4 files changed, 59 insertions, 0 deletions

diff --git a/net/dccp/ccid.c b/net/dccp/ccid.c
index 8fe931a3d7a1..647cb0614f84 100644
--- a/net/dccp/ccid.c
+++ b/net/dccp/ccid.c
@@ -13,6 +13,13 @@
 
 #include "ccid.h"
 
+static u8 builtin_ccids[] = {
+        DCCPC_CCID2,            /* CCID2 is supported by default */
+#if defined(CONFIG_IP_DCCP_CCID3) || defined(CONFIG_IP_DCCP_CCID3_MODULE)
+        DCCPC_CCID3,
+#endif
+};
+
 static struct ccid_operations *ccids[CCID_MAX];
 #if defined(CONFIG_SMP) || defined(CONFIG_PREEMPT)
 static atomic_t ccids_lockct = ATOMIC_INIT(0);
@@ -86,6 +93,47 @@ static void ccid_kmem_cache_destroy(struct kmem_cache *slab)
         }
 }
 
+/* check that up to @array_len members in @ccid_array are supported */
+bool ccid_support_check(u8 const *ccid_array, u8 array_len)
+{
+        u8 i, j, found;
+
+        for (i = 0, found = 0; i < array_len; i++, found = 0) {
+                for (j = 0; !found && j < ARRAY_SIZE(builtin_ccids); j++)
+                        found = (ccid_array[i] == builtin_ccids[j]);
+                if (!found)
+                        return false;
+        }
+        return true;
+}
+
+/**
+ * ccid_get_builtin_ccids  -  Provide copy of `builtin' CCID array
+ * @ccid_array: pointer to copy into
+ * @array_len: value to return length into
+ * This function allocates memory - caller must see that it is freed after use.
+ */
+int ccid_get_builtin_ccids(u8 **ccid_array, u8 *array_len)
+{
+        *ccid_array = kmemdup(builtin_ccids, sizeof(builtin_ccids), gfp_any());
+        if (*ccid_array == NULL)
+                return -ENOBUFS;
+        *array_len = ARRAY_SIZE(builtin_ccids);
+        return 0;
+}
+
+int ccid_getsockopt_builtin_ccids(struct sock *sk, int len,
+                                    char __user *optval, int __user *optlen)
+{
+        if (len < sizeof(builtin_ccids))
+                return -EINVAL;
+
+        if (put_user(sizeof(builtin_ccids), optlen) ||
+            copy_to_user(optval, builtin_ccids, sizeof(builtin_ccids)))
+                return -EFAULT;
+        return 0;
+}
+
 int ccid_register(struct ccid_operations *ccid_ops)
 {
         int err = -ENOBUFS;
diff --git a/net/dccp/ccid.h b/net/dccp/ccid.h
index fdeae7b57319..259f5469d7d0 100644
--- a/net/dccp/ccid.h
+++ b/net/dccp/ccid.h
@@ -103,6 +103,11 @@ static inline void *ccid_priv(const struct ccid *ccid)
         return (void *)ccid->ccid_priv;
 }
 
+extern bool ccid_support_check(u8 const *ccid_array, u8 array_len);
+extern int  ccid_get_builtin_ccids(u8 **ccid_array, u8 *array_len);
+extern int  ccid_getsockopt_builtin_ccids(struct sock *sk, int len,
+                                          char __user *, int __user *);
+
 extern struct ccid *ccid_new(unsigned char id, struct sock *sk, int rx,
                              gfp_t gfp);
 
diff --git a/net/dccp/feat.c b/net/dccp/feat.c
index 192d494a3816..f79fb5e33f5e 100644
--- a/net/dccp/feat.c
+++ b/net/dccp/feat.c
@@ -342,6 +342,10 @@ static int __feat_register_sp(struct list_head *fn, u8 feat, u8 is_local,
             !dccp_feat_sp_list_ok(feat, sp_val, sp_len))
                 return -EINVAL;
 
+        /* Avoid negotiating alien CCIDs by only advertising supported ones */
+        if (feat == DCCPF_CCID && !ccid_support_check(sp_val, sp_len))
+                return -EOPNOTSUPP;
+
         if (dccp_feat_clone_sp_val(&fval, sp_val, sp_len))
                 return -ENOMEM;
 
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 01332fe7a99a..b4b10cbd8880 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -649,6 +649,8 @@ static int do_dccp_getsockopt(struct sock *sk, int level, int optname,
         case DCCP_SOCKOPT_GET_CUR_MPS:
                 val = dp->dccps_mss_cache;
                 break;
+        case DCCP_SOCKOPT_AVAILABLE_CCIDS:
+                return ccid_getsockopt_builtin_ccids(sk, len, optval, optlen);
         case DCCP_SOCKOPT_SERVER_TIMEWAIT:
                 val = dp->dccps_server_timewait;
                 break;