linux/net/sctp/sm_statefuns.c
<<
>>
Prefs
   1/* SCTP kernel implementation
   2 * (C) Copyright IBM Corp. 2001, 2004
   3 * Copyright (c) 1999-2000 Cisco, Inc.
   4 * Copyright (c) 1999-2001 Motorola, Inc.
   5 * Copyright (c) 2001-2002 Intel Corp.
   6 * Copyright (c) 2002      Nokia Corp.
   7 *
   8 * This is part of the SCTP Linux Kernel Implementation.
   9 *
  10 * These are the state functions for the state machine.
  11 *
  12 * This SCTP implementation is free software;
  13 * you can redistribute it and/or modify it under the terms of
  14 * the GNU General Public License as published by
  15 * the Free Software Foundation; either version 2, or (at your option)
  16 * any later version.
  17 *
  18 * This SCTP implementation is distributed in the hope that it
  19 * will be useful, but WITHOUT ANY WARRANTY; without even the implied
  20 *                 ************************
  21 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
  22 * See the GNU General Public License for more details.
  23 *
  24 * You should have received a copy of the GNU General Public License
  25 * along with GNU CC; see the file COPYING.  If not, write to
  26 * the Free Software Foundation, 59 Temple Place - Suite 330,
  27 * Boston, MA 02111-1307, USA.
  28 *
  29 * Please send any bug reports or fixes you make to the
  30 * email address(es):
  31 *    lksctp developers <lksctp-developers@lists.sourceforge.net>
  32 *
  33 * Or submit a bug report through the following website:
  34 *    http://www.sf.net/projects/lksctp
  35 *
  36 * Written or modified by:
  37 *    La Monte H.P. Yarroll <piggy@acm.org>
  38 *    Karl Knutson          <karl@athena.chicago.il.us>
  39 *    Mathew Kotowsky       <kotowsky@sctp.org>
  40 *    Sridhar Samudrala     <samudrala@us.ibm.com>
  41 *    Jon Grimm             <jgrimm@us.ibm.com>
  42 *    Hui Huang             <hui.huang@nokia.com>
  43 *    Dajiang Zhang         <dajiang.zhang@nokia.com>
  44 *    Daisy Chang           <daisyc@us.ibm.com>
  45 *    Ardelle Fan           <ardelle.fan@intel.com>
  46 *    Ryan Layer            <rmlayer@us.ibm.com>
  47 *    Kevin Gao             <kevin.gao@intel.com>
  48 *
  49 * Any bugs reported given to us we will try to fix... any fixes shared will
  50 * be incorporated into the next SCTP release.
  51 */
  52
  53#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  54
  55#include <linux/types.h>
  56#include <linux/kernel.h>
  57#include <linux/ip.h>
  58#include <linux/ipv6.h>
  59#include <linux/net.h>
  60#include <linux/inet.h>
  61#include <linux/slab.h>
  62#include <net/sock.h>
  63#include <net/inet_ecn.h>
  64#include <linux/skbuff.h>
  65#include <net/sctp/sctp.h>
  66#include <net/sctp/sm.h>
  67#include <net/sctp/structs.h>
  68
  69static struct sctp_packet *sctp_abort_pkt_new(const struct sctp_endpoint *ep,
  70                                  const struct sctp_association *asoc,
  71                                  struct sctp_chunk *chunk,
  72                                  const void *payload,
  73                                  size_t paylen);
  74static int sctp_eat_data(const struct sctp_association *asoc,
  75                         struct sctp_chunk *chunk,
  76                         sctp_cmd_seq_t *commands);
  77static struct sctp_packet *sctp_ootb_pkt_new(const struct sctp_association *asoc,
  78                                             const struct sctp_chunk *chunk);
  79static void sctp_send_stale_cookie_err(const struct sctp_endpoint *ep,
  80                                       const struct sctp_association *asoc,
  81                                       const struct sctp_chunk *chunk,
  82                                       sctp_cmd_seq_t *commands,
  83                                       struct sctp_chunk *err_chunk);
  84static sctp_disposition_t sctp_sf_do_5_2_6_stale(const struct sctp_endpoint *ep,
  85                                                 const struct sctp_association *asoc,
  86                                                 const sctp_subtype_t type,
  87                                                 void *arg,
  88                                                 sctp_cmd_seq_t *commands);
  89static sctp_disposition_t sctp_sf_shut_8_4_5(const struct sctp_endpoint *ep,
  90                                             const struct sctp_association *asoc,
  91                                             const sctp_subtype_t type,
  92                                             void *arg,
  93                                             sctp_cmd_seq_t *commands);
  94static sctp_disposition_t sctp_sf_tabort_8_4_8(const struct sctp_endpoint *ep,
  95                                        const struct sctp_association *asoc,
  96                                        const sctp_subtype_t type,
  97                                        void *arg,
  98                                        sctp_cmd_seq_t *commands);
  99static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk);
 100
 101static sctp_disposition_t sctp_stop_t1_and_abort(sctp_cmd_seq_t *commands,
 102                                           __be16 error, int sk_err,
 103                                           const struct sctp_association *asoc,
 104                                           struct sctp_transport *transport);
 105
 106static sctp_disposition_t sctp_sf_abort_violation(
 107                                     const struct sctp_endpoint *ep,
 108                                     const struct sctp_association *asoc,
 109                                     void *arg,
 110                                     sctp_cmd_seq_t *commands,
 111                                     const __u8 *payload,
 112                                     const size_t paylen);
 113
 114static sctp_disposition_t sctp_sf_violation_chunklen(
 115                                     const struct sctp_endpoint *ep,
 116                                     const struct sctp_association *asoc,
 117                                     const sctp_subtype_t type,
 118                                     void *arg,
 119                                     sctp_cmd_seq_t *commands);
 120
 121static sctp_disposition_t sctp_sf_violation_paramlen(
 122                                     const struct sctp_endpoint *ep,
 123                                     const struct sctp_association *asoc,
 124                                     const sctp_subtype_t type,
 125                                     void *arg, void *ext,
 126                                     sctp_cmd_seq_t *commands);
 127
 128static sctp_disposition_t sctp_sf_violation_ctsn(
 129                                     const struct sctp_endpoint *ep,
 130                                     const struct sctp_association *asoc,
 131                                     const sctp_subtype_t type,
 132                                     void *arg,
 133                                     sctp_cmd_seq_t *commands);
 134
 135static sctp_disposition_t sctp_sf_violation_chunk(
 136                                     const struct sctp_endpoint *ep,
 137                                     const struct sctp_association *asoc,
 138                                     const sctp_subtype_t type,
 139                                     void *arg,
 140                                     sctp_cmd_seq_t *commands);
 141
 142static sctp_ierror_t sctp_sf_authenticate(const struct sctp_endpoint *ep,
 143                                    const struct sctp_association *asoc,
 144                                    const sctp_subtype_t type,
 145                                    struct sctp_chunk *chunk);
 146
 147static sctp_disposition_t __sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep,
 148                                        const struct sctp_association *asoc,
 149                                        const sctp_subtype_t type,
 150                                        void *arg,
 151                                        sctp_cmd_seq_t *commands);
 152
 153/* Small helper function that checks if the chunk length
 154 * is of the appropriate length.  The 'required_length' argument
 155 * is set to be the size of a specific chunk we are testing.
 156 * Return Values:  1 = Valid length
 157 *                 0 = Invalid length
 158 *
 159 */
 160static inline int
 161sctp_chunk_length_valid(struct sctp_chunk *chunk,
 162                           __u16 required_length)
 163{
 164        __u16 chunk_length = ntohs(chunk->chunk_hdr->length);
 165
 166        if (unlikely(chunk_length < required_length))
 167                return 0;
 168
 169        return 1;
 170}
 171
 172/**********************************************************
 173 * These are the state functions for handling chunk events.
 174 **********************************************************/
 175
 176/*
 177 * Process the final SHUTDOWN COMPLETE.
 178 *
 179 * Section: 4 (C) (diagram), 9.2
 180 * Upon reception of the SHUTDOWN COMPLETE chunk the endpoint will verify
 181 * that it is in SHUTDOWN-ACK-SENT state, if it is not the chunk should be
 182 * discarded. If the endpoint is in the SHUTDOWN-ACK-SENT state the endpoint
 183 * should stop the T2-shutdown timer and remove all knowledge of the
 184 * association (and thus the association enters the CLOSED state).
 185 *
 186 * Verification Tag: 8.5.1(C), sctpimpguide 2.41.
 187 * C) Rules for packet carrying SHUTDOWN COMPLETE:
 188 * ...
 189 * - The receiver of a SHUTDOWN COMPLETE shall accept the packet
 190 *   if the Verification Tag field of the packet matches its own tag and
 191 *   the T bit is not set
 192 *   OR
 193 *   it is set to its peer's tag and the T bit is set in the Chunk
 194 *   Flags.
 195 *   Otherwise, the receiver MUST silently discard the packet
 196 *   and take no further action.  An endpoint MUST ignore the
 197 *   SHUTDOWN COMPLETE if it is not in the SHUTDOWN-ACK-SENT state.
 198 *
 199 * Inputs
 200 * (endpoint, asoc, chunk)
 201 *
 202 * Outputs
 203 * (asoc, reply_msg, msg_up, timers, counters)
 204 *
 205 * The return value is the disposition of the chunk.
 206 */
 207sctp_disposition_t sctp_sf_do_4_C(const struct sctp_endpoint *ep,
 208                                  const struct sctp_association *asoc,
 209                                  const sctp_subtype_t type,
 210                                  void *arg,
 211                                  sctp_cmd_seq_t *commands)
 212{
 213        struct sctp_chunk *chunk = arg;
 214        struct sctp_ulpevent *ev;
 215
 216        if (!sctp_vtag_verify_either(chunk, asoc))
 217                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
 218
 219        /* RFC 2960 6.10 Bundling
 220         *
 221         * An endpoint MUST NOT bundle INIT, INIT ACK or
 222         * SHUTDOWN COMPLETE with any other chunks.
 223         */
 224        if (!chunk->singleton)
 225                return sctp_sf_violation_chunk(ep, asoc, type, arg, commands);
 226
 227        /* Make sure that the SHUTDOWN_COMPLETE chunk has a valid length. */
 228        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
 229                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
 230                                                  commands);
 231
 232        /* RFC 2960 10.2 SCTP-to-ULP
 233         *
 234         * H) SHUTDOWN COMPLETE notification
 235         *
 236         * When SCTP completes the shutdown procedures (section 9.2) this
 237         * notification is passed to the upper layer.
 238         */
 239        ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_SHUTDOWN_COMP,
 240                                             0, 0, 0, NULL, GFP_ATOMIC);
 241        if (ev)
 242                sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
 243                                SCTP_ULPEVENT(ev));
 244
 245        /* Upon reception of the SHUTDOWN COMPLETE chunk the endpoint
 246         * will verify that it is in SHUTDOWN-ACK-SENT state, if it is
 247         * not the chunk should be discarded. If the endpoint is in
 248         * the SHUTDOWN-ACK-SENT state the endpoint should stop the
 249         * T2-shutdown timer and remove all knowledge of the
 250         * association (and thus the association enters the CLOSED
 251         * state).
 252         */
 253        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
 254                        SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
 255
 256        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
 257                        SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
 258
 259        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
 260                        SCTP_STATE(SCTP_STATE_CLOSED));
 261
 262        SCTP_INC_STATS(SCTP_MIB_SHUTDOWNS);
 263        SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
 264
 265        sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
 266
 267        return SCTP_DISPOSITION_DELETE_TCB;
 268}
 269
 270/*
 271 * Respond to a normal INIT chunk.
 272 * We are the side that is being asked for an association.
 273 *
 274 * Section: 5.1 Normal Establishment of an Association, B
 275 * B) "Z" shall respond immediately with an INIT ACK chunk.  The
 276 *    destination IP address of the INIT ACK MUST be set to the source
 277 *    IP address of the INIT to which this INIT ACK is responding.  In
 278 *    the response, besides filling in other parameters, "Z" must set the
 279 *    Verification Tag field to Tag_A, and also provide its own
 280 *    Verification Tag (Tag_Z) in the Initiate Tag field.
 281 *
 282 * Verification Tag: Must be 0.
 283 *
 284 * Inputs
 285 * (endpoint, asoc, chunk)
 286 *
 287 * Outputs
 288 * (asoc, reply_msg, msg_up, timers, counters)
 289 *
 290 * The return value is the disposition of the chunk.
 291 */
 292sctp_disposition_t sctp_sf_do_5_1B_init(const struct sctp_endpoint *ep,
 293                                        const struct sctp_association *asoc,
 294                                        const sctp_subtype_t type,
 295                                        void *arg,
 296                                        sctp_cmd_seq_t *commands)
 297{
 298        struct sctp_chunk *chunk = arg;
 299        struct sctp_chunk *repl;
 300        struct sctp_association *new_asoc;
 301        struct sctp_chunk *err_chunk;
 302        struct sctp_packet *packet;
 303        sctp_unrecognized_param_t *unk_param;
 304        int len;
 305
 306        /* 6.10 Bundling
 307         * An endpoint MUST NOT bundle INIT, INIT ACK or
 308         * SHUTDOWN COMPLETE with any other chunks.
 309         *
 310         * IG Section 2.11.2
 311         * Furthermore, we require that the receiver of an INIT chunk MUST
 312         * enforce these rules by silently discarding an arriving packet
 313         * with an INIT chunk that is bundled with other chunks.
 314         */
 315        if (!chunk->singleton)
 316                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
 317
 318        /* If the packet is an OOTB packet which is temporarily on the
 319         * control endpoint, respond with an ABORT.
 320         */
 321        if (ep == sctp_sk((sctp_get_ctl_sock()))->ep) {
 322                SCTP_INC_STATS(SCTP_MIB_OUTOFBLUES);
 323                return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
 324        }
 325
 326        /* 3.1 A packet containing an INIT chunk MUST have a zero Verification
 327         * Tag.
 328         */
 329        if (chunk->sctp_hdr->vtag != 0)
 330                return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
 331
 332        /* Make sure that the INIT chunk has a valid length.
 333         * Normally, this would cause an ABORT with a Protocol Violation
 334         * error, but since we don't have an association, we'll
 335         * just discard the packet.
 336         */
 337        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_init_chunk_t)))
 338                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
 339
 340        /* If the INIT is coming toward a closing socket, we'll send back
 341         * and ABORT.  Essentially, this catches the race of INIT being
 342         * backloged to the socket at the same time as the user isses close().
 343         * Since the socket and all its associations are going away, we
 344         * can treat this OOTB
 345         */
 346        if (sctp_sstate(ep->base.sk, CLOSING))
 347                return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
 348
 349        /* Verify the INIT chunk before processing it. */
 350        err_chunk = NULL;
 351        if (!sctp_verify_init(asoc, chunk->chunk_hdr->type,
 352                              (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
 353                              &err_chunk)) {
 354                /* This chunk contains fatal error. It is to be discarded.
 355                 * Send an ABORT, with causes if there is any.
 356                 */
 357                if (err_chunk) {
 358                        packet = sctp_abort_pkt_new(ep, asoc, arg,
 359                                        (__u8 *)(err_chunk->chunk_hdr) +
 360                                        sizeof(sctp_chunkhdr_t),
 361                                        ntohs(err_chunk->chunk_hdr->length) -
 362                                        sizeof(sctp_chunkhdr_t));
 363
 364                        sctp_chunk_free(err_chunk);
 365
 366                        if (packet) {
 367                                sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
 368                                                SCTP_PACKET(packet));
 369                                SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
 370                                return SCTP_DISPOSITION_CONSUME;
 371                        } else {
 372                                return SCTP_DISPOSITION_NOMEM;
 373                        }
 374                } else {
 375                        return sctp_sf_tabort_8_4_8(ep, asoc, type, arg,
 376                                                    commands);
 377                }
 378        }
 379
 380        /* Grab the INIT header.  */
 381        chunk->subh.init_hdr = (sctp_inithdr_t *)chunk->skb->data;
 382
 383        /* Tag the variable length parameters.  */
 384        chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(sctp_inithdr_t));
 385
 386        new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC);
 387        if (!new_asoc)
 388                goto nomem;
 389
 390        if (sctp_assoc_set_bind_addr_from_ep(new_asoc,
 391                                             sctp_scope(sctp_source(chunk)),
 392                                             GFP_ATOMIC) < 0)
 393                goto nomem_init;
 394
 395        /* The call, sctp_process_init(), can fail on memory allocation.  */
 396        if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk),
 397                               (sctp_init_chunk_t *)chunk->chunk_hdr,
 398                               GFP_ATOMIC))
 399                goto nomem_init;
 400
 401        /* B) "Z" shall respond immediately with an INIT ACK chunk.  */
 402
 403        /* If there are errors need to be reported for unknown parameters,
 404         * make sure to reserve enough room in the INIT ACK for them.
 405         */
 406        len = 0;
 407        if (err_chunk)
 408                len = ntohs(err_chunk->chunk_hdr->length) -
 409                        sizeof(sctp_chunkhdr_t);
 410
 411        repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
 412        if (!repl)
 413                goto nomem_init;
 414
 415        /* If there are errors need to be reported for unknown parameters,
 416         * include them in the outgoing INIT ACK as "Unrecognized parameter"
 417         * parameter.
 418         */
 419        if (err_chunk) {
 420                /* Get the "Unrecognized parameter" parameter(s) out of the
 421                 * ERROR chunk generated by sctp_verify_init(). Since the
 422                 * error cause code for "unknown parameter" and the
 423                 * "Unrecognized parameter" type is the same, we can
 424                 * construct the parameters in INIT ACK by copying the
 425                 * ERROR causes over.
 426                 */
 427                unk_param = (sctp_unrecognized_param_t *)
 428                            ((__u8 *)(err_chunk->chunk_hdr) +
 429                            sizeof(sctp_chunkhdr_t));
 430                /* Replace the cause code with the "Unrecognized parameter"
 431                 * parameter type.
 432                 */
 433                sctp_addto_chunk(repl, len, unk_param);
 434                sctp_chunk_free(err_chunk);
 435        }
 436
 437        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
 438
 439        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
 440
 441        /*
 442         * Note:  After sending out INIT ACK with the State Cookie parameter,
 443         * "Z" MUST NOT allocate any resources, nor keep any states for the
 444         * new association.  Otherwise, "Z" will be vulnerable to resource
 445         * attacks.
 446         */
 447        sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
 448
 449        return SCTP_DISPOSITION_DELETE_TCB;
 450
 451nomem_init:
 452        sctp_association_free(new_asoc);
 453nomem:
 454        if (err_chunk)
 455                sctp_chunk_free(err_chunk);
 456        return SCTP_DISPOSITION_NOMEM;
 457}
 458
 459/*
 460 * Respond to a normal INIT ACK chunk.
 461 * We are the side that is initiating the association.
 462 *
 463 * Section: 5.1 Normal Establishment of an Association, C
 464 * C) Upon reception of the INIT ACK from "Z", "A" shall stop the T1-init
 465 *    timer and leave COOKIE-WAIT state. "A" shall then send the State
 466 *    Cookie received in the INIT ACK chunk in a COOKIE ECHO chunk, start
 467 *    the T1-cookie timer, and enter the COOKIE-ECHOED state.
 468 *
 469 *    Note: The COOKIE ECHO chunk can be bundled with any pending outbound
 470 *    DATA chunks, but it MUST be the first chunk in the packet and
 471 *    until the COOKIE ACK is returned the sender MUST NOT send any
 472 *    other packets to the peer.
 473 *
 474 * Verification Tag: 3.3.3
 475 *   If the value of the Initiate Tag in a received INIT ACK chunk is
 476 *   found to be 0, the receiver MUST treat it as an error and close the
 477 *   association by transmitting an ABORT.
 478 *
 479 * Inputs
 480 * (endpoint, asoc, chunk)
 481 *
 482 * Outputs
 483 * (asoc, reply_msg, msg_up, timers, counters)
 484 *
 485 * The return value is the disposition of the chunk.
 486 */
 487sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
 488                                       const struct sctp_association *asoc,
 489                                       const sctp_subtype_t type,
 490                                       void *arg,
 491                                       sctp_cmd_seq_t *commands)
 492{
 493        struct sctp_chunk *chunk = arg;
 494        sctp_init_chunk_t *initchunk;
 495        struct sctp_chunk *err_chunk;
 496        struct sctp_packet *packet;
 497
 498        if (!sctp_vtag_verify(chunk, asoc))
 499                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
 500
 501        /* 6.10 Bundling
 502         * An endpoint MUST NOT bundle INIT, INIT ACK or
 503         * SHUTDOWN COMPLETE with any other chunks.
 504         */
 505        if (!chunk->singleton)
 506                return sctp_sf_violation_chunk(ep, asoc, type, arg, commands);
 507
 508        /* Make sure that the INIT-ACK chunk has a valid length */
 509        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_initack_chunk_t)))
 510                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
 511                                                  commands);
 512        /* Grab the INIT header.  */
 513        chunk->subh.init_hdr = (sctp_inithdr_t *) chunk->skb->data;
 514
 515        /* Verify the INIT chunk before processing it. */
 516        err_chunk = NULL;
 517        if (!sctp_verify_init(asoc, chunk->chunk_hdr->type,
 518                              (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
 519                              &err_chunk)) {
 520
 521                sctp_error_t error = SCTP_ERROR_NO_RESOURCE;
 522
 523                /* This chunk contains fatal error. It is to be discarded.
 524                 * Send an ABORT, with causes.  If there are no causes,
 525                 * then there wasn't enough memory.  Just terminate
 526                 * the association.
 527                 */
 528                if (err_chunk) {
 529                        packet = sctp_abort_pkt_new(ep, asoc, arg,
 530                                        (__u8 *)(err_chunk->chunk_hdr) +
 531                                        sizeof(sctp_chunkhdr_t),
 532                                        ntohs(err_chunk->chunk_hdr->length) -
 533                                        sizeof(sctp_chunkhdr_t));
 534
 535                        sctp_chunk_free(err_chunk);
 536
 537                        if (packet) {
 538                                sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
 539                                                SCTP_PACKET(packet));
 540                                SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
 541                                error = SCTP_ERROR_INV_PARAM;
 542                        }
 543                }
 544
 545                /* SCTP-AUTH, Section 6.3:
 546                 *    It should be noted that if the receiver wants to tear
 547                 *    down an association in an authenticated way only, the
 548                 *    handling of malformed packets should not result in
 549                 *    tearing down the association.
 550                 *
 551                 * This means that if we only want to abort associations
 552                 * in an authenticated way (i.e AUTH+ABORT), then we
 553                 * can't destroy this association just because the packet
 554                 * was malformed.
 555                 */
 556                if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
 557                        return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
 558
 559                SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
 560                return sctp_stop_t1_and_abort(commands, error, ECONNREFUSED,
 561                                                asoc, chunk->transport);
 562        }
 563
 564        /* Tag the variable length parameters.  Note that we never
 565         * convert the parameters in an INIT chunk.
 566         */
 567        chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(sctp_inithdr_t));
 568
 569        initchunk = (sctp_init_chunk_t *) chunk->chunk_hdr;
 570
 571        sctp_add_cmd_sf(commands, SCTP_CMD_PEER_INIT,
 572                        SCTP_PEER_INIT(initchunk));
 573
 574        /* Reset init error count upon receipt of INIT-ACK.  */
 575        sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());
 576
 577        /* 5.1 C) "A" shall stop the T1-init timer and leave
 578         * COOKIE-WAIT state.  "A" shall then ... start the T1-cookie
 579         * timer, and enter the COOKIE-ECHOED state.
 580         */
 581        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
 582                        SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
 583        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
 584                        SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
 585        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
 586                        SCTP_STATE(SCTP_STATE_COOKIE_ECHOED));
 587
 588        /* SCTP-AUTH: genereate the assocition shared keys so that
 589         * we can potentially signe the COOKIE-ECHO.
 590         */
 591        sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_SHKEY, SCTP_NULL());
 592
 593        /* 5.1 C) "A" shall then send the State Cookie received in the
 594         * INIT ACK chunk in a COOKIE ECHO chunk, ...
 595         */
 596        /* If there is any errors to report, send the ERROR chunk generated
 597         * for unknown parameters as well.
 598         */
 599        sctp_add_cmd_sf(commands, SCTP_CMD_GEN_COOKIE_ECHO,
 600                        SCTP_CHUNK(err_chunk));
 601
 602        return SCTP_DISPOSITION_CONSUME;
 603}
 604
 605/*
 606 * Respond to a normal COOKIE ECHO chunk.
 607 * We are the side that is being asked for an association.
 608 *
 609 * Section: 5.1 Normal Establishment of an Association, D
 610 * D) Upon reception of the COOKIE ECHO chunk, Endpoint "Z" will reply
 611 *    with a COOKIE ACK chunk after building a TCB and moving to
 612 *    the ESTABLISHED state. A COOKIE ACK chunk may be bundled with
 613 *    any pending DATA chunks (and/or SACK chunks), but the COOKIE ACK
 614 *    chunk MUST be the first chunk in the packet.
 615 *
 616 *   IMPLEMENTATION NOTE: An implementation may choose to send the
 617 *   Communication Up notification to the SCTP user upon reception
 618 *   of a valid COOKIE ECHO chunk.
 619 *
 620 * Verification Tag: 8.5.1 Exceptions in Verification Tag Rules
 621 * D) Rules for packet carrying a COOKIE ECHO
 622 *
 623 * - When sending a COOKIE ECHO, the endpoint MUST use the value of the
 624 *   Initial Tag received in the INIT ACK.
 625 *
 626 * - The receiver of a COOKIE ECHO follows the procedures in Section 5.
 627 *
 628 * Inputs
 629 * (endpoint, asoc, chunk)
 630 *
 631 * Outputs
 632 * (asoc, reply_msg, msg_up, timers, counters)
 633 *
 634 * The return value is the disposition of the chunk.
 635 */
 636sctp_disposition_t sctp_sf_do_5_1D_ce(const struct sctp_endpoint *ep,
 637                                      const struct sctp_association *asoc,
 638                                      const sctp_subtype_t type, void *arg,
 639                                      sctp_cmd_seq_t *commands)
 640{
 641        struct sctp_chunk *chunk = arg;
 642        struct sctp_association *new_asoc;
 643        sctp_init_chunk_t *peer_init;
 644        struct sctp_chunk *repl;
 645        struct sctp_ulpevent *ev, *ai_ev = NULL;
 646        int error = 0;
 647        struct sctp_chunk *err_chk_p;
 648        struct sock *sk;
 649
 650        /* If the packet is an OOTB packet which is temporarily on the
 651         * control endpoint, respond with an ABORT.
 652         */
 653        if (ep == sctp_sk((sctp_get_ctl_sock()))->ep) {
 654                SCTP_INC_STATS(SCTP_MIB_OUTOFBLUES);
 655                return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
 656        }
 657
 658        /* Make sure that the COOKIE_ECHO chunk has a valid length.
 659         * In this case, we check that we have enough for at least a
 660         * chunk header.  More detailed verification is done
 661         * in sctp_unpack_cookie().
 662         */
 663        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
 664                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
 665
 666        /* If the endpoint is not listening or if the number of associations
 667         * on the TCP-style socket exceed the max backlog, respond with an
 668         * ABORT.
 669         */
 670        sk = ep->base.sk;
 671        if (!sctp_sstate(sk, LISTENING) ||
 672            (sctp_style(sk, TCP) && sk_acceptq_is_full(sk)))
 673                return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
 674
 675        /* "Decode" the chunk.  We have no optional parameters so we
 676         * are in good shape.
 677         */
 678        chunk->subh.cookie_hdr =
 679                (struct sctp_signed_cookie *)chunk->skb->data;
 680        if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
 681                                         sizeof(sctp_chunkhdr_t)))
 682                goto nomem;
 683
 684        /* 5.1 D) Upon reception of the COOKIE ECHO chunk, Endpoint
 685         * "Z" will reply with a COOKIE ACK chunk after building a TCB
 686         * and moving to the ESTABLISHED state.
 687         */
 688        new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, &error,
 689                                      &err_chk_p);
 690
 691        /* FIXME:
 692         * If the re-build failed, what is the proper error path
 693         * from here?
 694         *
 695         * [We should abort the association. --piggy]
 696         */
 697        if (!new_asoc) {
 698                /* FIXME: Several errors are possible.  A bad cookie should
 699                 * be silently discarded, but think about logging it too.
 700                 */
 701                switch (error) {
 702                case -SCTP_IERROR_NOMEM:
 703                        goto nomem;
 704
 705                case -SCTP_IERROR_STALE_COOKIE:
 706                        sctp_send_stale_cookie_err(ep, asoc, chunk, commands,
 707                                                   err_chk_p);
 708                        return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
 709
 710                case -SCTP_IERROR_BAD_SIG:
 711                default:
 712                        return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
 713                }
 714        }
 715
 716
 717        /* Delay state machine commands until later.
 718         *
 719         * Re-build the bind address for the association is done in
 720         * the sctp_unpack_cookie() already.
 721         */
 722        /* This is a brand-new association, so these are not yet side
 723         * effects--it is safe to run them here.
 724         */
 725        peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
 726
 727        if (!sctp_process_init(new_asoc, chunk,
 728                               &chunk->subh.cookie_hdr->c.peer_addr,
 729                               peer_init, GFP_ATOMIC))
 730                goto nomem_init;
 731
 732        /* SCTP-AUTH:  Now that we've populate required fields in
 733         * sctp_process_init, set up the assocaition shared keys as
 734         * necessary so that we can potentially authenticate the ACK
 735         */
 736        error = sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC);
 737        if (error)
 738                goto nomem_init;
 739
 740        /* SCTP-AUTH:  auth_chunk pointer is only set when the cookie-echo
 741         * is supposed to be authenticated and we have to do delayed
 742         * authentication.  We've just recreated the association using
 743         * the information in the cookie and now it's much easier to
 744         * do the authentication.
 745         */
 746        if (chunk->auth_chunk) {
 747                struct sctp_chunk auth;
 748                sctp_ierror_t ret;
 749
 750                /* set-up our fake chunk so that we can process it */
 751                auth.skb = chunk->auth_chunk;
 752                auth.asoc = chunk->asoc;
 753                auth.sctp_hdr = chunk->sctp_hdr;
 754                auth.chunk_hdr = (sctp_chunkhdr_t *)skb_push(chunk->auth_chunk,
 755                                            sizeof(sctp_chunkhdr_t));
 756                skb_pull(chunk->auth_chunk, sizeof(sctp_chunkhdr_t));
 757                auth.transport = chunk->transport;
 758
 759                ret = sctp_sf_authenticate(ep, new_asoc, type, &auth);
 760
 761                /* We can now safely free the auth_chunk clone */
 762                kfree_skb(chunk->auth_chunk);
 763
 764                if (ret != SCTP_IERROR_NO_ERROR) {
 765                        sctp_association_free(new_asoc);
 766                        return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
 767                }
 768        }
 769
 770        repl = sctp_make_cookie_ack(new_asoc, chunk);
 771        if (!repl)
 772                goto nomem_init;
 773
 774        /* RFC 2960 5.1 Normal Establishment of an Association
 775         *
 776         * D) IMPLEMENTATION NOTE: An implementation may choose to
 777         * send the Communication Up notification to the SCTP user
 778         * upon reception of a valid COOKIE ECHO chunk.
 779         */
 780        ev = sctp_ulpevent_make_assoc_change(new_asoc, 0, SCTP_COMM_UP, 0,
 781                                             new_asoc->c.sinit_num_ostreams,
 782                                             new_asoc->c.sinit_max_instreams,
 783                                             NULL, GFP_ATOMIC);
 784        if (!ev)
 785                goto nomem_ev;
 786
 787        /* Sockets API Draft Section 5.3.1.6
 788         * When a peer sends a Adaptation Layer Indication parameter , SCTP
 789         * delivers this notification to inform the application that of the
 790         * peers requested adaptation layer.
 791         */
 792        if (new_asoc->peer.adaptation_ind) {
 793                ai_ev = sctp_ulpevent_make_adaptation_indication(new_asoc,
 794                                                            GFP_ATOMIC);
 795                if (!ai_ev)
 796                        goto nomem_aiev;
 797        }
 798
 799        /* Add all the state machine commands now since we've created
 800         * everything.  This way we don't introduce memory corruptions
 801         * during side-effect processing and correclty count established
 802         * associations.
 803         */
 804        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
 805        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
 806                        SCTP_STATE(SCTP_STATE_ESTABLISHED));
 807        SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
 808        SCTP_INC_STATS(SCTP_MIB_PASSIVEESTABS);
 809        sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
 810
 811        if (new_asoc->autoclose)
 812                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
 813                                SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
 814
 815        /* This will send the COOKIE ACK */
 816        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
 817
 818        /* Queue the ASSOC_CHANGE event */
 819        sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
 820
 821        /* Send up the Adaptation Layer Indication event */
 822        if (ai_ev)
 823                sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
 824                                SCTP_ULPEVENT(ai_ev));
 825
 826        return SCTP_DISPOSITION_CONSUME;
 827
 828nomem_aiev:
 829        sctp_ulpevent_free(ev);
 830nomem_ev:
 831        sctp_chunk_free(repl);
 832nomem_init:
 833        sctp_association_free(new_asoc);
 834nomem:
 835        return SCTP_DISPOSITION_NOMEM;
 836}
 837
 838/*
 839 * Respond to a normal COOKIE ACK chunk.
 840 * We are the side that is being asked for an association.
 841 *
 842 * RFC 2960 5.1 Normal Establishment of an Association
 843 *
 844 * E) Upon reception of the COOKIE ACK, endpoint "A" will move from the
 845 *    COOKIE-ECHOED state to the ESTABLISHED state, stopping the T1-cookie
 846 *    timer. It may also notify its ULP about the successful
 847 *    establishment of the association with a Communication Up
 848 *    notification (see Section 10).
 849 *
 850 * Verification Tag:
 851 * Inputs
 852 * (endpoint, asoc, chunk)
 853 *
 854 * Outputs
 855 * (asoc, reply_msg, msg_up, timers, counters)
 856 *
 857 * The return value is the disposition of the chunk.
 858 */
 859sctp_disposition_t sctp_sf_do_5_1E_ca(const struct sctp_endpoint *ep,
 860                                      const struct sctp_association *asoc,
 861                                      const sctp_subtype_t type, void *arg,
 862                                      sctp_cmd_seq_t *commands)
 863{
 864        struct sctp_chunk *chunk = arg;
 865        struct sctp_ulpevent *ev;
 866
 867        if (!sctp_vtag_verify(chunk, asoc))
 868                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
 869
 870        /* Verify that the chunk length for the COOKIE-ACK is OK.
 871         * If we don't do this, any bundled chunks may be junked.
 872         */
 873        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
 874                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
 875                                                  commands);
 876
 877        /* Reset init error count upon receipt of COOKIE-ACK,
 878         * to avoid problems with the managemement of this
 879         * counter in stale cookie situations when a transition back
 880         * from the COOKIE-ECHOED state to the COOKIE-WAIT
 881         * state is performed.
 882         */
 883        sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());
 884
 885        /* RFC 2960 5.1 Normal Establishment of an Association
 886         *
 887         * E) Upon reception of the COOKIE ACK, endpoint "A" will move
 888         * from the COOKIE-ECHOED state to the ESTABLISHED state,
 889         * stopping the T1-cookie timer.
 890         */
 891        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
 892                        SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
 893        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
 894                        SCTP_STATE(SCTP_STATE_ESTABLISHED));
 895        SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
 896        SCTP_INC_STATS(SCTP_MIB_ACTIVEESTABS);
 897        sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
 898        if (asoc->autoclose)
 899                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
 900                                SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
 901
 902        /* It may also notify its ULP about the successful
 903         * establishment of the association with a Communication Up
 904         * notification (see Section 10).
 905         */
 906        ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_COMM_UP,
 907                                             0, asoc->c.sinit_num_ostreams,
 908                                             asoc->c.sinit_max_instreams,
 909                                             NULL, GFP_ATOMIC);
 910
 911        if (!ev)
 912                goto nomem;
 913
 914        sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
 915
 916        /* Sockets API Draft Section 5.3.1.6
 917         * When a peer sends a Adaptation Layer Indication parameter , SCTP
 918         * delivers this notification to inform the application that of the
 919         * peers requested adaptation layer.
 920         */
 921        if (asoc->peer.adaptation_ind) {
 922                ev = sctp_ulpevent_make_adaptation_indication(asoc, GFP_ATOMIC);
 923                if (!ev)
 924                        goto nomem;
 925
 926                sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
 927                                SCTP_ULPEVENT(ev));
 928        }
 929
 930        return SCTP_DISPOSITION_CONSUME;
 931nomem:
 932        return SCTP_DISPOSITION_NOMEM;
 933}
 934
 935/* Generate and sendout a heartbeat packet.  */
 936static sctp_disposition_t sctp_sf_heartbeat(const struct sctp_endpoint *ep,
 937                                            const struct sctp_association *asoc,
 938                                            const sctp_subtype_t type,
 939                                            void *arg,
 940                                            sctp_cmd_seq_t *commands)
 941{
 942        struct sctp_transport *transport = (struct sctp_transport *) arg;
 943        struct sctp_chunk *reply;
 944
 945        /* Send a heartbeat to our peer.  */
 946        reply = sctp_make_heartbeat(asoc, transport);
 947        if (!reply)
 948                return SCTP_DISPOSITION_NOMEM;
 949
 950        /* Set rto_pending indicating that an RTT measurement
 951         * is started with this heartbeat chunk.
 952         */
 953        sctp_add_cmd_sf(commands, SCTP_CMD_RTO_PENDING,
 954                        SCTP_TRANSPORT(transport));
 955
 956        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
 957        return SCTP_DISPOSITION_CONSUME;
 958}
 959
 960/* Generate a HEARTBEAT packet on the given transport.  */
 961sctp_disposition_t sctp_sf_sendbeat_8_3(const struct sctp_endpoint *ep,
 962                                        const struct sctp_association *asoc,
 963                                        const sctp_subtype_t type,
 964                                        void *arg,
 965                                        sctp_cmd_seq_t *commands)
 966{
 967        struct sctp_transport *transport = (struct sctp_transport *) arg;
 968
 969        if (asoc->overall_error_count >= asoc->max_retrans) {
 970                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
 971                                SCTP_ERROR(ETIMEDOUT));
 972                /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
 973                sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
 974                                SCTP_PERR(SCTP_ERROR_NO_ERROR));
 975                SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
 976                SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
 977                return SCTP_DISPOSITION_DELETE_TCB;
 978        }
 979
 980        /* Section 3.3.5.
 981         * The Sender-specific Heartbeat Info field should normally include
 982         * information about the sender's current time when this HEARTBEAT
 983         * chunk is sent and the destination transport address to which this
 984         * HEARTBEAT is sent (see Section 8.3).
 985         */
 986
 987        if (transport->param_flags & SPP_HB_ENABLE) {
 988                if (SCTP_DISPOSITION_NOMEM ==
 989                                sctp_sf_heartbeat(ep, asoc, type, arg,
 990                                                  commands))
 991                        return SCTP_DISPOSITION_NOMEM;
 992
 993                /* Set transport error counter and association error counter
 994                 * when sending heartbeat.
 995                 */
 996                sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_HB_SENT,
 997                                SCTP_TRANSPORT(transport));
 998        }
 999        sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_IDLE,
1000                        SCTP_TRANSPORT(transport));
1001        sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMER_UPDATE,
1002                        SCTP_TRANSPORT(transport));
1003
1004        return SCTP_DISPOSITION_CONSUME;
1005}
1006
1007/*
1008 * Process an heartbeat request.
1009 *
1010 * Section: 8.3 Path Heartbeat
1011 * The receiver of the HEARTBEAT should immediately respond with a
1012 * HEARTBEAT ACK that contains the Heartbeat Information field copied
1013 * from the received HEARTBEAT chunk.
1014 *
1015 * Verification Tag:  8.5 Verification Tag [Normal verification]
1016 * When receiving an SCTP packet, the endpoint MUST ensure that the
1017 * value in the Verification Tag field of the received SCTP packet
1018 * matches its own Tag. If the received Verification Tag value does not
1019 * match the receiver's own tag value, the receiver shall silently
1020 * discard the packet and shall not process it any further except for
1021 * those cases listed in Section 8.5.1 below.
1022 *
1023 * Inputs
1024 * (endpoint, asoc, chunk)
1025 *
1026 * Outputs
1027 * (asoc, reply_msg, msg_up, timers, counters)
1028 *
1029 * The return value is the disposition of the chunk.
1030 */
1031sctp_disposition_t sctp_sf_beat_8_3(const struct sctp_endpoint *ep,
1032                                    const struct sctp_association *asoc,
1033                                    const sctp_subtype_t type,
1034                                    void *arg,
1035                                    sctp_cmd_seq_t *commands)
1036{
1037        struct sctp_chunk *chunk = arg;
1038        struct sctp_chunk *reply;
1039        size_t paylen = 0;
1040
1041        if (!sctp_vtag_verify(chunk, asoc))
1042                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
1043
1044        /* Make sure that the HEARTBEAT chunk has a valid length. */
1045        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_heartbeat_chunk_t)))
1046                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
1047                                                  commands);
1048
1049        /* 8.3 The receiver of the HEARTBEAT should immediately
1050         * respond with a HEARTBEAT ACK that contains the Heartbeat
1051         * Information field copied from the received HEARTBEAT chunk.
1052         */
1053        chunk->subh.hb_hdr = (sctp_heartbeathdr_t *) chunk->skb->data;
1054        paylen = ntohs(chunk->chunk_hdr->length) - sizeof(sctp_chunkhdr_t);
1055        if (!pskb_pull(chunk->skb, paylen))
1056                goto nomem;
1057
1058        reply = sctp_make_heartbeat_ack(asoc, chunk,
1059                                        chunk->subh.hb_hdr, paylen);
1060        if (!reply)
1061                goto nomem;
1062
1063        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
1064        return SCTP_DISPOSITION_CONSUME;
1065
1066nomem:
1067        return SCTP_DISPOSITION_NOMEM;
1068}
1069
1070/*
1071 * Process the returning HEARTBEAT ACK.
1072 *
1073 * Section: 8.3 Path Heartbeat
1074 * Upon the receipt of the HEARTBEAT ACK, the sender of the HEARTBEAT
1075 * should clear the error counter of the destination transport
1076 * address to which the HEARTBEAT was sent, and mark the destination
1077 * transport address as active if it is not so marked. The endpoint may
1078 * optionally report to the upper layer when an inactive destination
1079 * address is marked as active due to the reception of the latest
1080 * HEARTBEAT ACK. The receiver of the HEARTBEAT ACK must also
1081 * clear the association overall error count as well (as defined
1082 * in section 8.1).
1083 *
1084 * The receiver of the HEARTBEAT ACK should also perform an RTT
1085 * measurement for that destination transport address using the time
1086 * value carried in the HEARTBEAT ACK chunk.
1087 *
1088 * Verification Tag:  8.5 Verification Tag [Normal verification]
1089 *
1090 * Inputs
1091 * (endpoint, asoc, chunk)
1092 *
1093 * Outputs
1094 * (asoc, reply_msg, msg_up, timers, counters)
1095 *
1096 * The return value is the disposition of the chunk.
1097 */
1098sctp_disposition_t sctp_sf_backbeat_8_3(const struct sctp_endpoint *ep,
1099                                        const struct sctp_association *asoc,
1100                                        const sctp_subtype_t type,
1101                                        void *arg,
1102                                        sctp_cmd_seq_t *commands)
1103{
1104        struct sctp_chunk *chunk = arg;
1105        union sctp_addr from_addr;
1106        struct sctp_transport *link;
1107        sctp_sender_hb_info_t *hbinfo;
1108        unsigned long max_interval;
1109
1110        if (!sctp_vtag_verify(chunk, asoc))
1111                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
1112
1113        /* Make sure that the HEARTBEAT-ACK chunk has a valid length.  */
1114        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t) +
1115                                            sizeof(sctp_sender_hb_info_t)))
1116                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
1117                                                  commands);
1118
1119        hbinfo = (sctp_sender_hb_info_t *) chunk->skb->data;
1120        /* Make sure that the length of the parameter is what we expect */
1121        if (ntohs(hbinfo->param_hdr.length) !=
1122                                    sizeof(sctp_sender_hb_info_t)) {
1123                return SCTP_DISPOSITION_DISCARD;
1124        }
1125
1126        from_addr = hbinfo->daddr;
1127        link = sctp_assoc_lookup_paddr(asoc, &from_addr);
1128
1129        /* This should never happen, but lets log it if so.  */
1130        if (unlikely(!link)) {
1131                if (from_addr.sa.sa_family == AF_INET6) {
1132                        net_warn_ratelimited("%s association %p could not find address %pI6\n",
1133                                             __func__,
1134                                             asoc,
1135                                             &from_addr.v6.sin6_addr);
1136                } else {
1137                        net_warn_ratelimited("%s association %p could not find address %pI4\n",
1138                                             __func__,
1139                                             asoc,
1140                                             &from_addr.v4.sin_addr.s_addr);
1141                }
1142                return SCTP_DISPOSITION_DISCARD;
1143        }
1144
1145        /* Validate the 64-bit random nonce. */
1146        if (hbinfo->hb_nonce != link->hb_nonce)
1147                return SCTP_DISPOSITION_DISCARD;
1148
1149        max_interval = link->hbinterval + link->rto;
1150
1151        /* Check if the timestamp looks valid.  */
1152        if (time_after(hbinfo->sent_at, jiffies) ||
1153            time_after(jiffies, hbinfo->sent_at + max_interval)) {
1154                SCTP_DEBUG_PRINTK("%s: HEARTBEAT ACK with invalid timestamp "
1155                                  "received for transport: %p\n",
1156                                   __func__, link);
1157                return SCTP_DISPOSITION_DISCARD;
1158        }
1159
1160        /* 8.3 Upon the receipt of the HEARTBEAT ACK, the sender of
1161         * the HEARTBEAT should clear the error counter of the
1162         * destination transport address to which the HEARTBEAT was
1163         * sent and mark the destination transport address as active if
1164         * it is not so marked.
1165         */
1166        sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_ON, SCTP_TRANSPORT(link));
1167
1168        return SCTP_DISPOSITION_CONSUME;
1169}
1170
1171/* Helper function to send out an abort for the restart
1172 * condition.
1173 */
1174static int sctp_sf_send_restart_abort(union sctp_addr *ssa,
1175                                      struct sctp_chunk *init,
1176                                      sctp_cmd_seq_t *commands)
1177{
1178        int len;
1179        struct sctp_packet *pkt;
1180        union sctp_addr_param *addrparm;
1181        struct sctp_errhdr *errhdr;
1182        struct sctp_endpoint *ep;
1183        char buffer[sizeof(struct sctp_errhdr)+sizeof(union sctp_addr_param)];
1184        struct sctp_af *af = sctp_get_af_specific(ssa->v4.sin_family);
1185
1186        /* Build the error on the stack.   We are way to malloc crazy
1187         * throughout the code today.
1188         */
1189        errhdr = (struct sctp_errhdr *)buffer;
1190        addrparm = (union sctp_addr_param *)errhdr->variable;
1191
1192        /* Copy into a parm format. */
1193        len = af->to_addr_param(ssa, addrparm);
1194        len += sizeof(sctp_errhdr_t);
1195
1196        errhdr->cause = SCTP_ERROR_RESTART;
1197        errhdr->length = htons(len);
1198
1199        /* Assign to the control socket. */
1200        ep = sctp_sk((sctp_get_ctl_sock()))->ep;
1201
1202        /* Association is NULL since this may be a restart attack and we
1203         * want to send back the attacker's vtag.
1204         */
1205        pkt = sctp_abort_pkt_new(ep, NULL, init, errhdr, len);
1206
1207        if (!pkt)
1208                goto out;
1209        sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT, SCTP_PACKET(pkt));
1210
1211        SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
1212
1213        /* Discard the rest of the inbound packet. */
1214        sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
1215
1216out:
1217        /* Even if there is no memory, treat as a failure so
1218         * the packet will get dropped.
1219         */
1220        return 0;
1221}
1222
1223static bool list_has_sctp_addr(const struct list_head *list,
1224                               union sctp_addr *ipaddr)
1225{
1226        struct sctp_transport *addr;
1227
1228        list_for_each_entry(addr, list, transports) {
1229                if (sctp_cmp_addr_exact(ipaddr, &addr->ipaddr))
1230                        return true;
1231        }
1232
1233        return false;
1234}
1235/* A restart is occurring, check to make sure no new addresses
1236 * are being added as we may be under a takeover attack.
1237 */
1238static int sctp_sf_check_restart_addrs(const struct sctp_association *new_asoc,
1239                                       const struct sctp_association *asoc,
1240                                       struct sctp_chunk *init,
1241                                       sctp_cmd_seq_t *commands)
1242{
1243        struct sctp_transport *new_addr;
1244        int ret = 1;
1245
1246        /* Implementor's Guide - Section 5.2.2
1247         * ...
1248         * Before responding the endpoint MUST check to see if the
1249         * unexpected INIT adds new addresses to the association. If new
1250         * addresses are added to the association, the endpoint MUST respond
1251         * with an ABORT..
1252         */
1253
1254        /* Search through all current addresses and make sure
1255         * we aren't adding any new ones.
1256         */
1257        list_for_each_entry(new_addr, &new_asoc->peer.transport_addr_list,
1258                            transports) {
1259                if (!list_has_sctp_addr(&asoc->peer.transport_addr_list,
1260                                        &new_addr->ipaddr)) {
1261                        sctp_sf_send_restart_abort(&new_addr->ipaddr, init,
1262                                                   commands);
1263                        ret = 0;
1264                        break;
1265                }
1266        }
1267
1268        /* Return success if all addresses were found. */
1269        return ret;
1270}
1271
1272/* Populate the verification/tie tags based on overlapping INIT
1273 * scenario.
1274 *
1275 * Note: Do not use in CLOSED or SHUTDOWN-ACK-SENT state.
1276 */
1277static void sctp_tietags_populate(struct sctp_association *new_asoc,
1278                                  const struct sctp_association *asoc)
1279{
1280        switch (asoc->state) {
1281
1282        /* 5.2.1 INIT received in COOKIE-WAIT or COOKIE-ECHOED State */
1283
1284        case SCTP_STATE_COOKIE_WAIT:
1285                new_asoc->c.my_vtag     = asoc->c.my_vtag;
1286                new_asoc->c.my_ttag     = asoc->c.my_vtag;
1287                new_asoc->c.peer_ttag   = 0;
1288                break;
1289
1290        case SCTP_STATE_COOKIE_ECHOED:
1291                new_asoc->c.my_vtag     = asoc->c.my_vtag;
1292                new_asoc->c.my_ttag     = asoc->c.my_vtag;
1293                new_asoc->c.peer_ttag   = asoc->c.peer_vtag;
1294                break;
1295
1296        /* 5.2.2 Unexpected INIT in States Other than CLOSED, COOKIE-ECHOED,
1297         * COOKIE-WAIT and SHUTDOWN-ACK-SENT
1298         */
1299        default:
1300                new_asoc->c.my_ttag   = asoc->c.my_vtag;
1301                new_asoc->c.peer_ttag = asoc->c.peer_vtag;
1302                break;
1303        }
1304
1305        /* Other parameters for the endpoint SHOULD be copied from the
1306         * existing parameters of the association (e.g. number of
1307         * outbound streams) into the INIT ACK and cookie.
1308         */
1309        new_asoc->rwnd                  = asoc->rwnd;
1310        new_asoc->c.sinit_num_ostreams  = asoc->c.sinit_num_ostreams;
1311        new_asoc->c.sinit_max_instreams = asoc->c.sinit_max_instreams;
1312        new_asoc->c.initial_tsn         = asoc->c.initial_tsn;
1313}
1314
1315/*
1316 * Compare vtag/tietag values to determine unexpected COOKIE-ECHO
1317 * handling action.
1318 *
1319 * RFC 2960 5.2.4 Handle a COOKIE ECHO when a TCB exists.
1320 *
1321 * Returns value representing action to be taken.   These action values
1322 * correspond to Action/Description values in RFC 2960, Table 2.
1323 */
1324static char sctp_tietags_compare(struct sctp_association *new_asoc,
1325                                 const struct sctp_association *asoc)
1326{
1327        /* In this case, the peer may have restarted.  */
1328        if ((asoc->c.my_vtag != new_asoc->c.my_vtag) &&
1329            (asoc->c.peer_vtag != new_asoc->c.peer_vtag) &&
1330            (asoc->c.my_vtag == new_asoc->c.my_ttag) &&
1331            (asoc->c.peer_vtag == new_asoc->c.peer_ttag))
1332                return 'A';
1333
1334        /* Collision case B. */
1335        if ((asoc->c.my_vtag == new_asoc->c.my_vtag) &&
1336            ((asoc->c.peer_vtag != new_asoc->c.peer_vtag) ||
1337             (0 == asoc->c.peer_vtag))) {
1338                return 'B';
1339        }
1340
1341        /* Collision case D. */
1342        if ((asoc->c.my_vtag == new_asoc->c.my_vtag) &&
1343            (asoc->c.peer_vtag == new_asoc->c.peer_vtag))
1344                return 'D';
1345
1346        /* Collision case C. */
1347        if ((asoc->c.my_vtag != new_asoc->c.my_vtag) &&
1348            (asoc->c.peer_vtag == new_asoc->c.peer_vtag) &&
1349            (0 == new_asoc->c.my_ttag) &&
1350            (0 == new_asoc->c.peer_ttag))
1351                return 'C';
1352
1353        /* No match to any of the special cases; discard this packet. */
1354        return 'E';
1355}
1356
1357/* Common helper routine for both duplicate and simulataneous INIT
1358 * chunk handling.
1359 */
1360static sctp_disposition_t sctp_sf_do_unexpected_init(
1361        const struct sctp_endpoint *ep,
1362        const struct sctp_association *asoc,
1363        const sctp_subtype_t type,
1364        void *arg, sctp_cmd_seq_t *commands)
1365{
1366        sctp_disposition_t retval;
1367        struct sctp_chunk *chunk = arg;
1368        struct sctp_chunk *repl;
1369        struct sctp_association *new_asoc;
1370        struct sctp_chunk *err_chunk;
1371        struct sctp_packet *packet;
1372        sctp_unrecognized_param_t *unk_param;
1373        int len;
1374
1375        /* 6.10 Bundling
1376         * An endpoint MUST NOT bundle INIT, INIT ACK or
1377         * SHUTDOWN COMPLETE with any other chunks.
1378         *
1379         * IG Section 2.11.2
1380         * Furthermore, we require that the receiver of an INIT chunk MUST
1381         * enforce these rules by silently discarding an arriving packet
1382         * with an INIT chunk that is bundled with other chunks.
1383         */
1384        if (!chunk->singleton)
1385                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
1386
1387        /* 3.1 A packet containing an INIT chunk MUST have a zero Verification
1388         * Tag.
1389         */
1390        if (chunk->sctp_hdr->vtag != 0)
1391                return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
1392
1393        /* Make sure that the INIT chunk has a valid length.
1394         * In this case, we generate a protocol violation since we have
1395         * an association established.
1396         */
1397        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_init_chunk_t)))
1398                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
1399                                                  commands);
1400        /* Grab the INIT header.  */
1401        chunk->subh.init_hdr = (sctp_inithdr_t *) chunk->skb->data;
1402
1403        /* Tag the variable length parameters.  */
1404        chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(sctp_inithdr_t));
1405
1406        /* Verify the INIT chunk before processing it. */
1407        err_chunk = NULL;
1408        if (!sctp_verify_init(asoc, chunk->chunk_hdr->type,
1409                              (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
1410                              &err_chunk)) {
1411                /* This chunk contains fatal error. It is to be discarded.
1412                 * Send an ABORT, with causes if there is any.
1413                 */
1414                if (err_chunk) {
1415                        packet = sctp_abort_pkt_new(ep, asoc, arg,
1416                                        (__u8 *)(err_chunk->chunk_hdr) +
1417                                        sizeof(sctp_chunkhdr_t),
1418                                        ntohs(err_chunk->chunk_hdr->length) -
1419                                        sizeof(sctp_chunkhdr_t));
1420
1421                        if (packet) {
1422                                sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
1423                                                SCTP_PACKET(packet));
1424                                SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
1425                                retval = SCTP_DISPOSITION_CONSUME;
1426                        } else {
1427                                retval = SCTP_DISPOSITION_NOMEM;
1428                        }
1429                        goto cleanup;
1430                } else {
1431                        return sctp_sf_tabort_8_4_8(ep, asoc, type, arg,
1432                                                    commands);
1433                }
1434        }
1435
1436        /*
1437         * Other parameters for the endpoint SHOULD be copied from the
1438         * existing parameters of the association (e.g. number of
1439         * outbound streams) into the INIT ACK and cookie.
1440         * FIXME:  We are copying parameters from the endpoint not the
1441         * association.
1442         */
1443        new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC);
1444        if (!new_asoc)
1445                goto nomem;
1446
1447        if (sctp_assoc_set_bind_addr_from_ep(new_asoc,
1448                                sctp_scope(sctp_source(chunk)), GFP_ATOMIC) < 0)
1449                goto nomem;
1450
1451        /* In the outbound INIT ACK the endpoint MUST copy its current
1452         * Verification Tag and Peers Verification tag into a reserved
1453         * place (local tie-tag and per tie-tag) within the state cookie.
1454         */
1455        if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk),
1456                               (sctp_init_chunk_t *)chunk->chunk_hdr,
1457                               GFP_ATOMIC))
1458                goto nomem;
1459
1460        /* Make sure no new addresses are being added during the
1461         * restart.   Do not do this check for COOKIE-WAIT state,
1462         * since there are no peer addresses to check against.
1463         * Upon return an ABORT will have been sent if needed.
1464         */
1465        if (!sctp_state(asoc, COOKIE_WAIT)) {
1466                if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk,
1467                                                 commands)) {
1468                        retval = SCTP_DISPOSITION_CONSUME;
1469                        goto nomem_retval;
1470                }
1471        }
1472
1473        sctp_tietags_populate(new_asoc, asoc);
1474
1475        /* B) "Z" shall respond immediately with an INIT ACK chunk.  */
1476
1477        /* If there are errors need to be reported for unknown parameters,
1478         * make sure to reserve enough room in the INIT ACK for them.
1479         */
1480        len = 0;
1481        if (err_chunk) {
1482                len = ntohs(err_chunk->chunk_hdr->length) -
1483                        sizeof(sctp_chunkhdr_t);
1484        }
1485
1486        repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
1487        if (!repl)
1488                goto nomem;
1489
1490        /* If there are errors need to be reported for unknown parameters,
1491         * include them in the outgoing INIT ACK as "Unrecognized parameter"
1492         * parameter.
1493         */
1494        if (err_chunk) {
1495                /* Get the "Unrecognized parameter" parameter(s) out of the
1496                 * ERROR chunk generated by sctp_verify_init(). Since the
1497                 * error cause code for "unknown parameter" and the
1498                 * "Unrecognized parameter" type is the same, we can
1499                 * construct the parameters in INIT ACK by copying the
1500                 * ERROR causes over.
1501                 */
1502                unk_param = (sctp_unrecognized_param_t *)
1503                            ((__u8 *)(err_chunk->chunk_hdr) +
1504                            sizeof(sctp_chunkhdr_t));
1505                /* Replace the cause code with the "Unrecognized parameter"
1506                 * parameter type.
1507                 */
1508                sctp_addto_chunk(repl, len, unk_param);
1509        }
1510
1511        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
1512        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1513
1514        /*
1515         * Note: After sending out INIT ACK with the State Cookie parameter,
1516         * "Z" MUST NOT allocate any resources for this new association.
1517         * Otherwise, "Z" will be vulnerable to resource attacks.
1518         */
1519        sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
1520        retval = SCTP_DISPOSITION_CONSUME;
1521
1522        return retval;
1523
1524nomem:
1525        retval = SCTP_DISPOSITION_NOMEM;
1526nomem_retval:
1527        if (new_asoc)
1528                sctp_association_free(new_asoc);
1529cleanup:
1530        if (err_chunk)
1531                sctp_chunk_free(err_chunk);
1532        return retval;
1533}
1534
1535/*
1536 * Handle simultaneous INIT.
1537 * This means we started an INIT and then we got an INIT request from
1538 * our peer.
1539 *
1540 * Section: 5.2.1 INIT received in COOKIE-WAIT or COOKIE-ECHOED State (Item B)
1541 * This usually indicates an initialization collision, i.e., each
1542 * endpoint is attempting, at about the same time, to establish an
1543 * association with the other endpoint.
1544 *
1545 * Upon receipt of an INIT in the COOKIE-WAIT or COOKIE-ECHOED state, an
1546 * endpoint MUST respond with an INIT ACK using the same parameters it
1547 * sent in its original INIT chunk (including its Verification Tag,
1548 * unchanged). These original parameters are combined with those from the
1549 * newly received INIT chunk. The endpoint shall also generate a State
1550 * Cookie with the INIT ACK. The endpoint uses the parameters sent in its
1551 * INIT to calculate the State Cookie.
1552 *
1553 * After that, the endpoint MUST NOT change its state, the T1-init
1554 * timer shall be left running and the corresponding TCB MUST NOT be
1555 * destroyed. The normal procedures for handling State Cookies when
1556 * a TCB exists will resolve the duplicate INITs to a single association.
1557 *
1558 * For an endpoint that is in the COOKIE-ECHOED state it MUST populate
1559 * its Tie-Tags with the Tag information of itself and its peer (see
1560 * section 5.2.2 for a description of the Tie-Tags).
1561 *
1562 * Verification Tag: Not explicit, but an INIT can not have a valid
1563 * verification tag, so we skip the check.
1564 *
1565 * Inputs
1566 * (endpoint, asoc, chunk)
1567 *
1568 * Outputs
1569 * (asoc, reply_msg, msg_up, timers, counters)
1570 *
1571 * The return value is the disposition of the chunk.
1572 */
1573sctp_disposition_t sctp_sf_do_5_2_1_siminit(const struct sctp_endpoint *ep,
1574                                    const struct sctp_association *asoc,
1575                                    const sctp_subtype_t type,
1576                                    void *arg,
1577                                    sctp_cmd_seq_t *commands)
1578{
1579        /* Call helper to do the real work for both simulataneous and
1580         * duplicate INIT chunk handling.
1581         */
1582        return sctp_sf_do_unexpected_init(ep, asoc, type, arg, commands);
1583}
1584
1585/*
1586 * Handle duplicated INIT messages.  These are usually delayed
1587 * restransmissions.
1588 *
1589 * Section: 5.2.2 Unexpected INIT in States Other than CLOSED,
1590 * COOKIE-ECHOED and COOKIE-WAIT
1591 *
1592 * Unless otherwise stated, upon reception of an unexpected INIT for
1593 * this association, the endpoint shall generate an INIT ACK with a
1594 * State Cookie.  In the outbound INIT ACK the endpoint MUST copy its
1595 * current Verification Tag and peer's Verification Tag into a reserved
1596 * place within the state cookie.  We shall refer to these locations as
1597 * the Peer's-Tie-Tag and the Local-Tie-Tag.  The outbound SCTP packet
1598 * containing this INIT ACK MUST carry a Verification Tag value equal to
1599 * the Initiation Tag found in the unexpected INIT.  And the INIT ACK
1600 * MUST contain a new Initiation Tag (randomly generated see Section
1601 * 5.3.1).  Other parameters for the endpoint SHOULD be copied from the
1602 * existing parameters of the association (e.g. number of outbound
1603 * streams) into the INIT ACK and cookie.
1604 *
1605 * After sending out the INIT ACK, the endpoint shall take no further
1606 * actions, i.e., the existing association, including its current state,
1607 * and the corresponding TCB MUST NOT be changed.
1608 *
1609 * Note: Only when a TCB exists and the association is not in a COOKIE-
1610 * WAIT state are the Tie-Tags populated.  For a normal association INIT
1611 * (i.e. the endpoint is in a COOKIE-WAIT state), the Tie-Tags MUST be
1612 * set to 0 (indicating that no previous TCB existed).  The INIT ACK and
1613 * State Cookie are populated as specified in section 5.2.1.
1614 *
1615 * Verification Tag: Not specified, but an INIT has no way of knowing
1616 * what the verification tag could be, so we ignore it.
1617 *
1618 * Inputs
1619 * (endpoint, asoc, chunk)
1620 *
1621 * Outputs
1622 * (asoc, reply_msg, msg_up, timers, counters)
1623 *
1624 * The return value is the disposition of the chunk.
1625 */
1626sctp_disposition_t sctp_sf_do_5_2_2_dupinit(const struct sctp_endpoint *ep,
1627                                        const struct sctp_association *asoc,
1628                                        const sctp_subtype_t type,
1629                                        void *arg,
1630                                        sctp_cmd_seq_t *commands)
1631{
1632        /* Call helper to do the real work for both simulataneous and
1633         * duplicate INIT chunk handling.
1634         */
1635        return sctp_sf_do_unexpected_init(ep, asoc, type, arg, commands);
1636}
1637
1638
1639/*
1640 * Unexpected INIT-ACK handler.
1641 *
1642 * Section 5.2.3
1643 * If an INIT ACK received by an endpoint in any state other than the
1644 * COOKIE-WAIT state, the endpoint should discard the INIT ACK chunk.
1645 * An unexpected INIT ACK usually indicates the processing of an old or
1646 * duplicated INIT chunk.
1647*/
1648sctp_disposition_t sctp_sf_do_5_2_3_initack(const struct sctp_endpoint *ep,
1649                                            const struct sctp_association *asoc,
1650                                            const sctp_subtype_t type,
1651                                            void *arg, sctp_cmd_seq_t *commands)
1652{
1653        /* Per the above section, we'll discard the chunk if we have an
1654         * endpoint.  If this is an OOTB INIT-ACK, treat it as such.
1655         */
1656        if (ep == sctp_sk((sctp_get_ctl_sock()))->ep)
1657                return sctp_sf_ootb(ep, asoc, type, arg, commands);
1658        else
1659                return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
1660}
1661
1662/* Unexpected COOKIE-ECHO handler for peer restart (Table 2, action 'A')
1663 *
1664 * Section 5.2.4
1665 *  A)  In this case, the peer may have restarted.
1666 */
1667static sctp_disposition_t sctp_sf_do_dupcook_a(const struct sctp_endpoint *ep,
1668                                        const struct sctp_association *asoc,
1669                                        struct sctp_chunk *chunk,
1670                                        sctp_cmd_seq_t *commands,
1671                                        struct sctp_association *new_asoc)
1672{
1673        sctp_init_chunk_t *peer_init;
1674        struct sctp_ulpevent *ev;
1675        struct sctp_chunk *repl;
1676        struct sctp_chunk *err;
1677        sctp_disposition_t disposition;
1678
1679        /* new_asoc is a brand-new association, so these are not yet
1680         * side effects--it is safe to run them here.
1681         */
1682        peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
1683
1684        if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk), peer_init,
1685                               GFP_ATOMIC))
1686                goto nomem;
1687
1688        /* Make sure no new addresses are being added during the
1689         * restart.  Though this is a pretty complicated attack
1690         * since you'd have to get inside the cookie.
1691         */
1692        if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk, commands)) {
1693                return SCTP_DISPOSITION_CONSUME;
1694        }
1695
1696        /* If the endpoint is in the SHUTDOWN-ACK-SENT state and recognizes
1697         * the peer has restarted (Action A), it MUST NOT setup a new
1698         * association but instead resend the SHUTDOWN ACK and send an ERROR
1699         * chunk with a "Cookie Received while Shutting Down" error cause to
1700         * its peer.
1701        */
1702        if (sctp_state(asoc, SHUTDOWN_ACK_SENT)) {
1703                disposition = sctp_sf_do_9_2_reshutack(ep, asoc,
1704                                SCTP_ST_CHUNK(chunk->chunk_hdr->type),
1705                                chunk, commands);
1706                if (SCTP_DISPOSITION_NOMEM == disposition)
1707                        goto nomem;
1708
1709                err = sctp_make_op_error(asoc, chunk,
1710                                         SCTP_ERROR_COOKIE_IN_SHUTDOWN,
1711                                         NULL, 0, 0);
1712                if (err)
1713                        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
1714                                        SCTP_CHUNK(err));
1715
1716                return SCTP_DISPOSITION_CONSUME;
1717        }
1718
1719        /* For now, stop pending T3-rtx and SACK timers, fail any unsent/unacked
1720         * data. Consider the optional choice of resending of this data.
1721         */
1722        sctp_add_cmd_sf(commands, SCTP_CMD_T3_RTX_TIMERS_STOP, SCTP_NULL());
1723        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
1724                        SCTP_TO(SCTP_EVENT_TIMEOUT_SACK));
1725        sctp_add_cmd_sf(commands, SCTP_CMD_PURGE_OUTQUEUE, SCTP_NULL());
1726
1727        /* Stop pending T4-rto timer, teardown ASCONF queue, ASCONF-ACK queue
1728         * and ASCONF-ACK cache.
1729         */
1730        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
1731                        SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
1732        sctp_add_cmd_sf(commands, SCTP_CMD_PURGE_ASCONF_QUEUE, SCTP_NULL());
1733
1734        repl = sctp_make_cookie_ack(new_asoc, chunk);
1735        if (!repl)
1736                goto nomem;
1737
1738        /* Report association restart to upper layer. */
1739        ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_RESTART, 0,
1740                                             new_asoc->c.sinit_num_ostreams,
1741                                             new_asoc->c.sinit_max_instreams,
1742                                             NULL, GFP_ATOMIC);
1743        if (!ev)
1744                goto nomem_ev;
1745
1746        /* Update the content of current association. */
1747        sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
1748        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1749        sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
1750        return SCTP_DISPOSITION_CONSUME;
1751
1752nomem_ev:
1753        sctp_chunk_free(repl);
1754nomem:
1755        return SCTP_DISPOSITION_NOMEM;
1756}
1757
1758/* Unexpected COOKIE-ECHO handler for setup collision (Table 2, action 'B')
1759 *
1760 * Section 5.2.4
1761 *   B) In this case, both sides may be attempting to start an association
1762 *      at about the same time but the peer endpoint started its INIT
1763 *      after responding to the local endpoint's INIT
1764 */
1765/* This case represents an initialization collision.  */
1766static sctp_disposition_t sctp_sf_do_dupcook_b(const struct sctp_endpoint *ep,
1767                                        const struct sctp_association *asoc,
1768                                        struct sctp_chunk *chunk,
1769                                        sctp_cmd_seq_t *commands,
1770                                        struct sctp_association *new_asoc)
1771{
1772        sctp_init_chunk_t *peer_init;
1773        struct sctp_chunk *repl;
1774
1775        /* new_asoc is a brand-new association, so these are not yet
1776         * side effects--it is safe to run them here.
1777         */
1778        peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
1779        if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk), peer_init,
1780                               GFP_ATOMIC))
1781                goto nomem;
1782
1783        /* Update the content of current association.  */
1784        sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
1785        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
1786                        SCTP_STATE(SCTP_STATE_ESTABLISHED));
1787        SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
1788        sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
1789
1790        repl = sctp_make_cookie_ack(new_asoc, chunk);
1791        if (!repl)
1792                goto nomem;
1793
1794        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1795
1796        /* RFC 2960 5.1 Normal Establishment of an Association
1797         *
1798         * D) IMPLEMENTATION NOTE: An implementation may choose to
1799         * send the Communication Up notification to the SCTP user
1800         * upon reception of a valid COOKIE ECHO chunk.
1801         *
1802         * Sadly, this needs to be implemented as a side-effect, because
1803         * we are not guaranteed to have set the association id of the real
1804         * association and so these notifications need to be delayed until
1805         * the association id is allocated.
1806         */
1807
1808        sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_CHANGE, SCTP_U8(SCTP_COMM_UP));
1809
1810        /* Sockets API Draft Section 5.3.1.6
1811         * When a peer sends a Adaptation Layer Indication parameter , SCTP
1812         * delivers this notification to inform the application that of the
1813         * peers requested adaptation layer.
1814         *
1815         * This also needs to be done as a side effect for the same reason as
1816         * above.
1817         */
1818        if (asoc->peer.adaptation_ind)
1819                sctp_add_cmd_sf(commands, SCTP_CMD_ADAPTATION_IND, SCTP_NULL());
1820
1821        return SCTP_DISPOSITION_CONSUME;
1822
1823nomem:
1824        return SCTP_DISPOSITION_NOMEM;
1825}
1826
1827/* Unexpected COOKIE-ECHO handler for setup collision (Table 2, action 'C')
1828 *
1829 * Section 5.2.4
1830 *  C) In this case, the local endpoint's cookie has arrived late.
1831 *     Before it arrived, the local endpoint sent an INIT and received an
1832 *     INIT-ACK and finally sent a COOKIE ECHO with the peer's same tag
1833 *     but a new tag of its own.
1834 */
1835/* This case represents an initialization collision.  */
1836static sctp_disposition_t sctp_sf_do_dupcook_c(const struct sctp_endpoint *ep,
1837                                        const struct sctp_association *asoc,
1838                                        struct sctp_chunk *chunk,
1839                                        sctp_cmd_seq_t *commands,
1840                                        struct sctp_association *new_asoc)
1841{
1842        /* The cookie should be silently discarded.
1843         * The endpoint SHOULD NOT change states and should leave
1844         * any timers running.
1845         */
1846        return SCTP_DISPOSITION_DISCARD;
1847}
1848
1849/* Unexpected COOKIE-ECHO handler lost chunk (Table 2, action 'D')
1850 *
1851 * Section 5.2.4
1852 *
1853 * D) When both local and remote tags match the endpoint should always
1854 *    enter the ESTABLISHED state, if it has not already done so.
1855 */
1856/* This case represents an initialization collision.  */
1857static sctp_disposition_t sctp_sf_do_dupcook_d(const struct sctp_endpoint *ep,
1858                                        const struct sctp_association *asoc,
1859                                        struct sctp_chunk *chunk,
1860                                        sctp_cmd_seq_t *commands,
1861                                        struct sctp_association *new_asoc)
1862{
1863        struct sctp_ulpevent *ev = NULL, *ai_ev = NULL;
1864        struct sctp_chunk *repl;
1865
1866        /* Clarification from Implementor's Guide:
1867         * D) When both local and remote tags match the endpoint should
1868         * enter the ESTABLISHED state, if it is in the COOKIE-ECHOED state.
1869         * It should stop any cookie timer that may be running and send
1870         * a COOKIE ACK.
1871         */
1872
1873        /* Don't accidentally move back into established state. */
1874        if (asoc->state < SCTP_STATE_ESTABLISHED) {
1875                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
1876                                SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
1877                sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
1878                                SCTP_STATE(SCTP_STATE_ESTABLISHED));
1879                SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
1880                sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START,
1881                                SCTP_NULL());
1882
1883                /* RFC 2960 5.1 Normal Establishment of an Association
1884                 *
1885                 * D) IMPLEMENTATION NOTE: An implementation may choose
1886                 * to send the Communication Up notification to the
1887                 * SCTP user upon reception of a valid COOKIE
1888                 * ECHO chunk.
1889                 */
1890                ev = sctp_ulpevent_make_assoc_change(asoc, 0,
1891                                             SCTP_COMM_UP, 0,
1892                                             asoc->c.sinit_num_ostreams,
1893                                             asoc->c.sinit_max_instreams,
1894                                             NULL, GFP_ATOMIC);
1895                if (!ev)
1896                        goto nomem;
1897
1898                /* Sockets API Draft Section 5.3.1.6
1899                 * When a peer sends a Adaptation Layer Indication parameter,
1900                 * SCTP delivers this notification to inform the application
1901                 * that of the peers requested adaptation layer.
1902                 */
1903                if (asoc->peer.adaptation_ind) {
1904                        ai_ev = sctp_ulpevent_make_adaptation_indication(asoc,
1905                                                                 GFP_ATOMIC);
1906                        if (!ai_ev)
1907                                goto nomem;
1908
1909                }
1910        }
1911
1912        repl = sctp_make_cookie_ack(new_asoc, chunk);
1913        if (!repl)
1914                goto nomem;
1915
1916        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1917
1918        if (ev)
1919                sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
1920                                SCTP_ULPEVENT(ev));
1921        if (ai_ev)
1922                sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
1923                                        SCTP_ULPEVENT(ai_ev));
1924
1925        return SCTP_DISPOSITION_CONSUME;
1926
1927nomem:
1928        if (ai_ev)
1929                sctp_ulpevent_free(ai_ev);
1930        if (ev)
1931                sctp_ulpevent_free(ev);
1932        return SCTP_DISPOSITION_NOMEM;
1933}
1934
1935/*
1936 * Handle a duplicate COOKIE-ECHO.  This usually means a cookie-carrying
1937 * chunk was retransmitted and then delayed in the network.
1938 *
1939 * Section: 5.2.4 Handle a COOKIE ECHO when a TCB exists
1940 *
1941 * Verification Tag: None.  Do cookie validation.
1942 *
1943 * Inputs
1944 * (endpoint, asoc, chunk)
1945 *
1946 * Outputs
1947 * (asoc, reply_msg, msg_up, timers, counters)
1948 *
1949 * The return value is the disposition of the chunk.
1950 */
1951sctp_disposition_t sctp_sf_do_5_2_4_dupcook(const struct sctp_endpoint *ep,
1952                                        const struct sctp_association *asoc,
1953                                        const sctp_subtype_t type,
1954                                        void *arg,
1955                                        sctp_cmd_seq_t *commands)
1956{
1957        sctp_disposition_t retval;
1958        struct sctp_chunk *chunk = arg;
1959        struct sctp_association *new_asoc;
1960        int error = 0;
1961        char action;
1962        struct sctp_chunk *err_chk_p;
1963
1964        /* Make sure that the chunk has a valid length from the protocol
1965         * perspective.  In this case check to make sure we have at least
1966         * enough for the chunk header.  Cookie length verification is
1967         * done later.
1968         */
1969        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
1970                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
1971                                                  commands);
1972
1973        /* "Decode" the chunk.  We have no optional parameters so we
1974         * are in good shape.
1975         */
1976        chunk->subh.cookie_hdr = (struct sctp_signed_cookie *)chunk->skb->data;
1977        if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
1978                                        sizeof(sctp_chunkhdr_t)))
1979                goto nomem;
1980
1981        /* In RFC 2960 5.2.4 3, if both Verification Tags in the State Cookie
1982         * of a duplicate COOKIE ECHO match the Verification Tags of the
1983         * current association, consider the State Cookie valid even if
1984         * the lifespan is exceeded.
1985         */
1986        new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, &error,
1987                                      &err_chk_p);
1988
1989        /* FIXME:
1990         * If the re-build failed, what is the proper error path
1991         * from here?
1992         *
1993         * [We should abort the association. --piggy]
1994         */
1995        if (!new_asoc) {
1996                /* FIXME: Several errors are possible.  A bad cookie should
1997                 * be silently discarded, but think about logging it too.
1998                 */
1999                switch (error) {
2000                case -SCTP_IERROR_NOMEM:
2001                        goto nomem;
2002
2003                case -SCTP_IERROR_STALE_COOKIE:
2004                        sctp_send_stale_cookie_err(ep, asoc, chunk, commands,
2005                                                   err_chk_p);
2006                        return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2007                case -SCTP_IERROR_BAD_SIG:
2008                default:
2009                        return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2010                }
2011        }
2012
2013        /* Compare the tie_tag in cookie with the verification tag of
2014         * current association.
2015         */
2016        action = sctp_tietags_compare(new_asoc, asoc);
2017
2018        switch (action) {
2019        case 'A': /* Association restart. */
2020                retval = sctp_sf_do_dupcook_a(ep, asoc, chunk, commands,
2021                                              new_asoc);
2022                break;
2023
2024        case 'B': /* Collision case B. */
2025                retval = sctp_sf_do_dupcook_b(ep, asoc, chunk, commands,
2026                                              new_asoc);
2027                break;
2028
2029        case 'C': /* Collision case C. */
2030                retval = sctp_sf_do_dupcook_c(ep, asoc, chunk, commands,
2031                                              new_asoc);
2032                break;
2033
2034        case 'D': /* Collision case D. */
2035                retval = sctp_sf_do_dupcook_d(ep, asoc, chunk, commands,
2036                                              new_asoc);
2037                break;
2038
2039        default: /* Discard packet for all others. */
2040                retval = sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2041                break;
2042        }
2043
2044        /* Delete the tempory new association. */
2045        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
2046        sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
2047
2048        /* Restore association pointer to provide SCTP command interpeter
2049         * with a valid context in case it needs to manipulate
2050         * the queues */
2051        sctp_add_cmd_sf(commands, SCTP_CMD_SET_ASOC,
2052                         SCTP_ASOC((struct sctp_association *)asoc));
2053
2054        return retval;
2055
2056nomem:
2057        return SCTP_DISPOSITION_NOMEM;
2058}
2059
2060/*
2061 * Process an ABORT.  (SHUTDOWN-PENDING state)
2062 *
2063 * See sctp_sf_do_9_1_abort().
2064 */
2065sctp_disposition_t sctp_sf_shutdown_pending_abort(
2066        const struct sctp_endpoint *ep,
2067        const struct sctp_association *asoc,
2068        const sctp_subtype_t type,
2069        void *arg,
2070        sctp_cmd_seq_t *commands)
2071{
2072        struct sctp_chunk *chunk = arg;
2073
2074        if (!sctp_vtag_verify_either(chunk, asoc))
2075                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2076
2077        /* Make sure that the ABORT chunk has a valid length.
2078         * Since this is an ABORT chunk, we have to discard it
2079         * because of the following text:
2080         * RFC 2960, Section 3.3.7
2081         *    If an endpoint receives an ABORT with a format error or for an
2082         *    association that doesn't exist, it MUST silently discard it.
2083         * Because the length is "invalid", we can't really discard just
2084         * as we do not know its true length.  So, to be safe, discard the
2085         * packet.
2086         */
2087        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
2088                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2089
2090        /* ADD-IP: Special case for ABORT chunks
2091         * F4)  One special consideration is that ABORT Chunks arriving
2092         * destined to the IP address being deleted MUST be
2093         * ignored (see Section 5.3.1 for further details).
2094         */
2095        if (SCTP_ADDR_DEL ==
2096                    sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2097                return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
2098
2099        return __sctp_sf_do_9_1_abort(ep, asoc, type, arg, commands);
2100}
2101
2102/*
2103 * Process an ABORT.  (SHUTDOWN-SENT state)
2104 *
2105 * See sctp_sf_do_9_1_abort().
2106 */
2107sctp_disposition_t sctp_sf_shutdown_sent_abort(const struct sctp_endpoint *ep,
2108                                        const struct sctp_association *asoc,
2109                                        const sctp_subtype_t type,
2110                                        void *arg,
2111                                        sctp_cmd_seq_t *commands)
2112{
2113        struct sctp_chunk *chunk = arg;
2114
2115        if (!sctp_vtag_verify_either(chunk, asoc))
2116                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2117
2118        /* Make sure that the ABORT chunk has a valid length.
2119         * Since this is an ABORT chunk, we have to discard it
2120         * because of the following text:
2121         * RFC 2960, Section 3.3.7
2122         *    If an endpoint receives an ABORT with a format error or for an
2123         *    association that doesn't exist, it MUST silently discard it.
2124         * Because the length is "invalid", we can't really discard just
2125         * as we do not know its true length.  So, to be safe, discard the
2126         * packet.
2127         */
2128        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
2129                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2130
2131        /* ADD-IP: Special case for ABORT chunks
2132         * F4)  One special consideration is that ABORT Chunks arriving
2133         * destined to the IP address being deleted MUST be
2134         * ignored (see Section 5.3.1 for further details).
2135         */
2136        if (SCTP_ADDR_DEL ==
2137                    sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2138                return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
2139
2140        /* Stop the T2-shutdown timer. */
2141        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2142                        SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
2143
2144        /* Stop the T5-shutdown guard timer.  */
2145        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2146                        SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
2147
2148        return __sctp_sf_do_9_1_abort(ep, asoc, type, arg, commands);
2149}
2150
2151/*
2152 * Process an ABORT.  (SHUTDOWN-ACK-SENT state)
2153 *
2154 * See sctp_sf_do_9_1_abort().
2155 */
2156sctp_disposition_t sctp_sf_shutdown_ack_sent_abort(
2157        const struct sctp_endpoint *ep,
2158        const struct sctp_association *asoc,
2159        const sctp_subtype_t type,
2160        void *arg,
2161        sctp_cmd_seq_t *commands)
2162{
2163        /* The same T2 timer, so we should be able to use
2164         * common function with the SHUTDOWN-SENT state.
2165         */
2166        return sctp_sf_shutdown_sent_abort(ep, asoc, type, arg, commands);
2167}
2168
2169/*
2170 * Handle an Error received in COOKIE_ECHOED state.
2171 *
2172 * Only handle the error type of stale COOKIE Error, the other errors will
2173 * be ignored.
2174 *
2175 * Inputs
2176 * (endpoint, asoc, chunk)
2177 *
2178 * Outputs
2179 * (asoc, reply_msg, msg_up, timers, counters)
2180 *
2181 * The return value is the disposition of the chunk.
2182 */
2183sctp_disposition_t sctp_sf_cookie_echoed_err(const struct sctp_endpoint *ep,
2184                                        const struct sctp_association *asoc,
2185                                        const sctp_subtype_t type,
2186                                        void *arg,
2187                                        sctp_cmd_seq_t *commands)
2188{
2189        struct sctp_chunk *chunk = arg;
2190        sctp_errhdr_t *err;
2191
2192        if (!sctp_vtag_verify(chunk, asoc))
2193                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2194
2195        /* Make sure that the ERROR chunk has a valid length.
2196         * The parameter walking depends on this as well.
2197         */
2198        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_operr_chunk_t)))
2199                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
2200                                                  commands);
2201
2202        /* Process the error here */
2203        /* FUTURE FIXME:  When PR-SCTP related and other optional
2204         * parms are emitted, this will have to change to handle multiple
2205         * errors.
2206         */
2207        sctp_walk_errors(err, chunk->chunk_hdr) {
2208                if (SCTP_ERROR_STALE_COOKIE == err->cause)
2209                        return sctp_sf_do_5_2_6_stale(ep, asoc, type,
2210                                                        arg, commands);
2211        }
2212
2213        /* It is possible to have malformed error causes, and that
2214         * will cause us to end the walk early.  However, since
2215         * we are discarding the packet, there should be no adverse
2216         * affects.
2217         */
2218        return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2219}
2220
2221/*
2222 * Handle a Stale COOKIE Error
2223 *
2224 * Section: 5.2.6 Handle Stale COOKIE Error
2225 * If the association is in the COOKIE-ECHOED state, the endpoint may elect
2226 * one of the following three alternatives.
2227 * ...
2228 * 3) Send a new INIT chunk to the endpoint, adding a Cookie
2229 *    Preservative parameter requesting an extension to the lifetime of
2230 *    the State Cookie. When calculating the time extension, an
2231 *    implementation SHOULD use the RTT information measured based on the
2232 *    previous COOKIE ECHO / ERROR exchange, and should add no more
2233 *    than 1 second beyond the measured RTT, due to long State Cookie
2234 *    lifetimes making the endpoint more subject to a replay attack.
2235 *
2236 * Verification Tag:  Not explicit, but safe to ignore.
2237 *
2238 * Inputs
2239 * (endpoint, asoc, chunk)
2240 *
2241 * Outputs
2242 * (asoc, reply_msg, msg_up, timers, counters)
2243 *
2244 * The return value is the disposition of the chunk.
2245 */
2246static sctp_disposition_t sctp_sf_do_5_2_6_stale(const struct sctp_endpoint *ep,
2247                                                 const struct sctp_association *asoc,
2248                                                 const sctp_subtype_t type,
2249                                                 void *arg,
2250                                                 sctp_cmd_seq_t *commands)
2251{
2252        struct sctp_chunk *chunk = arg;
2253        time_t stale;
2254        sctp_cookie_preserve_param_t bht;
2255        sctp_errhdr_t *err;
2256        struct sctp_chunk *reply;
2257        struct sctp_bind_addr *bp;
2258        int attempts = asoc->init_err_counter + 1;
2259
2260        if (attempts > asoc->max_init_attempts) {
2261                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
2262                                SCTP_ERROR(ETIMEDOUT));
2263                sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
2264                                SCTP_PERR(SCTP_ERROR_STALE_COOKIE));
2265                return SCTP_DISPOSITION_DELETE_TCB;
2266        }
2267
2268        err = (sctp_errhdr_t *)(chunk->skb->data);
2269
2270        /* When calculating the time extension, an implementation
2271         * SHOULD use the RTT information measured based on the
2272         * previous COOKIE ECHO / ERROR exchange, and should add no
2273         * more than 1 second beyond the measured RTT, due to long
2274         * State Cookie lifetimes making the endpoint more subject to
2275         * a replay attack.
2276         * Measure of Staleness's unit is usec. (1/1000000 sec)
2277         * Suggested Cookie Life-span Increment's unit is msec.
2278         * (1/1000 sec)
2279         * In general, if you use the suggested cookie life, the value
2280         * found in the field of measure of staleness should be doubled
2281         * to give ample time to retransmit the new cookie and thus
2282         * yield a higher probability of success on the reattempt.
2283         */
2284        stale = ntohl(*(__be32 *)((u8 *)err + sizeof(sctp_errhdr_t)));
2285        stale = (stale * 2) / 1000;
2286
2287        bht.param_hdr.type = SCTP_PARAM_COOKIE_PRESERVATIVE;
2288        bht.param_hdr.length = htons(sizeof(bht));
2289        bht.lifespan_increment = htonl(stale);
2290
2291        /* Build that new INIT chunk.  */
2292        bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
2293        reply = sctp_make_init(asoc, bp, GFP_ATOMIC, sizeof(bht));
2294        if (!reply)
2295                goto nomem;
2296
2297        sctp_addto_chunk(reply, sizeof(bht), &bht);
2298
2299        /* Clear peer's init_tag cached in assoc as we are sending a new INIT */
2300        sctp_add_cmd_sf(commands, SCTP_CMD_CLEAR_INIT_TAG, SCTP_NULL());
2301
2302        /* Stop pending T3-rtx and heartbeat timers */
2303        sctp_add_cmd_sf(commands, SCTP_CMD_T3_RTX_TIMERS_STOP, SCTP_NULL());
2304        sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
2305
2306        /* Delete non-primary peer ip addresses since we are transitioning
2307         * back to the COOKIE-WAIT state
2308         */
2309        sctp_add_cmd_sf(commands, SCTP_CMD_DEL_NON_PRIMARY, SCTP_NULL());
2310
2311        /* If we've sent any data bundled with COOKIE-ECHO we will need to
2312         * resend
2313         */
2314        sctp_add_cmd_sf(commands, SCTP_CMD_T1_RETRAN,
2315                        SCTP_TRANSPORT(asoc->peer.primary_path));
2316
2317        /* Cast away the const modifier, as we want to just
2318         * rerun it through as a sideffect.
2319         */
2320        sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_INC, SCTP_NULL());
2321
2322        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2323                        SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
2324        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2325                        SCTP_STATE(SCTP_STATE_COOKIE_WAIT));
2326        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
2327                        SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
2328
2329        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
2330
2331        return SCTP_DISPOSITION_CONSUME;
2332
2333nomem:
2334        return SCTP_DISPOSITION_NOMEM;
2335}
2336
2337/*
2338 * Process an ABORT.
2339 *
2340 * Section: 9.1
2341 * After checking the Verification Tag, the receiving endpoint shall
2342 * remove the association from its record, and shall report the
2343 * termination to its upper layer.
2344 *
2345 * Verification Tag: 8.5.1 Exceptions in Verification Tag Rules
2346 * B) Rules for packet carrying ABORT:
2347 *
2348 *  - The endpoint shall always fill in the Verification Tag field of the
2349 *    outbound packet with the destination endpoint's tag value if it
2350 *    is known.
2351 *
2352 *  - If the ABORT is sent in response to an OOTB packet, the endpoint
2353 *    MUST follow the procedure described in Section 8.4.
2354 *
2355 *  - The receiver MUST accept the packet if the Verification Tag
2356 *    matches either its own tag, OR the tag of its peer. Otherwise, the
2357 *    receiver MUST silently discard the packet and take no further
2358 *    action.
2359 *
2360 * Inputs
2361 * (endpoint, asoc, chunk)
2362 *
2363 * Outputs
2364 * (asoc, reply_msg, msg_up, timers, counters)
2365 *
2366 * The return value is the disposition of the chunk.
2367 */
2368sctp_disposition_t sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep,
2369                                        const struct sctp_association *asoc,
2370                                        const sctp_subtype_t type,
2371                                        void *arg,
2372                                        sctp_cmd_seq_t *commands)
2373{
2374        struct sctp_chunk *chunk = arg;
2375
2376        if (!sctp_vtag_verify_either(chunk, asoc))
2377                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2378
2379        /* Make sure that the ABORT chunk has a valid length.
2380         * Since this is an ABORT chunk, we have to discard it
2381         * because of the following text:
2382         * RFC 2960, Section 3.3.7
2383         *    If an endpoint receives an ABORT with a format error or for an
2384         *    association that doesn't exist, it MUST silently discard it.
2385         * Because the length is "invalid", we can't really discard just
2386         * as we do not know its true length.  So, to be safe, discard the
2387         * packet.
2388         */
2389        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
2390                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2391
2392        /* ADD-IP: Special case for ABORT chunks
2393         * F4)  One special consideration is that ABORT Chunks arriving
2394         * destined to the IP address being deleted MUST be
2395         * ignored (see Section 5.3.1 for further details).
2396         */
2397        if (SCTP_ADDR_DEL ==
2398                    sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2399                return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
2400
2401        return __sctp_sf_do_9_1_abort(ep, asoc, type, arg, commands);
2402}
2403
2404static sctp_disposition_t __sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep,
2405                                        const struct sctp_association *asoc,
2406                                        const sctp_subtype_t type,
2407                                        void *arg,
2408                                        sctp_cmd_seq_t *commands)
2409{
2410        struct sctp_chunk *chunk = arg;
2411        unsigned int len;
2412        __be16 error = SCTP_ERROR_NO_ERROR;
2413
2414        /* See if we have an error cause code in the chunk.  */
2415        len = ntohs(chunk->chunk_hdr->length);
2416        if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr)) {
2417
2418                sctp_errhdr_t *err;
2419                sctp_walk_errors(err, chunk->chunk_hdr);
2420                if ((void *)err != (void *)chunk->chunk_end)
2421                        return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2422
2423                error = ((sctp_errhdr_t *)chunk->skb->data)->cause;
2424        }
2425
2426        sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(ECONNRESET));
2427        /* ASSOC_FAILED will DELETE_TCB. */
2428        sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, SCTP_PERR(error));
2429        SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
2430        SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
2431
2432        return SCTP_DISPOSITION_ABORT;
2433}
2434
2435/*
2436 * Process an ABORT.  (COOKIE-WAIT state)
2437 *
2438 * See sctp_sf_do_9_1_abort() above.
2439 */
2440sctp_disposition_t sctp_sf_cookie_wait_abort(const struct sctp_endpoint *ep,
2441                                     const struct sctp_association *asoc,
2442                                     const sctp_subtype_t type,
2443                                     void *arg,
2444                                     sctp_cmd_seq_t *commands)
2445{
2446        struct sctp_chunk *chunk = arg;
2447        unsigned int len;
2448        __be16 error = SCTP_ERROR_NO_ERROR;
2449
2450        if (!sctp_vtag_verify_either(chunk, asoc))
2451                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2452
2453        /* Make sure that the ABORT chunk has a valid length.
2454         * Since this is an ABORT chunk, we have to discard it
2455         * because of the following text:
2456         * RFC 2960, Section 3.3.7
2457         *    If an endpoint receives an ABORT with a format error or for an
2458         *    association that doesn't exist, it MUST silently discard it.
2459         * Because the length is "invalid", we can't really discard just
2460         * as we do not know its true length.  So, to be safe, discard the
2461         * packet.
2462         */
2463        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
2464                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2465
2466        /* See if we have an error cause code in the chunk.  */
2467        len = ntohs(chunk->chunk_hdr->length);
2468        if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
2469                error = ((sctp_errhdr_t *)chunk->skb->data)->cause;
2470
2471        return sctp_stop_t1_and_abort(commands, error, ECONNREFUSED, asoc,
2472                                      chunk->transport);
2473}
2474
2475/*
2476 * Process an incoming ICMP as an ABORT.  (COOKIE-WAIT state)
2477 */
2478sctp_disposition_t sctp_sf_cookie_wait_icmp_abort(const struct sctp_endpoint *ep,
2479                                        const struct sctp_association *asoc,
2480                                        const sctp_subtype_t type,
2481                                        void *arg,
2482                                        sctp_cmd_seq_t *commands)
2483{
2484        return sctp_stop_t1_and_abort(commands, SCTP_ERROR_NO_ERROR,
2485                                      ENOPROTOOPT, asoc,
2486                                      (struct sctp_transport *)arg);
2487}
2488
2489/*
2490 * Process an ABORT.  (COOKIE-ECHOED state)
2491 */
2492sctp_disposition_t sctp_sf_cookie_echoed_abort(const struct sctp_endpoint *ep,
2493                                               const struct sctp_association *asoc,
2494                                               const sctp_subtype_t type,
2495                                               void *arg,
2496                                               sctp_cmd_seq_t *commands)
2497{
2498        /* There is a single T1 timer, so we should be able to use
2499         * common function with the COOKIE-WAIT state.
2500         */
2501        return sctp_sf_cookie_wait_abort(ep, asoc, type, arg, commands);
2502}
2503
2504/*
2505 * Stop T1 timer and abort association with "INIT failed".
2506 *
2507 * This is common code called by several sctp_sf_*_abort() functions above.
2508 */
2509static sctp_disposition_t sctp_stop_t1_and_abort(sctp_cmd_seq_t *commands,
2510                                           __be16 error, int sk_err,
2511                                           const struct sctp_association *asoc,
2512                                           struct sctp_transport *transport)
2513{
2514        SCTP_DEBUG_PRINTK("ABORT received (INIT).\n");
2515        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2516                        SCTP_STATE(SCTP_STATE_CLOSED));
2517        SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
2518        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2519                        SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
2520        sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(sk_err));
2521        /* CMD_INIT_FAILED will DELETE_TCB. */
2522        sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
2523                        SCTP_PERR(error));
2524        return SCTP_DISPOSITION_ABORT;
2525}
2526
2527/*
2528 * sctp_sf_do_9_2_shut
2529 *
2530 * Section: 9.2
2531 * Upon the reception of the SHUTDOWN, the peer endpoint shall
2532 *  - enter the SHUTDOWN-RECEIVED state,
2533 *
2534 *  - stop accepting new data from its SCTP user
2535 *
2536 *  - verify, by checking the Cumulative TSN Ack field of the chunk,
2537 *    that all its outstanding DATA chunks have been received by the
2538 *    SHUTDOWN sender.
2539 *
2540 * Once an endpoint as reached the SHUTDOWN-RECEIVED state it MUST NOT
2541 * send a SHUTDOWN in response to a ULP request. And should discard
2542 * subsequent SHUTDOWN chunks.
2543 *
2544 * If there are still outstanding DATA chunks left, the SHUTDOWN
2545 * receiver shall continue to follow normal data transmission
2546 * procedures defined in Section 6 until all outstanding DATA chunks
2547 * are acknowledged; however, the SHUTDOWN receiver MUST NOT accept
2548 * new data from its SCTP user.
2549 *
2550 * Verification Tag:  8.5 Verification Tag [Normal verification]
2551 *
2552 * Inputs
2553 * (endpoint, asoc, chunk)
2554 *
2555 * Outputs
2556 * (asoc, reply_msg, msg_up, timers, counters)
2557 *
2558 * The return value is the disposition of the chunk.
2559 */
2560sctp_disposition_t sctp_sf_do_9_2_shutdown(const struct sctp_endpoint *ep,
2561                                           const struct sctp_association *asoc,
2562                                           const sctp_subtype_t type,
2563                                           void *arg,
2564                                           sctp_cmd_seq_t *commands)
2565{
2566        struct sctp_chunk *chunk = arg;
2567        sctp_shutdownhdr_t *sdh;
2568        sctp_disposition_t disposition;
2569        struct sctp_ulpevent *ev;
2570        __u32 ctsn;
2571
2572        if (!sctp_vtag_verify(chunk, asoc))
2573                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2574
2575        /* Make sure that the SHUTDOWN chunk has a valid length. */
2576        if (!sctp_chunk_length_valid(chunk,
2577                                      sizeof(struct sctp_shutdown_chunk_t)))
2578                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
2579                                                  commands);
2580
2581        /* Convert the elaborate header.  */
2582        sdh = (sctp_shutdownhdr_t *)chunk->skb->data;
2583        skb_pull(chunk->skb, sizeof(sctp_shutdownhdr_t));
2584        chunk->subh.shutdown_hdr = sdh;
2585        ctsn = ntohl(sdh->cum_tsn_ack);
2586
2587        if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
2588                SCTP_DEBUG_PRINTK("ctsn %x\n", ctsn);
2589                SCTP_DEBUG_PRINTK("ctsn_ack_point %x\n", asoc->ctsn_ack_point);
2590                return SCTP_DISPOSITION_DISCARD;
2591        }
2592
2593        /* If Cumulative TSN Ack beyond the max tsn currently
2594         * send, terminating the association and respond to the
2595         * sender with an ABORT.
2596         */
2597        if (!TSN_lt(ctsn, asoc->next_tsn))
2598                return sctp_sf_violation_ctsn(ep, asoc, type, arg, commands);
2599
2600        /* API 5.3.1.5 SCTP_SHUTDOWN_EVENT
2601         * When a peer sends a SHUTDOWN, SCTP delivers this notification to
2602         * inform the application that it should cease sending data.
2603         */
2604        ev = sctp_ulpevent_make_shutdown_event(asoc, 0, GFP_ATOMIC);
2605        if (!ev) {
2606                disposition = SCTP_DISPOSITION_NOMEM;
2607                goto out;
2608        }
2609        sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
2610
2611        /* Upon the reception of the SHUTDOWN, the peer endpoint shall
2612         *  - enter the SHUTDOWN-RECEIVED state,
2613         *  - stop accepting new data from its SCTP user
2614         *
2615         * [This is implicit in the new state.]
2616         */
2617        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2618                        SCTP_STATE(SCTP_STATE_SHUTDOWN_RECEIVED));
2619        disposition = SCTP_DISPOSITION_CONSUME;
2620
2621        if (sctp_outq_is_empty(&asoc->outqueue)) {
2622                disposition = sctp_sf_do_9_2_shutdown_ack(ep, asoc, type,
2623                                                          arg, commands);
2624        }
2625
2626        if (SCTP_DISPOSITION_NOMEM == disposition)
2627                goto out;
2628
2629        /*  - verify, by checking the Cumulative TSN Ack field of the
2630         *    chunk, that all its outstanding DATA chunks have been
2631         *    received by the SHUTDOWN sender.
2632         */
2633        sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_CTSN,
2634                        SCTP_BE32(chunk->subh.shutdown_hdr->cum_tsn_ack));
2635
2636out:
2637        return disposition;
2638}
2639
2640/*
2641 * sctp_sf_do_9_2_shut_ctsn
2642 *
2643 * Once an endpoint has reached the SHUTDOWN-RECEIVED state,
2644 * it MUST NOT send a SHUTDOWN in response to a ULP request.
2645 * The Cumulative TSN Ack of the received SHUTDOWN chunk
2646 * MUST be processed.
2647 */
2648sctp_disposition_t sctp_sf_do_9_2_shut_ctsn(const struct sctp_endpoint *ep,
2649                                           const struct sctp_association *asoc,
2650                                           const sctp_subtype_t type,
2651                                           void *arg,
2652                                           sctp_cmd_seq_t *commands)
2653{
2654        struct sctp_chunk *chunk = arg;
2655        sctp_shutdownhdr_t *sdh;
2656        __u32 ctsn;
2657
2658        if (!sctp_vtag_verify(chunk, asoc))
2659                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2660
2661        /* Make sure that the SHUTDOWN chunk has a valid length. */
2662        if (!sctp_chunk_length_valid(chunk,
2663                                      sizeof(struct sctp_shutdown_chunk_t)))
2664                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
2665                                                  commands);
2666
2667        sdh = (sctp_shutdownhdr_t *)chunk->skb->data;
2668        ctsn = ntohl(sdh->cum_tsn_ack);
2669
2670        if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
2671                SCTP_DEBUG_PRINTK("ctsn %x\n", ctsn);
2672                SCTP_DEBUG_PRINTK("ctsn_ack_point %x\n", asoc->ctsn_ack_point);
2673                return SCTP_DISPOSITION_DISCARD;
2674        }
2675
2676        /* If Cumulative TSN Ack beyond the max tsn currently
2677         * send, terminating the association and respond to the
2678         * sender with an ABORT.
2679         */
2680        if (!TSN_lt(ctsn, asoc->next_tsn))
2681                return sctp_sf_violation_ctsn(ep, asoc, type, arg, commands);
2682
2683        /* verify, by checking the Cumulative TSN Ack field of the
2684         * chunk, that all its outstanding DATA chunks have been
2685         * received by the SHUTDOWN sender.
2686         */
2687        sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_CTSN,
2688                        SCTP_BE32(sdh->cum_tsn_ack));
2689
2690        return SCTP_DISPOSITION_CONSUME;
2691}
2692
2693/* RFC 2960 9.2
2694 * If an endpoint is in SHUTDOWN-ACK-SENT state and receives an INIT chunk
2695 * (e.g., if the SHUTDOWN COMPLETE was lost) with source and destination
2696 * transport addresses (either in the IP addresses or in the INIT chunk)
2697 * that belong to this association, it should discard the INIT chunk and
2698 * retransmit the SHUTDOWN ACK chunk.
2699 */
2700sctp_disposition_t sctp_sf_do_9_2_reshutack(const struct sctp_endpoint *ep,
2701                                    const struct sctp_association *asoc,
2702                                    const sctp_subtype_t type,
2703                                    void *arg,
2704                                    sctp_cmd_seq_t *commands)
2705{
2706        struct sctp_chunk *chunk = (struct sctp_chunk *) arg;
2707        struct sctp_chunk *reply;
2708
2709        /* Make sure that the chunk has a valid length */
2710        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
2711                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
2712                                                  commands);
2713
2714        /* Since we are not going to really process this INIT, there
2715         * is no point in verifying chunk boundries.  Just generate
2716         * the SHUTDOWN ACK.
2717         */
2718        reply = sctp_make_shutdown_ack(asoc, chunk);
2719        if (NULL == reply)
2720                goto nomem;
2721
2722        /* Set the transport for the SHUTDOWN ACK chunk and the timeout for
2723         * the T2-SHUTDOWN timer.
2724         */
2725        sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
2726
2727        /* and restart the T2-shutdown timer. */
2728        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
2729                        SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
2730
2731        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
2732
2733        return SCTP_DISPOSITION_CONSUME;
2734nomem:
2735        return SCTP_DISPOSITION_NOMEM;
2736}
2737
2738/*
2739 * sctp_sf_do_ecn_cwr
2740 *
2741 * Section:  Appendix A: Explicit Congestion Notification
2742 *
2743 * CWR:
2744 *
2745 * RFC 2481 details a specific bit for a sender to send in the header of
2746 * its next outbound TCP segment to indicate to its peer that it has
2747 * reduced its congestion window.  This is termed the CWR bit.  For
2748 * SCTP the same indication is made by including the CWR chunk.
2749 * This chunk contains one data element, i.e. the TSN number that
2750 * was sent in the ECNE chunk.  This element represents the lowest
2751 * TSN number in the datagram that was originally marked with the
2752 * CE bit.
2753 *
2754 * Verification Tag: 8.5 Verification Tag [Normal verification]
2755 * Inputs
2756 * (endpoint, asoc, chunk)
2757 *
2758 * Outputs
2759 * (asoc, reply_msg, msg_up, timers, counters)
2760 *
2761 * The return value is the disposition of the chunk.
2762 */
2763sctp_disposition_t sctp_sf_do_ecn_cwr(const struct sctp_endpoint *ep,
2764                                      const struct sctp_association *asoc,
2765                                      const sctp_subtype_t type,
2766                                      void *arg,
2767                                      sctp_cmd_seq_t *commands)
2768{
2769        sctp_cwrhdr_t *cwr;
2770        struct sctp_chunk *chunk = arg;
2771        u32 lowest_tsn;
2772
2773        if (!sctp_vtag_verify(chunk, asoc))
2774                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2775
2776        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_ecne_chunk_t)))
2777                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
2778                                                  commands);
2779
2780        cwr = (sctp_cwrhdr_t *) chunk->skb->data;
2781        skb_pull(chunk->skb, sizeof(sctp_cwrhdr_t));
2782
2783        lowest_tsn = ntohl(cwr->lowest_tsn);
2784
2785        /* Does this CWR ack the last sent congestion notification? */
2786        if (TSN_lte(asoc->last_ecne_tsn, lowest_tsn)) {
2787                /* Stop sending ECNE. */
2788                sctp_add_cmd_sf(commands,
2789                                SCTP_CMD_ECN_CWR,
2790                                SCTP_U32(lowest_tsn));
2791        }
2792        return SCTP_DISPOSITION_CONSUME;
2793}
2794
2795/*
2796 * sctp_sf_do_ecne
2797 *
2798 * Section:  Appendix A: Explicit Congestion Notification
2799 *
2800 * ECN-Echo
2801 *
2802 * RFC 2481 details a specific bit for a receiver to send back in its
2803 * TCP acknowledgements to notify the sender of the Congestion
2804 * Experienced (CE) bit having arrived from the network.  For SCTP this
2805 * same indication is made by including the ECNE chunk.  This chunk
2806 * contains one data element, i.e. the lowest TSN associated with the IP
2807 * datagram marked with the CE bit.....
2808 *
2809 * Verification Tag: 8.5 Verification Tag [Normal verification]
2810 * Inputs
2811 * (endpoint, asoc, chunk)
2812 *
2813 * Outputs
2814 * (asoc, reply_msg, msg_up, timers, counters)
2815 *
2816 * The return value is the disposition of the chunk.
2817 */
2818sctp_disposition_t sctp_sf_do_ecne(const struct sctp_endpoint *ep,
2819                                   const struct sctp_association *asoc,
2820                                   const sctp_subtype_t type,
2821                                   void *arg,
2822                                   sctp_cmd_seq_t *commands)
2823{
2824        sctp_ecnehdr_t *ecne;
2825        struct sctp_chunk *chunk = arg;
2826
2827        if (!sctp_vtag_verify(chunk, asoc))
2828                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2829
2830        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_ecne_chunk_t)))
2831                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
2832                                                  commands);
2833
2834        ecne = (sctp_ecnehdr_t *) chunk->skb->data;
2835        skb_pull(chunk->skb, sizeof(sctp_ecnehdr_t));
2836
2837        /* If this is a newer ECNE than the last CWR packet we sent out */
2838        sctp_add_cmd_sf(commands, SCTP_CMD_ECN_ECNE,
2839                        SCTP_U32(ntohl(ecne->lowest_tsn)));
2840
2841        return SCTP_DISPOSITION_CONSUME;
2842}
2843
2844/*
2845 * Section: 6.2  Acknowledgement on Reception of DATA Chunks
2846 *
2847 * The SCTP endpoint MUST always acknowledge the reception of each valid
2848 * DATA chunk.
2849 *
2850 * The guidelines on delayed acknowledgement algorithm specified in
2851 * Section 4.2 of [RFC2581] SHOULD be followed. Specifically, an
2852 * acknowledgement SHOULD be generated for at least every second packet
2853 * (not every second DATA chunk) received, and SHOULD be generated within
2854 * 200 ms of the arrival of any unacknowledged DATA chunk. In some
2855 * situations it may be beneficial for an SCTP transmitter to be more
2856 * conservative than the algorithms detailed in this document allow.
2857 * However, an SCTP transmitter MUST NOT be more aggressive than the
2858 * following algorithms allow.
2859 *
2860 * A SCTP receiver MUST NOT generate more than one SACK for every
2861 * incoming packet, other than to update the offered window as the
2862 * receiving application consumes new data.
2863 *
2864 * Verification Tag:  8.5 Verification Tag [Normal verification]
2865 *
2866 * Inputs
2867 * (endpoint, asoc, chunk)
2868 *
2869 * Outputs
2870 * (asoc, reply_msg, msg_up, timers, counters)
2871 *
2872 * The return value is the disposition of the chunk.
2873 */
2874sctp_disposition_t sctp_sf_eat_data_6_2(const struct sctp_endpoint *ep,
2875                                        const struct sctp_association *asoc,
2876                                        const sctp_subtype_t type,
2877                                        void *arg,
2878                                        sctp_cmd_seq_t *commands)
2879{
2880        struct sctp_chunk *chunk = arg;
2881        sctp_arg_t force = SCTP_NOFORCE();
2882        int error;
2883
2884        if (!sctp_vtag_verify(chunk, asoc)) {
2885                sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
2886                                SCTP_NULL());
2887                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
2888        }
2889
2890        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_data_chunk_t)))
2891                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
2892                                                  commands);
2893
2894        error = sctp_eat_data(asoc, chunk, commands );
2895        switch (error) {
2896        case SCTP_IERROR_NO_ERROR:
2897                break;
2898        case SCTP_IERROR_HIGH_TSN:
2899        case SCTP_IERROR_BAD_STREAM:
2900                SCTP_INC_STATS(SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
2901                goto discard_noforce;
2902        case SCTP_IERROR_DUP_TSN:
2903        case SCTP_IERROR_IGNORE_TSN:
2904                SCTP_INC_STATS(SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
2905                goto discard_force;
2906        case SCTP_IERROR_NO_DATA:
2907                goto consume;
2908        case SCTP_IERROR_PROTO_VIOLATION:
2909                return sctp_sf_abort_violation(ep, asoc, chunk, commands,
2910                        (u8 *)chunk->subh.data_hdr, sizeof(sctp_datahdr_t));
2911        default:
2912                BUG();
2913        }
2914
2915        if (chunk->chunk_hdr->flags & SCTP_DATA_SACK_IMM)
2916                force = SCTP_FORCE();
2917
2918        if (asoc->autoclose) {
2919                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
2920                                SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
2921        }
2922
2923        /* If this is the last chunk in a packet, we need to count it
2924         * toward sack generation.  Note that we need to SACK every
2925         * OTHER packet containing data chunks, EVEN IF WE DISCARD
2926         * THEM.  We elect to NOT generate SACK's if the chunk fails
2927         * the verification tag test.
2928         *
2929         * RFC 2960 6.2 Acknowledgement on Reception of DATA Chunks
2930         *
2931         * The SCTP endpoint MUST always acknowledge the reception of
2932         * each valid DATA chunk.
2933         *
2934         * The guidelines on delayed acknowledgement algorithm
2935         * specified in  Section 4.2 of [RFC2581] SHOULD be followed.
2936         * Specifically, an acknowledgement SHOULD be generated for at
2937         * least every second packet (not every second DATA chunk)
2938         * received, and SHOULD be generated within 200 ms of the
2939         * arrival of any unacknowledged DATA chunk.  In some
2940         * situations it may be beneficial for an SCTP transmitter to
2941         * be more conservative than the algorithms detailed in this
2942         * document allow. However, an SCTP transmitter MUST NOT be
2943         * more aggressive than the following algorithms allow.
2944         */
2945        if (chunk->end_of_packet)
2946                sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, force);
2947
2948        return SCTP_DISPOSITION_CONSUME;
2949
2950discard_force:
2951        /* RFC 2960 6.2 Acknowledgement on Reception of DATA Chunks
2952         *
2953         * When a packet arrives with duplicate DATA chunk(s) and with
2954         * no new DATA chunk(s), the endpoint MUST immediately send a
2955         * SACK with no delay.  If a packet arrives with duplicate
2956         * DATA chunk(s) bundled with new DATA chunks, the endpoint
2957         * MAY immediately send a SACK.  Normally receipt of duplicate
2958         * DATA chunks will occur when the original SACK chunk was lost
2959         * and the peer's RTO has expired.  The duplicate TSN number(s)
2960         * SHOULD be reported in the SACK as duplicate.
2961         */
2962        /* In our case, we split the MAY SACK advice up whether or not
2963         * the last chunk is a duplicate.'
2964         */
2965        if (chunk->end_of_packet)
2966                sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
2967        return SCTP_DISPOSITION_DISCARD;
2968
2969discard_noforce:
2970        if (chunk->end_of_packet)
2971                sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, force);
2972
2973        return SCTP_DISPOSITION_DISCARD;
2974consume:
2975        return SCTP_DISPOSITION_CONSUME;
2976
2977}
2978
2979/*
2980 * sctp_sf_eat_data_fast_4_4
2981 *
2982 * Section: 4 (4)
2983 * (4) In SHUTDOWN-SENT state the endpoint MUST acknowledge any received
2984 *    DATA chunks without delay.
2985 *
2986 * Verification Tag:  8.5 Verification Tag [Normal verification]
2987 * Inputs
2988 * (endpoint, asoc, chunk)
2989 *
2990 * Outputs
2991 * (asoc, reply_msg, msg_up, timers, counters)
2992 *
2993 * The return value is the disposition of the chunk.
2994 */
2995sctp_disposition_t sctp_sf_eat_data_fast_4_4(const struct sctp_endpoint *ep,
2996                                     const struct sctp_association *asoc,
2997                                     const sctp_subtype_t type,
2998                                     void *arg,
2999                                     sctp_cmd_seq_t *commands)
3000{
3001        struct sctp_chunk *chunk = arg;
3002        int error;
3003
3004        if (!sctp_vtag_verify(chunk, asoc)) {
3005                sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3006                                SCTP_NULL());
3007                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3008        }
3009
3010        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_data_chunk_t)))
3011                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3012                                                  commands);
3013
3014        error = sctp_eat_data(asoc, chunk, commands );
3015        switch (error) {
3016        case SCTP_IERROR_NO_ERROR:
3017        case SCTP_IERROR_HIGH_TSN:
3018        case SCTP_IERROR_DUP_TSN:
3019        case SCTP_IERROR_IGNORE_TSN:
3020        case SCTP_IERROR_BAD_STREAM:
3021                break;
3022        case SCTP_IERROR_NO_DATA:
3023                goto consume;
3024        case SCTP_IERROR_PROTO_VIOLATION:
3025                return sctp_sf_abort_violation(ep, asoc, chunk, commands,
3026                        (u8 *)chunk->subh.data_hdr, sizeof(sctp_datahdr_t));
3027        default:
3028                BUG();
3029        }
3030
3031        /* Go a head and force a SACK, since we are shutting down. */
3032
3033        /* Implementor's Guide.
3034         *
3035         * While in SHUTDOWN-SENT state, the SHUTDOWN sender MUST immediately
3036         * respond to each received packet containing one or more DATA chunk(s)
3037         * with a SACK, a SHUTDOWN chunk, and restart the T2-shutdown timer
3038         */
3039        if (chunk->end_of_packet) {
3040                /* We must delay the chunk creation since the cumulative
3041                 * TSN has not been updated yet.
3042                 */
3043                sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SHUTDOWN, SCTP_NULL());
3044                sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
3045                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
3046                                SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
3047        }
3048
3049consume:
3050        return SCTP_DISPOSITION_CONSUME;
3051}
3052
3053/*
3054 * Section: 6.2  Processing a Received SACK
3055 * D) Any time a SACK arrives, the endpoint performs the following:
3056 *
3057 *     i) If Cumulative TSN Ack is less than the Cumulative TSN Ack Point,
3058 *     then drop the SACK.   Since Cumulative TSN Ack is monotonically
3059 *     increasing, a SACK whose Cumulative TSN Ack is less than the
3060 *     Cumulative TSN Ack Point indicates an out-of-order SACK.
3061 *
3062 *     ii) Set rwnd equal to the newly received a_rwnd minus the number
3063 *     of bytes still outstanding after processing the Cumulative TSN Ack
3064 *     and the Gap Ack Blocks.
3065 *
3066 *     iii) If the SACK is missing a TSN that was previously
3067 *     acknowledged via a Gap Ack Block (e.g., the data receiver
3068 *     reneged on the data), then mark the corresponding DATA chunk
3069 *     as available for retransmit:  Mark it as missing for fast
3070 *     retransmit as described in Section 7.2.4 and if no retransmit
3071 *     timer is running for the destination address to which the DATA
3072 *     chunk was originally transmitted, then T3-rtx is started for
3073 *     that destination address.
3074 *
3075 * Verification Tag:  8.5 Verification Tag [Normal verification]
3076 *
3077 * Inputs
3078 * (endpoint, asoc, chunk)
3079 *
3080 * Outputs
3081 * (asoc, reply_msg, msg_up, timers, counters)
3082 *
3083 * The return value is the disposition of the chunk.
3084 */
3085sctp_disposition_t sctp_sf_eat_sack_6_2(const struct sctp_endpoint *ep,
3086                                        const struct sctp_association *asoc,
3087                                        const sctp_subtype_t type,
3088                                        void *arg,
3089                                        sctp_cmd_seq_t *commands)
3090{
3091        struct sctp_chunk *chunk = arg;
3092        sctp_sackhdr_t *sackh;
3093        __u32 ctsn;
3094
3095        if (!sctp_vtag_verify(chunk, asoc))
3096                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3097
3098        /* Make sure that the SACK chunk has a valid length. */
3099        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_sack_chunk_t)))
3100                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3101                                                  commands);
3102
3103        /* Pull the SACK chunk from the data buffer */
3104        sackh = sctp_sm_pull_sack(chunk);
3105        /* Was this a bogus SACK? */
3106        if (!sackh)
3107                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3108        chunk->subh.sack_hdr = sackh;
3109        ctsn = ntohl(sackh->cum_tsn_ack);
3110
3111        /* i) If Cumulative TSN Ack is less than the Cumulative TSN
3112         *     Ack Point, then drop the SACK.  Since Cumulative TSN
3113         *     Ack is monotonically increasing, a SACK whose
3114         *     Cumulative TSN Ack is less than the Cumulative TSN Ack
3115         *     Point indicates an out-of-order SACK.
3116         */
3117        if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
3118                SCTP_DEBUG_PRINTK("ctsn %x\n", ctsn);
3119                SCTP_DEBUG_PRINTK("ctsn_ack_point %x\n", asoc->ctsn_ack_point);
3120                return SCTP_DISPOSITION_DISCARD;
3121        }
3122
3123        /* If Cumulative TSN Ack beyond the max tsn currently
3124         * send, terminating the association and respond to the
3125         * sender with an ABORT.
3126         */
3127        if (!TSN_lt(ctsn, asoc->next_tsn))
3128                return sctp_sf_violation_ctsn(ep, asoc, type, arg, commands);
3129
3130        /* Return this SACK for further processing.  */
3131        sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_SACK, SCTP_SACKH(sackh));
3132
3133        /* Note: We do the rest of the work on the PROCESS_SACK
3134         * sideeffect.
3135         */
3136        return SCTP_DISPOSITION_CONSUME;
3137}
3138
3139/*
3140 * Generate an ABORT in response to a packet.
3141 *
3142 * Section: 8.4 Handle "Out of the blue" Packets, sctpimpguide 2.41
3143 *
3144 * 8) The receiver should respond to the sender of the OOTB packet with
3145 *    an ABORT.  When sending the ABORT, the receiver of the OOTB packet
3146 *    MUST fill in the Verification Tag field of the outbound packet
3147 *    with the value found in the Verification Tag field of the OOTB
3148 *    packet and set the T-bit in the Chunk Flags to indicate that the
3149 *    Verification Tag is reflected.  After sending this ABORT, the
3150 *    receiver of the OOTB packet shall discard the OOTB packet and take
3151 *    no further action.
3152 *
3153 * Verification Tag:
3154 *
3155 * The return value is the disposition of the chunk.
3156*/
3157static sctp_disposition_t sctp_sf_tabort_8_4_8(const struct sctp_endpoint *ep,
3158                                        const struct sctp_association *asoc,
3159                                        const sctp_subtype_t type,
3160                                        void *arg,
3161                                        sctp_cmd_seq_t *commands)
3162{
3163        struct sctp_packet *packet = NULL;
3164        struct sctp_chunk *chunk = arg;
3165        struct sctp_chunk *abort;
3166
3167        packet = sctp_ootb_pkt_new(asoc, chunk);
3168
3169        if (packet) {
3170                /* Make an ABORT. The T bit will be set if the asoc
3171                 * is NULL.
3172                 */
3173                abort = sctp_make_abort(asoc, chunk, 0);
3174                if (!abort) {
3175                        sctp_ootb_pkt_free(packet);
3176                        return SCTP_DISPOSITION_NOMEM;
3177                }
3178
3179                /* Reflect vtag if T-Bit is set */
3180                if (sctp_test_T_bit(abort))
3181                        packet->vtag = ntohl(chunk->sctp_hdr->vtag);
3182
3183                /* Set the skb to the belonging sock for accounting.  */
3184                abort->skb->sk = ep->base.sk;
3185
3186                sctp_packet_append_chunk(packet, abort);
3187
3188                sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
3189                                SCTP_PACKET(packet));
3190
3191                SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
3192
3193                sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3194                return SCTP_DISPOSITION_CONSUME;
3195        }
3196
3197        return SCTP_DISPOSITION_NOMEM;
3198}
3199
3200/*
3201 * Received an ERROR chunk from peer.  Generate SCTP_REMOTE_ERROR
3202 * event as ULP notification for each cause included in the chunk.
3203 *
3204 * API 5.3.1.3 - SCTP_REMOTE_ERROR
3205 *
3206 * The return value is the disposition of the chunk.
3207*/
3208sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep,
3209                                        const struct sctp_association *asoc,
3210                                        const sctp_subtype_t type,
3211                                        void *arg,
3212                                        sctp_cmd_seq_t *commands)
3213{
3214        struct sctp_chunk *chunk = arg;
3215        sctp_errhdr_t *err;
3216
3217        if (!sctp_vtag_verify(chunk, asoc))
3218                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3219
3220        /* Make sure that the ERROR chunk has a valid length. */
3221        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_operr_chunk_t)))
3222                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3223                                                  commands);
3224        sctp_walk_errors(err, chunk->chunk_hdr);
3225        if ((void *)err != (void *)chunk->chunk_end)
3226                return sctp_sf_violation_paramlen(ep, asoc, type, arg,
3227                                                  (void *)err, commands);
3228
3229        sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,
3230                        SCTP_CHUNK(chunk));
3231
3232        return SCTP_DISPOSITION_CONSUME;
3233}
3234
3235/*
3236 * Process an inbound SHUTDOWN ACK.
3237 *
3238 * From Section 9.2:
3239 * Upon the receipt of the SHUTDOWN ACK, the SHUTDOWN sender shall
3240 * stop the T2-shutdown timer, send a SHUTDOWN COMPLETE chunk to its
3241 * peer, and remove all record of the association.
3242 *
3243 * The return value is the disposition.
3244 */
3245sctp_disposition_t sctp_sf_do_9_2_final(const struct sctp_endpoint *ep,
3246                                        const struct sctp_association *asoc,
3247                                        const sctp_subtype_t type,
3248                                        void *arg,
3249                                        sctp_cmd_seq_t *commands)
3250{
3251        struct sctp_chunk *chunk = arg;
3252        struct sctp_chunk *reply;
3253        struct sctp_ulpevent *ev;
3254
3255        if (!sctp_vtag_verify(chunk, asoc))
3256                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3257
3258        /* Make sure that the SHUTDOWN_ACK chunk has a valid length. */
3259        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
3260                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3261                                                  commands);
3262        /* 10.2 H) SHUTDOWN COMPLETE notification
3263         *
3264         * When SCTP completes the shutdown procedures (section 9.2) this
3265         * notification is passed to the upper layer.
3266         */
3267        ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_SHUTDOWN_COMP,
3268                                             0, 0, 0, NULL, GFP_ATOMIC);
3269        if (!ev)
3270                goto nomem;
3271
3272        /* ...send a SHUTDOWN COMPLETE chunk to its peer, */
3273        reply = sctp_make_shutdown_complete(asoc, chunk);
3274        if (!reply)
3275                goto nomem_chunk;
3276
3277        /* Do all the commands now (after allocation), so that we
3278         * have consistent state if memory allocation failes
3279         */
3280        sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
3281
3282        /* Upon the receipt of the SHUTDOWN ACK, the SHUTDOWN sender shall
3283         * stop the T2-shutdown timer,
3284         */
3285        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3286                        SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
3287
3288        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3289                        SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
3290
3291        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
3292                        SCTP_STATE(SCTP_STATE_CLOSED));
3293        SCTP_INC_STATS(SCTP_MIB_SHUTDOWNS);
3294        SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
3295        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
3296
3297        /* ...and remove all record of the association. */
3298        sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
3299        return SCTP_DISPOSITION_DELETE_TCB;
3300
3301nomem_chunk:
3302        sctp_ulpevent_free(ev);
3303nomem:
3304        return SCTP_DISPOSITION_NOMEM;
3305}
3306
3307/*
3308 * RFC 2960, 8.4 - Handle "Out of the blue" Packets, sctpimpguide 2.41.
3309 *
3310 * 5) If the packet contains a SHUTDOWN ACK chunk, the receiver should
3311 *    respond to the sender of the OOTB packet with a SHUTDOWN COMPLETE.
3312 *    When sending the SHUTDOWN COMPLETE, the receiver of the OOTB
3313 *    packet must fill in the Verification Tag field of the outbound
3314 *    packet with the Verification Tag received in the SHUTDOWN ACK and
3315 *    set the T-bit in the Chunk Flags to indicate that the Verification
3316 *    Tag is reflected.
3317 *
3318 * 8) The receiver should respond to the sender of the OOTB packet with
3319 *    an ABORT.  When sending the ABORT, the receiver of the OOTB packet
3320 *    MUST fill in the Verification Tag field of the outbound packet
3321 *    with the value found in the Verification Tag field of the OOTB
3322 *    packet and set the T-bit in the Chunk Flags to indicate that the
3323 *    Verification Tag is reflected.  After sending this ABORT, the
3324 *    receiver of the OOTB packet shall discard the OOTB packet and take
3325 *    no further action.
3326 */
3327sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep,
3328                                const struct sctp_association *asoc,
3329                                const sctp_subtype_t type,
3330                                void *arg,
3331                                sctp_cmd_seq_t *commands)
3332{
3333        struct sctp_chunk *chunk = arg;
3334        struct sk_buff *skb = chunk->skb;
3335        sctp_chunkhdr_t *ch;
3336        sctp_errhdr_t *err;
3337        __u8 *ch_end;
3338        int ootb_shut_ack = 0;
3339        int ootb_cookie_ack = 0;
3340
3341        SCTP_INC_STATS(SCTP_MIB_OUTOFBLUES);
3342
3343        ch = (sctp_chunkhdr_t *) chunk->chunk_hdr;
3344        do {
3345                /* Report violation if the chunk is less then minimal */
3346                if (ntohs(ch->length) < sizeof(sctp_chunkhdr_t))
3347                        return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3348                                                  commands);
3349
3350                /* Now that we know we at least have a chunk header,
3351                 * do things that are type appropriate.
3352                 */
3353                if (SCTP_CID_SHUTDOWN_ACK == ch->type)
3354                        ootb_shut_ack = 1;
3355
3356                /* RFC 2960, Section 3.3.7
3357                 *   Moreover, under any circumstances, an endpoint that
3358                 *   receives an ABORT  MUST NOT respond to that ABORT by
3359                 *   sending an ABORT of its own.
3360                 */
3361                if (SCTP_CID_ABORT == ch->type)
3362                        return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3363
3364                /* RFC 8.4, 7) If the packet contains a "Stale cookie" ERROR
3365                 * or a COOKIE ACK the SCTP Packet should be silently
3366                 * discarded.
3367                 */
3368
3369                if (SCTP_CID_COOKIE_ACK == ch->type)
3370                        ootb_cookie_ack = 1;
3371
3372                if (SCTP_CID_ERROR == ch->type) {
3373                        sctp_walk_errors(err, ch) {
3374                                if (SCTP_ERROR_STALE_COOKIE == err->cause) {
3375                                        ootb_cookie_ack = 1;
3376                                        break;
3377                                }
3378                        }
3379                }
3380
3381                /* Report violation if chunk len overflows */
3382                ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length));
3383                if (ch_end > skb_tail_pointer(skb))
3384                        return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3385                                                  commands);
3386
3387                ch = (sctp_chunkhdr_t *) ch_end;
3388        } while (ch_end < skb_tail_pointer(skb));
3389
3390        if (ootb_shut_ack)
3391                return sctp_sf_shut_8_4_5(ep, asoc, type, arg, commands);
3392        else if (ootb_cookie_ack)
3393                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3394        else
3395                return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
3396}
3397
3398/*
3399 * Handle an "Out of the blue" SHUTDOWN ACK.
3400 *
3401 * Section: 8.4 5, sctpimpguide 2.41.
3402 *
3403 * 5) If the packet contains a SHUTDOWN ACK chunk, the receiver should
3404 *    respond to the sender of the OOTB packet with a SHUTDOWN COMPLETE.
3405 *    When sending the SHUTDOWN COMPLETE, the receiver of the OOTB
3406 *    packet must fill in the Verification Tag field of the outbound
3407 *    packet with the Verification Tag received in the SHUTDOWN ACK and
3408 *    set the T-bit in the Chunk Flags to indicate that the Verification
3409 *    Tag is reflected.
3410 *
3411 * Inputs
3412 * (endpoint, asoc, type, arg, commands)
3413 *
3414 * Outputs
3415 * (sctp_disposition_t)
3416 *
3417 * The return value is the disposition of the chunk.
3418 */
3419static sctp_disposition_t sctp_sf_shut_8_4_5(const struct sctp_endpoint *ep,
3420                                             const struct sctp_association *asoc,
3421                                             const sctp_subtype_t type,
3422                                             void *arg,
3423                                             sctp_cmd_seq_t *commands)
3424{
3425        struct sctp_packet *packet = NULL;
3426        struct sctp_chunk *chunk = arg;
3427        struct sctp_chunk *shut;
3428
3429        packet = sctp_ootb_pkt_new(asoc, chunk);
3430
3431        if (packet) {
3432                /* Make an SHUTDOWN_COMPLETE.
3433                 * The T bit will be set if the asoc is NULL.
3434                 */
3435                shut = sctp_make_shutdown_complete(asoc, chunk);
3436                if (!shut) {
3437                        sctp_ootb_pkt_free(packet);
3438                        return SCTP_DISPOSITION_NOMEM;
3439                }
3440
3441                /* Reflect vtag if T-Bit is set */
3442                if (sctp_test_T_bit(shut))
3443                        packet->vtag = ntohl(chunk->sctp_hdr->vtag);
3444
3445                /* Set the skb to the belonging sock for accounting.  */
3446                shut->skb->sk = ep->base.sk;
3447
3448                sctp_packet_append_chunk(packet, shut);
3449
3450                sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
3451                                SCTP_PACKET(packet));
3452
3453                SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
3454
3455                /* If the chunk length is invalid, we don't want to process
3456                 * the reset of the packet.
3457                 */
3458                if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
3459                        return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3460
3461                /* We need to discard the rest of the packet to prevent
3462                 * potential bomming attacks from additional bundled chunks.
3463                 * This is documented in SCTP Threats ID.
3464                 */
3465                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3466        }
3467
3468        return SCTP_DISPOSITION_NOMEM;
3469}
3470
3471/*
3472 * Handle SHUTDOWN ACK in COOKIE_ECHOED or COOKIE_WAIT state.
3473 *
3474 * Verification Tag:  8.5.1 E) Rules for packet carrying a SHUTDOWN ACK
3475 *   If the receiver is in COOKIE-ECHOED or COOKIE-WAIT state the
3476 *   procedures in section 8.4 SHOULD be followed, in other words it
3477 *   should be treated as an Out Of The Blue packet.
3478 *   [This means that we do NOT check the Verification Tag on these
3479 *   chunks. --piggy ]
3480 *
3481 */
3482sctp_disposition_t sctp_sf_do_8_5_1_E_sa(const struct sctp_endpoint *ep,
3483                                      const struct sctp_association *asoc,
3484                                      const sctp_subtype_t type,
3485                                      void *arg,
3486                                      sctp_cmd_seq_t *commands)
3487{
3488        struct sctp_chunk *chunk = arg;
3489
3490        /* Make sure that the SHUTDOWN_ACK chunk has a valid length. */
3491        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
3492                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3493                                                  commands);
3494
3495        /* Although we do have an association in this case, it corresponds
3496         * to a restarted association. So the packet is treated as an OOTB
3497         * packet and the state function that handles OOTB SHUTDOWN_ACK is
3498         * called with a NULL association.
3499         */
3500        SCTP_INC_STATS(SCTP_MIB_OUTOFBLUES);
3501
3502        return sctp_sf_shut_8_4_5(ep, NULL, type, arg, commands);
3503}
3504
3505/* ADDIP Section 4.2 Upon reception of an ASCONF Chunk.  */
3506sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep,
3507                                     const struct sctp_association *asoc,
3508                                     const sctp_subtype_t type, void *arg,
3509                                     sctp_cmd_seq_t *commands)
3510{
3511        struct sctp_chunk       *chunk = arg;
3512        struct sctp_chunk       *asconf_ack = NULL;
3513        struct sctp_paramhdr    *err_param = NULL;
3514        sctp_addiphdr_t         *hdr;
3515        union sctp_addr_param   *addr_param;
3516        __u32                   serial;
3517        int                     length;
3518
3519        if (!sctp_vtag_verify(chunk, asoc)) {
3520                sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3521                                SCTP_NULL());
3522                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3523        }
3524
3525        /* ADD-IP: Section 4.1.1
3526         * This chunk MUST be sent in an authenticated way by using
3527         * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk
3528         * is received unauthenticated it MUST be silently discarded as
3529         * described in [I-D.ietf-tsvwg-sctp-auth].
3530         */
3531        if (!sctp_addip_noauth && !chunk->auth)
3532                return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
3533
3534        /* Make sure that the ASCONF ADDIP chunk has a valid length.  */
3535        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_addip_chunk_t)))
3536                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3537                                                  commands);
3538
3539        hdr = (sctp_addiphdr_t *)chunk->skb->data;
3540        serial = ntohl(hdr->serial);
3541
3542        addr_param = (union sctp_addr_param *)hdr->params;
3543        length = ntohs(addr_param->p.length);
3544        if (length < sizeof(sctp_paramhdr_t))
3545                return sctp_sf_violation_paramlen(ep, asoc, type, arg,
3546                           (void *)addr_param, commands);
3547
3548        /* Verify the ASCONF chunk before processing it. */
3549        if (!sctp_verify_asconf(asoc,
3550                            (sctp_paramhdr_t *)((void *)addr_param + length),
3551                            (void *)chunk->chunk_end,
3552                            &err_param))
3553                return sctp_sf_violation_paramlen(ep, asoc, type, arg,
3554                                                  (void *)err_param, commands);
3555
3556        /* ADDIP 5.2 E1) Compare the value of the serial number to the value
3557         * the endpoint stored in a new association variable
3558         * 'Peer-Serial-Number'.
3559         */
3560        if (serial == asoc->peer.addip_serial + 1) {
3561                /* If this is the first instance of ASCONF in the packet,
3562                 * we can clean our old ASCONF-ACKs.
3563                 */
3564                if (!chunk->has_asconf)
3565                        sctp_assoc_clean_asconf_ack_cache(asoc);
3566
3567                /* ADDIP 5.2 E4) When the Sequence Number matches the next one
3568                 * expected, process the ASCONF as described below and after
3569                 * processing the ASCONF Chunk, append an ASCONF-ACK Chunk to
3570                 * the response packet and cache a copy of it (in the event it
3571                 * later needs to be retransmitted).
3572                 *
3573                 * Essentially, do V1-V5.
3574                 */
3575                asconf_ack = sctp_process_asconf((struct sctp_association *)
3576                                                 asoc, chunk);
3577                if (!asconf_ack)
3578                        return SCTP_DISPOSITION_NOMEM;
3579        } else if (serial < asoc->peer.addip_serial + 1) {
3580                /* ADDIP 5.2 E2)
3581                 * If the value found in the Sequence Number is less than the
3582                 * ('Peer- Sequence-Number' + 1), simply skip to the next
3583                 * ASCONF, and include in the outbound response packet
3584                 * any previously cached ASCONF-ACK response that was
3585                 * sent and saved that matches the Sequence Number of the
3586                 * ASCONF.  Note: It is possible that no cached ASCONF-ACK
3587                 * Chunk exists.  This will occur when an older ASCONF
3588                 * arrives out of order.  In such a case, the receiver
3589                 * should skip the ASCONF Chunk and not include ASCONF-ACK
3590                 * Chunk for that chunk.
3591                 */
3592                asconf_ack = sctp_assoc_lookup_asconf_ack(asoc, hdr->serial);
3593                if (!asconf_ack)
3594                        return SCTP_DISPOSITION_DISCARD;
3595
3596                /* Reset the transport so that we select the correct one
3597                 * this time around.  This is to make sure that we don't
3598                 * accidentally use a stale transport that's been removed.
3599                 */
3600                asconf_ack->transport = NULL;
3601        } else {
3602                /* ADDIP 5.2 E5) Otherwise, the ASCONF Chunk is discarded since
3603                 * it must be either a stale packet or from an attacker.
3604                 */
3605                return SCTP_DISPOSITION_DISCARD;
3606        }
3607
3608        /* ADDIP 5.2 E6)  The destination address of the SCTP packet
3609         * containing the ASCONF-ACK Chunks MUST be the source address of
3610         * the SCTP packet that held the ASCONF Chunks.
3611         *
3612         * To do this properly, we'll set the destination address of the chunk
3613         * and at the transmit time, will try look up the transport to use.
3614         * Since ASCONFs may be bundled, the correct transport may not be
3615         * created until we process the entire packet, thus this workaround.
3616         */
3617        asconf_ack->dest = chunk->source;
3618        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(asconf_ack));
3619        if (asoc->new_transport) {
3620                sctp_sf_heartbeat(ep, asoc, type, asoc->new_transport,
3621                    commands);
3622                ((struct sctp_association *)asoc)->new_transport = NULL;
3623        }
3624
3625        return SCTP_DISPOSITION_CONSUME;
3626}
3627
3628/*
3629 * ADDIP Section 4.3 General rules for address manipulation
3630 * When building TLV parameters for the ASCONF Chunk that will add or
3631 * delete IP addresses the D0 to D13 rules should be applied:
3632 */
3633sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
3634                                         const struct sctp_association *asoc,
3635                                         const sctp_subtype_t type, void *arg,
3636                                         sctp_cmd_seq_t *commands)
3637{
3638        struct sctp_chunk       *asconf_ack = arg;
3639        struct sctp_chunk       *last_asconf = asoc->addip_last_asconf;
3640        struct sctp_chunk       *abort;
3641        struct sctp_paramhdr    *err_param = NULL;
3642        sctp_addiphdr_t         *addip_hdr;
3643        __u32                   sent_serial, rcvd_serial;
3644
3645        if (!sctp_vtag_verify(asconf_ack, asoc)) {
3646                sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3647                                SCTP_NULL());
3648                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3649        }
3650
3651        /* ADD-IP, Section 4.1.2:
3652         * This chunk MUST be sent in an authenticated way by using
3653         * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk
3654         * is received unauthenticated it MUST be silently discarded as
3655         * described in [I-D.ietf-tsvwg-sctp-auth].
3656         */
3657        if (!sctp_addip_noauth && !asconf_ack->auth)
3658                return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
3659
3660        /* Make sure that the ADDIP chunk has a valid length.  */
3661        if (!sctp_chunk_length_valid(asconf_ack, sizeof(sctp_addip_chunk_t)))
3662                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3663                                                  commands);
3664
3665        addip_hdr = (sctp_addiphdr_t *)asconf_ack->skb->data;
3666        rcvd_serial = ntohl(addip_hdr->serial);
3667
3668        /* Verify the ASCONF-ACK chunk before processing it. */
3669        if (!sctp_verify_asconf(asoc,
3670            (sctp_paramhdr_t *)addip_hdr->params,
3671            (void *)asconf_ack->chunk_end,
3672            &err_param))
3673                return sctp_sf_violation_paramlen(ep, asoc, type, arg,
3674                           (void *)err_param, commands);
3675
3676        if (last_asconf) {
3677                addip_hdr = (sctp_addiphdr_t *)last_asconf->subh.addip_hdr;
3678                sent_serial = ntohl(addip_hdr->serial);
3679        } else {
3680                sent_serial = asoc->addip_serial - 1;
3681        }
3682
3683        /* D0) If an endpoint receives an ASCONF-ACK that is greater than or
3684         * equal to the next serial number to be used but no ASCONF chunk is
3685         * outstanding the endpoint MUST ABORT the association. Note that a
3686         * sequence number is greater than if it is no more than 2^^31-1
3687         * larger than the current sequence number (using serial arithmetic).
3688         */
3689        if (ADDIP_SERIAL_gte(rcvd_serial, sent_serial + 1) &&
3690            !(asoc->addip_last_asconf)) {
3691                abort = sctp_make_abort(asoc, asconf_ack,
3692                                        sizeof(sctp_errhdr_t));
3693                if (abort) {
3694                        sctp_init_cause(abort, SCTP_ERROR_ASCONF_ACK, 0);
3695                        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
3696                                        SCTP_CHUNK(abort));
3697                }
3698                /* We are going to ABORT, so we might as well stop
3699                 * processing the rest of the chunks in the packet.
3700                 */
3701                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3702                                SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
3703                sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
3704                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
3705                                SCTP_ERROR(ECONNABORTED));
3706                sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
3707                                SCTP_PERR(SCTP_ERROR_ASCONF_ACK));
3708                SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
3709                SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
3710                return SCTP_DISPOSITION_ABORT;
3711        }
3712
3713        if ((rcvd_serial == sent_serial) && asoc->addip_last_asconf) {
3714                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
3715                                SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
3716
3717                if (!sctp_process_asconf_ack((struct sctp_association *)asoc,
3718                                             asconf_ack)) {
3719                        /* Successfully processed ASCONF_ACK.  We can
3720                         * release the next asconf if we have one.
3721                         */
3722                        sctp_add_cmd_sf(commands, SCTP_CMD_SEND_NEXT_ASCONF,
3723                                        SCTP_NULL());
3724                        return SCTP_DISPOSITION_CONSUME;
3725                }
3726
3727                abort = sctp_make_abort(asoc, asconf_ack,
3728                                        sizeof(sctp_errhdr_t));
3729                if (abort) {
3730                        sctp_init_cause(abort, SCTP_ERROR_RSRC_LOW, 0);
3731                        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
3732                                        SCTP_CHUNK(abort));
3733                }
3734                /* We are going to ABORT, so we might as well stop
3735                 * processing the rest of the chunks in the packet.
3736                 */
3737                sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
3738                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
3739                                SCTP_ERROR(ECONNABORTED));
3740                sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
3741                                SCTP_PERR(SCTP_ERROR_ASCONF_ACK));
3742                SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
3743                SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
3744                return SCTP_DISPOSITION_ABORT;
3745        }
3746
3747        return SCTP_DISPOSITION_DISCARD;
3748}
3749
3750/*
3751 * PR-SCTP Section 3.6 Receiver Side Implementation of PR-SCTP
3752 *
3753 * When a FORWARD TSN chunk arrives, the data receiver MUST first update
3754 * its cumulative TSN point to the value carried in the FORWARD TSN
3755 * chunk, and then MUST further advance its cumulative TSN point locally
3756 * if possible.
3757 * After the above processing, the data receiver MUST stop reporting any
3758 * missing TSNs earlier than or equal to the new cumulative TSN point.
3759 *
3760 * Verification Tag:  8.5 Verification Tag [Normal verification]
3761 *
3762 * The return value is the disposition of the chunk.
3763 */
3764sctp_disposition_t sctp_sf_eat_fwd_tsn(const struct sctp_endpoint *ep,
3765                                       const struct sctp_association *asoc,
3766                                       const sctp_subtype_t type,
3767                                       void *arg,
3768                                       sctp_cmd_seq_t *commands)
3769{
3770        struct sctp_chunk *chunk = arg;
3771        struct sctp_fwdtsn_hdr *fwdtsn_hdr;
3772        struct sctp_fwdtsn_skip *skip;
3773        __u16 len;
3774        __u32 tsn;
3775
3776        if (!sctp_vtag_verify(chunk, asoc)) {
3777                sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3778                                SCTP_NULL());
3779                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3780        }
3781
3782        /* Make sure that the FORWARD_TSN chunk has valid length.  */
3783        if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_fwdtsn_chunk)))
3784                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3785                                                  commands);
3786
3787        fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data;
3788        chunk->subh.fwdtsn_hdr = fwdtsn_hdr;
3789        len = ntohs(chunk->chunk_hdr->length);
3790        len -= sizeof(struct sctp_chunkhdr);
3791        skb_pull(chunk->skb, len);
3792
3793        tsn = ntohl(fwdtsn_hdr->new_cum_tsn);
3794        SCTP_DEBUG_PRINTK("%s: TSN 0x%x.\n", __func__, tsn);
3795
3796        /* The TSN is too high--silently discard the chunk and count on it
3797         * getting retransmitted later.
3798         */
3799        if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
3800                goto discard_noforce;
3801
3802        /* Silently discard the chunk if stream-id is not valid */
3803        sctp_walk_fwdtsn(skip, chunk) {
3804                if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
3805                        goto discard_noforce;
3806        }
3807
3808        sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
3809        if (len > sizeof(struct sctp_fwdtsn_hdr))
3810                sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
3811                                SCTP_CHUNK(chunk));
3812
3813        /* Count this as receiving DATA. */
3814        if (asoc->autoclose) {
3815                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
3816                                SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
3817        }
3818
3819        /* FIXME: For now send a SACK, but DATA processing may
3820         * send another.
3821         */
3822        sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_NOFORCE());
3823
3824        return SCTP_DISPOSITION_CONSUME;
3825
3826discard_noforce:
3827        return SCTP_DISPOSITION_DISCARD;
3828}
3829
3830sctp_disposition_t sctp_sf_eat_fwd_tsn_fast(
3831        const struct sctp_endpoint *ep,
3832        const struct sctp_association *asoc,
3833        const sctp_subtype_t type,
3834        void *arg,
3835        sctp_cmd_seq_t *commands)
3836{
3837        struct sctp_chunk *chunk = arg;
3838        struct sctp_fwdtsn_hdr *fwdtsn_hdr;
3839        struct sctp_fwdtsn_skip *skip;
3840        __u16 len;
3841        __u32 tsn;
3842
3843        if (!sctp_vtag_verify(chunk, asoc)) {
3844                sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
3845                                SCTP_NULL());
3846                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3847        }
3848
3849        /* Make sure that the FORWARD_TSN chunk has a valid length.  */
3850        if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_fwdtsn_chunk)))
3851                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
3852                                                  commands);
3853
3854        fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data;
3855        chunk->subh.fwdtsn_hdr = fwdtsn_hdr;
3856        len = ntohs(chunk->chunk_hdr->length);
3857        len -= sizeof(struct sctp_chunkhdr);
3858        skb_pull(chunk->skb, len);
3859
3860        tsn = ntohl(fwdtsn_hdr->new_cum_tsn);
3861        SCTP_DEBUG_PRINTK("%s: TSN 0x%x.\n", __func__, tsn);
3862
3863        /* The TSN is too high--silently discard the chunk and count on it
3864         * getting retransmitted later.
3865         */
3866        if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
3867                goto gen_shutdown;
3868
3869        /* Silently discard the chunk if stream-id is not valid */
3870        sctp_walk_fwdtsn(skip, chunk) {
3871                if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
3872                        goto gen_shutdown;
3873        }
3874
3875        sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
3876        if (len > sizeof(struct sctp_fwdtsn_hdr))
3877                sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
3878                                SCTP_CHUNK(chunk));
3879
3880        /* Go a head and force a SACK, since we are shutting down. */
3881gen_shutdown:
3882        /* Implementor's Guide.
3883         *
3884         * While in SHUTDOWN-SENT state, the SHUTDOWN sender MUST immediately
3885         * respond to each received packet containing one or more DATA chunk(s)
3886         * with a SACK, a SHUTDOWN chunk, and restart the T2-shutdown timer
3887         */
3888        sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SHUTDOWN, SCTP_NULL());
3889        sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
3890        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
3891                        SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
3892
3893        return SCTP_DISPOSITION_CONSUME;
3894}
3895
3896/*
3897 * SCTP-AUTH Section 6.3 Receiving authenticated chukns
3898 *
3899 *    The receiver MUST use the HMAC algorithm indicated in the HMAC
3900 *    Identifier field.  If this algorithm was not specified by the
3901 *    receiver in the HMAC-ALGO parameter in the INIT or INIT-ACK chunk
3902 *    during association setup, the AUTH chunk and all chunks after it MUST
3903 *    be discarded and an ERROR chunk SHOULD be sent with the error cause
3904 *    defined in Section 4.1.
3905 *
3906 *    If an endpoint with no shared key receives a Shared Key Identifier
3907 *    other than 0, it MUST silently discard all authenticated chunks.  If
3908 *    the endpoint has at least one endpoint pair shared key for the peer,
3909 *    it MUST use the key specified by the Shared Key Identifier if a
3910 *    key has been configured for that Shared Key Identifier.  If no
3911 *    endpoint pair shared key has been configured for that Shared Key
3912 *    Identifier, all authenticated chunks MUST be silently discarded.
3913 *
3914 * Verification Tag:  8.5 Verification Tag [Normal verification]
3915 *
3916 * The return value is the disposition of the chunk.
3917 */
3918static sctp_ierror_t sctp_sf_authenticate(const struct sctp_endpoint *ep,
3919                                    const struct sctp_association *asoc,
3920                                    const sctp_subtype_t type,
3921                                    struct sctp_chunk *chunk)
3922{
3923        struct sctp_authhdr *auth_hdr;
3924        struct sctp_hmac *hmac;
3925        unsigned int sig_len;
3926        __u16 key_id;
3927        __u8 *save_digest;
3928        __u8 *digest;
3929
3930        /* Pull in the auth header, so we can do some more verification */
3931        auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
3932        chunk->subh.auth_hdr = auth_hdr;
3933        skb_pull(chunk->skb, sizeof(struct sctp_authhdr));
3934
3935        /* Make sure that we suport the HMAC algorithm from the auth
3936         * chunk.
3937         */
3938        if (!sctp_auth_asoc_verify_hmac_id(asoc, auth_hdr->hmac_id))
3939                return SCTP_IERROR_AUTH_BAD_HMAC;
3940
3941        /* Make sure that the provided shared key identifier has been
3942         * configured
3943         */
3944        key_id = ntohs(auth_hdr->shkey_id);
3945        if (key_id != asoc->active_key_id && !sctp_auth_get_shkey(asoc, key_id))
3946                return SCTP_IERROR_AUTH_BAD_KEYID;
3947
3948
3949        /* Make sure that the length of the signature matches what
3950         * we expect.
3951         */
3952        sig_len = ntohs(chunk->chunk_hdr->length) - sizeof(sctp_auth_chunk_t);
3953        hmac = sctp_auth_get_hmac(ntohs(auth_hdr->hmac_id));
3954        if (sig_len != hmac->hmac_len)
3955                return SCTP_IERROR_PROTO_VIOLATION;
3956
3957        /* Now that we've done validation checks, we can compute and
3958         * verify the hmac.  The steps involved are:
3959         *  1. Save the digest from the chunk.
3960         *  2. Zero out the digest in the chunk.
3961         *  3. Compute the new digest
3962         *  4. Compare saved and new digests.
3963         */
3964        digest = auth_hdr->hmac;
3965        skb_pull(chunk->skb, sig_len);
3966
3967        save_digest = kmemdup(digest, sig_len, GFP_ATOMIC);
3968        if (!save_digest)
3969                goto nomem;
3970
3971        memset(digest, 0, sig_len);
3972
3973        sctp_auth_calculate_hmac(asoc, chunk->skb,
3974                                (struct sctp_auth_chunk *)chunk->chunk_hdr,
3975                                GFP_ATOMIC);
3976
3977        /* Discard the packet if the digests do not match */
3978        if (memcmp(save_digest, digest, sig_len)) {
3979                kfree(save_digest);
3980                return SCTP_IERROR_BAD_SIG;
3981        }
3982
3983        kfree(save_digest);
3984        chunk->auth = 1;
3985
3986        return SCTP_IERROR_NO_ERROR;
3987nomem:
3988        return SCTP_IERROR_NOMEM;
3989}
3990
3991sctp_disposition_t sctp_sf_eat_auth(const struct sctp_endpoint *ep,
3992                                    const struct sctp_association *asoc,
3993                                    const sctp_subtype_t type,
3994                                    void *arg,
3995                                    sctp_cmd_seq_t *commands)
3996{
3997        struct sctp_authhdr *auth_hdr;
3998        struct sctp_chunk *chunk = arg;
3999        struct sctp_chunk *err_chunk;
4000        sctp_ierror_t error;
4001
4002        /* Make sure that the peer has AUTH capable */
4003        if (!asoc->peer.auth_capable)
4004                return sctp_sf_unk_chunk(ep, asoc, type, arg, commands);
4005
4006        if (!sctp_vtag_verify(chunk, asoc)) {
4007                sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
4008                                SCTP_NULL());
4009                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
4010        }
4011
4012        /* Make sure that the AUTH chunk has valid length.  */
4013        if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_auth_chunk)))
4014                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
4015                                                  commands);
4016
4017        auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
4018        error = sctp_sf_authenticate(ep, asoc, type, chunk);
4019        switch (error) {
4020        case SCTP_IERROR_AUTH_BAD_HMAC:
4021                /* Generate the ERROR chunk and discard the rest
4022                 * of the packet
4023                 */
4024                err_chunk = sctp_make_op_error(asoc, chunk,
4025                                               SCTP_ERROR_UNSUP_HMAC,
4026                                               &auth_hdr->hmac_id,
4027                                               sizeof(__u16), 0);
4028                if (err_chunk) {
4029                        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
4030                                        SCTP_CHUNK(err_chunk));
4031                }
4032                /* Fall Through */
4033        case SCTP_IERROR_AUTH_BAD_KEYID:
4034        case SCTP_IERROR_BAD_SIG:
4035                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
4036
4037        case SCTP_IERROR_PROTO_VIOLATION:
4038                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
4039                                                  commands);
4040
4041        case SCTP_IERROR_NOMEM:
4042                return SCTP_DISPOSITION_NOMEM;
4043
4044        default:                        /* Prevent gcc warnings */
4045                break;
4046        }
4047
4048        if (asoc->active_key_id != ntohs(auth_hdr->shkey_id)) {
4049                struct sctp_ulpevent *ev;
4050
4051                ev = sctp_ulpevent_make_authkey(asoc, ntohs(auth_hdr->shkey_id),
4052                                    SCTP_AUTH_NEWKEY, GFP_ATOMIC);
4053
4054                if (!ev)
4055                        return -ENOMEM;
4056
4057                sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
4058                                SCTP_ULPEVENT(ev));
4059        }
4060
4061        return SCTP_DISPOSITION_CONSUME;
4062}
4063
4064/*
4065 * Process an unknown chunk.
4066 *
4067 * Section: 3.2. Also, 2.1 in the implementor's guide.
4068 *
4069 * Chunk Types are encoded such that the highest-order two bits specify
4070 * the action that must be taken if the processing endpoint does not
4071 * recognize the Chunk Type.
4072 *
4073 * 00 - Stop processing this SCTP packet and discard it, do not process
4074 *      any further chunks within it.
4075 *
4076 * 01 - Stop processing this SCTP packet and discard it, do not process
4077 *      any further chunks within it, and report the unrecognized
4078 *      chunk in an 'Unrecognized Chunk Type'.
4079 *
4080 * 10 - Skip this chunk and continue processing.
4081 *
4082 * 11 - Skip this chunk and continue processing, but report in an ERROR
4083 *      Chunk using the 'Unrecognized Chunk Type' cause of error.
4084 *
4085 * The return value is the disposition of the chunk.
4086 */
4087sctp_disposition_t sctp_sf_unk_chunk(const struct sctp_endpoint *ep,
4088                                     const struct sctp_association *asoc,
4089                                     const sctp_subtype_t type,
4090                                     void *arg,
4091                                     sctp_cmd_seq_t *commands)
4092{
4093        struct sctp_chunk *unk_chunk = arg;
4094        struct sctp_chunk *err_chunk;
4095        sctp_chunkhdr_t *hdr;
4096
4097        SCTP_DEBUG_PRINTK("Processing the unknown chunk id %d.\n", type.chunk);
4098
4099        if (!sctp_vtag_verify(unk_chunk, asoc))
4100                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
4101
4102        /* Make sure that the chunk has a valid length.
4103         * Since we don't know the chunk type, we use a general
4104         * chunkhdr structure to make a comparison.
4105         */
4106        if (!sctp_chunk_length_valid(unk_chunk, sizeof(sctp_chunkhdr_t)))
4107                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
4108                                                  commands);
4109
4110        switch (type.chunk & SCTP_CID_ACTION_MASK) {
4111        case SCTP_CID_ACTION_DISCARD:
4112                /* Discard the packet.  */
4113                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
4114                break;
4115        case SCTP_CID_ACTION_DISCARD_ERR:
4116                /* Generate an ERROR chunk as response. */
4117                hdr = unk_chunk->chunk_hdr;
4118                err_chunk = sctp_make_op_error(asoc, unk_chunk,
4119                                               SCTP_ERROR_UNKNOWN_CHUNK, hdr,
4120                                               WORD_ROUND(ntohs(hdr->length)),
4121                                               0);
4122                if (err_chunk) {
4123                        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
4124                                        SCTP_CHUNK(err_chunk));
4125                }
4126
4127                /* Discard the packet.  */
4128                sctp_sf_pdiscard(ep, asoc, type, arg, commands);
4129                return SCTP_DISPOSITION_CONSUME;
4130                break;
4131        case SCTP_CID_ACTION_SKIP:
4132                /* Skip the chunk.  */
4133                return SCTP_DISPOSITION_DISCARD;
4134                break;
4135        case SCTP_CID_ACTION_SKIP_ERR:
4136                /* Generate an ERROR chunk as response. */
4137                hdr = unk_chunk->chunk_hdr;
4138                err_chunk = sctp_make_op_error(asoc, unk_chunk,
4139                                               SCTP_ERROR_UNKNOWN_CHUNK, hdr,
4140                                               WORD_ROUND(ntohs(hdr->length)),
4141                                               0);
4142                if (err_chunk) {
4143                        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
4144                                        SCTP_CHUNK(err_chunk));
4145                }
4146                /* Skip the chunk.  */
4147                return SCTP_DISPOSITION_CONSUME;
4148                break;
4149        default:
4150                break;
4151        }
4152
4153        return SCTP_DISPOSITION_DISCARD;
4154}
4155
4156/*
4157 * Discard the chunk.
4158 *
4159 * Section: 0.2, 5.2.3, 5.2.5, 5.2.6, 6.0, 8.4.6, 8.5.1c, 9.2
4160 * [Too numerous to mention...]
4161 * Verification Tag: No verification needed.
4162 * Inputs
4163 * (endpoint, asoc, chunk)
4164 *
4165 * Outputs
4166 * (asoc, reply_msg, msg_up, timers, counters)
4167 *
4168 * The return value is the disposition of the chunk.
4169 */
4170sctp_disposition_t sctp_sf_discard_chunk(const struct sctp_endpoint *ep,
4171                                         const struct sctp_association *asoc,
4172                                         const sctp_subtype_t type,
4173                                         void *arg,
4174                                         sctp_cmd_seq_t *commands)
4175{
4176        struct sctp_chunk *chunk = arg;
4177
4178        /* Make sure that the chunk has a valid length.
4179         * Since we don't know the chunk type, we use a general
4180         * chunkhdr structure to make a comparison.
4181         */
4182        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
4183                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
4184                                                  commands);
4185
4186        SCTP_DEBUG_PRINTK("Chunk %d is discarded\n", type.chunk);
4187        return SCTP_DISPOSITION_DISCARD;
4188}
4189
4190/*
4191 * Discard the whole packet.
4192 *
4193 * Section: 8.4 2)
4194 *
4195 * 2) If the OOTB packet contains an ABORT chunk, the receiver MUST
4196 *    silently discard the OOTB packet and take no further action.
4197 *
4198 * Verification Tag: No verification necessary
4199 *
4200 * Inputs
4201 * (endpoint, asoc, chunk)
4202 *
4203 * Outputs
4204 * (asoc, reply_msg, msg_up, timers, counters)
4205 *
4206 * The return value is the disposition of the chunk.
4207 */
4208sctp_disposition_t sctp_sf_pdiscard(const struct sctp_endpoint *ep,
4209                                    const struct sctp_association *asoc,
4210                                    const sctp_subtype_t type,
4211                                    void *arg,
4212                                    sctp_cmd_seq_t *commands)
4213{
4214        SCTP_INC_STATS(SCTP_MIB_IN_PKT_DISCARDS);
4215        sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
4216
4217        return SCTP_DISPOSITION_CONSUME;
4218}
4219
4220
4221/*
4222 * The other end is violating protocol.
4223 *
4224 * Section: Not specified
4225 * Verification Tag: Not specified
4226 * Inputs
4227 * (endpoint, asoc, chunk)
4228 *
4229 * Outputs
4230 * (asoc, reply_msg, msg_up, timers, counters)
4231 *
4232 * We simply tag the chunk as a violation.  The state machine will log
4233 * the violation and continue.
4234 */
4235sctp_disposition_t sctp_sf_violation(const struct sctp_endpoint *ep,
4236                                     const struct sctp_association *asoc,
4237                                     const sctp_subtype_t type,
4238                                     void *arg,
4239                                     sctp_cmd_seq_t *commands)
4240{
4241        struct sctp_chunk *chunk = arg;
4242
4243        /* Make sure that the chunk has a valid length. */
4244        if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
4245                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
4246                                                  commands);
4247
4248        return SCTP_DISPOSITION_VIOLATION;
4249}
4250
4251/*
4252 * Common function to handle a protocol violation.
4253 */
4254static sctp_disposition_t sctp_sf_abort_violation(
4255                                     const struct sctp_endpoint *ep,
4256                                     const struct sctp_association *asoc,
4257                                     void *arg,
4258                                     sctp_cmd_seq_t *commands,
4259                                     const __u8 *payload,
4260                                     const size_t paylen)
4261{
4262        struct sctp_packet *packet = NULL;
4263        struct sctp_chunk *chunk =  arg;
4264        struct sctp_chunk *abort = NULL;
4265
4266        /* SCTP-AUTH, Section 6.3:
4267         *    It should be noted that if the receiver wants to tear
4268         *    down an association in an authenticated way only, the
4269         *    handling of malformed packets should not result in
4270         *    tearing down the association.
4271         *
4272         * This means that if we only want to abort associations
4273         * in an authenticated way (i.e AUTH+ABORT), then we
4274         * can't destroy this association just because the packet
4275         * was malformed.
4276         */
4277        if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
4278                goto discard;
4279
4280        /* Make the abort chunk. */
4281        abort = sctp_make_abort_violation(asoc, chunk, payload, paylen);
4282        if (!abort)
4283                goto nomem;
4284
4285        if (asoc) {
4286                /* Treat INIT-ACK as a special case during COOKIE-WAIT. */
4287                if (chunk->chunk_hdr->type == SCTP_CID_INIT_ACK &&
4288                    !asoc->peer.i.init_tag) {
4289                        sctp_initack_chunk_t *initack;
4290
4291                        initack = (sctp_initack_chunk_t *)chunk->chunk_hdr;
4292                        if (!sctp_chunk_length_valid(chunk,
4293                                                     sizeof(sctp_initack_chunk_t)))
4294                                abort->chunk_hdr->flags |= SCTP_CHUNK_FLAG_T;
4295                        else {
4296                                unsigned int inittag;
4297
4298                                inittag = ntohl(initack->init_hdr.init_tag);
4299                                sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_INITTAG,
4300                                                SCTP_U32(inittag));
4301                        }
4302                }
4303
4304                sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
4305                SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
4306
4307                if (asoc->state <= SCTP_STATE_COOKIE_ECHOED) {
4308                        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4309                                        SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
4310                        sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4311                                        SCTP_ERROR(ECONNREFUSED));
4312                        sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
4313                                        SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
4314                } else {
4315                        sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4316                                        SCTP_ERROR(ECONNABORTED));
4317                        sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
4318                                        SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
4319                        SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
4320                }
4321        } else {
4322                packet = sctp_ootb_pkt_new(asoc, chunk);
4323
4324                if (!packet)
4325                        goto nomem_pkt;
4326
4327                if (sctp_test_T_bit(abort))
4328                        packet->vtag = ntohl(chunk->sctp_hdr->vtag);
4329
4330                abort->skb->sk = ep->base.sk;
4331
4332                sctp_packet_append_chunk(packet, abort);
4333
4334                sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
4335                        SCTP_PACKET(packet));
4336
4337                SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
4338        }
4339
4340        SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
4341
4342discard:
4343        sctp_sf_pdiscard(ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
4344        return SCTP_DISPOSITION_ABORT;
4345
4346nomem_pkt:
4347        sctp_chunk_free(abort);
4348nomem:
4349        return SCTP_DISPOSITION_NOMEM;
4350}
4351
4352/*
4353 * Handle a protocol violation when the chunk length is invalid.
4354 * "Invalid" length is identified as smaller than the minimal length a
4355 * given chunk can be.  For example, a SACK chunk has invalid length
4356 * if its length is set to be smaller than the size of sctp_sack_chunk_t.
4357 *
4358 * We inform the other end by sending an ABORT with a Protocol Violation
4359 * error code.
4360 *
4361 * Section: Not specified
4362 * Verification Tag:  Nothing to do
4363 * Inputs
4364 * (endpoint, asoc, chunk)
4365 *
4366 * Outputs
4367 * (reply_msg, msg_up, counters)
4368 *
4369 * Generate an  ABORT chunk and terminate the association.
4370 */
4371static sctp_disposition_t sctp_sf_violation_chunklen(
4372                                     const struct sctp_endpoint *ep,
4373                                     const struct sctp_association *asoc,
4374                                     const sctp_subtype_t type,
4375                                     void *arg,
4376                                     sctp_cmd_seq_t *commands)
4377{
4378        static const char err_str[]="The following chunk had invalid length:";
4379
4380        return sctp_sf_abort_violation(ep, asoc, arg, commands, err_str,
4381                                        sizeof(err_str));
4382}
4383
4384/*
4385 * Handle a protocol violation when the parameter length is invalid.
4386 * If the length is smaller than the minimum length of a given parameter,
4387 * or accumulated length in multi parameters exceeds the end of the chunk,
4388 * the length is considered as invalid.
4389 */
4390static sctp_disposition_t sctp_sf_violation_paramlen(
4391                                     const struct sctp_endpoint *ep,
4392                                     const struct sctp_association *asoc,
4393                                     const sctp_subtype_t type,
4394                                     void *arg, void *ext,
4395                                     sctp_cmd_seq_t *commands)
4396{
4397        struct sctp_chunk *chunk =  arg;
4398        struct sctp_paramhdr *param = ext;
4399        struct sctp_chunk *abort = NULL;
4400
4401        if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
4402                goto discard;
4403
4404        /* Make the abort chunk. */
4405        abort = sctp_make_violation_paramlen(asoc, chunk, param);
4406        if (!abort)
4407                goto nomem;
4408
4409        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
4410        SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
4411
4412        sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4413                        SCTP_ERROR(ECONNABORTED));
4414        sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
4415                        SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
4416        SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
4417        SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
4418
4419discard:
4420        sctp_sf_pdiscard(ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
4421        return SCTP_DISPOSITION_ABORT;
4422nomem:
4423        return SCTP_DISPOSITION_NOMEM;
4424}
4425
4426/* Handle a protocol violation when the peer trying to advance the
4427 * cumulative tsn ack to a point beyond the max tsn currently sent.
4428 *
4429 * We inform the other end by sending an ABORT with a Protocol Violation
4430 * error code.
4431 */
4432static sctp_disposition_t sctp_sf_violation_ctsn(
4433                                     const struct sctp_endpoint *ep,
4434                                     const struct sctp_association *asoc,
4435                                     const sctp_subtype_t type,
4436                                     void *arg,
4437                                     sctp_cmd_seq_t *commands)
4438{
4439        static const char err_str[]="The cumulative tsn ack beyond the max tsn currently sent:";
4440
4441        return sctp_sf_abort_violation(ep, asoc, arg, commands, err_str,
4442                                        sizeof(err_str));
4443}
4444
4445/* Handle protocol violation of an invalid chunk bundling.  For example,
4446 * when we have an association and we receive bundled INIT-ACK, or
4447 * SHUDOWN-COMPLETE, our peer is clearly violationg the "MUST NOT bundle"
4448 * statement from the specs.  Additionally, there might be an attacker
4449 * on the path and we may not want to continue this communication.
4450 */
4451static sctp_disposition_t sctp_sf_violation_chunk(
4452                                     const struct sctp_endpoint *ep,
4453                                     const struct sctp_association *asoc,
4454                                     const sctp_subtype_t type,
4455                                     void *arg,
4456                                     sctp_cmd_seq_t *commands)
4457{
4458        static const char err_str[]="The following chunk violates protocol:";
4459
4460        if (!asoc)
4461                return sctp_sf_violation(ep, asoc, type, arg, commands);
4462
4463        return sctp_sf_abort_violation(ep, asoc, arg, commands, err_str,
4464                                        sizeof(err_str));
4465}
4466/***************************************************************************
4467 * These are the state functions for handling primitive (Section 10) events.
4468 ***************************************************************************/
4469/*
4470 * sctp_sf_do_prm_asoc
4471 *
4472 * Section: 10.1 ULP-to-SCTP
4473 * B) Associate
4474 *
4475 * Format: ASSOCIATE(local SCTP instance name, destination transport addr,
4476 * outbound stream count)
4477 * -> association id [,destination transport addr list] [,outbound stream
4478 * count]
4479 *
4480 * This primitive allows the upper layer to initiate an association to a
4481 * specific peer endpoint.
4482 *
4483 * The peer endpoint shall be specified by one of the transport addresses
4484 * which defines the endpoint (see Section 1.4).  If the local SCTP
4485 * instance has not been initialized, the ASSOCIATE is considered an
4486 * error.
4487 * [This is not relevant for the kernel implementation since we do all
4488 * initialization at boot time.  It we hadn't initialized we wouldn't
4489 * get anywhere near this code.]
4490 *
4491 * An association id, which is a local handle to the SCTP association,
4492 * will be returned on successful establishment of the association. If
4493 * SCTP is not able to open an SCTP association with the peer endpoint,
4494 * an error is returned.
4495 * [In the kernel implementation, the struct sctp_association needs to
4496 * be created BEFORE causing this primitive to run.]
4497 *
4498 * Other association parameters may be returned, including the
4499 * complete destination transport addresses of the peer as well as the
4500 * outbound stream count of the local endpoint. One of the transport
4501 * address from the returned destination addresses will be selected by
4502 * the local endpoint as default primary path for sending SCTP packets
4503 * to this peer.  The returned "destination transport addr list" can
4504 * be used by the ULP to change the default primary path or to force
4505 * sending a packet to a specific transport address.  [All of this
4506 * stuff happens when the INIT ACK arrives.  This is a NON-BLOCKING
4507 * function.]
4508 *
4509 * Mandatory attributes:
4510 *
4511 * o local SCTP instance name - obtained from the INITIALIZE operation.
4512 *   [This is the argument asoc.]
4513 * o destination transport addr - specified as one of the transport
4514 * addresses of the peer endpoint with which the association is to be
4515 * established.
4516 *  [This is asoc->peer.active_path.]
4517 * o outbound stream count - the number of outbound streams the ULP
4518 * would like to open towards this peer endpoint.
4519 * [BUG: This is not currently implemented.]
4520 * Optional attributes:
4521 *
4522 * None.
4523 *
4524 * The return value is a disposition.
4525 */
4526sctp_disposition_t sctp_sf_do_prm_asoc(const struct sctp_endpoint *ep,
4527                                       const struct sctp_association *asoc,
4528                                       const sctp_subtype_t type,
4529                                       void *arg,
4530                                       sctp_cmd_seq_t *commands)
4531{
4532        struct sctp_chunk *repl;
4533        struct sctp_association* my_asoc;
4534
4535        /* The comment below says that we enter COOKIE-WAIT AFTER
4536         * sending the INIT, but that doesn't actually work in our
4537         * implementation...
4538         */
4539        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
4540                        SCTP_STATE(SCTP_STATE_COOKIE_WAIT));
4541
4542        /* RFC 2960 5.1 Normal Establishment of an Association
4543         *
4544         * A) "A" first sends an INIT chunk to "Z".  In the INIT, "A"
4545         * must provide its Verification Tag (Tag_A) in the Initiate
4546         * Tag field.  Tag_A SHOULD be a random number in the range of
4547         * 1 to 4294967295 (see 5.3.1 for Tag value selection). ...
4548         */
4549
4550        repl = sctp_make_init(asoc, &asoc->base.bind_addr, GFP_ATOMIC, 0);
4551        if (!repl)
4552                goto nomem;
4553
4554        /* Cast away the const modifier, as we want to just
4555         * rerun it through as a sideffect.
4556         */
4557        my_asoc = (struct sctp_association *)asoc;
4558        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(my_asoc));
4559
4560        /* Choose transport for INIT. */
4561        sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
4562                        SCTP_CHUNK(repl));
4563
4564        /* After sending the INIT, "A" starts the T1-init timer and
4565         * enters the COOKIE-WAIT state.
4566         */
4567        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
4568                        SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
4569        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
4570        return SCTP_DISPOSITION_CONSUME;
4571
4572nomem:
4573        return SCTP_DISPOSITION_NOMEM;
4574}
4575
4576/*
4577 * Process the SEND primitive.
4578 *
4579 * Section: 10.1 ULP-to-SCTP
4580 * E) Send
4581 *
4582 * Format: SEND(association id, buffer address, byte count [,context]
4583 *         [,stream id] [,life time] [,destination transport address]
4584 *         [,unorder flag] [,no-bundle flag] [,payload protocol-id] )
4585 * -> result
4586 *
4587 * This is the main method to send user data via SCTP.
4588 *
4589 * Mandatory attributes:
4590 *
4591 *  o association id - local handle to the SCTP association
4592 *
4593 *  o buffer address - the location where the user message to be
4594 *    transmitted is stored;
4595 *
4596 *  o byte count - The size of the user data in number of bytes;
4597 *
4598 * Optional attributes:
4599 *
4600 *  o context - an optional 32 bit integer that will be carried in the
4601 *    sending failure notification to the ULP if the transportation of
4602 *    this User Message fails.
4603 *
4604 *  o stream id - to indicate which stream to send the data on. If not
4605 *    specified, stream 0 will be used.
4606 *
4607 *  o life time - specifies the life time of the user data. The user data
4608 *    will not be sent by SCTP after the life time expires. This
4609 *    parameter can be used to avoid efforts to transmit stale
4610 *    user messages. SCTP notifies the ULP if the data cannot be
4611 *    initiated to transport (i.e. sent to the destination via SCTP's
4612 *    send primitive) within the life time variable. However, the
4613 *    user data will be transmitted if SCTP has attempted to transmit a
4614 *    chunk before the life time expired.
4615 *
4616 *  o destination transport address - specified as one of the destination
4617 *    transport addresses of the peer endpoint to which this packet
4618 *    should be sent. Whenever possible, SCTP should use this destination
4619 *    transport address for sending the packets, instead of the current
4620 *    primary path.
4621 *
4622 *  o unorder flag - this flag, if present, indicates that the user
4623 *    would like the data delivered in an unordered fashion to the peer
4624 *    (i.e., the U flag is set to 1 on all DATA chunks carrying this
4625 *    message).
4626 *
4627 *  o no-bundle flag - instructs SCTP not to bundle this user data with
4628 *    other outbound DATA chunks. SCTP MAY still bundle even when
4629 *    this flag is present, when faced with network congestion.
4630 *
4631 *  o payload protocol-id - A 32 bit unsigned integer that is to be
4632 *    passed to the peer indicating the type of payload protocol data
4633 *    being transmitted. This value is passed as opaque data by SCTP.
4634 *
4635 * The return value is the disposition.
4636 */
4637sctp_disposition_t sctp_sf_do_prm_send(const struct sctp_endpoint *ep,
4638                                       const struct sctp_association *asoc,
4639                                       const sctp_subtype_t type,
4640                                       void *arg,
4641                                       sctp_cmd_seq_t *commands)
4642{
4643        struct sctp_datamsg *msg = arg;
4644
4645        sctp_add_cmd_sf(commands, SCTP_CMD_SEND_MSG, SCTP_DATAMSG(msg));
4646        return SCTP_DISPOSITION_CONSUME;
4647}
4648
4649/*
4650 * Process the SHUTDOWN primitive.
4651 *
4652 * Section: 10.1:
4653 * C) Shutdown
4654 *
4655 * Format: SHUTDOWN(association id)
4656 * -> result
4657 *
4658 * Gracefully closes an association. Any locally queued user data
4659 * will be delivered to the peer. The association will be terminated only
4660 * after the peer acknowledges all the SCTP packets sent.  A success code
4661 * will be returned on successful termination of the association. If
4662 * attempting to terminate the association results in a failure, an error
4663 * code shall be returned.
4664 *
4665 * Mandatory attributes:
4666 *
4667 *  o association id - local handle to the SCTP association
4668 *
4669 * Optional attributes:
4670 *
4671 * None.
4672 *
4673 * The return value is the disposition.
4674 */
4675sctp_disposition_t sctp_sf_do_9_2_prm_shutdown(
4676        const struct sctp_endpoint *ep,
4677        const struct sctp_association *asoc,
4678        const sctp_subtype_t type,
4679        void *arg,
4680        sctp_cmd_seq_t *commands)
4681{
4682        int disposition;
4683
4684        /* From 9.2 Shutdown of an Association
4685         * Upon receipt of the SHUTDOWN primitive from its upper
4686         * layer, the endpoint enters SHUTDOWN-PENDING state and
4687         * remains there until all outstanding data has been
4688         * acknowledged by its peer. The endpoint accepts no new data
4689         * from its upper layer, but retransmits data to the far end
4690         * if necessary to fill gaps.
4691         */
4692        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
4693                        SCTP_STATE(SCTP_STATE_SHUTDOWN_PENDING));
4694
4695        disposition = SCTP_DISPOSITION_CONSUME;
4696        if (sctp_outq_is_empty(&asoc->outqueue)) {
4697                disposition = sctp_sf_do_9_2_start_shutdown(ep, asoc, type,
4698                                                            arg, commands);
4699        }
4700        return disposition;
4701}
4702
4703/*
4704 * Process the ABORT primitive.
4705 *
4706 * Section: 10.1:
4707 * C) Abort
4708 *
4709 * Format: Abort(association id [, cause code])
4710 * -> result
4711 *
4712 * Ungracefully closes an association. Any locally queued user data
4713 * will be discarded and an ABORT chunk is sent to the peer.  A success code
4714 * will be returned on successful abortion of the association. If
4715 * attempting to abort the association results in a failure, an error
4716 * code shall be returned.
4717 *
4718 * Mandatory attributes:
4719 *
4720 *  o association id - local handle to the SCTP association
4721 *
4722 * Optional attributes:
4723 *
4724 *  o cause code - reason of the abort to be passed to the peer
4725 *
4726 * None.
4727 *
4728 * The return value is the disposition.
4729 */
4730sctp_disposition_t sctp_sf_do_9_1_prm_abort(
4731        const struct sctp_endpoint *ep,
4732        const struct sctp_association *asoc,
4733        const sctp_subtype_t type,
4734        void *arg,
4735        sctp_cmd_seq_t *commands)
4736{
4737        /* From 9.1 Abort of an Association
4738         * Upon receipt of the ABORT primitive from its upper
4739         * layer, the endpoint enters CLOSED state and
4740         * discard all outstanding data has been
4741         * acknowledged by its peer. The endpoint accepts no new data
4742         * from its upper layer, but retransmits data to the far end
4743         * if necessary to fill gaps.
4744         */
4745        struct sctp_chunk *abort = arg;
4746        sctp_disposition_t retval;
4747
4748        retval = SCTP_DISPOSITION_CONSUME;
4749
4750        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
4751
4752        /* Even if we can't send the ABORT due to low memory delete the
4753         * TCB.  This is a departure from our typical NOMEM handling.
4754         */
4755
4756        sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4757                        SCTP_ERROR(ECONNABORTED));
4758        /* Delete the established association. */
4759        sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
4760                        SCTP_PERR(SCTP_ERROR_USER_ABORT));
4761
4762        SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
4763        SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
4764
4765        return retval;
4766}
4767
4768/* We tried an illegal operation on an association which is closed.  */
4769sctp_disposition_t sctp_sf_error_closed(const struct sctp_endpoint *ep,
4770                                        const struct sctp_association *asoc,
4771                                        const sctp_subtype_t type,
4772                                        void *arg,
4773                                        sctp_cmd_seq_t *commands)
4774{
4775        sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_ERROR, SCTP_ERROR(-EINVAL));
4776        return SCTP_DISPOSITION_CONSUME;
4777}
4778
4779/* We tried an illegal operation on an association which is shutting
4780 * down.
4781 */
4782sctp_disposition_t sctp_sf_error_shutdown(const struct sctp_endpoint *ep,
4783                                          const struct sctp_association *asoc,
4784                                          const sctp_subtype_t type,
4785                                          void *arg,
4786                                          sctp_cmd_seq_t *commands)
4787{
4788        sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_ERROR,
4789                        SCTP_ERROR(-ESHUTDOWN));
4790        return SCTP_DISPOSITION_CONSUME;
4791}
4792
4793/*
4794 * sctp_cookie_wait_prm_shutdown
4795 *
4796 * Section: 4 Note: 2
4797 * Verification Tag:
4798 * Inputs
4799 * (endpoint, asoc)
4800 *
4801 * The RFC does not explicitly address this issue, but is the route through the
4802 * state table when someone issues a shutdown while in COOKIE_WAIT state.
4803 *
4804 * Outputs
4805 * (timers)
4806 */
4807sctp_disposition_t sctp_sf_cookie_wait_prm_shutdown(
4808        const struct sctp_endpoint *ep,
4809        const struct sctp_association *asoc,
4810        const sctp_subtype_t type,
4811        void *arg,
4812        sctp_cmd_seq_t *commands)
4813{
4814        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4815                        SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
4816
4817        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
4818                        SCTP_STATE(SCTP_STATE_CLOSED));
4819
4820        SCTP_INC_STATS(SCTP_MIB_SHUTDOWNS);
4821
4822        sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
4823
4824        return SCTP_DISPOSITION_DELETE_TCB;
4825}
4826
4827/*
4828 * sctp_cookie_echoed_prm_shutdown
4829 *
4830 * Section: 4 Note: 2
4831 * Verification Tag:
4832 * Inputs
4833 * (endpoint, asoc)
4834 *
4835 * The RFC does not explcitly address this issue, but is the route through the
4836 * state table when someone issues a shutdown while in COOKIE_ECHOED state.
4837 *
4838 * Outputs
4839 * (timers)
4840 */
4841sctp_disposition_t sctp_sf_cookie_echoed_prm_shutdown(
4842        const struct sctp_endpoint *ep,
4843        const struct sctp_association *asoc,
4844        const sctp_subtype_t type,
4845        void *arg, sctp_cmd_seq_t *commands)
4846{
4847        /* There is a single T1 timer, so we should be able to use
4848         * common function with the COOKIE-WAIT state.
4849         */
4850        return sctp_sf_cookie_wait_prm_shutdown(ep, asoc, type, arg, commands);
4851}
4852
4853/*
4854 * sctp_sf_cookie_wait_prm_abort
4855 *
4856 * Section: 4 Note: 2
4857 * Verification Tag:
4858 * Inputs
4859 * (endpoint, asoc)
4860 *
4861 * The RFC does not explicitly address this issue, but is the route through the
4862 * state table when someone issues an abort while in COOKIE_WAIT state.
4863 *
4864 * Outputs
4865 * (timers)
4866 */
4867sctp_disposition_t sctp_sf_cookie_wait_prm_abort(
4868        const struct sctp_endpoint *ep,
4869        const struct sctp_association *asoc,
4870        const sctp_subtype_t type,
4871        void *arg,
4872        sctp_cmd_seq_t *commands)
4873{
4874        struct sctp_chunk *abort = arg;
4875        sctp_disposition_t retval;
4876
4877        /* Stop T1-init timer */
4878        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4879                        SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
4880        retval = SCTP_DISPOSITION_CONSUME;
4881
4882        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
4883
4884        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
4885                        SCTP_STATE(SCTP_STATE_CLOSED));
4886
4887        SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
4888
4889        /* Even if we can't send the ABORT due to low memory delete the
4890         * TCB.  This is a departure from our typical NOMEM handling.
4891         */
4892
4893        sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
4894                        SCTP_ERROR(ECONNREFUSED));
4895        /* Delete the established association. */
4896        sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
4897                        SCTP_PERR(SCTP_ERROR_USER_ABORT));
4898
4899        return retval;
4900}
4901
4902/*
4903 * sctp_sf_cookie_echoed_prm_abort
4904 *
4905 * Section: 4 Note: 3
4906 * Verification Tag:
4907 * Inputs
4908 * (endpoint, asoc)
4909 *
4910 * The RFC does not explcitly address this issue, but is the route through the
4911 * state table when someone issues an abort while in COOKIE_ECHOED state.
4912 *
4913 * Outputs
4914 * (timers)
4915 */
4916sctp_disposition_t sctp_sf_cookie_echoed_prm_abort(
4917        const struct sctp_endpoint *ep,
4918        const struct sctp_association *asoc,
4919        const sctp_subtype_t type,
4920        void *arg,
4921        sctp_cmd_seq_t *commands)
4922{
4923        /* There is a single T1 timer, so we should be able to use
4924         * common function with the COOKIE-WAIT state.
4925         */
4926        return sctp_sf_cookie_wait_prm_abort(ep, asoc, type, arg, commands);
4927}
4928
4929/*
4930 * sctp_sf_shutdown_pending_prm_abort
4931 *
4932 * Inputs
4933 * (endpoint, asoc)
4934 *
4935 * The RFC does not explicitly address this issue, but is the route through the
4936 * state table when someone issues an abort while in SHUTDOWN-PENDING state.
4937 *
4938 * Outputs
4939 * (timers)
4940 */
4941sctp_disposition_t sctp_sf_shutdown_pending_prm_abort(
4942        const struct sctp_endpoint *ep,
4943        const struct sctp_association *asoc,
4944        const sctp_subtype_t type,
4945        void *arg,
4946        sctp_cmd_seq_t *commands)
4947{
4948        /* Stop the T5-shutdown guard timer.  */
4949        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4950                        SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
4951
4952        return sctp_sf_do_9_1_prm_abort(ep, asoc, type, arg, commands);
4953}
4954
4955/*
4956 * sctp_sf_shutdown_sent_prm_abort
4957 *
4958 * Inputs
4959 * (endpoint, asoc)
4960 *
4961 * The RFC does not explicitly address this issue, but is the route through the
4962 * state table when someone issues an abort while in SHUTDOWN-SENT state.
4963 *
4964 * Outputs
4965 * (timers)
4966 */
4967sctp_disposition_t sctp_sf_shutdown_sent_prm_abort(
4968        const struct sctp_endpoint *ep,
4969        const struct sctp_association *asoc,
4970        const sctp_subtype_t type,
4971        void *arg,
4972        sctp_cmd_seq_t *commands)
4973{
4974        /* Stop the T2-shutdown timer.  */
4975        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4976                        SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
4977
4978        /* Stop the T5-shutdown guard timer.  */
4979        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
4980                        SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
4981
4982        return sctp_sf_do_9_1_prm_abort(ep, asoc, type, arg, commands);
4983}
4984
4985/*
4986 * sctp_sf_cookie_echoed_prm_abort
4987 *
4988 * Inputs
4989 * (endpoint, asoc)
4990 *
4991 * The RFC does not explcitly address this issue, but is the route through the
4992 * state table when someone issues an abort while in COOKIE_ECHOED state.
4993 *
4994 * Outputs
4995 * (timers)
4996 */
4997sctp_disposition_t sctp_sf_shutdown_ack_sent_prm_abort(
4998        const struct sctp_endpoint *ep,
4999        const struct sctp_association *asoc,
5000        const sctp_subtype_t type,
5001        void *arg,
5002        sctp_cmd_seq_t *commands)
5003{
5004        /* The same T2 timer, so we should be able to use
5005         * common function with the SHUTDOWN-SENT state.
5006         */
5007        return sctp_sf_shutdown_sent_prm_abort(ep, asoc, type, arg, commands);
5008}
5009
5010/*
5011 * Process the REQUESTHEARTBEAT primitive
5012 *
5013 * 10.1 ULP-to-SCTP
5014 * J) Request Heartbeat
5015 *
5016 * Format: REQUESTHEARTBEAT(association id, destination transport address)
5017 *
5018 * -> result
5019 *
5020 * Instructs the local endpoint to perform a HeartBeat on the specified
5021 * destination transport address of the given association. The returned
5022 * result should indicate whether the transmission of the HEARTBEAT
5023 * chunk to the destination address is successful.
5024 *
5025 * Mandatory attributes:
5026 *
5027 * o association id - local handle to the SCTP association
5028 *
5029 * o destination transport address - the transport address of the
5030 *   association on which a heartbeat should be issued.
5031 */
5032sctp_disposition_t sctp_sf_do_prm_requestheartbeat(
5033                                        const struct sctp_endpoint *ep,
5034                                        const struct sctp_association *asoc,
5035                                        const sctp_subtype_t type,
5036                                        void *arg,
5037                                        sctp_cmd_seq_t *commands)
5038{
5039        if (SCTP_DISPOSITION_NOMEM == sctp_sf_heartbeat(ep, asoc, type,
5040                                      (struct sctp_transport *)arg, commands))
5041                return SCTP_DISPOSITION_NOMEM;
5042
5043        /*
5044         * RFC 2960 (bis), section 8.3
5045         *
5046         *    D) Request an on-demand HEARTBEAT on a specific destination
5047         *    transport address of a given association.
5048         *
5049         *    The endpoint should increment the respective error  counter of
5050         *    the destination transport address each time a HEARTBEAT is sent
5051         *    to that address and not acknowledged within one RTO.
5052         *
5053         */
5054        sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_HB_SENT,
5055                        SCTP_TRANSPORT(arg));
5056        return SCTP_DISPOSITION_CONSUME;
5057}
5058
5059/*
5060 * ADDIP Section 4.1 ASCONF Chunk Procedures
5061 * When an endpoint has an ASCONF signaled change to be sent to the
5062 * remote endpoint it should do A1 to A9
5063 */
5064sctp_disposition_t sctp_sf_do_prm_asconf(const struct sctp_endpoint *ep,
5065                                        const struct sctp_association *asoc,
5066                                        const sctp_subtype_t type,
5067                                        void *arg,
5068                                        sctp_cmd_seq_t *commands)
5069{
5070        struct sctp_chunk *chunk = arg;
5071
5072        sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T4, SCTP_CHUNK(chunk));
5073        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
5074                        SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
5075        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(chunk));
5076        return SCTP_DISPOSITION_CONSUME;
5077}
5078
5079/*
5080 * Ignore the primitive event
5081 *
5082 * The return value is the disposition of the primitive.
5083 */
5084sctp_disposition_t sctp_sf_ignore_primitive(
5085        const struct sctp_endpoint *ep,
5086        const struct sctp_association *asoc,
5087        const sctp_subtype_t type,
5088        void *arg,
5089        sctp_cmd_seq_t *commands)
5090{
5091        SCTP_DEBUG_PRINTK("Primitive type %d is ignored.\n", type.primitive);
5092        return SCTP_DISPOSITION_DISCARD;
5093}
5094
5095/***************************************************************************
5096 * These are the state functions for the OTHER events.
5097 ***************************************************************************/
5098
5099/*
5100 * When the SCTP stack has no more user data to send or retransmit, this
5101 * notification is given to the user. Also, at the time when a user app
5102 * subscribes to this event, if there is no data to be sent or
5103 * retransmit, the stack will immediately send up this notification.
5104 */
5105sctp_disposition_t sctp_sf_do_no_pending_tsn(
5106        const struct sctp_endpoint *ep,
5107        const struct sctp_association *asoc,
5108        const sctp_subtype_t type,
5109        void *arg,
5110        sctp_cmd_seq_t *commands)
5111{
5112        struct sctp_ulpevent *event;
5113
5114        event = sctp_ulpevent_make_sender_dry_event(asoc, GFP_ATOMIC);
5115        if (!event)
5116                return SCTP_DISPOSITION_NOMEM;
5117
5118        sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(event));
5119
5120        return SCTP_DISPOSITION_CONSUME;
5121}
5122
5123/*
5124 * Start the shutdown negotiation.
5125 *
5126 * From Section 9.2:
5127 * Once all its outstanding data has been acknowledged, the endpoint
5128 * shall send a SHUTDOWN chunk to its peer including in the Cumulative
5129 * TSN Ack field the last sequential TSN it has received from the peer.
5130 * It shall then start the T2-shutdown timer and enter the SHUTDOWN-SENT
5131 * state. If the timer expires, the endpoint must re-send the SHUTDOWN
5132 * with the updated last sequential TSN received from its peer.
5133 *
5134 * The return value is the disposition.
5135 */
5136sctp_disposition_t sctp_sf_do_9_2_start_shutdown(
5137        const struct sctp_endpoint *ep,
5138        const struct sctp_association *asoc,
5139        const sctp_subtype_t type,
5140        void *arg,
5141        sctp_cmd_seq_t *commands)
5142{
5143        struct sctp_chunk *reply;
5144
5145        /* Once all its outstanding data has been acknowledged, the
5146         * endpoint shall send a SHUTDOWN chunk to its peer including
5147         * in the Cumulative TSN Ack field the last sequential TSN it
5148         * has received from the peer.
5149         */
5150        reply = sctp_make_shutdown(asoc, NULL);
5151        if (!reply)
5152                goto nomem;
5153
5154        /* Set the transport for the SHUTDOWN chunk and the timeout for the
5155         * T2-shutdown timer.
5156         */
5157        sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
5158
5159        /* It shall then start the T2-shutdown timer */
5160        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
5161                        SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5162
5163        /* RFC 4960 Section 9.2
5164         * The sender of the SHUTDOWN MAY also start an overall guard timer
5165         * 'T5-shutdown-guard' to bound the overall time for shutdown sequence.
5166         */
5167        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
5168                        SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5169
5170        if (asoc->autoclose)
5171                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5172                                SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
5173
5174        /* and enter the SHUTDOWN-SENT state.  */
5175        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
5176                        SCTP_STATE(SCTP_STATE_SHUTDOWN_SENT));
5177
5178        /* sctp-implguide 2.10 Issues with Heartbeating and failover
5179         *
5180         * HEARTBEAT ... is discontinued after sending either SHUTDOWN
5181         * or SHUTDOWN-ACK.
5182         */
5183        sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
5184
5185        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
5186
5187        return SCTP_DISPOSITION_CONSUME;
5188
5189nomem:
5190        return SCTP_DISPOSITION_NOMEM;
5191}
5192
5193/*
5194 * Generate a SHUTDOWN ACK now that everything is SACK'd.
5195 *
5196 * From Section 9.2:
5197 *
5198 * If it has no more outstanding DATA chunks, the SHUTDOWN receiver
5199 * shall send a SHUTDOWN ACK and start a T2-shutdown timer of its own,
5200 * entering the SHUTDOWN-ACK-SENT state. If the timer expires, the
5201 * endpoint must re-send the SHUTDOWN ACK.
5202 *
5203 * The return value is the disposition.
5204 */
5205sctp_disposition_t sctp_sf_do_9_2_shutdown_ack(
5206        const struct sctp_endpoint *ep,
5207        const struct sctp_association *asoc,
5208        const sctp_subtype_t type,
5209        void *arg,
5210        sctp_cmd_seq_t *commands)
5211{
5212        struct sctp_chunk *chunk = (struct sctp_chunk *) arg;
5213        struct sctp_chunk *reply;
5214
5215        /* There are 2 ways of getting here:
5216         *    1) called in response to a SHUTDOWN chunk
5217         *    2) called when SCTP_EVENT_NO_PENDING_TSN event is issued.
5218         *
5219         * For the case (2), the arg parameter is set to NULL.  We need
5220         * to check that we have a chunk before accessing it's fields.
5221         */
5222        if (chunk) {
5223                if (!sctp_vtag_verify(chunk, asoc))
5224                        return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
5225
5226                /* Make sure that the SHUTDOWN chunk has a valid length. */
5227                if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_shutdown_chunk_t)))
5228                        return sctp_sf_violation_chunklen(ep, asoc, type, arg,
5229                                                          commands);
5230        }
5231
5232        /* If it has no more outstanding DATA chunks, the SHUTDOWN receiver
5233         * shall send a SHUTDOWN ACK ...
5234         */
5235        reply = sctp_make_shutdown_ack(asoc, chunk);
5236        if (!reply)
5237                goto nomem;
5238
5239        /* Set the transport for the SHUTDOWN ACK chunk and the timeout for
5240         * the T2-shutdown timer.
5241         */
5242        sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
5243
5244        /* and start/restart a T2-shutdown timer of its own, */
5245        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
5246                        SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5247
5248        if (asoc->autoclose)
5249                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
5250                                SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
5251
5252        /* Enter the SHUTDOWN-ACK-SENT state.  */
5253        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
5254                        SCTP_STATE(SCTP_STATE_SHUTDOWN_ACK_SENT));
5255
5256        /* sctp-implguide 2.10 Issues with Heartbeating and failover
5257         *
5258         * HEARTBEAT ... is discontinued after sending either SHUTDOWN
5259         * or SHUTDOWN-ACK.
5260         */
5261        sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
5262
5263        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
5264
5265        return SCTP_DISPOSITION_CONSUME;
5266
5267nomem:
5268        return SCTP_DISPOSITION_NOMEM;
5269}
5270
5271/*
5272 * Ignore the event defined as other
5273 *
5274 * The return value is the disposition of the event.
5275 */
5276sctp_disposition_t sctp_sf_ignore_other(const struct sctp_endpoint *ep,
5277                                        const struct sctp_association *asoc,
5278                                        const sctp_subtype_t type,
5279                                        void *arg,
5280                                        sctp_cmd_seq_t *commands)
5281{
5282        SCTP_DEBUG_PRINTK("The event other type %d is ignored\n", type.other);
5283        return SCTP_DISPOSITION_DISCARD;
5284}
5285
5286/************************************************************
5287 * These are the state functions for handling timeout events.
5288 ************************************************************/
5289
5290/*
5291 * RTX Timeout
5292 *
5293 * Section: 6.3.3 Handle T3-rtx Expiration
5294 *
5295 * Whenever the retransmission timer T3-rtx expires for a destination
5296 * address, do the following:
5297 * [See below]
5298 *
5299 * The return value is the disposition of the chunk.
5300 */
5301sctp_disposition_t sctp_sf_do_6_3_3_rtx(const struct sctp_endpoint *ep,
5302                                        const struct sctp_association *asoc,
5303                                        const sctp_subtype_t type,
5304                                        void *arg,
5305                                        sctp_cmd_seq_t *commands)
5306{
5307        struct sctp_transport *transport = arg;
5308
5309        SCTP_INC_STATS(SCTP_MIB_T3_RTX_EXPIREDS);
5310
5311        if (asoc->overall_error_count >= asoc->max_retrans) {
5312                if (asoc->state == SCTP_STATE_SHUTDOWN_PENDING) {
5313                        /*
5314                         * We are here likely because the receiver had its rwnd
5315                         * closed for a while and we have not been able to
5316                         * transmit the locally queued data within the maximum
5317                         * retransmission attempts limit.  Start the T5
5318                         * shutdown guard timer to give the receiver one last
5319                         * chance and some additional time to recover before
5320                         * aborting.
5321                         */
5322                        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START_ONCE,
5323                                SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5324                } else {
5325                        sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
5326                                        SCTP_ERROR(ETIMEDOUT));
5327                        /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
5328                        sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
5329                                        SCTP_PERR(SCTP_ERROR_NO_ERROR));
5330                        SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
5331                        SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
5332                        return SCTP_DISPOSITION_DELETE_TCB;
5333                }
5334        }
5335
5336        /* E1) For the destination address for which the timer
5337         * expires, adjust its ssthresh with rules defined in Section
5338         * 7.2.3 and set the cwnd <- MTU.
5339         */
5340
5341        /* E2) For the destination address for which the timer
5342         * expires, set RTO <- RTO * 2 ("back off the timer").  The
5343         * maximum value discussed in rule C7 above (RTO.max) may be
5344         * used to provide an upper bound to this doubling operation.
5345         */
5346
5347        /* E3) Determine how many of the earliest (i.e., lowest TSN)
5348         * outstanding DATA chunks for the address for which the
5349         * T3-rtx has expired will fit into a single packet, subject
5350         * to the MTU constraint for the path corresponding to the
5351         * destination transport address to which the retransmission
5352         * is being sent (this may be different from the address for
5353         * which the timer expires [see Section 6.4]).  Call this
5354         * value K. Bundle and retransmit those K DATA chunks in a
5355         * single packet to the destination endpoint.
5356         *
5357         * Note: Any DATA chunks that were sent to the address for
5358         * which the T3-rtx timer expired but did not fit in one MTU
5359         * (rule E3 above), should be marked for retransmission and
5360         * sent as soon as cwnd allows (normally when a SACK arrives).
5361         */
5362
5363        /* Do some failure management (Section 8.2). */