 bht.param_hdr.type = SCTP_PARAM_COOKIE_PRESERVATIVE;
2125 bht.param_hdr.length = htons(sizeof(bht));
2126 bht.lifespan_increment = htonl(stale);
2127
2128 /* Build that new INIT chunk. */
2129 bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
2130 reply = sctp_make_init(asoc, bp, GFP_ATOMIC, sizeof(bht));
2131 if (!reply)
2132 goto nomem;
2133
2134 sctp_addto_chunk(reply, sizeof(bht), &bht);
2135
2136 /* Clear peer's init_tag cached in assoc as we are sending a new INIT */
2137 sctp_add_cmd_sf(commands, SCTP_CMD_CLEAR_INIT_TAG, SCTP_NULL());
2138
2139 /* Stop pending T3-rtx and heartbeat timers */
2140 sctp_add_cmd_sf(commands, SCTP_CMD_T3_RTX_TIMERS_STOP, SCTP_NULL());
2141 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
2142
2143 /* Delete non-primary peer ip addresses since we are transitioning
2144 * back to the COOKIE-WAIT state
2145 */
2146 sctp_add_cmd_sf(commands, SCTP_CMD_DEL_NON_PRIMARY, SCTP_NULL());
2147
2148 /* If we've sent any data bundled with COOKIE-ECHO we will need to
2149 * resend
2150 */
2151 sctp_add_cmd_sf(commands, SCTP_CMD_RETRAN,
2152 SCTP_TRANSPORT(asoc->peer.primary_path));
2153
2154 /* Cast away the const modifier, as we want to just
2155 * rerun it through as a sideffect.
2156 */
2157 sctp_add_cmd_sf(commands, SCTP_CMD_COUNTER_INC,
2158 SCTP_COUNTER(SCTP_COUNTER_INIT_ERROR));
2159
2160 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2161 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
2162 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2163 SCTP_STATE(SCTP_STATE_COOKIE_WAIT));
2164 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
2165 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
2166
2167 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
2168
2169 return SCTP_DISPOSITION_CONSUME;
2170
2171nomem:
2172 return SCTP_DISPOSITION_NOMEM;
2173}
2174
2175/*
2176 * Process an ABORT.
2177 *
2178 * Section: 9.1
2179 * After checking the Verification Tag, the receiving endpoint shall
2180 * remove the association from its record, and shall report the
2181 * termination to its upper layer.
2182 *
2183 * Verification Tag: 8.5.1 Exceptions in Verification Tag Rules
2184 * B) Rules for packet carrying ABORT:
2185 *
2186 * - The endpoint shall always fill in the Verification Tag field of the
2187 * outbound packet with the destination endpoint's tag value if it
2188 * is known.
2189 *
2190 * - If the ABORT is sent in response to an OOTB packet, the endpoint
2191 * MUST follow the procedure described in Section 8.4.
2192 *
2193 * - The receiver MUST accept the packet if the Verification Tag
2194 * matches either its own tag, OR the tag of its peer. Otherwise, the
2195 * receiver MUST silently discard the packet and take no further
2196 * action.
2197 *
2198 * Inputs
2199 * (endpoint, asoc, chunk)
2200 *
2201 * Outputs
2202 * (asoc, reply_msg, msg_up, timers, counters)
2203 *
2204 * The return value is the disposition of the chunk.
2205 */
2206sctp_disposition_t sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep,
2207 const struct sctp_association *asoc,
2208 const sctp_subtype_t type,
2209 void *arg,
2210 sctp_cmd_seq_t *commands)
2211{
2212 struct sctp_chunk *chunk = arg;
2213 unsigned len;
2214 __u16 error = SCTP_ERROR_NO_ERROR;
2215
2216 if (!sctp_vtag_verify_either(chunk, asoc))
2217 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2218
2219 /* Make sure that the ABORT chunk has a valid length.
2220 * Since this is an ABORT chunk, we have to discard it
2221 * because of the following text:
2222 * RFC 2960, Section 3.3.7
2223 * If an endpoint receives an ABORT with a format error or for an
2224 * association that doesn't exist, it MUST silently discard it.
2225 * Becasue the length is "invalid", we can't really discard just
2226 * as we do not know its true length. So, to be safe, discard the
2227 * packet.
2228 */
2229 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
2230 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2231
2232 /* See if we have an error cause code in the chunk. */
2233 len = ntohs(chunk->chunk_hdr->length);
2234 if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
2235 error = ((sctp_errhdr_t *)chunk->skb->data)->cause;
2236
2237 /* ASSOC_FAILED will DELETE_TCB. */
2238 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, SCTP_U32(error));
2239 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
2240 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
2241
2242 return SCTP_DISPOSITION_ABORT;
2243}
2244
2245/*
2246 * Process an ABORT. (COOKIE-WAIT state)
2247 *
2248 * See sctp_sf_do_9_1_abort() above.
2249 */
2250sctp_disposition_t sctp_sf_cookie_wait_abort(const struct sctp_endpoint *ep,
2251 const struct sctp_association *asoc,
2252 const sctp_subtype_t type,
2253 void *arg,
2254 sctp_cmd_seq_t *commands)
2255{
2256 struct sctp_chunk *chunk = arg;
2257 unsigned len;
2258 __u16 error = SCTP_ERROR_NO_ERROR;
2259
2260 if (!sctp_vtag_verify_either(chunk, asoc))
2261 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2262
2263 /* Make sure that the ABORT chunk has a valid length.
2264 * Since this is an ABORT chunk, we have to discard it
2265 * because of the following text:
2266 * RFC 2960, Section 3.3.7
2267 * If an endpoint receives an ABORT with a format error or for an
2268 * association that doesn't exist, it MUST silently discard it.
2269 * Becasue the length is "invalid", we can't really discard just
2270 * as we do not know its true length. So, to be safe, discard the
2271 * packet.
2272 */
2273 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
2274 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2275
2276 /* See if we have an error cause code in the chunk. */
2277 len = ntohs(chunk->chunk_hdr->length);
2278 if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
2279 error = ((sctp_errhdr_t *)chunk->skb->data)->cause;
2280
2281 sctp_stop_t1_and_abort(commands, error);
2282 return SCTP_DISPOSITION_ABORT;
2283}
2284
2285/*
2286 * Process an incoming ICMP as an ABORT. (COOKIE-WAIT state)
2287 */
2288sctp_disposition_t sctp_sf_cookie_wait_icmp_abort(const struct sctp_endpoint *ep,
2289 const struct sctp_association *asoc,
2290 const sctp_subtype_t type,
2291 void *arg,
2292 sctp_cmd_seq_t *commands)
2293{
2294 sctp_stop_t1_and_abort(commands, SCTP_ERROR_NO_ERROR);
2295 return SCTP_DISPOSITION_ABORT;
2296}
2297
2298/*
2299 * Process an ABORT. (COOKIE-ECHOED state)
2300 */
2301sctp_disposition_t sctp_sf_cookie_echoed_abort(const struct sctp_endpoint *ep,
2302 const struct sctp_association *asoc,
2303 const sctp_subtype_t type,
2304 void *arg,
2305 sctp_cmd_seq_t *commands)
2306{
2307 /* There is a single T1 timer, so we should be able to use
2308 * common function with the COOKIE-WAIT state.
2309 */
2310 return sctp_sf_cookie_wait_abort(ep, asoc, type, arg, commands);
2311}
2312
2313/*
2314 * Stop T1 timer and abort association with "INIT failed".
2315 *
2316 * This is common code called by several sctp_sf_*_abort() functions above.
2317 */
2318void sctp_stop_t1_and_abort(sctp_cmd_seq_t *commands, __u16 error)
2319{
2320 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2321 SCTP_STATE(SCTP_STATE_CLOSED));
2322 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
2323 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2324 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
2325 /* CMD_INIT_FAILED will DELETE_TCB. */
2326 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
2327 SCTP_U32(error));
2328}
2329
2330/*
2331 * sctp_sf_do_9_2_shut
2332 *
2333 * Section: 9.2
2334 * Upon the reception of the SHUTDOWN, the peer endpoint shall
2335 * - enter the SHUTDOWN-RECEIVED state,
2336 *
2337 * - stop accepting new data from its SCTP user
2338 *
2339 * - verify, by checking the Cumulative TSN Ack field of the chunk,
2340 * that all its outstanding DATA chunks have been received by the
2341 * SHUTDOWN sender.
2342 *
2343 * Once an endpoint as reached the SHUTDOWN-RECEIVED state it MUST NOT
2344 * send a SHUTDOWN in response to a ULP request. And should discard
2345 * subsequent SHUTDOWN chunks.
2346 *
2347 * If there are still outstanding DATA chunks left, the SHUTDOWN
2348 * receiver shall continue to follow normal data transmission
2349 * procedures defined in Section 6 until all outstanding DATA chunks
2350 * are acknowledged; however, the SHUTDOWN receiver MUST NOT accept
2351 * new data from its SCTP user.
2352 *
2353 * Verification Tag: 8.5 Verification Tag [Normal verification]
2354 *
2355 * Inputs
2356 * (endpoint, asoc, chunk)
2357 *
2358 * Outputs
2359 * (asoc, reply_msg, msg_up, timers, counters)
2360 *
2361 * The return value is the disposition of the chunk.
2362 */
2363sctp_disposition_t sctp_sf_do_9_2_shutdown(const struct sctp_endpoint *ep,
2364 const struct sctp_association *asoc,
2365 const sctp_subtype_t type,
2366 void *arg,
2367 sctp_cmd_seq_t *commands)
2368{
2369 struct sctp_chunk *chunk = arg;
2370 sctp_shutdownhdr_t *sdh;
2371 sctp_disposition_t disposition;
2372 struct sctp_ulpevent *ev;
2373
2374 if (!sctp_vtag_verify(chunk, asoc))
2375 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2376
2377 /* Make sure that the SHUTDOWN chunk has a valid length. */
2378 if (!sctp_chunk_length_valid(chunk,
2379 sizeof(struct sctp_shutdown_chunk_t)))
2380 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
2381 commands);
2382
2383 /* Convert the elaborate header. */
2384 sdh = (sctp_shutdownhdr_t *)chunk->skb->data;
2385 skb_pull(chunk->skb, sizeof(sctp_shutdownhdr_t));
2386 chunk->subh.shutdown_hdr = sdh;
2387
2388 /* Upon the reception of the SHUTDOWN, the peer endpoint shall
2389 * - enter the SHUTDOWN-RECEIVED state,
2390 * - stop accepting new data from its SCTP user
2391 *
2392 * [This is implicit in the new state.]
2393 */
2394 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2395 SCTP_STATE(SCTP_STATE_SHUTDOWN_RECEIVED));
2396 disposition = SCTP_DISPOSITION_CONSUME;
2397
2398 if (sctp_outq_is_empty(&asoc->outqueue)) {
2399 disposition = sctp_sf_do_9_2_shutdown_ack(ep, asoc, type,
2400 arg, commands);
2401 }
2402
2403 if (SCTP_DISPOSITION_NOMEM == disposition)
2404 goto out;
2405
2406 /* - verify, by checking the Cumulative TSN Ack field of the
2407 * chunk, that all its outstanding DATA chunks have been
2408 * received by the SHUTDOWN sender.
2409 */
2410 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_CTSN,
2411 SCTP_U32(chunk->subh.shutdown_hdr->cum_tsn_ack));
2412
2413 /* API 5.3.1.5 SCTP_SHUTDOWN_EVENT
2414 * When a peer sends a SHUTDOWN, SCTP delivers this notification to
2415 * inform the application that it should cease sending data.
2416 */
2417 ev = sctp_ulpevent_make_shutdown_event(asoc, 0, GFP_ATOMIC);
2418 if (!ev) {
2419 disposition = SCTP_DISPOSITION_NOMEM;
2420 goto out;
2421 }
2422 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
2423
2424out:
2425 return disposition;
2426}
2427
2428/* RFC 2960 9.2
2429 * If an endpoint is in SHUTDOWN-ACK-SENT state and receives an INIT chunk
2430 * (e.g., if the SHUTDOWN COMPLETE was lost) with source and destination
2431 * transport addresses (either in the IP addresses or in the INIT chunk)
2432 * that belong to this association, it should discard the INIT chunk and
2433 * retransmit the SHUTDOWN ACK chunk.
2434 */
2435sctp_disposition_t sctp_sf_do_9_2_reshutack(const struct sctp_endpoint *ep,
2436 const struct sctp_association *asoc,
2437 const sctp_subtype_t type,
2438 void *arg,
2439 sctp_cmd_seq_t *commands)
2440{
2441 struct sctp_chunk *chunk = (struct sctp_chunk *) arg;
2442 struct sctp_chunk *reply;
2443
2444 /* Since we are not going to really process this INIT, there
2445 * is no point in verifying chunk boundries. Just generate
2446 * the SHUTDOWN ACK.
2447 */
2448 reply = sctp_make_shutdown_ack(asoc, chunk);
2449 if (NULL == reply)
2450 goto nomem;
2451
2452 /* Set the transport for the SHUTDOWN ACK chunk and the timeout for
2453 * the T2-SHUTDOWN timer.
2454 */
2455 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
2456
2457 /* and restart the T2-shutdown timer. */
2458 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
2459 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
2460
2461 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
2462
2463 return SCTP_DISPOSITION_CONSUME;
2464nomem:
2465 return SCTP_DISPOSITION_NOMEM;
2466}
2467
2468/*
2469 * sctp_sf_do_ecn_cwr
2470 *
2471 * Section: Appendix A: Explicit Congestion Notification
2472 *
2473 * CWR:
2474 *
2475 * RFC 2481 details a specific bit for a sender to send in the header of
2476 * its next outbound TCP segment to indicate to its peer that it has
2477 * reduced its congestion window. This is termed the CWR bit. For
2478 * SCTP the same indication is made by including the CWR chunk.
2479 * This chunk contains one data element, i.e. the TSN number that
2480 * was sent in the ECNE chunk. This element represents the lowest
2481 * TSN number in the datagram that was originally marked with the
2482 * CE bit.
2483 *
2484 * Verification Tag: 8.5 Verification Tag [Normal verification]
2485 * Inputs
2486 * (endpoint, asoc, chunk)
2487 *
2488 * Outputs
2489 * (asoc, reply_msg, msg_up, timers, counters)
2490 *
2491 * The return value is the disposition of the chunk.
2492 */
2493sctp_disposition_t sctp_sf_do_ecn_cwr(const struct sctp_endpoint *ep,
2494 const struct sctp_association *asoc,
2495 const sctp_subtype_t type,
2496 void *arg,
2497 sctp_cmd_seq_t *commands)
2498{
2499 sctp_cwrhdr_t *cwr;
2500 struct sctp_chunk *chunk = arg;
2501
2502 if (!sctp_vtag_verify(chunk, asoc))
2503 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2504
2505 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_ecne_chunk_t)))
2506 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
2507 commands);
2508
2509 cwr = (sctp_cwrhdr_t *) chunk->skb->data;
2510 skb_pull(chunk->skb, sizeof(sctp_cwrhdr_t));
2511
2512 cwr->lowest_tsn = ntohl(cwr->lowest_tsn);
2513
2514 /* Does this CWR ack the last sent congestion notification? */
2515 if (TSN_lte(asoc->last_ecne_tsn, cwr->lowest_tsn)) {
2516 /* Stop sending ECNE. */
2517 sctp_add_cmd_sf(commands,
2518 SCTP_CMD_ECN_CWR,
2519 SCTP_U32(cwr->lowest_tsn));
2520 }
2521 return SCTP_DISPOSITION_CONSUME;
2522}
2523
2524/*
2525 * sctp_sf_do_ecne
2526 *
2527 * Section: Appendix A: Explicit Congestion Notification
2528 *
2529 * ECN-Echo
2530 *
2531 * RFC 2481 details a specific bit for a receiver to send back in its
2532 * TCP acknowledgements to notify the sender of the Congestion
2533 * Experienced (CE) bit having arrived from the network. For SCTP this
2534 * same indication is made by including the ECNE chunk. This chunk
2535 * contains one data element, i.e. the lowest TSN associated with the IP
2536 * datagram marked with the CE bit.....
2537 *
2538 * Verification Tag: 8.5 Verification Tag [Normal verification]
2539 * Inputs
2540 * (endpoint, asoc, chunk)
2541 *
2542 * Outputs
2543 * (asoc, reply_msg, msg_up, timers, counters)
2544 *
2545 * The return value is the disposition of the chunk.
2546 */
2547sctp_disposition_t sctp_sf_do_ecne(const struct sctp_endpoint *ep,
2548 const struct sctp_association *asoc,
2549 const sctp_subtype_t type,
2550 void *arg,
2551 sctp_cmd_seq_t *commands)
2552{
2553 sctp_ecnehdr_t *ecne;
2554 struct sctp_chunk *chunk = arg;
2555
2556 if (!sctp_vtag_verify(chunk, asoc))
2557 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2558
2559 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_ecne_chunk_t)))
2560 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
2561 commands);
2562
2563 ecne = (sctp_ecnehdr_t *) chunk->skb->data;
2564 skb_pull(chunk->skb, sizeof(sctp_ecnehdr_t));
2565
2566 /* If this is a newer ECNE than the last CWR packet we sent out */
2567 sctp_add_cmd_sf(commands, SCTP_CMD_ECN_ECNE,
2568 SCTP_U32(ntohl(ecne->lowest_tsn)));
2569
2570 return SCTP_DISPOSITION_CONSUME;
2571}
2572
2573/*
2574 * Section: 6.2 Acknowledgement on Reception of DATA Chunks
2575 *
2576 * The SCTP endpoint MUST always acknowledge the reception of each valid
2577 * DATA chunk.
2578 *
2579 * The guidelines on delayed acknowledgement algorithm specified in
2580 * Section 4.2 of [RFC2581] SHOULD be followed. Specifically, an
2581 * acknowledgement SHOULD be generated for at least every second packet
2582 * (not every second DATA chunk) received, and SHOULD be generated within
2583 * 200 ms of the arrival of any unacknowledged DATA chunk. In some
2584 * situations it may be beneficial for an SCTP transmitter to be more
2585 * conservative than the algorithms detailed in this document allow.
2586 * However, an SCTP transmitter MUST NOT be more aggressive than the
2587 * following algorithms allow.
2588 *
2589 * A SCTP receiver MUST NOT generate more than one SACK for every
2590 * incoming packet, other than to update the offered window as the
2591 * receiving application consumes new data.
2592 *
2593 * Verification Tag: 8.5 Verification Tag [Normal verification]
2594 *
2595 * Inputs
2596 * (endpoint, asoc, chunk)
2597 *
2598 * Outputs
2599 * (asoc, reply_msg, msg_up, timers, counters)
2600 *
2601 * The return value is the disposition of the chunk.
2602 */
2603sctp_disposition_t sctp_sf_eat_data_6_2(const struct sctp_endpoint *ep,
2604 const struct sctp_association *asoc,
2605 const sctp_subtype_t type,
2606 void *arg,
2607 sctp_cmd_seq_t *commands)
2608{
2609 struct sctp_chunk *chunk = arg;
2610 int error;
2611
2612 if (!sctp_vtag_verify(chunk, asoc)) {
2613 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
2614 SCTP_NULL());
2615 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2616 }
2617
2618 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_data_chunk_t)))
2619 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
2620 commands);
2621
2622 error = sctp_eat_data(asoc, chunk, commands );
2623 switch (error) {
2624 case SCTP_IERROR_NO_ERROR:
2625 break;
2626 case SCTP_IERROR_HIGH_TSN:
2627 case SCTP_IERROR_BAD_STREAM:
2628 goto discard_noforce;
2629 case SCTP_IERROR_DUP_TSN:
2630 case SCTP_IERROR_IGNORE_TSN:
2631 goto discard_force;
2632 case SCTP_IERROR_NO_DATA:
2633 goto consume;
2634 default:
2635 BUG();
2636 }
2637
2638 if (asoc->autoclose) {
2639 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
2640 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
2641 }
2642
2643 /* If this is the last chunk in a packet, we need to count it
2644 * toward sack generation. Note that we need to SACK every
2645 * OTHER packet containing data chunks, EVEN IF WE DISCARD
2646 * THEM. We elect to NOT generate SACK's if the chunk fails
2647 * the verification tag test.
2648 *
2649 * RFC 2960 6.2 Acknowledgement on Reception of DATA Chunks
2650 *
2651 * The SCTP endpoint MUST always acknowledge the reception of
2652 * each valid DATA chunk.
2653 *
2654 * The guidelines on delayed acknowledgement algorithm
2655 * specified in Section 4.2 of [RFC2581] SHOULD be followed.
2656 * Specifically, an acknowledgement SHOULD be generated for at
2657 * least every second packet (not every second DATA chunk)
2658 * received, and SHOULD be generated within 200 ms of the
2659 * arrival of any unacknowledged DATA chunk. In some
2660 * situations it may be beneficial for an SCTP transmitter to
2661 * be more conservative than the algorithms detailed in this
2662 * document allow. However, an SCTP transmitter MUST NOT be
2663 * more aggressive than the following algorithms allow.
2664 */
2665 if (chunk->end_of_packet) {
2666 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_NOFORCE());
2667
2668 /* Start the SACK timer. */
2669 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
2670 SCTP_TO(SCTP_EVENT_TIMEOUT_SACK));
2671 }
2672
2673 return SCTP_DISPOSITION_CONSUME;
2674
2675discard_force:
2676 /* RFC 2960 6.2 Acknowledgement on Reception of DATA Chunks
2677 *
2678 * When a packet arrives with duplicate DATA chunk(s) and with
2679 * no new DATA chunk(s), the endpoint MUST immediately send a
2680 * SACK with no delay. If a packet arrives with duplicate
2681 * DATA chunk(s) bundled with new DATA chunks, the endpoint
2682 * MAY immediately send a SACK. Normally receipt of duplicate
2683 * DATA chunks will occur when the original SACK chunk was lost
2684 * and the peer's RTO has expired. The duplicate TSN number(s)
2685 * SHOULD be reported in the SACK as duplicate.
2686 */
2687 /* In our case, we split the MAY SACK advice up whether or not
2688 * the last chunk is a duplicate.'
2689 */
2690 if (chunk->end_of_packet)
2691 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
2692 return SCTP_DISPOSITION_DISCARD;
2693
2694discard_noforce:
2695 if (chunk->end_of_packet) {
2696 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_NOFORCE());
2697
2698 /* Start the SACK timer. */
2699 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
2700 SCTP_TO(SCTP_EVENT_TIMEOUT_SACK));
2701 }
2702 return SCTP_DISPOSITION_DISCARD;
2703consume:
2704 return SCTP_DISPOSITION_CONSUME;
2705
2706}
2707
2708/*
2709 * sctp_sf_eat_data_fast_4_4
2710 *
2711 * Section: 4 (4)
2712 * (4) In SHUTDOWN-SENT state the endpoint MUST acknowledge any received
2713 * DATA chunks without delay.
2714 *
2715 * Verification Tag: 8.5 Verification Tag [Normal verification]
2716 * Inputs
2717 * (endpoint, asoc, chunk)
2718 *
2719 * Outputs
2720 * (asoc, reply_msg, msg_up, timers, counters)
2721 *
2722 * The return value is the disposition of the chunk.
2723 */
2724sctp_disposition_t sctp_sf_eat_data_fast_4_4(const struct sctp_endpoint *ep,
2725 const struct sctp_association *asoc,
2726 const sctp_subtype_t type,
2727 void *arg,
2728 sctp_cmd_seq_t *commands)
2729{
2730 struct sctp_chunk *chunk = arg;
2731 int error;
2732
2733 if (!sctp_vtag_verify(chunk, asoc)) {
2734 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
2735 SCTP_NULL());
2736 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2737 }
2738
2739 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_data_chunk_t)))
2740 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
2741 commands);
2742
2743 error = sctp_eat_data(asoc, chunk, commands );
2744 switch (error) {
2745 case SCTP_IERROR_NO_ERROR:
2746 case SCTP_IERROR_HIGH_TSN:
2747 case SCTP_IERROR_DUP_TSN:
2748 case SCTP_IERROR_IGNORE_TSN:
2749 case SCTP_IERROR_BAD_STREAM:
2750 break;
2751 case SCTP_IERROR_NO_DATA:
2752 goto consume;
2753 default:
2754 BUG();
2755 }
2756
2757 /* Go a head and force a SACK, since we are shutting down. */
2758
2759 /* Implementor's Guide.
2760 *
2761 * While in SHUTDOWN-SENT state, the SHUTDOWN sender MUST immediately
2762 * respond to each received packet containing one or more DATA chunk(s)
2763 * with a SACK, a SHUTDOWN chunk, and restart the T2-shutdown timer
2764 */
2765 if (chunk->end_of_packet) {
2766 /* We must delay the chunk creation since the cumulative
2767 * TSN has not been updated yet.
2768 */
2769 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SHUTDOWN, SCTP_NULL());
2770 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
2771 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
2772 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
2773 }
2774
2775consume:
2776 return SCTP_DISPOSITION_CONSUME;
2777}
2778
2779/*
2780 * Section: 6.2 Processing a Received SACK
2781 * D) Any time a SACK arrives, the endpoint performs the following:
2782 *
2783 * i) If Cumulative TSN Ack is less than the Cumulative TSN Ack Point,
2784 * then drop the SACK. Since Cumulative TSN Ack is monotonically
2785 * increasing, a SACK whose Cumulative TSN Ack is less than the
2786 * Cumulative TSN Ack Point indicates an out-of-order SACK.
2787 *
2788 * ii) Set rwnd equal to the newly received a_rwnd minus the number
2789 * of bytes still outstanding after processing the Cumulative TSN Ack
2790 * and the Gap Ack Blocks.
2791 *
2792 * iii) If the SACK is missing a TSN that was previously
2793 * acknowledged via a Gap Ack Block (e.g., the data receiver
2794 * reneged on the data), then mark the corresponding DATA chunk
2795 * as available for retransmit: Mark it as missing for fast
2796 * retransmit as described in Section 7.2.4 and if no retransmit
2797 * timer is running for the destination address to which the DATA
2798 * chunk was originally transmitted, then T3-rtx is started for
2799 * that destination address.
2800 *
2801 * Verification Tag: 8.5 Verification Tag [Normal verification]
2802 *
2803 * Inputs
2804 * (endpoint, asoc, chunk)
2805 *
2806 * Outputs
2807 * (asoc, reply_msg, msg_up, timers, counters)
2808 *
2809 * The return value is the disposition of the chunk.
2810 */
2811sctp_disposition_t sctp_sf_eat_sack_6_2(const struct sctp_endpoint *ep,
2812 const struct sctp_association *asoc,
2813 const sctp_subtype_t type,
2814 void *arg,
2815 sctp_cmd_seq_t *commands)
2816{
2817 struct sctp_chunk *chunk = arg;
2818 sctp_sackhdr_t *sackh;
2819 __u32 ctsn;
2820
2821 if (!sctp_vtag_verify(chunk, asoc))
2822 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2823
2824 /* Make sure that the SACK chunk has a valid length. */
2825 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_sack_chunk_t)))
2826 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
2827 commands);
2828
2829 /* Pull the SACK chunk from the data buffer */
2830 sackh = sctp_sm_pull_sack(chunk);
2831 /* Was this a bogus SACK? */
2832 if (!sackh)
2833 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2834 chunk->subh.sack_hdr = sackh;
2835 ctsn = ntohl(sackh->cum_tsn_ack);
2836
2837 /* i) If Cumulative TSN Ack is less than the Cumulative TSN
2838 * Ack Point, then drop the SACK. Since Cumulative TSN
2839 * Ack is monotonically increasing, a SACK whose
2840 * Cumulative TSN Ack is less than the Cumulative TSN Ack
2841 * Point indicates an out-of-order SACK.
2842 */
2843 if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
2844 SCTP_DEBUG_PRINTK("ctsn %x\n", ctsn);
2845 SCTP_DEBUG_PRINTK("ctsn_ack_point %x\n", asoc->ctsn_ack_point);
2846 return SCTP_DISPOSITION_DISCARD;
2847 }
2848
2849 /* Return this SACK for further processing. */
2850 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_SACK, SCTP_SACKH(sackh));
2851
2852 /* Note: We do the rest of the work on the PROCESS_SACK
2853 * sideeffect.
2854 */
2855 return SCTP_DISPOSITION_CONSUME;
2856}
2857
2858/*
2859 * Generate an ABORT in response to a packet.
2860 *
2861 * Section: 8.4 Handle "Out of the blue" Packets
2862 *
2863 * 8) The receiver should respond to the sender of the OOTB packet
2864 * with an ABORT. When sending the ABORT, the receiver of the
2865 * OOTB packet MUST fill in the Verification Tag field of the
2866 * outbound packet with the value found in the Verification Tag
2867 * field of the OOTB packet and set the T-bit in the Chunk Flags
2868 * to indicate that no TCB was found. After sending this ABORT,
2869 * the receiver of the OOTB packet shall discard the OOTB packet
2870 * and take no further action.
2871 *
2872 * Verification Tag:
2873 *
2874 * The return value is the disposition of the chunk.
2875*/
2876sctp_disposition_t sctp_sf_tabort_8_4_8(const struct sctp_endpoint *ep,
2877 const struct sctp_association *asoc,
2878 const sctp_subtype_t type,
2879 void *arg,
2880 sctp_cmd_seq_t *commands)
2881{
2882 struct sctp_packet *packet = NULL;
2883 struct sctp_chunk *chunk = arg;
2884 struct sctp_chunk *abort;
2885
2886 packet = sctp_ootb_pkt_new(asoc, chunk);
2887
2888 if (packet) {
2889 /* Make an ABORT. The T bit will be set if the asoc
2890 * is NULL.
2891 */
2892 abort = sctp_make_abort(asoc, chunk, 0);
2893 if (!abort) {
2894 sctp_ootb_pkt_free(packet);
2895 return SCTP_DISPOSITION_NOMEM;
2896 }
2897
2898 /* Set the skb to the belonging sock for accounting. */
2899 abort->skb->sk = ep->base.sk;
2900
2901 sctp_packet_append_chunk(packet, abort);
2902
2903 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
2904 SCTP_PACKET(packet));
2905
2906 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
2907
2908 return SCTP_DISPOSITION_CONSUME;
2909 }
2910
2911 return SCTP_DISPOSITION_NOMEM;
2912}
2913
2914/*
2915 * Received an ERROR chunk from peer. Generate SCTP_REMOTE_ERROR
2916 * event as ULP notification for each cause included in the chunk.
2917 *
2918 * API 5.3.1.3 - SCTP_REMOTE_ERROR
2919 *
2920 * The return value is the disposition of the chunk.
2921*/
2922sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep,
2923 const struct sctp_association *asoc,
2924 const sctp_subtype_t type,
2925 void *arg,
2926 sctp_cmd_seq_t *commands)
2927{
2928 struct sctp_chunk *chunk = arg;
2929 struct sctp_ulpevent *ev;
2930
2931 if (!sctp_vtag_verify(chunk, asoc))
2932 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2933
2934 /* Make sure that the ERROR chunk has a valid length. */
2935 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_operr_chunk_t)))
2936 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
2937 commands);
2938
2939 while (chunk->chunk_end > chunk->skb->data) {
2940 ev = sctp_ulpevent_make_remote_error(asoc, chunk, 0,
2941 GFP_ATOMIC);
2942 if (!ev)
2943 goto nomem;
2944
2945 if (!sctp_add_cmd(commands, SCTP_CMD_EVENT_ULP,
2946 SCTP_ULPEVENT(ev))) {
2947 sctp_ulpevent_free(ev);
2948 goto nomem;
2949 }
2950
2951 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,
2952 SCTP_CHUNK(chunk));
2953 }
2954 return SCTP_DISPOSITION_CONSUME;
2955
2956nomem:
2957 return SCTP_DISPOSITION_NOMEM;
2958}
2959
2960/*
2961 * Process an inbound SHUTDOWN ACK.
2962 *
2963 * From Section 9.2:
2964 * Upon the receipt of the SHUTDOWN ACK, the SHUTDOWN sender shall
2965 * stop the T2-shutdown timer, send a SHUTDOWN COMPLETE chunk to its
2966 * peer, and remove all record of the association.
2967 *
2968 * The return value is the disposition.
2969 */
2970sctp_disposition_t sctp_sf_do_9_2_final(const struct sctp_endpoint *ep,
2971 const struct sctp_association *asoc,
2972 const sctp_subtype_t type,
2973 void *arg,
2974 sctp_cmd_seq_t *commands)
2975{
2976 struct sctp_chunk *chunk = arg;
2977 struct sctp_chunk *reply;
2978 struct sctp_ulpevent *ev;
2979
2980 if (!sctp_vtag_verify(chunk, asoc))
2981 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2982
2983 /* Make sure that the SHUTDOWN_ACK chunk has a valid length. */
2984 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
2985 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
2986 commands);
2987
2988 /* 10.2 H) SHUTDOWN COMPLETE notification
2989 *
2990 * When SCTP completes the shutdown procedures (section 9.2) this
2991 * notification is passed to the upper layer.
2992 */
2993 ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_SHUTDOWN_COMP,
2994 0, 0, 0, GFP_ATOMIC);
2995 if (!ev)
2996 goto nomem;
2997
2998 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
2999
3000 /* Upon the receipt of the SHUTDOWN ACK, the SHUTDOWN sender shall
3001 * stop the T2-shutdown timer,
3002 */
3003 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3004 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
3005
3006 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3007 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
3008
3009 /* ...send a SHUTDOWN COMPLETE chunk to its peer, */
3010 reply = sctp_make_shutdown_complete(asoc, chunk);
3011 if (!reply)
3012 goto nomem;
3013
3014 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
3015 SCTP_STATE(SCTP_STATE_CLOSED));
3016 SCTP_INC_STATS(SCTP_MIB_SHUTDOWNS);
3017 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
3018 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
3019
3020 /* ...and remove all record of the association. */
3021 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
3022 return SCTP_DISPOSITION_DELETE_TCB;
3023
3024nomem:
3025 return SCTP_DISPOSITION_NOMEM;
3026}
3027
3028/*
3029 * RFC 2960, 8.4 - Handle "Out of the blue" Packets
3030 * 5) If the packet contains a SHUTDOWN ACK chunk, the receiver should
3031 * respond to the sender of the OOTB packet with a SHUTDOWN COMPLETE.
3032 * When sending the SHUTDOWN COMPLETE, the receiver of the OOTB
3033 * packet must fill in the Verification Tag field of the outbound
3034 * packet with the Verification Tag received in the SHUTDOWN ACK and
3035 * set the T-bit in the Chunk Flags to indicate that no TCB was
3036 * found. Otherwise,
3037 *
3038 * 8) The receiver should respond to the sender of the OOTB packet with
3039 * an ABORT. When sending the ABORT, the receiver of the OOTB packet
3040 * MUST fill in the Verification Tag field of the outbound packet
3041 * with the value found in the Verification Tag field of the OOTB
3042 * packet and set the T-bit in the Chunk Flags to indicate that no
3043 * TCB was found. After sending this ABORT, the receiver of the OOTB
3044 * packet shall discard the OOTB packet and take no further action.
3045 */
3046sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep,
3047 const struct sctp_association *asoc,
3048 const sctp_subtype_t type,
3049 void *arg,
3050 sctp_cmd_seq_t *commands)
3051{
3052 struct sctp_chunk *chunk = arg;
3053 struct sk_buff *skb = chunk->skb;
3054 sctp_chunkhdr_t *ch;
3055 __u8 *ch_end;
3056 int ootb_shut_ack = 0;
3057
3058 SCTP_INC_STATS(SCTP_MIB_OUTOFBLUES);
3059
3060 ch = (sctp_chunkhdr_t *) chunk->chunk_hdr;
3061 do {
3062 /* Break out if chunk length is less then minimal. */
3063 if (ntohs(ch->length) < sizeof(sctp_chunkhdr_t))
3064 break;
3065
3066 ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length));
3067
3068 if (SCTP_CID_SHUTDOWN_ACK == ch->type)
3069 ootb_shut_ack = 1;
3070
3071 /* RFC 2960, Section 3.3.7
3072 * Moreover, under any circumstances, an endpoint that
3073 * receives an ABORT MUST NOT respond to that ABORT by
3074 * sending an ABORT of its own.
3075 */
3076 if (SCTP_CID_ABORT == ch->type)
3077 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3078
3079 ch = (sctp_chunkhdr_t *) ch_end;
3080 } while (ch_end < skb->tail);
3081
3082 if (ootb_shut_ack)
3083 sctp_sf_shut_8_4_5(ep, asoc, type, arg, commands);
3084 else
3085 sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
3086
3087 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3088}
3089
3090/*
3091 * Handle an "Out of the blue" SHUTDOWN ACK.
3092 *
3093 * Section: 8.4 5)
3094 * 5) If the packet contains a SHUTDOWN ACK chunk, the receiver should
3095 * respond to the sender of the OOTB packet with a SHUTDOWN COMPLETE.
3096 * When sending the SHUTDOWN COMPLETE, the receiver of the OOTB packet
3097 * must fill in the Verification Tag field of the outbound packet with
3098 * the Verification Tag received in the SHUTDOWN ACK and set the
3099 * T-bit in the Chunk Flags to indicate that no TCB was found.
3100 *
3101 * Inputs
3102 * (endpoint, asoc, type, arg, commands)
3103 *
3104 * Outputs
3105 * (sctp_disposition_t)
3106 *
3107 * The return value is the disposition of the chunk.
3108 */
3109static sctp_disposition_t sctp_sf_shut_8_4_5(const struct sctp_endpoint *ep,
3110 const struct sctp_association *asoc,
3111 const sctp_subtype_t type,
3112 void *arg,
3113 sctp_cmd_seq_t *commands)
3114{
3115 struct sctp_packet *packet = NULL;
3116 struct sctp_chunk *chunk = arg;
3117 struct sctp_chunk *shut;
3118
3119 packet = sctp_ootb_pkt_new(asoc, chunk);
3120
3121 if (packet) {
3122 /* Make an SHUTDOWN_COMPLETE.
3123 * The T bit will be set if the asoc is NULL.
3124 */
3125 shut = sctp_make_shutdown_complete(asoc, chunk);
3126 if (!shut) {
3127 sctp_ootb_pkt_free(packet);
3128 return SCTP_DISPOSITION_NOMEM;
3129 }
3130
3131 /* Set the skb to the belonging sock for accounting. */
3132 shut->skb->sk = ep->base.sk;
3133
3134 sctp_packet_append_chunk(packet, shut);
3135
3136 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
3137 SCTP_PACKET(packet));
3138
3139 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
3140
3141 /* If the chunk length is invalid, we don't want to process
3142 * the reset of the packet.
3143 */
3144 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
3145 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3146
3147 return SCTP_DISPOSITION_CONSUME;
3148 }
3149
3150 return SCTP_DISPOSITION_NOMEM;
3151}
3152
3153/*
3154 * Handle SHUTDOWN ACK in COOKIE_ECHOED or COOKIE_WAIT state.
3155 *
3156 * Verification Tag: 8.5.1 E) Rules for packet carrying a SHUTDOWN ACK
3157 * If the receiver is in COOKIE-ECHOED or COOKIE-WAIT state the
3158 * procedures in section 8.4 SHOULD be followed, in other words it
3159 * should be treated as an Out Of The Blue packet.
3160 * [This means that we do NOT check the Verification Tag on these
3161 * chunks. --piggy ]
3162 *
3163 */
3164sctp_disposition_t sctp_sf_do_8_5_1_E_sa(const struct sctp_endpoint *ep,
3165 const struct sctp_association *asoc,
3166 const sctp_subtype_t type,
3167 void *arg,
3168 sctp_cmd_seq_t *commands)
3169{
3170 /* Although we do have an association in this case, it corresponds
3171 * to a restarted association. So the packet is treated as an OOTB
3172 * packet and the state function that handles OOTB SHUTDOWN_ACK is
3173 * called with a NULL association.
3174 */
3175 return sctp_sf_shut_8_4_5(ep, NULL, type, arg, commands);
3176}
3177
3178/* ADDIP Section 4.2 Upon reception of an ASCONF Chunk. */
3179sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep,
3180 const struct sctp_association *asoc,
3181 const sctp_subtype_t type, void *arg,
3182 sctp_cmd_seq_t *commands)
3183{
3184 struct sctp_chunk *chunk = arg;
3185 struct sctp_chunk *asconf_ack = NULL;
3186 sctp_addiphdr_t *hdr;
3187 __u32 serial;
3188
3189 if (!sctp_vtag_verify(chunk, asoc)) {
3190 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3191 SCTP_NULL());
3192 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3193 }
3194
3195 /* Make sure that the ASCONF ADDIP chunk has a valid length. */
3196 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_addip_chunk_t)))
3197 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3198 commands);
3199
3200 hdr = (sctp_addiphdr_t *)chunk->skb->data;
3201 serial = ntohl(hdr->serial);
3202
3203 /* ADDIP 4.2 C1) Compare the value of the serial number to the value
3204 * the endpoint stored in a new association variable
3205 * 'Peer-Serial-Number'.
3206 */
3207 if (serial == asoc->peer.addip_serial + 1) {
3208 /* ADDIP 4.2 C2) If the value found in the serial number is
3209 * equal to the ('Peer-Serial-Number' + 1), the endpoint MUST
3210 * do V1-V5.
3211 */
3212 asconf_ack = sctp_process_asconf((struct sctp_association *)
3213 asoc, chunk);
3214 if (!asconf_ack)
3215 return SCTP_DISPOSITION_NOMEM;
3216 } else if (serial == asoc->peer.addip_serial) {
3217 /* ADDIP 4.2 C3) If the value found in the serial number is
3218 * equal to the value stored in the 'Peer-Serial-Number'
3219 * IMPLEMENTATION NOTE: As an optimization a receiver may wish
3220 * to save the last ASCONF-ACK for some predetermined period of
3221 * time and instead of re-processing the ASCONF (with the same
3222 * serial number) it may just re-transmit the ASCONF-ACK.
3223 */
3224 if (asoc->addip_last_asconf_ack)
3225 asconf_ack = asoc->addip_last_asconf_ack;
3226 else
3227 return SCTP_DISPOSITION_DISCARD;
3228 } else {
3229 /* ADDIP 4.2 C4) Otherwise, the ASCONF Chunk is discarded since
3230 * it must be either a stale packet or from an attacker.
3231 */
3232 return SCTP_DISPOSITION_DISCARD;
3233 }
3234
3235 /* ADDIP 4.2 C5) In both cases C2 and C3 the ASCONF-ACK MUST be sent
3236 * back to the source address contained in the IP header of the ASCONF
3237 * being responded to.
3238 */
3239 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(asconf_ack));
3240
3241 return SCTP_DISPOSITION_CONSUME;
3242}
3243
3244/*
3245 * ADDIP Section 4.3 General rules for address manipulation
3246 * When building TLV parameters for the ASCONF Chunk that will add or
3247 * delete IP addresses the D0 to D13 rules should be applied:
3248 */
3249sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
3250 const struct sctp_association *asoc,
3251 const sctp_subtype_t type, void *arg,
3252 sctp_cmd_seq_t *commands)
3253{
3254 struct sctp_chunk *asconf_ack = arg;
3255 struct sctp_chunk *last_asconf = asoc->addip_last_asconf;
3256 struct sctp_chunk *abort;
3257 sctp_addiphdr_t *addip_hdr;
3258 __u32 sent_serial, rcvd_serial;
3259
3260 if (!sctp_vtag_verify(asconf_ack, asoc)) {
3261 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3262 SCTP_NULL());
3263 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3264 }
3265
3266 /* Make sure that the ADDIP chunk has a valid length. */
3267 if (!sctp_chunk_length_valid(asconf_ack, sizeof(sctp_addip_chunk_t)))
3268 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3269 commands);
3270
3271 addip_hdr = (sctp_addiphdr_t *)asconf_ack->skb->data;
3272 rcvd_serial = ntohl(addip_hdr->serial);
3273
3274 if (last_asconf) {
3275 addip_hdr = (sctp_addiphdr_t *)last_asconf->subh.addip_hdr;
3276 sent_serial = ntohl(addip_hdr->serial);
3277 } else {
3278 sent_serial = asoc->addip_serial - 1;
3279 }
3280
3281 /* D0) If an endpoint receives an ASCONF-ACK that is greater than or
3282 * equal to the next serial number to be used but no ASCONF chunk is
3283 * outstanding the endpoint MUST ABORT the association. Note that a
3284 * sequence number is greater than if it is no more than 2^^31-1
3285 * larger than the current sequence number (using serial arithmetic).
3286 */
3287 if (ADDIP_SERIAL_gte(rcvd_serial, sent_serial + 1) &&
3288 !(asoc->addip_last_asconf)) {
3289 abort = sctp_make_abort(asoc, asconf_ack,
3290 sizeof(sctp_errhdr_t));
3291 if (abort) {
3292 sctp_init_cause(abort, SCTP_ERROR_ASCONF_ACK, NULL, 0);
3293 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
3294 SCTP_CHUNK(abort));
3295 }
3296 /* We are going to ABORT, so we might as well stop
3297 * processing the rest of the chunks in the packet.
3298 */
3299 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3300 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
3301 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
3302 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
3303 SCTP_U32(SCTP_ERROR_ASCONF_ACK));
3304 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
3305 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
3306 return SCTP_DISPOSITION_ABORT;
3307 }
3308
3309 if ((rcvd_serial == sent_serial) && asoc->addip_last_asconf) {
3310 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3311 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
3312
3313 if (!sctp_process_asconf_ack((struct sctp_association *)asoc,
3314 asconf_ack))
3315 return SCTP_DISPOSITION_CONSUME;
3316
3317 abort = sctp_make_abort(asoc, asconf_ack,
3318 sizeof(sctp_errhdr_t));
3319 if (abort) {
3320 sctp_init_cause(abort, SCTP_ERROR_RSRC_LOW, NULL, 0);
3321 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
3322 SCTP_CHUNK(abort));
3323 }
3324 /* We are going to ABORT, so we might as well stop
3325 * processing the rest of the chunks in the packet.
3326 */
3327 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
3328 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
3329 SCTP_U32(SCTP_ERROR_ASCONF_ACK));
3330 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
3331 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
3332 return SCTP_DISPOSITION_ABORT;
3333 }
3334
3335 return SCTP_DISPOSITION_DISCARD;
3336}
3337
3338/*
3339 * PR-SCTP Section 3.6 Receiver Side Implementation of PR-SCTP
3340 *
3341 * When a FORWARD TSN chunk arrives, the data receiver MUST first update
3342 * its cumulative TSN point to the value carried in the FORWARD TSN
3343 * chunk, and then MUST further advance its cumulative TSN point locally
3344 * if possible.
3345 * After the above processing, the data receiver MUST stop reporting any
3346 * missing TSNs earlier than or equal to the new cumulative TSN point.
3347 *
3348 * Verification Tag: 8.5 Verification Tag [Normal verification]
3349 *
3350 * The return value is the disposition of the chunk.
3351 */
3352sctp_disposition_t sctp_sf_eat_fwd_tsn(const struct sctp_endpoint *ep,
3353 const struct sctp_association *asoc,
3354 const sctp_subtype_t type,
3355 void *arg,
3356 sctp_cmd_seq_t *commands)
3357{
3358 struct sctp_chunk *chunk = arg;
3359 struct sctp_fwdtsn_hdr *fwdtsn_hdr;
3360 __u16 len;
3361 __u32 tsn;
3362
3363 if (!sctp_vtag_verify(chunk, asoc)) {
3364 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3365 SCTP_NULL());
3366 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3367 }
3368
3369 /* Make sure that the FORWARD_TSN chunk has valid length. */
3370 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_fwdtsn_chunk)))
3371 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3372 commands);
3373
3374 fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data;
3375 chunk->subh.fwdtsn_hdr = fwdtsn_hdr;
3376 len = ntohs(chunk->chunk_hdr->length);
3377 len -= sizeof(struct sctp_chunkhdr);
3378 skb_pull(chunk->skb, len);
3379
3380 tsn = ntohl(fwdtsn_hdr->new_cum_tsn);
3381 SCTP_DEBUG_PRINTK("%s: TSN 0x%x.\n", __FUNCTION__, tsn);
3382
3383 /* The TSN is too high--silently discard the chunk and count on it
3384 * getting retransmitted later.
3385 */
3386 if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
3387 goto discard_noforce;
3388
3389 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
3390 if (len > sizeof(struct sctp_fwdtsn_hdr))
3391 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
3392 SCTP_CHUNK(chunk));
3393
3394 /* Count this as receiving DATA. */
3395 if (asoc->autoclose) {
3396 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
3397 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
3398 }
3399
3400 /* FIXME: For now send a SACK, but DATA processing may
3401 * send another.
3402 */
3403 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_NOFORCE());
3404 /* Start the SACK timer. */
3405 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
3406 SCTP_TO(SCTP_EVENT_TIMEOUT_SACK));
3407
3408 return SCTP_DISPOSITION_CONSUME;
3409
3410discard_noforce:
3411 return SCTP_DISPOSITION_DISCARD;
3412}
3413
3414sctp_disposition_t sctp_sf_eat_fwd_tsn_fast(
3415 const struct sctp_endpoint *ep,
3416 const struct sctp_association *asoc,
3417 const sctp_subtype_t type,
3418 void *arg,
3419 sctp_cmd_seq_t *commands)
3420{
3421 struct sctp_chunk *chunk = arg;
3422 struct sctp_fwdtsn_hdr *fwdtsn_hdr;
3423 __u16 len;
3424 __u32 tsn;
3425
3426 if (!sctp_vtag_verify(chunk, asoc)) {
3427 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3428 SCTP_NULL());
3429 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3430 }
3431
3432 /* Make sure that the FORWARD_TSN chunk has a valid length. */
3433 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_fwdtsn_chunk)))
3434 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3435 commands);
3436
3437 fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data;
3438 chunk->subh.fwdtsn_hdr = fwdtsn_hdr;
3439 len = ntohs(chunk->chunk_hdr->length);
3440 len -= sizeof(struct sctp_chunkhdr);
3441 skb_pull(chunk->skb, len);
3442
3443 tsn = ntohl(fwdtsn_hdr->new_cum_tsn);
3444 SCTP_DEBUG_PRINTK("%s: TSN 0x%x.\n", __FUNCTION__, tsn);
3445
3446 /* The TSN is too high--silently discard the chunk and count on it
3447 * getting retransmitted later.
3448 */
3449 if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
3450 goto gen_shutdown;
3451
3452 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
3453 if (len > sizeof(struct sctp_fwdtsn_hdr))
3454 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
3455 SCTP_CHUNK(chunk));
3456
3457 /* Go a head and force a SACK, since we are shutting down. */
3458gen_shutdown:
3459 /* Implementor's Guide.
3460 *
3461 * While in SHUTDOWN-SENT state, the SHUTDOWN sender MUST immediately
3462 * respond to each received packet containing one or more DATA chunk(s)
3463 * with a SACK, a SHUTDOWN chunk, and restart the T2-shutdown timer
3464 */
3465 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SHUTDOWN, SCTP_NULL());
3466 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
3467 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
3468 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
3469
3470 return SCTP_DISPOSITION_CONSUME;
3471}
3472
3473/*
3474 * Process an unknown chunk.
3475 *
3476 * Section: 3.2. Also, 2.1 in the implementor's guide.
3477 *
3478 * Chunk Types are encoded such that the highest-order two bits specify
3479 * the action that must be taken if the processing endpoint does not
3480 * recognize the Chunk Type.
3481 *
3482 * 00 - Stop processing this SCTP packet and discard it, do not process
3483 * any further chunks within it.
3484 *
3485 * 01 - Stop processing this SCTP packet and discard it, do not process
3486 * any further chunks within it, and report the unrecognized
3487 * chunk in an 'Unrecognized Chunk Type'.
3488 *
3489 * 10 - Skip this chunk and continue processing.
3490 *
3491 * 11 - Skip this chunk and continue processing, but report in an ERROR
3492 * Chunk using the 'Unrecognized Chunk Type' cause of error.
3493 *
3494 * The return value is the disposition of the chunk.
3495 */
3496sctp_disposition_t sctp_sf_unk_chunk(const struct sctp_endpoint *ep,
3497 const struct sctp_association *asoc,
3498 const sctp_subtype_t type,
3499 void *arg,
3500 sctp_cmd_seq_t *commands)
3501{
3502 struct sctp_chunk *unk_chunk = arg;
3503 struct sctp_chunk *err_chunk;
3504 sctp_chunkhdr_t *hdr;
3505
3506 SCTP_DEBUG_PRINTK("Processing the unknown chunk id %d.\n", type.chunk);
3507
3508 if (!sctp_vtag_verify(unk_chunk, asoc))
3509 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3510
3511 /* Make sure that the chunk has a valid length.
3512 * Since we don't know the chunk type, we use a general
3513 * chunkhdr structure to make a comparison.
3514 */
3515 if (!sctp_chunk_length_valid(unk_chunk, sizeof(sctp_chunkhdr_t)))
3516 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3517 commands);
3518
3519 switch (type.chunk & SCTP_CID_ACTION_MASK) {
3520 case SCTP_CID_ACTION_DISCARD:
3521 /* Discard the packet. */
3522 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3523 break;
3524 case SCTP_CID_ACTION_DISCARD_ERR:
3525 /* Discard the packet. */
3526 sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3527
3528 /* Generate an ERROR chunk as response. */
3529 hdr = unk_chunk->chunk_hdr;
3530 err_chunk = sctp_make_op_error(asoc, unk_chunk,
3531 SCTP_ERROR_UNKNOWN_CHUNK, hdr,
3532 WORD_ROUND(ntohs(hdr->length)));
3533 if (err_chunk) {
3534 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
3535 SCTP_CHUNK(err_chunk));
3536 }
3537 return SCTP_DISPOSITION_CONSUME;
3538 break;
3539 case SCTP_CID_ACTION_SKIP:
3540 /* Skip the chunk. */
3541 return SCTP_DISPOSITION_DISCARD;
3542 break;
3543 case SCTP_CID_ACTION_SKIP_ERR:
3544 /* Generate an ERROR chunk as response. */
3545 hdr = unk_chunk->chunk_hdr;
3546 err_chunk = sctp_make_op_error(asoc, unk_chunk,
3547 SCTP_ERROR_UNKNOWN_CHUNK, hdr,
3548 WORD_ROUND(ntohs(hdr->length)));
3549 if (err_chunk) {
3550 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
3551 SCTP_CHUNK(err_chunk));
3552 }
3553 /* Skip the chunk. */
3554 return SCTP_DISPOSITION_CONSUME;
3555 break;
3556 default:
3557 break;
3558 }
3559
3560 return SCTP_DISPOSITION_DISCARD;
3561}
3562
3563/*
3564 * Discard the chunk.
3565 *
3566 * Section: 0.2, 5.2.3, 5.2.5, 5.2.6, 6.0, 8.4.6, 8.5.1c, 9.2
3567 * [Too numerous to mention...]
3568 * Verification Tag: No verification needed.
3569 * Inputs
3570 * (endpoint, asoc, chunk)
3571 *
3572 * Outputs
3573 * (asoc, reply_msg, msg_up, timers, counters)
3574 *
3575 * The return value is the disposition of the chunk.
3576 */
3577sctp_disposition_t sctp_sf_discard_chunk(const struct sctp_endpoint *ep,
3578 const struct sctp_association *asoc,
3579 const sctp_subtype_t type,
3580 void *arg,
3581 sctp_cmd_seq_t *commands)
3582{
3583 SCTP_DEBUG_PRINTK("Chunk %d is discarded\n", type.chunk);
3584 return SCTP_DISPOSITION_DISCARD;
3585}
3586
3587/*
3588 * Discard the whole packet.
3589 *
3590 * Section: 8.4 2)
3591 *
3592 * 2) If the OOTB packet contains an ABORT chunk, the receiver MUST
3593 * silently discard the OOTB packet and take no further action.
3594 * Otherwise,
3595 *
3596 * Verification Tag: No verification necessary
3597 *
3598 * Inputs
3599 * (endpoint, asoc, chunk)
3600 *
3601 * Outputs
3602 * (asoc, reply_msg, msg_up, timers, counters)
3603 *
3604 * The return value is the disposition of the chunk.
3605 */
3606sctp_disposition_t sctp_sf_pdiscard(const struct sctp_endpoint *ep,
3607 const struct sctp_association *asoc,
3608 const sctp_subtype_t type,
3609 void *arg,
3610 sctp_cmd_seq_t *commands)
3611{
3612 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
3613
3614 return SCTP_DISPOSITION_CONSUME;
3615}
3616
3617
3618/*
3619 * The other end is violating protocol.
3620 *
3621 * Section: Not specified
3622 * Verification Tag: Not specified
3623 * Inputs
3624 * (endpoint, asoc, chunk)
3625 *
3626 * Outputs
3627 * (asoc, reply_msg, msg_up, timers, counters)
3628 *
3629 * We simply tag the chunk as a violation. The state machine will log
3630 * the violation and continue.
3631 */
3632sctp_disposition_t sctp_sf_violation(const struct sctp_endpoint *ep,
3633 const struct sctp_association *asoc,
3634 const sctp_subtype_t type,
3635 void *arg,
3636 sctp_cmd_seq_t *commands)
3637{
3638 return SCTP_DISPOSITION_VIOLATION;
3639}
3640
3641
3642/*
3643 * Handle a protocol violation when the chunk length is invalid.
3644 * "Invalid" length is identified as smaller then the minimal length a
3645 * given chunk can be. For example, a SACK chunk has invalid length
3646 * if it's length is set to be smaller then the size of sctp_sack_chunk_t.
3647 *
3648 * We inform the other end by sending an ABORT with a Protocol Violation
3649 * error code.
3650 *
3651 * Section: Not specified
3652 * Verification Tag: Nothing to do
3653 * Inputs
3654 * (endpoint, asoc, chunk)
3655 *
3656 * Outputs
3657 * (reply_msg, msg_up, counters)
3658 *
3659 * Generate an ABORT chunk and terminate the association.
3660 */
3661sctp_disposition_t sctp_sf_violation_chunklen(const struct sctp_endpoint *ep,
3662 const struct sctp_association *asoc,
3663 const sctp_subtype_t type,
3664 void *arg,
3665 sctp_cmd_seq_t *commands)
3666{
3667 struct sctp_chunk *chunk = arg;
3668 struct sctp_chunk *abort = NULL;
3669 char err_str[]="The following chunk had invalid length:";
3670
3671 /* Make the abort chunk. */
3672 abort = sctp_make_abort_violation(asoc, chunk, err_str,
3673 sizeof(err_str));
3674 if (!abort)
3675 goto nomem;
3676
3677 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
3678 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
3679
3680 if (asoc->state <= SCTP_STATE_COOKIE_ECHOED) {
3681 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3682 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
3683 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
3684 SCTP_U32(SCTP_ERROR_PROTO_VIOLATION));
3685 } else {
3686 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
3687 SCTP_U32(SCTP_ERROR_PROTO_VIOLATION));
3688 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
3689 }
3690
3691 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
3692
3693 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
3694
3695 return SCTP_DISPOSITION_ABORT;
3696
3697nomem:
3698 return SCTP_DISPOSITION_NOMEM;
3699}
3700
3701/***************************************************************************
3702 * These are the state functions for handling primitive (Section 10) events.
3703 ***************************************************************************/
3704/*
3705 * sctp_sf_do_prm_asoc
3706 *
3707 * Section: 10.1 ULP-to-SCTP
3708 * B) Associate
3709 *
3710 * Format: ASSOCIATE(local SCTP instance name, destination transport addr,
3711 * outbound stream count)
3712 * -> association id [,destination transport addr list] [,outbound stream
3713 * count]
3714 *
3715 * This primitive allows the upper layer to initiate an association to a
3716 * specific peer endpoint.
3717 *
3718 * The peer endpoint shall be specified by one of the transport addresses
3719 * which defines the endpoint (see Section 1.4). If the local SCTP
3720 * instance has not been initialized, the ASSOCIATE is considered an
3721 * error.
3722 * [This is not relevant for the kernel implementation since we do all
3723 * initialization at boot time. It we hadn't initialized we wouldn't
3724 * get anywhere near this code.]
3725 *
3726 * An association id, which is a local handle to the SCTP association,
3727 * will be returned on successful establishment of the association. If
3728 * SCTP is not able to open an SCTP association with the peer endpoint,
3729 * an error is returned.
3730 * [In the kernel implementation, the struct sctp_association needs to
3731 * be created BEFORE causing this primitive to run.]
3732 *
3733 * Other association parameters may be returned, including the
3734 * complete destination transport addresses of the peer as well as the
3735 * outbound stream count of the local endpoint. One of the transport
3736 * address from the returned destination addresses will be selected by
3737 * the local endpoint as default primary path for sending SCTP packets
3738 * to this peer. The returned "destination transport addr list" can
3739 * be used by the ULP to change the default primary path or to force
3740 * sending a packet to a specific transport address. [All of this
3741 * stuff happens when the INIT ACK arrives. This is a NON-BLOCKING
3742 * function.]
3743 *
3744 * Mandatory attributes:
3745 *
3746 * o local SCTP instance name - obtained from the INITIALIZE operation.
3747 * [This is the argument asoc.]
3748 * o destination transport addr - specified as one of the transport
3749 * addresses of the peer endpoint with which the association is to be
3750 * established.
3751 * [This is asoc->peer.active_path.]
3752 * o outbound stream count - the number of outbound streams the ULP
3753 * would like to open towards this peer endpoint.
3754 * [BUG: This is not currently implemented.]
3755 * Optional attributes:
3756 *
3757 * None.
3758 *
3759 * The return value is a disposition.
3760 */
3761sctp_disposition_t sctp_sf_do_prm_asoc(const struct sctp_endpoint *ep,
3762 const struct sctp_association *asoc,
3763 const sctp_subtype_t type,
3764 void *arg,
3765 sctp_cmd_seq_t *commands)
3766{
3767 struct sctp_chunk *repl;
3768
3769 /* The comment below says that we enter COOKIE-WAIT AFTER
3770 * sending the INIT, but that doesn't actually work in our
3771 * implementation...
3772 */
3773 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
3774 SCTP_STATE(SCTP_STATE_COOKIE_WAIT));
3775
3776 /* RFC 2960 5.1 Normal Establishment of an Association
3777 *
3778 * A) "A" first sends an INIT chunk to "Z". In the INIT, "A"
3779 * must provide its Verification Tag (Tag_A) in the Initiate
3780 * Tag field. Tag_A SHOULD be a random number in the range of
3781 * 1 to 4294967295 (see 5.3.1 for Tag value selection). ...
3782 */
3783
3784 repl = sctp_make_init(asoc, &asoc->base.bind_addr, GFP_ATOMIC, 0);
3785 if (!repl)
3786 goto nomem;
3787
3788 /* Cast away the const modifier, as we want to just
3789 * rerun it through as a sideffect.
3790 */
3791 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC,
3792 SCTP_ASOC((struct sctp_association *) asoc));
3793
3794 /* After sending the INIT, "A" starts the T1-init timer and
3795 * enters the COOKIE-WAIT state.
3796 */
3797 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
3798 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
3799 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
3800 return SCTP_DISPOSITION_CONSUME;
3801
3802nomem:
3803 return SCTP_DISPOSITION_NOMEM;
3804}
3805
3806/*
3807 * Process the SEND primitive.
3808 *
3809 * Section: 10.1 ULP-to-SCTP
3810 * E) Send
3811 *
3812 * Format: SEND(association id, buffer address, byte count [,context]
3813 * [,stream id] [,life time] [,destination transport address]
3814 * [,unorder flag] [,no-bundle flag] [,payload protocol-id] )
3815 * -> result
3816 *
3817 * This is the main method to send user data via SCTP.
3818 *
3819 * Mandatory attributes:
3820 *
3821 * o association id - local handle to the SCTP association
3822 *
3823 * o buffer address - the location where the user message to be
3824 * transmitted is stored;
3825 *
3826 * o byte count - The size of the user data in number of bytes;
3827 *
3828 * Optional attributes:
3829 *
3830 * o context - an optional 32 bit integer that will be carried in the
3831 * sending failure notification to the ULP if the transportation of
3832 * this User Message fails.
3833 *
3834 * o stream id - to indicate which stream to send the data on. If not
3835 * specified, stream 0 will be used.
3836 *
3837 * o life time - specifies the life time of the user data. The user data
3838 * will not be sent by SCTP after the life time expires. This
3839 * parameter can be used to avoid efforts to transmit stale
3840 * user messages. SCTP notifies the ULP if the data cannot be
3841 * initiated to transport (i.e. sent to the destination via SCTP's
3842 * send primitive) within the life time variable. However, the
3843 * user data will be transmitted if SCTP has attempted to transmit a
3844 * chunk before the life time expired.
3845 *
3846 * o destination transport address - specified as one of the destination
3847 * transport addresses of the peer endpoint to which this packet
3848 * should be sent. Whenever possible, SCTP should use this destination
3849 * transport address for sending the packets, instead of the current
3850 * primary path.
3851 *
3852 * o unorder flag - this flag, if present, indicates that the user
3853 * would like the data delivered in an unordered fashion to the peer
3854 * (i.e., the U flag is set to 1 on all DATA chunks carrying this
3855 * message).
3856 *
3857 * o no-bundle flag - instructs SCTP not to bundle this user data with
3858 * other outbound DATA chunks. SCTP MAY still bundle even when
3859 * this flag is present, when faced with network congestion.
3860 *
3861 * o payload protocol-id - A 32 bit unsigned integer that is to be
3862 * passed to the peer indicating the type of payload protocol data
3863 * being transmitted. This value is passed as opaque data by SCTP.
3864 *
3865 * The return value is the disposition.
3866 */
3867sctp_disposition_t sctp_sf_do_prm_send(const struct sctp_endpoint *ep,
3868 const struct sctp_association *asoc,
3869 const sctp_subtype_t type,
3870 void *arg,
3871 sctp_cmd_seq_t *commands)
3872{
3873 struct sctp_chunk *chunk = arg;
3874
3875 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(chunk));
3876 return SCTP_DISPOSITION_CONSUME;
3877}
3878
3879/*
3880 * Process the SHUTDOWN primitive.
3881 *
3882 * Section: 10.1:
3883 * C) Shutdown
3884 *
3885 * Format: SHUTDOWN(association id)
3886 * -> result
3887 *
3888 * Gracefully closes an association. Any locally queued user data
3889 * will be delivered to the peer. The association will be terminated only
3890 * after the peer acknowledges all the SCTP packets sent. A success code
3891 * will be returned on successful termination of the association. If
3892 * attempting to terminate the association results in a failure, an error
3893 * code shall be returned.
3894 *
3895 * Mandatory attributes:
3896 *
3897 * o association id - local handle to the SCTP association
3898 *
3899 * Optional attributes:
3900 *
3901 * None.
3902 *
3903 * The return value is the disposition.
3904 */
3905sctp_disposition_t sctp_sf_do_9_2_prm_shutdown(
3906 const struct sctp_endpoint *ep,
3907 const struct sctp_association *asoc,
3908 const sctp_subtype_t type,
3909 void *arg,
3910 sctp_cmd_seq_t *commands)
3911{
3912 int disposition;
3913
3914 /* From 9.2 Shutdown of an Association
3915 * Upon receipt of the SHUTDOWN primitive from its upper
3916 * layer, the endpoint enters SHUTDOWN-PENDING state and
3917 * remains there until all outstanding data has been
3918 * acknowledged by its peer. The endpoint accepts no new data
3919 * from its upper layer, but retransmits data to the far end
3920 * if necessary to fill gaps.
3921 */
3922 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
3923 SCTP_STATE(SCTP_STATE_SHUTDOWN_PENDING));
3924
3925 /* sctpimpguide-05 Section 2.12.2
3926 * The sender of the SHUTDOWN MAY also start an overall guard timer
3927 * 'T5-shutdown-guard' to bound the overall time for shutdown sequence.
3928 */
3929 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
3930 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
3931
3932 disposition = SCTP_DISPOSITION_CONSUME;
3933 if (sctp_outq_is_empty(&asoc->outqueue)) {
3934 disposition = sctp_sf_do_9_2_start_shutdown(ep, asoc, type,
3935 arg, commands);
3936 }
3937 return disposition;
3938}
3939
3940/*
3941 * Process the ABORT primitive.
3942 *
3943 * Section: 10.1:
3944 * C) Abort
3945 *
3946 * Format: Abort(association id [, cause code])
3947 * -> result
3948 *
3949 * Ungracefully closes an association. Any locally queued user data
3950 * will be discarded and an ABORT chunk is sent to the peer. A success code
3951 * will be returned on successful abortion of the association. If
3952 * attempting to abort the association results in a failure, an error
3953 * code shall be returned.
3954 *
3955 * Mandatory attributes:
3956 *
3957 * o association id - local handle to the SCTP association
3958 *
3959 * Optional attributes:
3960 *
3961 * o cause code - reason of the abort to be passed to the peer
3962 *
3963 * None.
3964 *
3965 * The return value is the disposition.
3966 */
3967sctp_disposition_t sctp_sf_do_9_1_prm_abort(
3968 const struct sctp_endpoint *ep,
3969 const struct sctp_association *asoc,
3970 const sctp_subtype_t type,
3971 void *arg,
3972 sctp_cmd_seq_t *commands)
3973{
3974 /* From 9.1 Abort of an Association
3975 * Upon receipt of the ABORT primitive from its upper
3976 * layer, the endpoint enters CLOSED state and
3977 * discard all outstanding data has been
3978 * acknowledged by its peer. The endpoint accepts no new data
3979 * from its upper layer, but retransmits data to the far end
3980 * if necessary to fill gaps.
3981 */
3982 struct msghdr *msg = arg;
3983 struct sctp_chunk *abort;
3984 sctp_disposition_t retval;
3985
3986 retval = SCTP_DISPOSITION_CONSUME;
3987
3988 /* Generate ABORT chunk to send the peer. */
3989 abort = sctp_make_abort_user(asoc, NULL, msg);
3990 if (!abort)
3991 retval = SCTP_DISPOSITION_NOMEM;
3992 else
3993 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
3994
3995 /* Even if we can't send the ABORT due to low memory delete the
3996 * TCB. This is a departure from our typical NOMEM handling.
3997 */
3998
3999 /* Delete the established association. */
4000 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
4001 SCTP_U32(SCTP_ERROR_USER_ABORT));
4002
4003 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
4004 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
4005
4006 return retval;
4007}
4008
4009/* We tried an illegal operation on an association which is closed. */
4010sctp_disposition_t sctp_sf_error_closed(const struct sctp_endpoint *ep,
4011 const struct sctp_association *asoc,
4012 const sctp_subtype_t type,
4013 void *arg,
4014 sctp_cmd_seq_t *commands)
4015{
4016 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_ERROR, SCTP_ERROR(-EINVAL));
4017 return SCTP_DISPOSITION_CONSUME;
4018}
4019
4020/* We tried an illegal operation on an association which is shutting
4021 * down.
4022 */
4023sctp_disposition_t sctp_sf_error_shutdown(const struct sctp_endpoint *ep,
4024 const struct sctp_association *asoc,
4025 const sctp_subtype_t type,
4026 void *arg,
4027 sctp_cmd_seq_t *commands)
4028{
4029 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_ERROR,
4030 SCTP_ERROR(-ESHUTDOWN));
4031 return SCTP_DISPOSITION_CONSUME;
4032}
4033
4034/*
4035 * sctp_cookie_wait_prm_shutdown
4036 *
4037 * Section: 4 Note: 2
4038 * Verification Tag:
4039 * Inputs
4040 * (endpoint, asoc)
4041 *
4042 * The RFC does not explicitly address this issue, but is the route through the
4043 * state table when someone issues a shutdown while in COOKIE_WAIT state.
4044 *
4045 * Outputs
4046 * (timers)
4047 */
4048sctp_disposition_t sctp_sf_cookie_wait_prm_shutdown(
4049 const struct sctp_endpoint *ep,
4050 const struct sctp_association *asoc,
4051 const sctp_subtype_t type,
4052 void *arg,
4053 sctp_cmd_seq_t *commands)
4054{
4055 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4056 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
4057
4058 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
4059 SCTP_STATE(SCTP_STATE_CLOSED));
4060
4061 SCTP_INC_STATS(SCTP_MIB_SHUTDOWNS);
4062
4063 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
4064
4065 return SCTP_DISPOSITION_DELETE_TCB;
4066}
4067
4068/*
4069 * sctp_cookie_echoed_prm_shutdown
4070 *
4071 * Section: 4 Note: 2
4072 * Verification Tag:
4073 * Inputs
4074 * (endpoint, asoc)
4075 *
4076 * The RFC does not explcitly address this issue, but is the route through the
4077 * state table when someone issues a shutdown while in COOKIE_ECHOED state.
4078 *
4079 * Outputs
4080 * (timers)
4081 */
4082sctp_disposition_t sctp_sf_cookie_echoed_prm_shutdown(
4083 const struct sctp_endpoint *ep,
4084 const struct sctp_association *asoc,
4085 const sctp_subtype_t type,
4086 void *arg, sctp_cmd_seq_t *commands)
4087{
4088 /* There is a single T1 timer, so we should be able to use
4089 * common function with the COOKIE-WAIT state.
4090 */
4091 return sctp_sf_cookie_wait_prm_shutdown(ep, asoc, type, arg, commands);
4092}
4093
4094/*
4095 * sctp_sf_cookie_wait_prm_abort
4096 *
4097 * Section: 4 Note: 2
4098 * Verification Tag:
4099 * Inputs
4100 * (endpoint, asoc)
4101 *
4102 * The RFC does not explicitly address this issue, but is the route through the
4103 * state table when someone issues an abort while in COOKIE_WAIT state.
4104 *
4105 * Outputs
4106 * (timers)
4107 */
4108sctp_disposition_t sctp_sf_cookie_wait_prm_abort(
4109 const struct sctp_endpoint *ep,
4110 const struct sctp_association *asoc,
4111 const sctp_subtype_t type,
4112 void *arg,
4113 sctp_cmd_seq_t *commands)
4114{
4115 struct msghdr *msg = arg;
4116 struct sctp_chunk *abort;
4117 sctp_disposition_t retval;
4118
4119 /* Stop T1-init timer */
4120 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4121 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
4122 retval = SCTP_DISPOSITION_CONSUME;
4123
4124 /* Generate ABORT chunk to send the peer */
4125 abort = sctp_make_abort_user(asoc, NULL, msg);
4126 if (!abort)
4127 retval = SCTP_DISPOSITION_NOMEM;
4128 else
4129 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
4130
4131 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
4132 SCTP_STATE(SCTP_STATE_CLOSED));
4133
4134 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
4135
4136 /* Even if we can't send the ABORT due to low memory delete the
4137 * TCB. This is a departure from our typical NOMEM handling.
4138 */
4139
4140 /* Delete the established association. */
4141 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
4142 SCTP_U32(SCTP_ERROR_USER_ABORT));
4143
4144 return retval;
4145}
4146
4147/*
4148 * sctp_sf_cookie_echoed_prm_abort
4149 *
4150 * Section: 4 Note: 3
4151 * Verification Tag:
4152 * Inputs
4153 * (endpoint, asoc)
4154 *
4155 * The RFC does not explcitly address this issue, but is the route through the
4156 * state table when someone issues an abort while in COOKIE_ECHOED state.
4157 *
4158 * Outputs
4159 * (timers)
4160 */
4161sctp_disposition_t sctp_sf_cookie_echoed_prm_abort(
4162 const struct sctp_endpoint *ep,
4163 const struct sctp_association *asoc,
4164 const sctp_subtype_t type,
4165 void *arg,
4166 sctp_cmd_seq_t *commands)
4167{
4168 /* There is a single T1 timer, so we should be able to use
4169 * common function with the COOKIE-WAIT state.
4170 */
4171 return sctp_sf_cookie_wait_prm_abort(ep, asoc, type, arg, commands);
4172}
4173
4174/*
4175 * sctp_sf_shutdown_pending_prm_abort
4176 *
4177 * Inputs
4178 * (endpoint, asoc)
4179 *
4180 * The RFC does not explicitly address this issue, but is the route through the
4181 * state table when someone issues an abort while in SHUTDOWN-PENDING state.
4182 *
4183 * Outputs
4184 * (timers)
4185 */
4186sctp_disposition_t sctp_sf_shutdown_pending_prm_abort(
4187 const struct sctp_endpoint *ep,
4188 const struct sctp_association *asoc,
4189 const sctp_subtype_t type,
4190 void *arg,
4191 sctp_cmd_seq_t *commands)
4192{
4193 /* Stop the T5-shutdown guard timer. */
4194 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4195 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
4196
4197 return sctp_sf_do_9_1_prm_abort(ep, asoc, type, arg, commands);
4198}
4199
4200/*
4201 * sctp_sf_shutdown_sent_prm_abort
4202 *
4203 * Inputs
4204 * (endpoint, asoc)
4205 *
4206 * The RFC does not explicitly address this issue, but is the route through the
4207 * state table when someone issues an abort while in SHUTDOWN-SENT state.
4208 *
4209 * Outputs
4210 * (timers)
4211 */
4212sctp_disposition_t sctp_sf_shutdown_sent_prm_abort(
4213 const struct sctp_endpoint *ep,
4214 const struct sctp_association *asoc,
4215 const sctp_subtype_t type,
4216 void *arg,
4217 sctp_cmd_seq_t *commands)
4218{
4219 /* Stop the T2-shutdown timer. */
4220 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4221 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
4222
4223 /* Stop the T5-shutdown guard timer. */
4224 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4225 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
4226
4227 return sctp_sf_do_9_1_prm_abort(ep, asoc, type, arg, commands);
4228}
4229
4230/*
4231 * sctp_sf_cookie_echoed_prm_abort
4232 *
4233 * Inputs
4234 * (endpoint, asoc)
4235 *
4236 * The RFC does not explcitly address this issue, but is the route through the
4237 * state table when someone issues an abort while in COOKIE_ECHOED state.
4238 *
4239 * Outputs
4240 * (timers)
4241 */
4242sctp_disposition_t sctp_sf_shutdown_ack_sent_prm_abort(
4243 const struct sctp_endpoint *ep,
4244 const struct sctp_association *asoc,
4245 const sctp_subtype_t type,
4246 void *arg,
4247 sctp_cmd_seq_t *commands)
4248{
4249 /* The same T2 timer, so we should be able to use
4250 * common function with the SHUTDOWN-SENT state.
4251 */
4252 return sctp_sf_shutdown_sent_prm_abort(ep, asoc, type, arg, commands);
4253}
4254
4255/*
4256 * Process the REQUESTHEARTBEAT primitive
4257 *
4258 * 10.1 ULP-to-SCTP
4259 * J) Request Heartbeat
4260 *
4261 * Format: REQUESTHEARTBEAT(association id, destination transport address)
4262 *
4263 * -> result
4264 *
4265 * Instructs the local endpoint to perform a HeartBeat on the specified
4266 * destination transport address of the given association. The returned
4267 * result should indicate whether the transmission of the HEARTBEAT
4268 * chunk to the destination address is successful.
4269 *
4270 * Mandatory attributes:
4271 *
4272 * o association id - local handle to the SCTP association
4273 *
4274 * o destination transport address - the transport address of the
4275 * association on which a heartbeat should be issued.
4276 */
4277sctp_disposition_t sctp_sf_do_prm_requestheartbeat(
4278 const struct sctp_endpoint *ep,
4279 const struct sctp_association *asoc,
4280 const sctp_subtype_t type,
4281 void *arg,
4282 sctp_cmd_seq_t *commands)
4283{
4284 return sctp_sf_heartbeat(ep, asoc, type, (struct sctp_transport *)arg,
4285 commands);
4286}
4287
4288/*
4289 * ADDIP Section 4.1 ASCONF Chunk Procedures
4290 * When an endpoint has an ASCONF signaled change to be sent to the
4291 * remote endpoint it should do A1 to A9
4292 */
4293sctp_disposition_t sctp_sf_do_prm_asconf(const struct sctp_endpoint *ep,
4294 const struct sctp_association *asoc,
4295 const sctp_subtype_t type,
4296 void *arg,
4297 sctp_cmd_seq_t *commands)
4298{
4299 struct sctp_chunk *chunk = arg;
4300
4301 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T4, SCTP_CHUNK(chunk));
4302 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
4303 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
4304 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(chunk));
4305 return SCTP_DISPOSITION_CONSUME;
4306}
4307
4308/*
4309 * Ignore the primitive event
4310 *
4311 * The return value is the disposition of the primitive.
4312 */
4313sctp_disposition_t sctp_sf_ignore_primitive(
4314 const struct sctp_endpoint *ep,
4315 const struct sctp_association *asoc,
4316 const sctp_subtype_t type,
4317 void *arg,
4318 sctp_cmd_seq_t *commands)
4319{
4320 SCTP_DEBUG_PRINTK("Primitive type %d is ignored.\n", type.primitive);
4321 return SCTP_DISPOSITION_DISCARD;
4322}
4323
4324/***************************************************************************
4325 * These are the state functions for the OTHER events.
4326 ***************************************************************************/
4327
4328/*
4329 * Start the shutdown negotiation.
4330 *
4331 * From Section 9.2:
4332 * Once all its outstanding data has been acknowledged, the endpoint
4333 * shall send a SHUTDOWN chunk to its peer including in the Cumulative
4334 * TSN Ack field the last sequential TSN it has received from the peer.
4335 * It shall then start the T2-shutdown timer and enter the SHUTDOWN-SENT
4336 * state. If the timer expires, the endpoint must re-send the SHUTDOWN
4337 * with the updated last sequential TSN received from its peer.
4338 *
4339 * The return value is the disposition.
4340 */
4341sctp_disposition_t sctp_sf_do_9_2_start_shutdown(
4342 const struct sctp_endpoint *ep,
4343 const struct sctp_association *asoc,
4344 const sctp_subtype_t type,
4345 void *arg,
4346 sctp_cmd_seq_t *commands)
4347{
4348 struct sctp_chunk *reply;
4349
4350 /* Once all its outstanding data has been acknowledged, the
4351 * endpoint shall send a SHUTDOWN chunk to its peer including
4352 * in the Cumulative TSN Ack field the last sequential TSN it
4353 * has received from the peer.
4354 */
4355 reply = sctp_make_shutdown(asoc, NULL);
4356 if (!reply)
4357 goto nomem;
4358
4359 /* Set the transport for the SHUTDOWN chunk and the timeout for the
4360 * T2-shutdown timer.
4361 */
4362 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
4363
4364 /* It shall then start the T2-shutdown timer */
4365 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
4366 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
4367
4368 if (asoc->autoclose)
4369 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4370 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
4371
4372 /* and enter the SHUTDOWN-SENT state. */
4373 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
4374 SCTP_STATE(SCTP_STATE_SHUTDOWN_SENT));
4375
4376 /* sctp-implguide 2.10 Issues with Heartbeating and failover
4377 *
4378 * HEARTBEAT ... is discontinued after sending either SHUTDOWN
4379 * or SHUTDOWN-ACK.
4380 */
4381 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
4382
4383 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
4384
4385 return SCTP_DISPOSITION_CONSUME;
4386
4387nomem:
4388 return SCTP_DISPOSITION_NOMEM;
4389}
4390
4391/*
4392 * Generate a SHUTDOWN ACK now that everything is SACK'd.
4393 *
4394 * From Section 9.2:
4395 *
4396 * If it has no more outstanding DATA chunks, the SHUTDOWN receiver
4397 * shall send a SHUTDOWN ACK and start a T2-shutdown timer of its own,
4398 * entering the SHUTDOWN-ACK-SENT state. If the timer expires, the
4399 * endpoint must re-send the SHUTDOWN ACK.
4400 *
4401 * The return value is the disposition.
4402 */
4403sctp_disposition_t sctp_sf_do_9_2_shutdown_ack(
4404 const struct sctp_endpoint *ep,
4405 const struct sctp_association *asoc,
4406 const sctp_subtype_t type,
4407 void *arg,
4408 sctp_cmd_seq_t *commands)
4409{
4410 struct sctp_chunk *chunk = (struct sctp_chunk *) arg;
4411 struct sctp_chunk *reply;
4412
4413 /* There are 2 ways of getting here:
4414 * 1) called in response to a SHUTDOWN chunk
4415 * 2) called when SCTP_EVENT_NO_PENDING_TSN event is issued.
4416 *
4417 * For the case (2), the arg parameter is set to NULL. We need
4418 * to check that we have a chunk before accessing it's fields.
4419 */
4420 if (chunk) {
4421 if (!sctp_vtag_verify(chunk, asoc))
4422 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
4423
4424 /* Make sure that the SHUTDOWN chunk has a valid length. */
4425 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_shutdown_chunk_t)))
4426 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
4427 commands);
4428 }
4429
4430 /* If it has no more outstanding DATA chunks, the SHUTDOWN receiver
4431 * shall send a SHUTDOWN ACK ...
4432 */
4433 reply = sctp_make_shutdown_ack(asoc, chunk);
4434 if (!reply)
4435 goto nomem;
4436
4437 /* Set the transport for the SHUTDOWN ACK chunk and the timeout for
4438 * the T2-shutdown timer.
4439 */
4440 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
4441
4442 /* and start/restart a T2-shutdown timer of its own, */
4443 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
4444 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
4445
4446 if (asoc->autoclose)
4447 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4448 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
4449
4450 /* Enter the SHUTDOWN-ACK-SENT state. */
4451 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
4452 SCTP_STATE(SCTP_STATE_SHUTDOWN_ACK_SENT));
4453
4454 /* sctp-implguide 2.10 Issues with Heartbeating and failover
4455 *
4456 * HEARTBEAT ... is discontinued after sending either SHUTDOWN
4457 * or SHUTDOWN-ACK.
4458 */
4459 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
4460
4461 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
4462
4463 return SCTP_DISPOSITION_CONSUME;
4464
4465nomem:
4466 return SCTP_DISPOSITION_NOMEM;
4467}
4468
4469/*
4470 * Ignore the event defined as other
4471 *
4472 * The return value is the disposition of the event.
4473 */
4474sctp_disposition_t sctp_sf_ignore_other(const struct sctp_endpoint *ep,
4475 const struct sctp_association *asoc,
4476 const sctp_subtype_t type,
4477 void *arg,
4478 sctp_cmd_seq_t *commands)
4479{
4480 SCTP_DEBUG_PRINTK("The event other type %d is ignored\n", type.other);
4481 return SCTP_DISPOSITION_DISCARD;
4482}
4483
4484/************************************************************
4485 * These are the state functions for handling timeout events.
4486 ************************************************************/
4487
4488/*
4489 * RTX Timeout
4490 *
4491 * Section: 6.3.3 Handle T3-rtx Expiration
4492 *
4493 * Whenever the retransmission timer T3-rtx expires for a destination
4494 * address, do the following:
4495 * [See below]
4496 *
4497 * The return value is the disposition of the chunk.
4498 */
4499sctp_disposition_t sctp_sf_do_6_3_3_rtx(const struct sctp_endpoint *ep,
4500 const struct sctp_association *asoc,
4501 const sctp_subtype_t type,
4502 void *arg,
4503 sctp_cmd_seq_t *commands)
4504{
4505 struct sctp_transport *transport = arg;
4506
4507 if (asoc->overall_error_count >= asoc->max_retrans) {
4508 /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
4509 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
4510 SCTP_U32(SCTP_ERROR_NO_ERROR));
4511 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
4512 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
4513 return SCTP_DISPOSITION_DELETE_TCB;
4514 }
4515
4516 /* E1) For the destination address for which the timer
4517 * expires, adjust its ssthresh with rules defined in Section
4518 * 7.2.3 and set the cwnd <- MTU.
4519 */
4520
4521 /* E2) For the destination address for which the timer
4522 * expires, set RTO <- RTO * 2 ("back off the timer"). The
4523 * maximum value discussed in rule C7 above (RTO.max) may be
4524 * used to provide an upper bound to this doubling operation.
4525 */
4526
4527 /* E3) Determine how many of the earliest (i.e., lowest TSN)
4528 * outstanding DATA chunks for the address for which the
4529 * T3-rtx has expired will fit into a single packet, subject
4530 * to the MTU constraint for the path corresponding to the
4531 * destination transport address to which the retransmission
4532 * is being sent (this may be different from the address for
4533 * which the timer expires [see Section 6.4]). Call this
4534 * value K. Bundle and retransmit those K DATA chunks in a
4535 * single packet to the destination endpoint.
4536 *
4537 * Note: Any DATA chunks that were sent to the address for
4538 * which the T3-rtx timer expired but did not fit in one MTU
4539 * (rule E3 above), should be marked for retransmission and
4540 * sent as soon as cwnd allows (normally when a SACK arrives).
4541 */
4542
4543 /* NB: Rules E4 and F1 are implicit in R1. */
4544 sctp_add_cmd_sf(commands, SCTP_CMD_RETRAN, SCTP_TRANSPORT(transport));
4545
4546 /* Do some failure management (Section 8.2). */
4547 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE, SCTP_TRANSPORT(transport));
4548
4549 return SCTP_DISPOSITION_CONSUME;
4550}
4551
4552/*
4553 * Generate delayed SACK on timeout
4554 *
4555 * Section: 6.2 Acknowledgement on Reception of DATA Chunks
4556 *
4557 * The guidelines on delayed acknowledgement algorithm specified in
4558 * Section 4.2 of [RFC2581] SHOULD be followed. Specifically, an
4559 * acknowledgement SHOULD be generated for at least every second packet
4560 * (not every second DATA chunk) received, and SHOULD be generated
4561 * within 200 ms of the arrival of any unacknowledged DATA chunk. In
4562 * some situations it may be beneficial for an SCTP transmitter to be
4563 * more conservative than the algorithms detailed in this document
4564 * allow. However, an SCTP transmitter MUST NOT be more aggressive than
4565 * the following algorithms allow.
4566 */
4567sctp_disposition_t sctp_sf_do_6_2_sack(const struct sctp_endpoint *ep,
4568 const struct sctp_association *asoc,
4569 const sctp_subtype_t type,
4570 void *arg,
4571 sctp_cmd_seq_t *commands)
4572{
4573 sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
4574 return SCTP_DISPOSITION_CONSUME;
4575}
4576
4577/*
4578 * sctp_sf_t1_timer_expire
4579 *
4580 * Section: 4 Note: 2
4581 * Verification Tag:
4582 * Inputs
4583 * (endpoint, asoc)
4584 *
4585 * RFC 2960 Section 4 Notes
4586 * 2) If the T1-init timer expires, the endpoint MUST retransmit INIT
4587 * and re-start the T1-init timer without changing state. This MUST
4588 * be repeated up to 'Max.Init.Retransmits' times. After that, the
4589 * endpoint MUST abort the initialization process and report the
4590 * error to SCTP user.
4591 *
4592 * 3) If the T1-cookie timer expires, the endpoint MUST retransmit
4593 * COOKIE ECHO and re-start the T1-cookie timer without changing
4594 * state. This MUST be repeated up to 'Max.Init.Retransmits' times.
4595 * After that, the endpoint MUST abort the initialization process and
4596 * report the error to SCTP user.
4597 *
4598 * Outputs
4599 * (timers, events)
4600 *
4601 */
4602sctp_disposition_t sctp_sf_t1_timer_expire(const struct sctp_endpoint *ep,
4603 const struct sctp_association *asoc,
4604 const sctp_subtype_t type,
4605 void *arg,
4606 sctp_cmd_seq_t *commands)
4607{
4608 struct sctp_chunk *repl;
4609 struct sctp_bind_addr *bp;
4610 sctp_event_timeout_t timer = (sctp_event_timeout_t) arg;
4611 int timeout;
4612 int attempts;
4613
4614 timeout = asoc->timeouts[timer];
4615 attempts = asoc->counters[SCTP_COUNTER_INIT_ERROR] + 1;
4616 repl = NULL;
4617
4618 SCTP_DEBUG_PRINTK("Timer T1 expired.\n");
4619
4620 if (attempts < asoc->max_init_attempts) {
4621 switch (timer) {
4622 case SCTP_EVENT_TIMEOUT_T1_INIT:
4623 bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
4624 repl = sctp_make_init(asoc, bp, GFP_ATOMIC, 0);
4625 break;
4626
4627 case SCTP_EVENT_TIMEOUT_T1_COOKIE:
4628 repl = sctp_make_cookie_echo(asoc, NULL);
4629 break;
4630
4631 default:
4632 BUG();
4633 break;
4634 };
4635
4636 if (!repl)
4637 goto nomem;
4638
4639 /* Issue a sideeffect to do the needed accounting. */
4640 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_RESTART,
4641 SCTP_TO(timer));
4642 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
4643 } else {
4644 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
4645 SCTP_U32(SCTP_ERROR_NO_ERROR));
4646 return SCTP_DISPOSITION_DELETE_TCB;
4647 }
4648
4649 return SCTP_DISPOSITION_CONSUME;
4650
4651nomem:
4652 return SCTP_DISPOSITION_NOMEM;
4653}
4654
4655/* RFC2960 9.2 If the timer expires, the endpoint must re-send the SHUTDOWN
4656 * with the updated last sequential TSN received from its peer.
4657 *
4658 * An endpoint should limit the number of retransmissions of the
4659 * SHUTDOWN chunk to the protocol parameter 'Association.Max.Retrans'.
4660 * If this threshold is exceeded the endpoint should destroy the TCB and
4661 * MUST report the peer endpoint unreachable to the upper layer (and
4662 * thus the association enters the CLOSED state). The reception of any
4663 * packet from its peer (i.e. as the peer sends all of its queued DATA
4664 * chunks) should clear the endpoint's retransmission count and restart
4665 * the T2-Shutdown timer, giving its peer ample opportunity to transmit
4666 * all of its queued DATA chunks that have not yet been sent.
4667 */
4668sctp_disposition_t sctp_sf_t2_timer_expire(const struct sctp_endpoint *ep,
4669 const struct sctp_association *asoc,
4670 const sctp_subtype_t type,
4671 void *arg,
4672 sctp_cmd_seq_t *commands)
4673{
4674 struct sctp_chunk *reply = NULL;
4675
4676 SCTP_DEBUG_PRINTK("Timer T2 expired.\n");
4677 if (asoc->overall_error_count >= asoc->max_retrans) {
4678 /* Note: CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
4679 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
4680 SCTP_U32(SCTP_ERROR_NO_ERROR));
4681 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
4682 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
4683 return SCTP_DISPOSITION_DELETE_TCB;
4684 }
4685
4686 switch (asoc->state) {
4687 case SCTP_STATE_SHUTDOWN_SENT:
4688 reply = sctp_make_shutdown(asoc, NULL);
4689 break;
4690
4691 case SCTP_STATE_SHUTDOWN_ACK_SENT:
4692 reply = sctp_make_shutdown_ack(asoc, NULL);
4693 break;
4694
4695 default:
4696 BUG();
4697 break;
4698 };
4699
4700 if (!reply)
4701 goto nomem;
4702
4703 /* Do some failure management (Section 8.2). */
4704 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE,
4705 SCTP_TRANSPORT(asoc->shutdown_last_sent_to));
4706
4707 /* Set the transport for the SHUTDOWN/ACK chunk and the timeout for
4708 * the T2-shutdown timer.
4709 */
4710 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
4711
4712 /* Restart the T2-shutdown timer. */
4713 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
4714 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
4715 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
4716 return SCTP_DISPOSITION_CONSUME;
4717
4718nomem:
4719 return SCTP_DISPOSITION_NOMEM;
4720}
4721
4722/*
4723 * ADDIP Section 4.1 ASCONF CHunk Procedures
4724 * If the T4 RTO timer expires the endpoint should do B1 to B5
4725 */
4726sctp_disposition_t sctp_sf_t4_timer_expire(
4727 const struct sctp_endpoint *ep,
4728 const struct sctp_association *asoc,
4729 const sctp_subtype_t type,
4730 void *arg,
4731 sctp_cmd_seq_t *commands)
4732{
4733 struct sctp_chunk *chunk = asoc->addip_last_asconf;
4734 struct sctp_transport *transport = chunk->transport;
4735
4736 /* ADDIP 4.1 B1) Increment the error counters and perform path failure
4737 * detection on the appropriate destination address as defined in
4738 * RFC2960 [5] section 8.1 and 8.2.
4739 */
4740 sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE, SCTP_TRANSPORT(transport));
4741
4742 /* Reconfig T4 timer and transport. */
4743 sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T4, SCTP_CHUNK(chunk));
4744
4745 /* ADDIP 4.1 B2) Increment the association error counters and perform
4746 * endpoint failure detection on the association as defined in
4747 * RFC2960 [5] section 8.1 and 8.2.
4748 * association error counter is incremented in SCTP_CMD_STRIKE.
4749 */
4750 if (asoc->overall_error_count >= asoc->max_retrans) {
4751 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4752 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
4753 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
4754 SCTP_U32(SCTP_ERROR_NO_ERROR));
4755 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
4756 SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
4757 return SCTP_DISPOSITION_ABORT;
4758 }
4759
4760 /* ADDIP 4.1 B3) Back-off the destination address RTO value to which
4761 * the ASCONF chunk was sent by doubling the RTO timer value.
4762 * This is done in SCTP_CMD_STRIKE.
4763 */
4764
4765 /* ADDIP 4.1 B4) Re-transmit the ASCONF Chunk last sent and if possible
4766 * choose an alternate destination address (please refer to RFC2960
4767 * [5] section 6.4.1). An endpoint MUST NOT add new parameters to this
4768 * chunk, it MUST be the same (including its serial number) as the last
4769 * ASCONF sent.
4770 */
4771 sctp_chunk_hold(asoc->addip_last_asconf);
4772 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
4773 SCTP_CHUNK(asoc->addip_last_asconf));
4774
4775 /* ADDIP 4.1 B5) Restart the T-4 RTO timer. Note that if a different
4776 * destination is selected, then the RTO used will be that of the new
4777 * destination address.
4778 */
4779 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
4780 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
4781
4782 return SCTP_DISPOSITION_CONSUME;
4783}
4784
4785/* sctpimpguide-05 Section 2.12.2
4786 * The sender of the SHUTDOWN MAY also start an overall guard timer
4787 * 'T5-shutdown-guard' to bound the overall time for shutdown sequence.
4788 * At the expiration of this timer the sender SHOULD abort the association
4789 * by sending an ABORT chunk.
4790 */
4791sctp_disposition_t sctp_sf_t5_timer_expire(const struct sctp_endpoint *ep,
4792 const struct sctp_association *asoc,
4793 const sctp_subtype_t type,
4794 void *arg,
4795 sctp_cmd_seq_t *commands)
4796{
4797 struct sctp_chunk *reply = NULL;
4798
4799 SCTP_DEBUG_PRINTK("Timer T5 expired.\n");
4800
4801 reply = sctp_make_abort(asoc, NULL, 0);
4802 if (!reply)
4803 goto nomem;
4804
4805 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
4806 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
4807 SCTP_U32(SCTP_ERROR_NO_ERROR));
4808
4809 return SCTP_DISPOSITION_DELETE_TCB;
4810nomem:
4811 return SCTP_DISPOSITION_NOMEM;
4812}
4813
4814/* Handle expiration of AUTOCLOSE timer. When the autoclose timer expires,
4815 * the association is automatically closed by starting the shutdown process.
4816 * The work that needs to be done is same as when SHUTDOWN is initiated by
4817 * the user. So this routine looks same as sctp_sf_do_9_2_prm_shutdown().
4818 */
4819sctp_disposition_t sctp_sf_autoclose_timer_expire(
4820 const struct sctp_endpoint *ep,
4821 const struct sctp_association *asoc,
4822 const sctp_subtype_t type,
4823 void *arg,
4824 sctp_cmd_seq_t *commands)
4825{
4826 int disposition;
4827
4828 /* From 9.2 Shutdown of an Association
4829 * Upon receipt of the SHUTDOWN primitive from its upper
4830 * layer, the endpoint enters SHUTDOWN-PENDING state and
4831 * remains there until all outstanding data has been
4832 * acknowledged by its peer. The endpoint accepts no new data
4833 * from its upper layer, but retransmits data to the far end
4834 * if necessary to fill gaps.
4835 */
4836 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
4837 SCTP_STATE(SCTP_STATE_SHUTDOWN_PENDING));
4838
4839 /* sctpimpguide-05 Section 2.12.2
4840 * The sender of the SHUTDOWN MAY also start an overall guard timer
4841 * 'T5-shutdown-guard' to bound the overall time for shutdown sequence.
4842 */
4843 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
4844 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
4845 disposition = SCTP_DISPOSITION_CONSUME;
4846 if (sctp_outq_is_empty(&asoc->outqueue)) {
4847 disposition = sctp_sf_do_9_2_start_shutdown(ep, asoc, type,
4848 arg, commands);
4849 }
4850 return disposition;
4851}
4852
4853/*****************************************************************************
4854 * These are sa state functions which could apply to all types of events.
4855 ****************************************************************************/
4856
4857/*
4858 * This table entry is not implemented.
4859 *
4860 * Inputs
4861 * (endpoint, asoc, chunk)
4862 *
4863 * The return value is the disposition of the chunk.
4864 */
4865sctp_disposition_t sctp_sf_not_impl(const struct sctp_endpoint *ep,
4866 const struct sctp_association *asoc,
4867 const sctp_subtype_t type,
4868 void *arg,
4869 sctp_cmd_seq_t *commands)
4870{
4871 return SCTP_DISPOSITION_NOT_IMPL;
4872}
4873
4874/*
4875 * This table entry represents a bug.
4876 *
4877 * Inputs
4878 * (endpoint, asoc, chunk)
4879 *
4880 * The return value is the disposition of the chunk.
4881 */
4882sctp_disposition_t sctp_sf_bug(const struct sctp_endpoint *ep,
4883 const struct sctp_association *asoc,
4884 const sctp_subtype_t type,
4885 void *arg,
4886 sctp_cmd_seq_t *commands)
4887{
4888 return SCTP_DISPOSITION_BUG;
4889}
4890
4891/*
4892 * This table entry represents the firing of a timer in the wrong state.
4893 * Since timer deletion cannot be guaranteed a timer 'may' end up firing
4894 * when the association is in the wrong state. This event should
4895 * be ignored, so as to prevent any rearming of the timer.
4896 *
4897 * Inputs
4898 * (endpoint, asoc, chunk)
4899 *
4900 * The return value is the disposition of the chunk.
4901 */
4902sctp_disposition_t sctp_sf_timer_ignore(const struct sctp_endpoint *ep,
4903 const struct sctp_association *asoc,
4904 const sctp_subtype_t type,
4905 void *arg,
4906 sctp_cmd_seq_t *commands)
4907{
4908 SCTP_DEBUG_PRINTK("Timer %d ignored.\n", type.chunk);
4909 return SCTP_DISPOSITION_CONSUME;
4910}
4911
4912/********************************************************************
4913 * 2nd Level Abstractions
4914 ********************************************************************/
4915
4916/* Pull the SACK chunk based on the SACK header. */
4917static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk)
4918{
4919 struct sctp_sackhdr *sack;
4920 unsigned int len;
4921 __u16 num_blocks;
4922 __u16 num_dup_tsns;
4923
4924 /* Protect ourselves from reading too far into
4925 * the skb from a bogus sender.
4926 */
4927 sack = (struct sctp_sackhdr *) chunk->skb->data;
4928
4929 num_blocks = ntohs(sack->num_gap_ack_blocks);
4930 num_dup_tsns = ntohs(sack->num_dup_tsns);
4931 len = sizeof(struct sctp_sackhdr);
4932 len += (num_blocks + num_dup_tsns) * sizeof(__u32);
4933 if (len > chunk->skb->len)
4934 return NULL;
4935
4936 skb_pull(chunk->skb, len);
4937
4938 return sack;
4939}
4940
4941/* Create an ABORT packet to be sent as a response, with the specified
4942 * error causes.
4943 */
4944static struct sctp_packet *sctp_abort_pkt_new(const struct sctp_endpoint *ep,
4945 const struct sctp_association *asoc,
4946 struct sctp_chunk *chunk,
4947 const void *payload,
4948 size_t paylen)
4949{
4950 struct sctp_packet *packet;
4951 struct sctp_chunk *abort;
4952
4953 packet = sctp_ootb_pkt_new(asoc, chunk);
4954
4955 if (packet) {
4956 /* Make an ABORT.
4957 * The T bit will be set if the asoc is NULL.
4958 */
4959 abort = sctp_make_abort(asoc, chunk, paylen);
4960 if (!abort) {
4961 sctp_ootb_pkt_free(packet);
4962 return NULL;
4963 }
4964 /* Add specified error causes, i.e., payload, to the
4965 * end of the chunk.
4966 */
4967 sctp_addto_chunk(abort, paylen, payload);
4968
4969 /* Set the skb to the belonging sock for accounting. */
4970 abort->skb->sk = ep->base.sk;
4971
4972 sctp_packet_append_chunk(packet, abort);
4973
4974 }
4975
4976 return packet;
4977}
4978
4979/* Allocate a packet for responding in the OOTB conditions. */
4980static struct sctp_packet *sctp_ootb_pkt_new(const struct sctp_association *asoc,
4981 const struct sctp_chunk *chunk)
4982{
4983 struct sctp_packet *packet;
4984 struct sctp_transport *transport;
4985 __u16 sport;
4986 __u16 dport;
4987 __u32 vtag;
4988
4989 /* Get the source and destination port from the inbound packet. */
4990 sport = ntohs(chunk->sctp_hdr->dest);
4991 dport = ntohs(chunk->sctp_hdr->source);
4992
4993 /* The V-tag is going to be the same as the inbound packet if no
4994 * association exists, otherwise, use the peer's vtag.
4995 */
4996 if (asoc) {
4997 vtag = asoc->peer.i.init_tag;
4998 } else {
4999 /* Special case the INIT and stale COOKIE_ECHO as there is no
5000 * vtag yet.
5001 */
5002 switch(chunk->chunk_hdr->type) {
5003 case SCTP_CID_INIT:
5004 {
5005 sctp_init_chunk_t *init;
5006
5007 init = (sctp_init_chunk_t *)chunk->chunk_hdr;
5008 vtag = ntohl(init->init_hdr.init_tag);
5009 break;
5010 }
5011 default:
5012 vtag = ntohl(chunk->sctp_hdr->vtag);
5013 break;
5014 }
5015 }
5016
5017 /* Make a transport for the bucket, Eliza... */
5018 transport = sctp_transport_new(sctp_source(chunk), GFP_ATOMIC);
5019 if (!transport)
5020 goto nomem;
5021
5022 /* Cache a route for the transport with the chunk's destination as
5023 * the source address.
5024 */
5025 sctp_transport_route(transport, (union sctp_addr *)&chunk->dest,
5026 sctp_sk(sctp_get_ctl_sock()));
5027
5028 packet = sctp_packet_init(&transport->packet, transport, sport, dport);
5029 packet = sctp_packet_config(packet, vtag, 0);
5030
5031 return packet;
5032
5033nomem:
5034 return NULL;
5035}
5036
5037/* Free the packet allocated earlier for responding in the OOTB condition. */
5038void sctp_ootb_pkt_free(struct sctp_packet *packet)
5039{
5040 sctp_transport_free(packet->transport);
5041}
5042
5043/* Send a stale cookie error when a invalid COOKIE ECHO chunk is found */
5044static void sctp_send_stale_cookie_err(const struct sctp_endpoint *ep,
5045 const struct sctp_association *asoc,
5046 const struct sctp_chunk *chunk,
5047 sctp_cmd_seq_t *commands,
5048 struct sctp_chunk *err_chunk)
5049{
5050 struct sctp_packet *packet;
5051
5052 if (err_chunk) {
5053 packet = sctp_ootb_pkt_new(asoc, chunk);
5054 if (packet) {
5055 struct sctp_signed_cookie *cookie;
5056
5057 /* Override the OOTB vtag from the cookie. */
5058 cookie = chunk->subh.cookie_hdr;
5059 packet->vtag = cookie->c.peer_vtag;
5060
5061 /* Set the skb to the belonging sock for accounting. */
5062 err_chunk->skb->sk = ep->base.sk;
5063 sctp_packet_append_chunk(packet, err_chunk);
5064 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
5065 SCTP_PACKET(packet));
5066 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
5067 } else
5068 sctp_chunk_free (err_chunk);
5069 }
5070}
5071
5072
5073/* Process a data chunk */
5074static int sctp_eat_data(const struct sctp_association *asoc,
5075 struct sctp_chunk *chunk,
5076 sctp_cmd_seq_t *commands)
5077{
5078 sctp_datahdr_t *data_hdr;
5079 struct sctp_chunk *err;
5080 size_t datalen;
5081 sctp_verb_t deliver;
5082 int tmp;
5083 __u32 tsn;
5084
5085 data_hdr = chunk->subh.data_hdr = (sctp_datahdr_t *)chunk->skb->data;
5086 skb_pull(chunk->skb, sizeof(sctp_datahdr_t));
5087
5088 tsn = ntohl(data_hdr->tsn);
5089 SCTP_DEBUG_PRINTK("eat_data: TSN 0x%x.\n", tsn);
5090
5091 /* ASSERT: Now skb->data is really the user data. */
5092
5093 /* Process ECN based congestion.
5094 *
5095 * Since the chunk structure is reused for all chunks within
5096 * a packet, we use ecn_ce_done to track if we've already
5097 * done CE processing for this packet.
5098 *
5099 * We need to do ECN processing even if we plan to discard the
5100 * chunk later.
5101 */
5102
5103 if (!chunk->ecn_ce_done) {
5104 struct sctp_af *af;
5105 chunk->ecn_ce_done = 1;
5106
5107 af = sctp_get_af_specific(
5108 ipver2af(chunk->skb->nh.iph->version));
5109
5110 if (af && af->is_ce(chunk->skb) && asoc->peer.ecn_capable) {
5111 /* Do real work as sideffect. */
5112 sctp_add_cmd_sf(commands, SCTP_CMD_ECN_CE,
5113 SCTP_U32(tsn));
5114 }
5115 }
5116
5117 tmp = sctp_tsnmap_check(&asoc->peer.tsn_map, tsn);
5118 if (tmp < 0) {
5119 /* The TSN is too high--silently discard the chunk and
5120 * count on it getting retransmitted later.
5121 */
5122 return SCTP_IERROR_HIGH_TSN;
5123 } else if (tmp > 0) {
5124 /* This is a duplicate. Record it. */
5125 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_DUP, SCTP_U32(tsn));
5126 return SCTP_IERROR_DUP_TSN;
5127 }
5128
5129 /* This is a new TSN. */
5130
5131 /* Discard if there is no room in the receive window.
5132 * Actually, allow a little bit of overflow (up to a MTU).
5133 */
5134 datalen = ntohs(chunk->chunk_hdr->length);
5135 datalen -= sizeof(sctp_data_chunk_t);
5136
5137 deliver = SCTP_CMD_CHUNK_ULP;
5138
5139 /* Think about partial delivery. */
5140 if ((datalen >= asoc->rwnd) && (!asoc->ulpq.pd_mode)) {
5141
5142 /* Even if we don't accept this chunk there is
5143 * memory pressure.
5144 */
5145 sctp_add_cmd_sf(commands, SCTP_CMD_PART_DELIVER, SCTP_NULL());
5146 }
5147
5148 /* Spill over rwnd a little bit. Note: While allowed, this spill over
5149 * seems a bit troublesome in that frag_point varies based on
5150 * PMTU. In cases, such as loopback, this might be a rather
5151 * large spill over.
5152 */
5153 if (!asoc->rwnd || asoc->rwnd_over ||
5154 (datalen > asoc->rwnd + asoc->frag_point)) {
5155
5156 /* If this is the next TSN, consider reneging to make
5157 * room. Note: Playing nice with a confused sender. A
5158 * malicious sender can still eat up all our buffer
5159 * space and in the future we may want to detect and
5160 * do more drastic reneging.
5161 */
5162 if (sctp_tsnmap_has_gap(&asoc->peer.tsn_map) &&
5163 (sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map) + 1) == tsn) {
5164 SCTP_DEBUG_PRINTK("Reneging for tsn:%u\n", tsn);
5165 deliver = SCTP_CMD_RENEGE;
5166 } else {
5167 SCTP_DEBUG_PRINTK("Discard tsn: %u len: %Zd, "
5168 "rwnd: %d\n", tsn, datalen,
5169 asoc->rwnd);
5170 return SCTP_IERROR_IGNORE_TSN;
5171 }
5172 }
5173
5174 /*
5175 * Section 3.3.10.9 No User Data (9)
5176 *
5177 * Cause of error
5178 * ---------------
5179 * No User Data: This error cause is returned to the originator of a
5180 * DATA chunk if a received DATA chunk has no user data.
5181 */
5182 if (unlikely(0 == datalen)) {
5183 err = sctp_make_abort_no_data(asoc, chunk, tsn);
5184 if (err) {
5185 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
5186 SCTP_CHUNK(err));
5187 }
5188 /* We are going to ABORT, so we might as well stop
5189 * processing the rest of the chunks in the packet.
5190 */
5191 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
5192 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5193 SCTP_U32(SCTP_ERROR_NO_DATA));
5194 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
5195 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
5196 return SCTP_IERROR_NO_DATA;
5197 }
5198
5199 /* If definately accepting the DATA chunk, record its TSN, otherwise
5200 * wait for renege processing.
5201 */
5202 if (SCTP_CMD_CHUNK_ULP == deliver)
5203 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_TSN, SCTP_U32(tsn));
5204
5205 /* Note: Some chunks may get overcounted (if we drop) or overcounted
5206 * if we renege and the chunk arrives again.
5207 */
5208 if (chunk->chunk_hdr->flags & SCTP_DATA_UNORDERED)
5209 SCTP_INC_STATS(SCTP_MIB_INUNORDERCHUNKS);
5210 else
5211 SCTP_INC_STATS(SCTP_MIB_INORDERCHUNKS);
5212
5213 /* RFC 2960 6.5 Stream Identifier and Stream Sequence Number
5214 *
5215 * If an endpoint receive a DATA chunk with an invalid stream
5216 * identifier, it shall acknowledge the reception of the DATA chunk
5217 * following the normal procedure, immediately send an ERROR chunk
5218 * with cause set to "Invalid Stream Identifier" (See Section 3.3.10)
5219 * and discard the DATA chunk.
5220 */
5221 if (ntohs(data_hdr->stream) >= asoc->c.sinit_max_instreams) {
5222 err = sctp_make_op_error(asoc, chunk, SCTP_ERROR_INV_STRM,
5223 &data_hdr->stream,
5224 sizeof(data_hdr->stream));
5225 if (err)
5226 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
5227 SCTP_CHUNK(err));
5228 return SCTP_IERROR_BAD_STREAM;
5229 }
5230
5231 /* Send the data up to the user. Note: Schedule the
5232 * SCTP_CMD_CHUNK_ULP cmd before the SCTP_CMD_GEN_SACK, as the SACK
5233 * chunk needs the updated rwnd.
5234 */
5235 sctp_add_cmd_sf(commands, deliver, SCTP_CHUNK(chunk));
5236
5237 return SCTP_IERROR_NO_ERROR;
5238}
generated by cgit v1.2.2 (git 2.25.0) at 2024-12-30 14:55:43 -0500