linux/net/dccp/proto.c
<<
>>
Prefs
   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 *  net/dccp/proto.c
   4 *
   5 *  An implementation of the DCCP protocol
   6 *  Arnaldo Carvalho de Melo <acme@conectiva.com.br>
   7 */
   8
   9#include <linux/dccp.h>
  10#include <linux/module.h>
  11#include <linux/types.h>
  12#include <linux/sched.h>
  13#include <linux/kernel.h>
  14#include <linux/skbuff.h>
  15#include <linux/netdevice.h>
  16#include <linux/in.h>
  17#include <linux/if_arp.h>
  18#include <linux/init.h>
  19#include <linux/random.h>
  20#include <linux/slab.h>
  21#include <net/checksum.h>
  22
  23#include <net/inet_sock.h>
  24#include <net/inet_common.h>
  25#include <net/sock.h>
  26#include <net/xfrm.h>
  27
  28#include <asm/ioctls.h>
  29#include <linux/spinlock.h>
  30#include <linux/timer.h>
  31#include <linux/delay.h>
  32#include <linux/poll.h>
  33
  34#include "ccid.h"
  35#include "dccp.h"
  36#include "feat.h"
  37
  38#define CREATE_TRACE_POINTS
  39#include "trace.h"
  40
  41DEFINE_SNMP_STAT(struct dccp_mib, dccp_statistics) __read_mostly;
  42
  43EXPORT_SYMBOL_GPL(dccp_statistics);
  44
  45struct percpu_counter dccp_orphan_count;
  46EXPORT_SYMBOL_GPL(dccp_orphan_count);
  47
  48struct inet_hashinfo dccp_hashinfo;
  49EXPORT_SYMBOL_GPL(dccp_hashinfo);
  50
  51/* the maximum queue length for tx in packets. 0 is no limit */
  52int sysctl_dccp_tx_qlen __read_mostly = 5;
  53
  54#ifdef CONFIG_IP_DCCP_DEBUG
  55static const char *dccp_state_name(const int state)
  56{
  57        static const char *const dccp_state_names[] = {
  58        [DCCP_OPEN]             = "OPEN",
  59        [DCCP_REQUESTING]       = "REQUESTING",
  60        [DCCP_PARTOPEN]         = "PARTOPEN",
  61        [DCCP_LISTEN]           = "LISTEN",
  62        [DCCP_RESPOND]          = "RESPOND",
  63        [DCCP_CLOSING]          = "CLOSING",
  64        [DCCP_ACTIVE_CLOSEREQ]  = "CLOSEREQ",
  65        [DCCP_PASSIVE_CLOSE]    = "PASSIVE_CLOSE",
  66        [DCCP_PASSIVE_CLOSEREQ] = "PASSIVE_CLOSEREQ",
  67        [DCCP_TIME_WAIT]        = "TIME_WAIT",
  68        [DCCP_CLOSED]           = "CLOSED",
  69        };
  70
  71        if (state >= DCCP_MAX_STATES)
  72                return "INVALID STATE!";
  73        else
  74                return dccp_state_names[state];
  75}
  76#endif
  77
  78void dccp_set_state(struct sock *sk, const int state)
  79{
  80        const int oldstate = sk->sk_state;
  81
  82        dccp_pr_debug("%s(%p)  %s  -->  %s\n", dccp_role(sk), sk,
  83                      dccp_state_name(oldstate), dccp_state_name(state));
  84        WARN_ON(state == oldstate);
  85
  86        switch (state) {
  87        case DCCP_OPEN:
  88                if (oldstate != DCCP_OPEN)
  89                        DCCP_INC_STATS(DCCP_MIB_CURRESTAB);
  90                /* Client retransmits all Confirm options until entering OPEN */
  91                if (oldstate == DCCP_PARTOPEN)
  92                        dccp_feat_list_purge(&dccp_sk(sk)->dccps_featneg);
  93                break;
  94
  95        case DCCP_CLOSED:
  96                if (oldstate == DCCP_OPEN || oldstate == DCCP_ACTIVE_CLOSEREQ ||
  97                    oldstate == DCCP_CLOSING)
  98                        DCCP_INC_STATS(DCCP_MIB_ESTABRESETS);
  99
 100                sk->sk_prot->unhash(sk);
 101                if (inet_csk(sk)->icsk_bind_hash != NULL &&
 102                    !(sk->sk_userlocks & SOCK_BINDPORT_LOCK))
 103                        inet_put_port(sk);
 104                fallthrough;
 105        default:
 106                if (oldstate == DCCP_OPEN)
 107                        DCCP_DEC_STATS(DCCP_MIB_CURRESTAB);
 108        }
 109
 110        /* Change state AFTER socket is unhashed to avoid closed
 111         * socket sitting in hash tables.
 112         */
 113        inet_sk_set_state(sk, state);
 114}
 115
 116EXPORT_SYMBOL_GPL(dccp_set_state);
 117
 118static void dccp_finish_passive_close(struct sock *sk)
 119{
 120        switch (sk->sk_state) {
 121        case DCCP_PASSIVE_CLOSE:
 122                /* Node (client or server) has received Close packet. */
 123                dccp_send_reset(sk, DCCP_RESET_CODE_CLOSED);
 124                dccp_set_state(sk, DCCP_CLOSED);
 125                break;
 126        case DCCP_PASSIVE_CLOSEREQ:
 127                /*
 128                 * Client received CloseReq. We set the `active' flag so that
 129                 * dccp_send_close() retransmits the Close as per RFC 4340, 8.3.
 130                 */
 131                dccp_send_close(sk, 1);
 132                dccp_set_state(sk, DCCP_CLOSING);
 133        }
 134}
 135
 136void dccp_done(struct sock *sk)
 137{
 138        dccp_set_state(sk, DCCP_CLOSED);
 139        dccp_clear_xmit_timers(sk);
 140
 141        sk->sk_shutdown = SHUTDOWN_MASK;
 142
 143        if (!sock_flag(sk, SOCK_DEAD))
 144                sk->sk_state_change(sk);
 145        else
 146                inet_csk_destroy_sock(sk);
 147}
 148
 149EXPORT_SYMBOL_GPL(dccp_done);
 150
 151const char *dccp_packet_name(const int type)
 152{
 153        static const char *const dccp_packet_names[] = {
 154                [DCCP_PKT_REQUEST]  = "REQUEST",
 155                [DCCP_PKT_RESPONSE] = "RESPONSE",
 156                [DCCP_PKT_DATA]     = "DATA",
 157                [DCCP_PKT_ACK]      = "ACK",
 158                [DCCP_PKT_DATAACK]  = "DATAACK",
 159                [DCCP_PKT_CLOSEREQ] = "CLOSEREQ",
 160                [DCCP_PKT_CLOSE]    = "CLOSE",
 161                [DCCP_PKT_RESET]    = "RESET",
 162                [DCCP_PKT_SYNC]     = "SYNC",
 163                [DCCP_PKT_SYNCACK]  = "SYNCACK",
 164        };
 165
 166        if (type >= DCCP_NR_PKT_TYPES)
 167                return "INVALID";
 168        else
 169                return dccp_packet_names[type];
 170}
 171
 172EXPORT_SYMBOL_GPL(dccp_packet_name);
 173
 174static void dccp_sk_destruct(struct sock *sk)
 175{
 176        struct dccp_sock *dp = dccp_sk(sk);
 177
 178        ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
 179        dp->dccps_hc_tx_ccid = NULL;
 180        inet_sock_destruct(sk);
 181}
 182
 183int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized)
 184{
 185        struct dccp_sock *dp = dccp_sk(sk);
 186        struct inet_connection_sock *icsk = inet_csk(sk);
 187
 188        icsk->icsk_rto          = DCCP_TIMEOUT_INIT;
 189        icsk->icsk_syn_retries  = sysctl_dccp_request_retries;
 190        sk->sk_state            = DCCP_CLOSED;
 191        sk->sk_write_space      = dccp_write_space;
 192        sk->sk_destruct         = dccp_sk_destruct;
 193        icsk->icsk_sync_mss     = dccp_sync_mss;
 194        dp->dccps_mss_cache     = 536;
 195        dp->dccps_rate_last     = jiffies;
 196        dp->dccps_role          = DCCP_ROLE_UNDEFINED;
 197        dp->dccps_service       = DCCP_SERVICE_CODE_IS_ABSENT;
 198        dp->dccps_tx_qlen       = sysctl_dccp_tx_qlen;
 199
 200        dccp_init_xmit_timers(sk);
 201
 202        INIT_LIST_HEAD(&dp->dccps_featneg);
 203        /* control socket doesn't need feat nego */
 204        if (likely(ctl_sock_initialized))
 205                return dccp_feat_init(sk);
 206        return 0;
 207}
 208
 209EXPORT_SYMBOL_GPL(dccp_init_sock);
 210
 211void dccp_destroy_sock(struct sock *sk)
 212{
 213        struct dccp_sock *dp = dccp_sk(sk);
 214
 215        __skb_queue_purge(&sk->sk_write_queue);
 216        if (sk->sk_send_head != NULL) {
 217                kfree_skb(sk->sk_send_head);
 218                sk->sk_send_head = NULL;
 219        }
 220
 221        /* Clean up a referenced DCCP bind bucket. */
 222        if (inet_csk(sk)->icsk_bind_hash != NULL)
 223                inet_put_port(sk);
 224
 225        kfree(dp->dccps_service_list);
 226        dp->dccps_service_list = NULL;
 227
 228        if (dp->dccps_hc_rx_ackvec != NULL) {
 229                dccp_ackvec_free(dp->dccps_hc_rx_ackvec);
 230                dp->dccps_hc_rx_ackvec = NULL;
 231        }
 232        ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
 233        dp->dccps_hc_rx_ccid = NULL;
 234
 235        /* clean up feature negotiation state */
 236        dccp_feat_list_purge(&dp->dccps_featneg);
 237}
 238
 239EXPORT_SYMBOL_GPL(dccp_destroy_sock);
 240
 241static inline int dccp_listen_start(struct sock *sk, int backlog)
 242{
 243        struct dccp_sock *dp = dccp_sk(sk);
 244
 245        dp->dccps_role = DCCP_ROLE_LISTEN;
 246        /* do not start to listen if feature negotiation setup fails */
 247        if (dccp_feat_finalise_settings(dp))
 248                return -EPROTO;
 249        return inet_csk_listen_start(sk, backlog);
 250}
 251
 252static inline int dccp_need_reset(int state)
 253{
 254        return state != DCCP_CLOSED && state != DCCP_LISTEN &&
 255               state != DCCP_REQUESTING;
 256}
 257
 258int dccp_disconnect(struct sock *sk, int flags)
 259{
 260        struct inet_connection_sock *icsk = inet_csk(sk);
 261        struct inet_sock *inet = inet_sk(sk);
 262        struct dccp_sock *dp = dccp_sk(sk);
 263        const int old_state = sk->sk_state;
 264
 265        if (old_state != DCCP_CLOSED)
 266                dccp_set_state(sk, DCCP_CLOSED);
 267
 268        /*
 269         * This corresponds to the ABORT function of RFC793, sec. 3.8
 270         * TCP uses a RST segment, DCCP a Reset packet with Code 2, "Aborted".
 271         */
 272        if (old_state == DCCP_LISTEN) {
 273                inet_csk_listen_stop(sk);
 274        } else if (dccp_need_reset(old_state)) {
 275                dccp_send_reset(sk, DCCP_RESET_CODE_ABORTED);
 276                sk->sk_err = ECONNRESET;
 277        } else if (old_state == DCCP_REQUESTING)
 278                sk->sk_err = ECONNRESET;
 279
 280        dccp_clear_xmit_timers(sk);
 281        ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
 282        dp->dccps_hc_rx_ccid = NULL;
 283
 284        __skb_queue_purge(&sk->sk_receive_queue);
 285        __skb_queue_purge(&sk->sk_write_queue);
 286        if (sk->sk_send_head != NULL) {
 287                __kfree_skb(sk->sk_send_head);
 288                sk->sk_send_head = NULL;
 289        }
 290
 291        inet->inet_dport = 0;
 292
 293        if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
 294                inet_reset_saddr(sk);
 295
 296        sk->sk_shutdown = 0;
 297        sock_reset_flag(sk, SOCK_DONE);
 298
 299        icsk->icsk_backoff = 0;
 300        inet_csk_delack_init(sk);
 301        __sk_dst_reset(sk);
 302
 303        WARN_ON(inet->inet_num && !icsk->icsk_bind_hash);
 304
 305        sk_error_report(sk);
 306        return 0;
 307}
 308
 309EXPORT_SYMBOL_GPL(dccp_disconnect);
 310
 311/*
 312 *      Wait for a DCCP event.
 313 *
 314 *      Note that we don't need to lock the socket, as the upper poll layers
 315 *      take care of normal races (between the test and the event) and we don't
 316 *      go look at any of the socket buffers directly.
 317 */
 318__poll_t dccp_poll(struct file *file, struct socket *sock,
 319                       poll_table *wait)
 320{
 321        __poll_t mask;
 322        struct sock *sk = sock->sk;
 323
 324        sock_poll_wait(file, sock, wait);
 325        if (sk->sk_state == DCCP_LISTEN)
 326                return inet_csk_listen_poll(sk);
 327
 328        /* Socket is not locked. We are protected from async events
 329           by poll logic and correct handling of state changes
 330           made by another threads is impossible in any case.
 331         */
 332
 333        mask = 0;
 334        if (sk->sk_err)
 335                mask = EPOLLERR;
 336
 337        if (sk->sk_shutdown == SHUTDOWN_MASK || sk->sk_state == DCCP_CLOSED)
 338                mask |= EPOLLHUP;
 339        if (sk->sk_shutdown & RCV_SHUTDOWN)
 340                mask |= EPOLLIN | EPOLLRDNORM | EPOLLRDHUP;
 341
 342        /* Connected? */
 343        if ((1 << sk->sk_state) & ~(DCCPF_REQUESTING | DCCPF_RESPOND)) {
 344                if (atomic_read(&sk->sk_rmem_alloc) > 0)
 345                        mask |= EPOLLIN | EPOLLRDNORM;
 346
 347                if (!(sk->sk_shutdown & SEND_SHUTDOWN)) {
 348                        if (sk_stream_is_writeable(sk)) {
 349                                mask |= EPOLLOUT | EPOLLWRNORM;
 350                        } else {  /* send SIGIO later */
 351                                sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk);
 352                                set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 353
 354                                /* Race breaker. If space is freed after
 355                                 * wspace test but before the flags are set,
 356                                 * IO signal will be lost.
 357                                 */
 358                                if (sk_stream_is_writeable(sk))
 359                                        mask |= EPOLLOUT | EPOLLWRNORM;
 360                        }
 361                }
 362        }
 363        return mask;
 364}
 365
 366EXPORT_SYMBOL_GPL(dccp_poll);
 367
 368int dccp_ioctl(struct sock *sk, int cmd, unsigned long arg)
 369{
 370        int rc = -ENOTCONN;
 371
 372        lock_sock(sk);
 373
 374        if (sk->sk_state == DCCP_LISTEN)
 375                goto out;
 376
 377        switch (cmd) {
 378        case SIOCOUTQ: {
 379                int amount = sk_wmem_alloc_get(sk);
 380                /* Using sk_wmem_alloc here because sk_wmem_queued is not used by DCCP and
 381                 * always 0, comparably to UDP.
 382                 */
 383
 384                rc = put_user(amount, (int __user *)arg);
 385        }
 386                break;
 387        case SIOCINQ: {
 388                struct sk_buff *skb;
 389                unsigned long amount = 0;
 390
 391                skb = skb_peek(&sk->sk_receive_queue);
 392                if (skb != NULL) {
 393                        /*
 394                         * We will only return the amount of this packet since
 395                         * that is all that will be read.
 396                         */
 397                        amount = skb->len;
 398                }
 399                rc = put_user(amount, (int __user *)arg);
 400        }
 401                break;
 402        default:
 403                rc = -ENOIOCTLCMD;
 404                break;
 405        }
 406out:
 407        release_sock(sk);
 408        return rc;
 409}
 410
 411EXPORT_SYMBOL_GPL(dccp_ioctl);
 412
 413static int dccp_setsockopt_service(struct sock *sk, const __be32 service,
 414                                   sockptr_t optval, unsigned int optlen)
 415{
 416        struct dccp_sock *dp = dccp_sk(sk);
 417        struct dccp_service_list *sl = NULL;
 418
 419        if (service == DCCP_SERVICE_INVALID_VALUE ||
 420            optlen > DCCP_SERVICE_LIST_MAX_LEN * sizeof(u32))
 421                return -EINVAL;
 422
 423        if (optlen > sizeof(service)) {
 424                sl = kmalloc(optlen, GFP_KERNEL);
 425                if (sl == NULL)
 426                        return -ENOMEM;
 427
 428                sl->dccpsl_nr = optlen / sizeof(u32) - 1;
 429                if (copy_from_sockptr_offset(sl->dccpsl_list, optval,
 430                                sizeof(service), optlen - sizeof(service)) ||
 431                    dccp_list_has_service(sl, DCCP_SERVICE_INVALID_VALUE)) {
 432                        kfree(sl);
 433                        return -EFAULT;
 434                }
 435        }
 436
 437        lock_sock(sk);
 438        dp->dccps_service = service;
 439
 440        kfree(dp->dccps_service_list);
 441
 442        dp->dccps_service_list = sl;
 443        release_sock(sk);
 444        return 0;
 445}
 446
 447static int dccp_setsockopt_cscov(struct sock *sk, int cscov, bool rx)
 448{
 449        u8 *list, len;
 450        int i, rc;
 451
 452        if (cscov < 0 || cscov > 15)
 453                return -EINVAL;
 454        /*
 455         * Populate a list of permissible values, in the range cscov...15. This
 456         * is necessary since feature negotiation of single values only works if
 457         * both sides incidentally choose the same value. Since the list starts
 458         * lowest-value first, negotiation will pick the smallest shared value.
 459         */
 460        if (cscov == 0)
 461                return 0;
 462        len = 16 - cscov;
 463
 464        list = kmalloc(len, GFP_KERNEL);
 465        if (list == NULL)
 466                return -ENOBUFS;
 467
 468        for (i = 0; i < len; i++)
 469                list[i] = cscov++;
 470
 471        rc = dccp_feat_register_sp(sk, DCCPF_MIN_CSUM_COVER, rx, list, len);
 472
 473        if (rc == 0) {
 474                if (rx)
 475                        dccp_sk(sk)->dccps_pcrlen = cscov;
 476                else
 477                        dccp_sk(sk)->dccps_pcslen = cscov;
 478        }
 479        kfree(list);
 480        return rc;
 481}
 482
 483static int dccp_setsockopt_ccid(struct sock *sk, int type,
 484                                sockptr_t optval, unsigned int optlen)
 485{
 486        u8 *val;
 487        int rc = 0;
 488
 489        if (optlen < 1 || optlen > DCCP_FEAT_MAX_SP_VALS)
 490                return -EINVAL;
 491
 492        val = memdup_sockptr(optval, optlen);
 493        if (IS_ERR(val))
 494                return PTR_ERR(val);
 495
 496        lock_sock(sk);
 497        if (type == DCCP_SOCKOPT_TX_CCID || type == DCCP_SOCKOPT_CCID)
 498                rc = dccp_feat_register_sp(sk, DCCPF_CCID, 1, val, optlen);
 499
 500        if (!rc && (type == DCCP_SOCKOPT_RX_CCID || type == DCCP_SOCKOPT_CCID))
 501                rc = dccp_feat_register_sp(sk, DCCPF_CCID, 0, val, optlen);
 502        release_sock(sk);
 503
 504        kfree(val);
 505        return rc;
 506}
 507
 508static int do_dccp_setsockopt(struct sock *sk, int level, int optname,
 509                sockptr_t optval, unsigned int optlen)
 510{
 511        struct dccp_sock *dp = dccp_sk(sk);
 512        int val, err = 0;
 513
 514        switch (optname) {
 515        case DCCP_SOCKOPT_PACKET_SIZE:
 516                DCCP_WARN("sockopt(PACKET_SIZE) is deprecated: fix your app\n");
 517                return 0;
 518        case DCCP_SOCKOPT_CHANGE_L:
 519        case DCCP_SOCKOPT_CHANGE_R:
 520                DCCP_WARN("sockopt(CHANGE_L/R) is deprecated: fix your app\n");
 521                return 0;
 522        case DCCP_SOCKOPT_CCID:
 523        case DCCP_SOCKOPT_RX_CCID:
 524        case DCCP_SOCKOPT_TX_CCID:
 525                return dccp_setsockopt_ccid(sk, optname, optval, optlen);
 526        }
 527
 528        if (optlen < (int)sizeof(int))
 529                return -EINVAL;
 530
 531        if (copy_from_sockptr(&val, optval, sizeof(int)))
 532                return -EFAULT;
 533
 534        if (optname == DCCP_SOCKOPT_SERVICE)
 535                return dccp_setsockopt_service(sk, val, optval, optlen);
 536
 537        lock_sock(sk);
 538        switch (optname) {
 539        case DCCP_SOCKOPT_SERVER_TIMEWAIT:
 540                if (dp->dccps_role != DCCP_ROLE_SERVER)
 541                        err = -EOPNOTSUPP;
 542                else
 543                        dp->dccps_server_timewait = (val != 0);
 544                break;
 545        case DCCP_SOCKOPT_SEND_CSCOV:
 546                err = dccp_setsockopt_cscov(sk, val, false);
 547                break;
 548        case DCCP_SOCKOPT_RECV_CSCOV:
 549                err = dccp_setsockopt_cscov(sk, val, true);
 550                break;
 551        case DCCP_SOCKOPT_QPOLICY_ID:
 552                if (sk->sk_state != DCCP_CLOSED)
 553                        err = -EISCONN;
 554                else if (val < 0 || val >= DCCPQ_POLICY_MAX)
 555                        err = -EINVAL;
 556                else
 557                        dp->dccps_qpolicy = val;
 558                break;
 559        case DCCP_SOCKOPT_QPOLICY_TXQLEN:
 560                if (val < 0)
 561                        err = -EINVAL;
 562                else
 563                        dp->dccps_tx_qlen = val;
 564                break;
 565        default:
 566                err = -ENOPROTOOPT;
 567                break;
 568        }
 569        release_sock(sk);
 570
 571        return err;
 572}
 573
 574int dccp_setsockopt(struct sock *sk, int level, int optname, sockptr_t optval,
 575                    unsigned int optlen)
 576{
 577        if (level != SOL_DCCP)
 578                return inet_csk(sk)->icsk_af_ops->setsockopt(sk, level,
 579                                                             optname, optval,
 580                                                             optlen);
 581        return do_dccp_setsockopt(sk, level, optname, optval, optlen);
 582}
 583
 584EXPORT_SYMBOL_GPL(dccp_setsockopt);
 585
 586static int dccp_getsockopt_service(struct sock *sk, int len,
 587                                   __be32 __user *optval,
 588                                   int __user *optlen)
 589{
 590        const struct dccp_sock *dp = dccp_sk(sk);
 591        const struct dccp_service_list *sl;
 592        int err = -ENOENT, slen = 0, total_len = sizeof(u32);
 593
 594        lock_sock(sk);
 595        if ((sl = dp->dccps_service_list) != NULL) {
 596                slen = sl->dccpsl_nr * sizeof(u32);
 597                total_len += slen;
 598        }
 599
 600        err = -EINVAL;
 601        if (total_len > len)
 602                goto out;
 603
 604        err = 0;
 605        if (put_user(total_len, optlen) ||
 606            put_user(dp->dccps_service, optval) ||
 607            (sl != NULL && copy_to_user(optval + 1, sl->dccpsl_list, slen)))
 608                err = -EFAULT;
 609out:
 610        release_sock(sk);
 611        return err;
 612}
 613
 614static int do_dccp_getsockopt(struct sock *sk, int level, int optname,
 615                    char __user *optval, int __user *optlen)
 616{
 617        struct dccp_sock *dp;
 618        int val, len;
 619
 620        if (get_user(len, optlen))
 621                return -EFAULT;
 622
 623        if (len < (int)sizeof(int))
 624                return -EINVAL;
 625
 626        dp = dccp_sk(sk);
 627
 628        switch (optname) {
 629        case DCCP_SOCKOPT_PACKET_SIZE:
 630                DCCP_WARN("sockopt(PACKET_SIZE) is deprecated: fix your app\n");
 631                return 0;
 632        case DCCP_SOCKOPT_SERVICE:
 633                return dccp_getsockopt_service(sk, len,
 634                                               (__be32 __user *)optval, optlen);
 635        case DCCP_SOCKOPT_GET_CUR_MPS:
 636                val = dp->dccps_mss_cache;
 637                break;
 638        case DCCP_SOCKOPT_AVAILABLE_CCIDS:
 639                return ccid_getsockopt_builtin_ccids(sk, len, optval, optlen);
 640        case DCCP_SOCKOPT_TX_CCID:
 641                val = ccid_get_current_tx_ccid(dp);
 642                if (val < 0)
 643                        return -ENOPROTOOPT;
 644                break;
 645        case DCCP_SOCKOPT_RX_CCID:
 646                val = ccid_get_current_rx_ccid(dp);
 647                if (val < 0)
 648                        return -ENOPROTOOPT;
 649                break;
 650        case DCCP_SOCKOPT_SERVER_TIMEWAIT:
 651                val = dp->dccps_server_timewait;
 652                break;
 653        case DCCP_SOCKOPT_SEND_CSCOV:
 654                val = dp->dccps_pcslen;
 655                break;
 656        case DCCP_SOCKOPT_RECV_CSCOV:
 657                val = dp->dccps_pcrlen;
 658                break;
 659        case DCCP_SOCKOPT_QPOLICY_ID:
 660                val = dp->dccps_qpolicy;
 661                break;
 662        case DCCP_SOCKOPT_QPOLICY_TXQLEN:
 663                val = dp->dccps_tx_qlen;
 664                break;
 665        case 128 ... 191:
 666                return ccid_hc_rx_getsockopt(dp->dccps_hc_rx_ccid, sk, optname,
 667                                             len, (u32 __user *)optval, optlen);
 668        case 192 ... 255:
 669                return ccid_hc_tx_getsockopt(dp->dccps_hc_tx_ccid, sk, optname,
 670                                             len, (u32 __user *)optval, optlen);
 671        default:
 672                return -ENOPROTOOPT;
 673        }
 674
 675        len = sizeof(val);
 676        if (put_user(len, optlen) || copy_to_user(optval, &val, len))
 677                return -EFAULT;
 678
 679        return 0;
 680}
 681
 682int dccp_getsockopt(struct sock *sk, int level, int optname,
 683                    char __user *optval, int __user *optlen)
 684{
 685        if (level != SOL_DCCP)
 686                return inet_csk(sk)->icsk_af_ops->getsockopt(sk, level,
 687                                                             optname, optval,
 688                                                             optlen);
 689        return do_dccp_getsockopt(sk, level, optname, optval, optlen);
 690}
 691
 692EXPORT_SYMBOL_GPL(dccp_getsockopt);
 693
 694static int dccp_msghdr_parse(struct msghdr *msg, struct sk_buff *skb)
 695{
 696        struct cmsghdr *cmsg;
 697
 698        /*
 699         * Assign an (opaque) qpolicy priority value to skb->priority.
 700         *
 701         * We are overloading this skb field for use with the qpolicy subystem.
 702         * The skb->priority is normally used for the SO_PRIORITY option, which
 703         * is initialised from sk_priority. Since the assignment of sk_priority
 704         * to skb->priority happens later (on layer 3), we overload this field
 705         * for use with queueing priorities as long as the skb is on layer 4.
 706         * The default priority value (if nothing is set) is 0.
 707         */
 708        skb->priority = 0;
 709
 710        for_each_cmsghdr(cmsg, msg) {
 711                if (!CMSG_OK(msg, cmsg))
 712                        return -EINVAL;
 713
 714                if (cmsg->cmsg_level != SOL_DCCP)
 715                        continue;
 716
 717                if (cmsg->cmsg_type <= DCCP_SCM_QPOLICY_MAX &&
 718                    !dccp_qpolicy_param_ok(skb->sk, cmsg->cmsg_type))
 719                        return -EINVAL;
 720
 721                switch (cmsg->cmsg_type) {
 722                case DCCP_SCM_PRIORITY:
 723                        if (cmsg->cmsg_len != CMSG_LEN(sizeof(__u32)))
 724                                return -EINVAL;
 725                        skb->priority = *(__u32 *)CMSG_DATA(cmsg);
 726                        break;
 727                default:
 728                        return -EINVAL;
 729                }
 730        }
 731        return 0;
 732}
 733
 734int dccp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
 735{
 736        const struct dccp_sock *dp = dccp_sk(sk);
 737        const int flags = msg->msg_flags;
 738        const int noblock = flags & MSG_DONTWAIT;
 739        struct sk_buff *skb;
 740        int rc, size;
 741        long timeo;
 742
 743        trace_dccp_probe(sk, len);
 744
 745        if (len > dp->dccps_mss_cache)
 746                return -EMSGSIZE;
 747
 748        lock_sock(sk);
 749
 750        if (dccp_qpolicy_full(sk)) {
 751                rc = -EAGAIN;
 752                goto out_release;
 753        }
 754
 755        timeo = sock_sndtimeo(sk, noblock);
 756
 757        /*
 758         * We have to use sk_stream_wait_connect here to set sk_write_pending,
 759         * so that the trick in dccp_rcv_request_sent_state_process.
 760         */
 761        /* Wait for a connection to finish. */
 762        if ((1 << sk->sk_state) & ~(DCCPF_OPEN | DCCPF_PARTOPEN))
 763                if ((rc = sk_stream_wait_connect(sk, &timeo)) != 0)
 764                        goto out_release;
 765
 766        size = sk->sk_prot->max_header + len;
 767        release_sock(sk);
 768        skb = sock_alloc_send_skb(sk, size, noblock, &rc);
 769        lock_sock(sk);
 770        if (skb == NULL)
 771                goto out_release;
 772
 773        if (sk->sk_state == DCCP_CLOSED) {
 774                rc = -ENOTCONN;
 775                goto out_discard;
 776        }
 777
 778        skb_reserve(skb, sk->sk_prot->max_header);
 779        rc = memcpy_from_msg(skb_put(skb, len), msg, len);
 780        if (rc != 0)
 781                goto out_discard;
 782
 783        rc = dccp_msghdr_parse(msg, skb);
 784        if (rc != 0)
 785                goto out_discard;
 786
 787        dccp_qpolicy_push(sk, skb);
 788        /*
 789         * The xmit_timer is set if the TX CCID is rate-based and will expire
 790         * when congestion control permits to release further packets into the
 791         * network. Window-based CCIDs do not use this timer.
 792         */
 793        if (!timer_pending(&dp->dccps_xmit_timer))
 794                dccp_write_xmit(sk);
 795out_release:
 796        release_sock(sk);
 797        return rc ? : len;
 798out_discard:
 799        kfree_skb(skb);
 800        goto out_release;
 801}
 802
 803EXPORT_SYMBOL_GPL(dccp_sendmsg);
 804
 805int dccp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,
 806                 int flags, int *addr_len)
 807{
 808        const struct dccp_hdr *dh;
 809        long timeo;
 810
 811        lock_sock(sk);
 812
 813        if (sk->sk_state == DCCP_LISTEN) {
 814                len = -ENOTCONN;
 815                goto out;
 816        }
 817
 818        timeo = sock_rcvtimeo(sk, nonblock);
 819
 820        do {
 821                struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);
 822
 823                if (skb == NULL)
 824                        goto verify_sock_status;
 825
 826                dh = dccp_hdr(skb);
 827
 828                switch (dh->dccph_type) {
 829                case DCCP_PKT_DATA:
 830                case DCCP_PKT_DATAACK:
 831                        goto found_ok_skb;
 832
 833                case DCCP_PKT_CLOSE:
 834                case DCCP_PKT_CLOSEREQ:
 835                        if (!(flags & MSG_PEEK))
 836                                dccp_finish_passive_close(sk);
 837                        fallthrough;
 838                case DCCP_PKT_RESET:
 839                        dccp_pr_debug("found fin (%s) ok!\n",
 840                                      dccp_packet_name(dh->dccph_type));
 841                        len = 0;
 842                        goto found_fin_ok;
 843                default:
 844                        dccp_pr_debug("packet_type=%s\n",
 845                                      dccp_packet_name(dh->dccph_type));
 846                        sk_eat_skb(sk, skb);
 847                }
 848verify_sock_status:
 849                if (sock_flag(sk, SOCK_DONE)) {
 850                        len = 0;
 851                        break;
 852                }
 853
 854                if (sk->sk_err) {
 855                        len = sock_error(sk);
 856                        break;
 857                }
 858
 859                if (sk->sk_shutdown & RCV_SHUTDOWN) {
 860                        len = 0;
 861                        break;
 862                }
 863
 864                if (sk->sk_state == DCCP_CLOSED) {
 865                        if (!sock_flag(sk, SOCK_DONE)) {
 866                                /* This occurs when user tries to read
 867                                 * from never connected socket.
 868                                 */
 869                                len = -ENOTCONN;
 870                                break;
 871                        }
 872                        len = 0;
 873                        break;
 874                }
 875
 876                if (!timeo) {
 877                        len = -EAGAIN;
 878                        break;
 879                }
 880
 881                if (signal_pending(current)) {
 882                        len = sock_intr_errno(timeo);
 883                        break;
 884                }
 885
 886                sk_wait_data(sk, &timeo, NULL);
 887                continue;
 888        found_ok_skb:
 889                if (len > skb->len)
 890                        len = skb->len;
 891                else if (len < skb->len)
 892                        msg->msg_flags |= MSG_TRUNC;
 893
 894                if (skb_copy_datagram_msg(skb, 0, msg, len)) {
 895                        /* Exception. Bailout! */
 896                        len = -EFAULT;
 897                        break;
 898                }
 899                if (flags & MSG_TRUNC)
 900                        len = skb->len;
 901        found_fin_ok:
 902                if (!(flags & MSG_PEEK))
 903                        sk_eat_skb(sk, skb);
 904                break;
 905        } while (1);
 906out:
 907        release_sock(sk);
 908        return len;
 909}
 910
 911EXPORT_SYMBOL_GPL(dccp_recvmsg);
 912
 913int inet_dccp_listen(struct socket *sock, int backlog)
 914{
 915        struct sock *sk = sock->sk;
 916        unsigned char old_state;
 917        int err;
 918
 919        lock_sock(sk);
 920
 921        err = -EINVAL;
 922        if (sock->state != SS_UNCONNECTED || sock->type != SOCK_DCCP)
 923                goto out;
 924
 925        old_state = sk->sk_state;
 926        if (!((1 << old_state) & (DCCPF_CLOSED | DCCPF_LISTEN)))
 927                goto out;
 928
 929        WRITE_ONCE(sk->sk_max_ack_backlog, backlog);
 930        /* Really, if the socket is already in listen state
 931         * we can only allow the backlog to be adjusted.
 932         */
 933        if (old_state != DCCP_LISTEN) {
 934                /*
 935                 * FIXME: here it probably should be sk->sk_prot->listen_start
 936                 * see tcp_listen_start
 937                 */
 938                err = dccp_listen_start(sk, backlog);
 939                if (err)
 940                        goto out;
 941        }
 942        err = 0;
 943
 944out:
 945        release_sock(sk);
 946        return err;
 947}
 948
 949EXPORT_SYMBOL_GPL(inet_dccp_listen);
 950
 951static void dccp_terminate_connection(struct sock *sk)
 952{
 953        u8 next_state = DCCP_CLOSED;
 954
 955        switch (sk->sk_state) {
 956        case DCCP_PASSIVE_CLOSE:
 957        case DCCP_PASSIVE_CLOSEREQ:
 958                dccp_finish_passive_close(sk);
 959                break;
 960        case DCCP_PARTOPEN:
 961                dccp_pr_debug("Stop PARTOPEN timer (%p)\n", sk);
 962                inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK);
 963                fallthrough;
 964        case DCCP_OPEN:
 965                dccp_send_close(sk, 1);
 966
 967                if (dccp_sk(sk)->dccps_role == DCCP_ROLE_SERVER &&
 968                    !dccp_sk(sk)->dccps_server_timewait)
 969                        next_state = DCCP_ACTIVE_CLOSEREQ;
 970                else
 971                        next_state = DCCP_CLOSING;
 972                fallthrough;
 973        default:
 974                dccp_set_state(sk, next_state);
 975        }
 976}
 977
 978void dccp_close(struct sock *sk, long timeout)
 979{
 980        struct dccp_sock *dp = dccp_sk(sk);
 981        struct sk_buff *skb;
 982        u32 data_was_unread = 0;
 983        int state;
 984
 985        lock_sock(sk);
 986
 987        sk->sk_shutdown = SHUTDOWN_MASK;
 988
 989        if (sk->sk_state == DCCP_LISTEN) {
 990                dccp_set_state(sk, DCCP_CLOSED);
 991
 992                /* Special case. */
 993                inet_csk_listen_stop(sk);
 994
 995                goto adjudge_to_death;
 996        }
 997
 998        sk_stop_timer(sk, &dp->dccps_xmit_timer);
 999
1000        /*
1001         * We need to flush the recv. buffs.  We do this only on the
1002         * descriptor close, not protocol-sourced closes, because the
1003          *reader process may not have drained the data yet!
1004         */
1005        while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) {
1006                data_was_unread += skb->len;
1007                __kfree_skb(skb);
1008        }
1009
1010        /* If socket has been already reset kill it. */
1011        if (sk->sk_state == DCCP_CLOSED)
1012                goto adjudge_to_death;
1013
1014        if (data_was_unread) {
1015                /* Unread data was tossed, send an appropriate Reset Code */
1016                DCCP_WARN("ABORT with %u bytes unread\n", data_was_unread);
1017                dccp_send_reset(sk, DCCP_RESET_CODE_ABORTED);
1018                dccp_set_state(sk, DCCP_CLOSED);
1019        } else if (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime) {
1020                /* Check zero linger _after_ checking for unread data. */
1021                sk->sk_prot->disconnect(sk, 0);
1022        } else if (sk->sk_state != DCCP_CLOSED) {
1023                /*
1024                 * Normal connection termination. May need to wait if there are
1025                 * still packets in the TX queue that are delayed by the CCID.
1026                 */
1027                dccp_flush_write_queue(sk, &timeout);
1028                dccp_terminate_connection(sk);
1029        }
1030
1031        /*
1032         * Flush write queue. This may be necessary in several cases:
1033         * - we have been closed by the peer but still have application data;
1034         * - abortive termination (unread data or zero linger time),
1035         * - normal termination but queue could not be flushed within time limit
1036         */
1037        __skb_queue_purge(&sk->sk_write_queue);
1038
1039        sk_stream_wait_close(sk, timeout);
1040
1041adjudge_to_death:
1042        state = sk->sk_state;
1043        sock_hold(sk);
1044        sock_orphan(sk);
1045
1046        /*
1047         * It is the last release_sock in its life. It will remove backlog.
1048         */
1049        release_sock(sk);
1050        /*
1051         * Now socket is owned by kernel and we acquire BH lock
1052         * to finish close. No need to check for user refs.
1053         */
1054        local_bh_disable();
1055        bh_lock_sock(sk);
1056        WARN_ON(sock_owned_by_user(sk));
1057
1058        percpu_counter_inc(sk->sk_prot->orphan_count);
1059
1060        /* Have we already been destroyed by a softirq or backlog? */
1061        if (state != DCCP_CLOSED && sk->sk_state == DCCP_CLOSED)
1062                goto out;
1063
1064        if (sk->sk_state == DCCP_CLOSED)
1065                inet_csk_destroy_sock(sk);
1066
1067        /* Otherwise, socket is reprieved until protocol close. */
1068
1069out:
1070        bh_unlock_sock(sk);
1071        local_bh_enable();
1072        sock_put(sk);
1073}
1074
1075EXPORT_SYMBOL_GPL(dccp_close);
1076
1077void dccp_shutdown(struct sock *sk, int how)
1078{
1079        dccp_pr_debug("called shutdown(%x)\n", how);
1080}
1081
1082EXPORT_SYMBOL_GPL(dccp_shutdown);
1083
1084static inline int __init dccp_mib_init(void)
1085{
1086        dccp_statistics = alloc_percpu(struct dccp_mib);
1087        if (!dccp_statistics)
1088                return -ENOMEM;
1089        return 0;
1090}
1091
1092static inline void dccp_mib_exit(void)
1093{
1094        free_percpu(dccp_statistics);
1095}
1096
1097static int thash_entries;
1098module_param(thash_entries, int, 0444);
1099MODULE_PARM_DESC(thash_entries, "Number of ehash buckets");
1100
1101#ifdef CONFIG_IP_DCCP_DEBUG
1102bool dccp_debug;
1103module_param(dccp_debug, bool, 0644);
1104MODULE_PARM_DESC(dccp_debug, "Enable debug messages");
1105
1106EXPORT_SYMBOL_GPL(dccp_debug);
1107#endif
1108
1109static int __init dccp_init(void)
1110{
1111        unsigned long goal;
1112        unsigned long nr_pages = totalram_pages();
1113        int ehash_order, bhash_order, i;
1114        int rc;
1115
1116        BUILD_BUG_ON(sizeof(struct dccp_skb_cb) >
1117                     sizeof_field(struct sk_buff, cb));
1118        rc = percpu_counter_init(&dccp_orphan_count, 0, GFP_KERNEL);
1119        if (rc)
1120                goto out_fail;
1121        inet_hashinfo_init(&dccp_hashinfo);
1122        rc = inet_hashinfo2_init_mod(&dccp_hashinfo);
1123        if (rc)
1124                goto out_free_percpu;
1125        rc = -ENOBUFS;
1126        dccp_hashinfo.bind_bucket_cachep =
1127                kmem_cache_create("dccp_bind_bucket",
1128                                  sizeof(struct inet_bind_bucket), 0,
1129                                  SLAB_HWCACHE_ALIGN, NULL);
1130        if (!dccp_hashinfo.bind_bucket_cachep)
1131                goto out_free_hashinfo2;
1132
1133        /*
1134         * Size and allocate the main established and bind bucket
1135         * hash tables.
1136         *
1137         * The methodology is similar to that of the buffer cache.
1138         */
1139        if (nr_pages >= (128 * 1024))
1140                goal = nr_pages >> (21 - PAGE_SHIFT);
1141        else
1142                goal = nr_pages >> (23 - PAGE_SHIFT);
1143
1144        if (thash_entries)
1145                goal = (thash_entries *
1146                        sizeof(struct inet_ehash_bucket)) >> PAGE_SHIFT;
1147        for (ehash_order = 0; (1UL << ehash_order) < goal; ehash_order++)
1148                ;
1149        do {
1150                unsigned long hash_size = (1UL << ehash_order) * PAGE_SIZE /
1151                                        sizeof(struct inet_ehash_bucket);
1152
1153                while (hash_size & (hash_size - 1))
1154                        hash_size--;
1155                dccp_hashinfo.ehash_mask = hash_size - 1;
1156                dccp_hashinfo.ehash = (struct inet_ehash_bucket *)
1157                        __get_free_pages(GFP_ATOMIC|__GFP_NOWARN, ehash_order);
1158        } while (!dccp_hashinfo.ehash && --ehash_order > 0);
1159
1160        if (!dccp_hashinfo.ehash) {
1161                DCCP_CRIT("Failed to allocate DCCP established hash table");
1162                goto out_free_bind_bucket_cachep;
1163        }
1164
1165        for (i = 0; i <= dccp_hashinfo.ehash_mask; i++)
1166                INIT_HLIST_NULLS_HEAD(&dccp_hashinfo.ehash[i].chain, i);
1167
1168        if (inet_ehash_locks_alloc(&dccp_hashinfo))
1169                        goto out_free_dccp_ehash;
1170
1171        bhash_order = ehash_order;
1172
1173        do {
1174                dccp_hashinfo.bhash_size = (1UL << bhash_order) * PAGE_SIZE /
1175                                        sizeof(struct inet_bind_hashbucket);
1176                if ((dccp_hashinfo.bhash_size > (64 * 1024)) &&
1177                    bhash_order > 0)
1178                        continue;
1179                dccp_hashinfo.bhash = (struct inet_bind_hashbucket *)
1180                        __get_free_pages(GFP_ATOMIC|__GFP_NOWARN, bhash_order);
1181        } while (!dccp_hashinfo.bhash && --bhash_order >= 0);
1182
1183        if (!dccp_hashinfo.bhash) {
1184                DCCP_CRIT("Failed to allocate DCCP bind hash table");
1185                goto out_free_dccp_locks;
1186        }
1187
1188        for (i = 0; i < dccp_hashinfo.bhash_size; i++) {
1189                spin_lock_init(&dccp_hashinfo.bhash[i].lock);
1190                INIT_HLIST_HEAD(&dccp_hashinfo.bhash[i].chain);
1191        }
1192
1193        rc = dccp_mib_init();
1194        if (rc)
1195                goto out_free_dccp_bhash;
1196
1197        rc = dccp_ackvec_init();
1198        if (rc)
1199                goto out_free_dccp_mib;
1200
1201        rc = dccp_sysctl_init();
1202        if (rc)
1203                goto out_ackvec_exit;
1204
1205        rc = ccid_initialize_builtins();
1206        if (rc)
1207                goto out_sysctl_exit;
1208
1209        dccp_timestamping_init();
1210
1211        return 0;
1212
1213out_sysctl_exit:
1214        dccp_sysctl_exit();
1215out_ackvec_exit:
1216        dccp_ackvec_exit();
1217out_free_dccp_mib:
1218        dccp_mib_exit();
1219out_free_dccp_bhash:
1220        free_pages((unsigned long)dccp_hashinfo.bhash, bhash_order);
1221out_free_dccp_locks:
1222        inet_ehash_locks_free(&dccp_hashinfo);
1223out_free_dccp_ehash:
1224        free_pages((unsigned long)dccp_hashinfo.ehash, ehash_order);
1225out_free_bind_bucket_cachep:
1226        kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
1227out_free_hashinfo2:
1228        inet_hashinfo2_free_mod(&dccp_hashinfo);
1229out_free_percpu:
1230        percpu_counter_destroy(&dccp_orphan_count);
1231out_fail:
1232        dccp_hashinfo.bhash = NULL;
1233        dccp_hashinfo.ehash = NULL;
1234        dccp_hashinfo.bind_bucket_cachep = NULL;
1235        return rc;
1236}
1237
1238static void __exit dccp_fini(void)
1239{
1240        ccid_cleanup_builtins();
1241        dccp_mib_exit();
1242        free_pages((unsigned long)dccp_hashinfo.bhash,
1243                   get_order(dccp_hashinfo.bhash_size *
1244                             sizeof(struct inet_bind_hashbucket)));
1245        free_pages((unsigned long)dccp_hashinfo.ehash,
1246                   get_order((dccp_hashinfo.ehash_mask + 1) *
1247                             sizeof(struct inet_ehash_bucket)));
1248        inet_ehash_locks_free(&dccp_hashinfo);
1249        kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
1250        dccp_ackvec_exit();
1251        dccp_sysctl_exit();
1252        inet_hashinfo2_free_mod(&dccp_hashinfo);
1253        percpu_counter_destroy(&dccp_orphan_count);
1254}
1255
1256module_init(dccp_init);
1257module_exit(dccp_fini);
1258
1259MODULE_LICENSE("GPL");
1260MODULE_AUTHOR("Arnaldo Carvalho de Melo <acme@conectiva.com.br>");
1261MODULE_DESCRIPTION("DCCP - Datagram Congestion Controlled Protocol");
1262