Merge tag 'arc-5.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc
[sfrench/cifs-2.6.git] / net / sctp / sm_statefuns.c
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* SCTP kernel implementation
3  * (C) Copyright IBM Corp. 2001, 2004
4  * Copyright (c) 1999-2000 Cisco, Inc.
5  * Copyright (c) 1999-2001 Motorola, Inc.
6  * Copyright (c) 2001-2002 Intel Corp.
7  * Copyright (c) 2002      Nokia Corp.
8  *
9  * This is part of the SCTP Linux Kernel Implementation.
10  *
11  * These are the state functions for the state machine.
12  *
13  * Please send any bug reports or fixes you make to the
14  * email address(es):
15  *    lksctp developers <linux-sctp@vger.kernel.org>
16  *
17  * Written or modified by:
18  *    La Monte H.P. Yarroll <piggy@acm.org>
19  *    Karl Knutson          <karl@athena.chicago.il.us>
20  *    Mathew Kotowsky       <kotowsky@sctp.org>
21  *    Sridhar Samudrala     <samudrala@us.ibm.com>
22  *    Jon Grimm             <jgrimm@us.ibm.com>
23  *    Hui Huang             <hui.huang@nokia.com>
24  *    Dajiang Zhang         <dajiang.zhang@nokia.com>
25  *    Daisy Chang           <daisyc@us.ibm.com>
26  *    Ardelle Fan           <ardelle.fan@intel.com>
27  *    Ryan Layer            <rmlayer@us.ibm.com>
28  *    Kevin Gao             <kevin.gao@intel.com>
29  */
30
31 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
32
33 #include <linux/types.h>
34 #include <linux/kernel.h>
35 #include <linux/ip.h>
36 #include <linux/ipv6.h>
37 #include <linux/net.h>
38 #include <linux/inet.h>
39 #include <linux/slab.h>
40 #include <net/sock.h>
41 #include <net/inet_ecn.h>
42 #include <linux/skbuff.h>
43 #include <net/sctp/sctp.h>
44 #include <net/sctp/sm.h>
45 #include <net/sctp/structs.h>
46
47 #define CREATE_TRACE_POINTS
48 #include <trace/events/sctp.h>
49
50 static struct sctp_packet *sctp_abort_pkt_new(
51                                         struct net *net,
52                                         const struct sctp_endpoint *ep,
53                                         const struct sctp_association *asoc,
54                                         struct sctp_chunk *chunk,
55                                         const void *payload, size_t paylen);
56 static int sctp_eat_data(const struct sctp_association *asoc,
57                          struct sctp_chunk *chunk,
58                          struct sctp_cmd_seq *commands);
59 static struct sctp_packet *sctp_ootb_pkt_new(
60                                         struct net *net,
61                                         const struct sctp_association *asoc,
62                                         const struct sctp_chunk *chunk);
63 static void sctp_send_stale_cookie_err(struct net *net,
64                                        const struct sctp_endpoint *ep,
65                                        const struct sctp_association *asoc,
66                                        const struct sctp_chunk *chunk,
67                                        struct sctp_cmd_seq *commands,
68                                        struct sctp_chunk *err_chunk);
69 static enum sctp_disposition sctp_sf_do_5_2_6_stale(
70                                         struct net *net,
71                                         const struct sctp_endpoint *ep,
72                                         const struct sctp_association *asoc,
73                                         const union sctp_subtype type,
74                                         void *arg,
75                                         struct sctp_cmd_seq *commands);
76 static enum sctp_disposition sctp_sf_shut_8_4_5(
77                                         struct net *net,
78                                         const struct sctp_endpoint *ep,
79                                         const struct sctp_association *asoc,
80                                         const union sctp_subtype type,
81                                         void *arg,
82                                         struct sctp_cmd_seq *commands);
83 static enum sctp_disposition sctp_sf_tabort_8_4_8(
84                                         struct net *net,
85                                         const struct sctp_endpoint *ep,
86                                         const struct sctp_association *asoc,
87                                         const union sctp_subtype type,
88                                         void *arg,
89                                         struct sctp_cmd_seq *commands);
90 static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk);
91
92 static enum sctp_disposition sctp_stop_t1_and_abort(
93                                         struct net *net,
94                                         struct sctp_cmd_seq *commands,
95                                         __be16 error, int sk_err,
96                                         const struct sctp_association *asoc,
97                                         struct sctp_transport *transport);
98
99 static enum sctp_disposition sctp_sf_abort_violation(
100                                         struct net *net,
101                                         const struct sctp_endpoint *ep,
102                                         const struct sctp_association *asoc,
103                                         void *arg,
104                                         struct sctp_cmd_seq *commands,
105                                         const __u8 *payload,
106                                         const size_t paylen);
107
108 static enum sctp_disposition sctp_sf_violation_chunklen(
109                                         struct net *net,
110                                         const struct sctp_endpoint *ep,
111                                         const struct sctp_association *asoc,
112                                         const union sctp_subtype type,
113                                         void *arg,
114                                         struct sctp_cmd_seq *commands);
115
116 static enum sctp_disposition sctp_sf_violation_paramlen(
117                                         struct net *net,
118                                         const struct sctp_endpoint *ep,
119                                         const struct sctp_association *asoc,
120                                         const union sctp_subtype type,
121                                         void *arg, void *ext,
122                                         struct sctp_cmd_seq *commands);
123
124 static enum sctp_disposition sctp_sf_violation_ctsn(
125                                         struct net *net,
126                                         const struct sctp_endpoint *ep,
127                                         const struct sctp_association *asoc,
128                                         const union sctp_subtype type,
129                                         void *arg,
130                                         struct sctp_cmd_seq *commands);
131
132 static enum sctp_disposition sctp_sf_violation_chunk(
133                                         struct net *net,
134                                         const struct sctp_endpoint *ep,
135                                         const struct sctp_association *asoc,
136                                         const union sctp_subtype type,
137                                         void *arg,
138                                         struct sctp_cmd_seq *commands);
139
140 static enum sctp_ierror sctp_sf_authenticate(
141                                         const struct sctp_association *asoc,
142                                         struct sctp_chunk *chunk);
143
144 static enum sctp_disposition __sctp_sf_do_9_1_abort(
145                                         struct net *net,
146                                         const struct sctp_endpoint *ep,
147                                         const struct sctp_association *asoc,
148                                         const union sctp_subtype type,
149                                         void *arg,
150                                         struct sctp_cmd_seq *commands);
151
152 /* Small helper function that checks if the chunk length
153  * is of the appropriate length.  The 'required_length' argument
154  * is set to be the size of a specific chunk we are testing.
155  * Return Values:  true  = Valid length
156  *                 false = Invalid length
157  *
158  */
159 static inline bool sctp_chunk_length_valid(struct sctp_chunk *chunk,
160                                            __u16 required_length)
161 {
162         __u16 chunk_length = ntohs(chunk->chunk_hdr->length);
163
164         /* Previously already marked? */
165         if (unlikely(chunk->pdiscard))
166                 return false;
167         if (unlikely(chunk_length < required_length))
168                 return false;
169
170         return true;
171 }
172
173 /**********************************************************
174  * These are the state functions for handling chunk events.
175  **********************************************************/
176
177 /*
178  * Process the final SHUTDOWN COMPLETE.
179  *
180  * Section: 4 (C) (diagram), 9.2
181  * Upon reception of the SHUTDOWN COMPLETE chunk the endpoint will verify
182  * that it is in SHUTDOWN-ACK-SENT state, if it is not the chunk should be
183  * discarded. If the endpoint is in the SHUTDOWN-ACK-SENT state the endpoint
184  * should stop the T2-shutdown timer and remove all knowledge of the
185  * association (and thus the association enters the CLOSED state).
186  *
187  * Verification Tag: 8.5.1(C), sctpimpguide 2.41.
188  * C) Rules for packet carrying SHUTDOWN COMPLETE:
189  * ...
190  * - The receiver of a SHUTDOWN COMPLETE shall accept the packet
191  *   if the Verification Tag field of the packet matches its own tag and
192  *   the T bit is not set
193  *   OR
194  *   it is set to its peer's tag and the T bit is set in the Chunk
195  *   Flags.
196  *   Otherwise, the receiver MUST silently discard the packet
197  *   and take no further action.  An endpoint MUST ignore the
198  *   SHUTDOWN COMPLETE if it is not in the SHUTDOWN-ACK-SENT state.
199  *
200  * Inputs
201  * (endpoint, asoc, chunk)
202  *
203  * Outputs
204  * (asoc, reply_msg, msg_up, timers, counters)
205  *
206  * The return value is the disposition of the chunk.
207  */
208 enum sctp_disposition sctp_sf_do_4_C(struct net *net,
209                                      const struct sctp_endpoint *ep,
210                                      const struct sctp_association *asoc,
211                                      const union sctp_subtype type,
212                                      void *arg, struct sctp_cmd_seq *commands)
213 {
214         struct sctp_chunk *chunk = arg;
215         struct sctp_ulpevent *ev;
216
217         if (!sctp_vtag_verify_either(chunk, asoc))
218                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
219
220         /* RFC 2960 6.10 Bundling
221          *
222          * An endpoint MUST NOT bundle INIT, INIT ACK or
223          * SHUTDOWN COMPLETE with any other chunks.
224          */
225         if (!chunk->singleton)
226                 return sctp_sf_violation_chunk(net, ep, asoc, type, arg, commands);
227
228         /* Make sure that the SHUTDOWN_COMPLETE chunk has a valid length. */
229         if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
230                 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
231                                                   commands);
232
233         /* RFC 2960 10.2 SCTP-to-ULP
234          *
235          * H) SHUTDOWN COMPLETE notification
236          *
237          * When SCTP completes the shutdown procedures (section 9.2) this
238          * notification is passed to the upper layer.
239          */
240         ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_SHUTDOWN_COMP,
241                                              0, 0, 0, NULL, GFP_ATOMIC);
242         if (ev)
243                 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
244                                 SCTP_ULPEVENT(ev));
245
246         /* Upon reception of the SHUTDOWN COMPLETE chunk the endpoint
247          * will verify that it is in SHUTDOWN-ACK-SENT state, if it is
248          * not the chunk should be discarded. If the endpoint is in
249          * the SHUTDOWN-ACK-SENT state the endpoint should stop the
250          * T2-shutdown timer and remove all knowledge of the
251          * association (and thus the association enters the CLOSED
252          * state).
253          */
254         sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
255                         SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
256
257         sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
258                         SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
259
260         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
261                         SCTP_STATE(SCTP_STATE_CLOSED));
262
263         SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS);
264         SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
265
266         sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
267
268         return SCTP_DISPOSITION_DELETE_TCB;
269 }
270
271 /*
272  * Respond to a normal INIT chunk.
273  * We are the side that is being asked for an association.
274  *
275  * Section: 5.1 Normal Establishment of an Association, B
276  * B) "Z" shall respond immediately with an INIT ACK chunk.  The
277  *    destination IP address of the INIT ACK MUST be set to the source
278  *    IP address of the INIT to which this INIT ACK is responding.  In
279  *    the response, besides filling in other parameters, "Z" must set the
280  *    Verification Tag field to Tag_A, and also provide its own
281  *    Verification Tag (Tag_Z) in the Initiate Tag field.
282  *
283  * Verification Tag: Must be 0.
284  *
285  * Inputs
286  * (endpoint, asoc, chunk)
287  *
288  * Outputs
289  * (asoc, reply_msg, msg_up, timers, counters)
290  *
291  * The return value is the disposition of the chunk.
292  */
293 enum sctp_disposition sctp_sf_do_5_1B_init(struct net *net,
294                                            const struct sctp_endpoint *ep,
295                                            const struct sctp_association *asoc,
296                                            const union sctp_subtype type,
297                                            void *arg,
298                                            struct sctp_cmd_seq *commands)
299 {
300         struct sctp_chunk *chunk = arg, *repl, *err_chunk;
301         struct sctp_unrecognized_param *unk_param;
302         struct sctp_association *new_asoc;
303         struct sctp_packet *packet;
304         int len;
305
306         /* Update socket peer label if first association. */
307         if (security_sctp_assoc_request((struct sctp_endpoint *)ep,
308                                         chunk->skb))
309                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
310
311         /* 6.10 Bundling
312          * An endpoint MUST NOT bundle INIT, INIT ACK or
313          * SHUTDOWN COMPLETE with any other chunks.
314          *
315          * IG Section 2.11.2
316          * Furthermore, we require that the receiver of an INIT chunk MUST
317          * enforce these rules by silently discarding an arriving packet
318          * with an INIT chunk that is bundled with other chunks.
319          */
320         if (!chunk->singleton)
321                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
322
323         /* If the packet is an OOTB packet which is temporarily on the
324          * control endpoint, respond with an ABORT.
325          */
326         if (ep == sctp_sk(net->sctp.ctl_sock)->ep) {
327                 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
328                 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
329         }
330
331         /* 3.1 A packet containing an INIT chunk MUST have a zero Verification
332          * Tag.
333          */
334         if (chunk->sctp_hdr->vtag != 0)
335                 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
336
337         /* Make sure that the INIT chunk has a valid length.
338          * Normally, this would cause an ABORT with a Protocol Violation
339          * error, but since we don't have an association, we'll
340          * just discard the packet.
341          */
342         if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
343                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
344
345         /* If the INIT is coming toward a closing socket, we'll send back
346          * and ABORT.  Essentially, this catches the race of INIT being
347          * backloged to the socket at the same time as the user isses close().
348          * Since the socket and all its associations are going away, we
349          * can treat this OOTB
350          */
351         if (sctp_sstate(ep->base.sk, CLOSING))
352                 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
353
354         /* Verify the INIT chunk before processing it. */
355         err_chunk = NULL;
356         if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type,
357                               (struct sctp_init_chunk *)chunk->chunk_hdr, chunk,
358                               &err_chunk)) {
359                 /* This chunk contains fatal error. It is to be discarded.
360                  * Send an ABORT, with causes if there is any.
361                  */
362                 if (err_chunk) {
363                         packet = sctp_abort_pkt_new(net, ep, asoc, arg,
364                                         (__u8 *)(err_chunk->chunk_hdr) +
365                                         sizeof(struct sctp_chunkhdr),
366                                         ntohs(err_chunk->chunk_hdr->length) -
367                                         sizeof(struct sctp_chunkhdr));
368
369                         sctp_chunk_free(err_chunk);
370
371                         if (packet) {
372                                 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
373                                                 SCTP_PACKET(packet));
374                                 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
375                                 return SCTP_DISPOSITION_CONSUME;
376                         } else {
377                                 return SCTP_DISPOSITION_NOMEM;
378                         }
379                 } else {
380                         return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg,
381                                                     commands);
382                 }
383         }
384
385         /* Grab the INIT header.  */
386         chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data;
387
388         /* Tag the variable length parameters.  */
389         chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(struct sctp_inithdr));
390
391         new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC);
392         if (!new_asoc)
393                 goto nomem;
394
395         if (sctp_assoc_set_bind_addr_from_ep(new_asoc,
396                                              sctp_scope(sctp_source(chunk)),
397                                              GFP_ATOMIC) < 0)
398                 goto nomem_init;
399
400         /* The call, sctp_process_init(), can fail on memory allocation.  */
401         if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk),
402                                (struct sctp_init_chunk *)chunk->chunk_hdr,
403                                GFP_ATOMIC))
404                 goto nomem_init;
405
406         /* B) "Z" shall respond immediately with an INIT ACK chunk.  */
407
408         /* If there are errors need to be reported for unknown parameters,
409          * make sure to reserve enough room in the INIT ACK for them.
410          */
411         len = 0;
412         if (err_chunk)
413                 len = ntohs(err_chunk->chunk_hdr->length) -
414                       sizeof(struct sctp_chunkhdr);
415
416         repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
417         if (!repl)
418                 goto nomem_init;
419
420         /* If there are errors need to be reported for unknown parameters,
421          * include them in the outgoing INIT ACK as "Unrecognized parameter"
422          * parameter.
423          */
424         if (err_chunk) {
425                 /* Get the "Unrecognized parameter" parameter(s) out of the
426                  * ERROR chunk generated by sctp_verify_init(). Since the
427                  * error cause code for "unknown parameter" and the
428                  * "Unrecognized parameter" type is the same, we can
429                  * construct the parameters in INIT ACK by copying the
430                  * ERROR causes over.
431                  */
432                 unk_param = (struct sctp_unrecognized_param *)
433                             ((__u8 *)(err_chunk->chunk_hdr) +
434                             sizeof(struct sctp_chunkhdr));
435                 /* Replace the cause code with the "Unrecognized parameter"
436                  * parameter type.
437                  */
438                 sctp_addto_chunk(repl, len, unk_param);
439                 sctp_chunk_free(err_chunk);
440         }
441
442         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
443
444         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
445
446         /*
447          * Note:  After sending out INIT ACK with the State Cookie parameter,
448          * "Z" MUST NOT allocate any resources, nor keep any states for the
449          * new association.  Otherwise, "Z" will be vulnerable to resource
450          * attacks.
451          */
452         sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
453
454         return SCTP_DISPOSITION_DELETE_TCB;
455
456 nomem_init:
457         sctp_association_free(new_asoc);
458 nomem:
459         if (err_chunk)
460                 sctp_chunk_free(err_chunk);
461         return SCTP_DISPOSITION_NOMEM;
462 }
463
464 /*
465  * Respond to a normal INIT ACK chunk.
466  * We are the side that is initiating the association.
467  *
468  * Section: 5.1 Normal Establishment of an Association, C
469  * C) Upon reception of the INIT ACK from "Z", "A" shall stop the T1-init
470  *    timer and leave COOKIE-WAIT state. "A" shall then send the State
471  *    Cookie received in the INIT ACK chunk in a COOKIE ECHO chunk, start
472  *    the T1-cookie timer, and enter the COOKIE-ECHOED state.
473  *
474  *    Note: The COOKIE ECHO chunk can be bundled with any pending outbound
475  *    DATA chunks, but it MUST be the first chunk in the packet and
476  *    until the COOKIE ACK is returned the sender MUST NOT send any
477  *    other packets to the peer.
478  *
479  * Verification Tag: 3.3.3
480  *   If the value of the Initiate Tag in a received INIT ACK chunk is
481  *   found to be 0, the receiver MUST treat it as an error and close the
482  *   association by transmitting an ABORT.
483  *
484  * Inputs
485  * (endpoint, asoc, chunk)
486  *
487  * Outputs
488  * (asoc, reply_msg, msg_up, timers, counters)
489  *
490  * The return value is the disposition of the chunk.
491  */
492 enum sctp_disposition sctp_sf_do_5_1C_ack(struct net *net,
493                                           const struct sctp_endpoint *ep,
494                                           const struct sctp_association *asoc,
495                                           const union sctp_subtype type,
496                                           void *arg,
497                                           struct sctp_cmd_seq *commands)
498 {
499         struct sctp_init_chunk *initchunk;
500         struct sctp_chunk *chunk = arg;
501         struct sctp_chunk *err_chunk;
502         struct sctp_packet *packet;
503
504         if (!sctp_vtag_verify(chunk, asoc))
505                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
506
507         /* 6.10 Bundling
508          * An endpoint MUST NOT bundle INIT, INIT ACK or
509          * SHUTDOWN COMPLETE with any other chunks.
510          */
511         if (!chunk->singleton)
512                 return sctp_sf_violation_chunk(net, ep, asoc, type, arg, commands);
513
514         /* Make sure that the INIT-ACK chunk has a valid length */
515         if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_initack_chunk)))
516                 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
517                                                   commands);
518         /* Grab the INIT header.  */
519         chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data;
520
521         /* Verify the INIT chunk before processing it. */
522         err_chunk = NULL;
523         if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type,
524                               (struct sctp_init_chunk *)chunk->chunk_hdr, chunk,
525                               &err_chunk)) {
526
527                 enum sctp_error error = SCTP_ERROR_NO_RESOURCE;
528
529                 /* This chunk contains fatal error. It is to be discarded.
530                  * Send an ABORT, with causes.  If there are no causes,
531                  * then there wasn't enough memory.  Just terminate
532                  * the association.
533                  */
534                 if (err_chunk) {
535                         packet = sctp_abort_pkt_new(net, ep, asoc, arg,
536                                         (__u8 *)(err_chunk->chunk_hdr) +
537                                         sizeof(struct sctp_chunkhdr),
538                                         ntohs(err_chunk->chunk_hdr->length) -
539                                         sizeof(struct sctp_chunkhdr));
540
541                         sctp_chunk_free(err_chunk);
542
543                         if (packet) {
544                                 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
545                                                 SCTP_PACKET(packet));
546                                 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
547                                 error = SCTP_ERROR_INV_PARAM;
548                         }
549                 }
550
551                 /* SCTP-AUTH, Section 6.3:
552                  *    It should be noted that if the receiver wants to tear
553                  *    down an association in an authenticated way only, the
554                  *    handling of malformed packets should not result in
555                  *    tearing down the association.
556                  *
557                  * This means that if we only want to abort associations
558                  * in an authenticated way (i.e AUTH+ABORT), then we
559                  * can't destroy this association just because the packet
560                  * was malformed.
561                  */
562                 if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
563                         return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
564
565                 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
566                 return sctp_stop_t1_and_abort(net, commands, error, ECONNREFUSED,
567                                                 asoc, chunk->transport);
568         }
569
570         /* Tag the variable length parameters.  Note that we never
571          * convert the parameters in an INIT chunk.
572          */
573         chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(struct sctp_inithdr));
574
575         initchunk = (struct sctp_init_chunk *)chunk->chunk_hdr;
576
577         sctp_add_cmd_sf(commands, SCTP_CMD_PEER_INIT,
578                         SCTP_PEER_INIT(initchunk));
579
580         /* Reset init error count upon receipt of INIT-ACK.  */
581         sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());
582
583         /* 5.1 C) "A" shall stop the T1-init timer and leave
584          * COOKIE-WAIT state.  "A" shall then ... start the T1-cookie
585          * timer, and enter the COOKIE-ECHOED state.
586          */
587         sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
588                         SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
589         sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
590                         SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
591         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
592                         SCTP_STATE(SCTP_STATE_COOKIE_ECHOED));
593
594         /* SCTP-AUTH: genereate the assocition shared keys so that
595          * we can potentially signe the COOKIE-ECHO.
596          */
597         sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_SHKEY, SCTP_NULL());
598
599         /* 5.1 C) "A" shall then send the State Cookie received in the
600          * INIT ACK chunk in a COOKIE ECHO chunk, ...
601          */
602         /* If there is any errors to report, send the ERROR chunk generated
603          * for unknown parameters as well.
604          */
605         sctp_add_cmd_sf(commands, SCTP_CMD_GEN_COOKIE_ECHO,
606                         SCTP_CHUNK(err_chunk));
607
608         return SCTP_DISPOSITION_CONSUME;
609 }
610
611 static bool sctp_auth_chunk_verify(struct net *net, struct sctp_chunk *chunk,
612                                    const struct sctp_association *asoc)
613 {
614         struct sctp_chunk auth;
615
616         if (!chunk->auth_chunk)
617                 return true;
618
619         /* SCTP-AUTH:  auth_chunk pointer is only set when the cookie-echo
620          * is supposed to be authenticated and we have to do delayed
621          * authentication.  We've just recreated the association using
622          * the information in the cookie and now it's much easier to
623          * do the authentication.
624          */
625
626         /* Make sure that we and the peer are AUTH capable */
627         if (!net->sctp.auth_enable || !asoc->peer.auth_capable)
628                 return false;
629
630         /* set-up our fake chunk so that we can process it */
631         auth.skb = chunk->auth_chunk;
632         auth.asoc = chunk->asoc;
633         auth.sctp_hdr = chunk->sctp_hdr;
634         auth.chunk_hdr = (struct sctp_chunkhdr *)
635                                 skb_push(chunk->auth_chunk,
636                                          sizeof(struct sctp_chunkhdr));
637         skb_pull(chunk->auth_chunk, sizeof(struct sctp_chunkhdr));
638         auth.transport = chunk->transport;
639
640         return sctp_sf_authenticate(asoc, &auth) == SCTP_IERROR_NO_ERROR;
641 }
642
643 /*
644  * Respond to a normal COOKIE ECHO chunk.
645  * We are the side that is being asked for an association.
646  *
647  * Section: 5.1 Normal Establishment of an Association, D
648  * D) Upon reception of the COOKIE ECHO chunk, Endpoint "Z" will reply
649  *    with a COOKIE ACK chunk after building a TCB and moving to
650  *    the ESTABLISHED state. A COOKIE ACK chunk may be bundled with
651  *    any pending DATA chunks (and/or SACK chunks), but the COOKIE ACK
652  *    chunk MUST be the first chunk in the packet.
653  *
654  *   IMPLEMENTATION NOTE: An implementation may choose to send the
655  *   Communication Up notification to the SCTP user upon reception
656  *   of a valid COOKIE ECHO chunk.
657  *
658  * Verification Tag: 8.5.1 Exceptions in Verification Tag Rules
659  * D) Rules for packet carrying a COOKIE ECHO
660  *
661  * - When sending a COOKIE ECHO, the endpoint MUST use the value of the
662  *   Initial Tag received in the INIT ACK.
663  *
664  * - The receiver of a COOKIE ECHO follows the procedures in Section 5.
665  *
666  * Inputs
667  * (endpoint, asoc, chunk)
668  *
669  * Outputs
670  * (asoc, reply_msg, msg_up, timers, counters)
671  *
672  * The return value is the disposition of the chunk.
673  */
674 enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,
675                                          const struct sctp_endpoint *ep,
676                                          const struct sctp_association *asoc,
677                                          const union sctp_subtype type,
678                                          void *arg,
679                                          struct sctp_cmd_seq *commands)
680 {
681         struct sctp_ulpevent *ev, *ai_ev = NULL, *auth_ev = NULL;
682         struct sctp_association *new_asoc;
683         struct sctp_init_chunk *peer_init;
684         struct sctp_chunk *chunk = arg;
685         struct sctp_chunk *err_chk_p;
686         struct sctp_chunk *repl;
687         struct sock *sk;
688         int error = 0;
689
690         /* If the packet is an OOTB packet which is temporarily on the
691          * control endpoint, respond with an ABORT.
692          */
693         if (ep == sctp_sk(net->sctp.ctl_sock)->ep) {
694                 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
695                 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
696         }
697
698         /* Make sure that the COOKIE_ECHO chunk has a valid length.
699          * In this case, we check that we have enough for at least a
700          * chunk header.  More detailed verification is done
701          * in sctp_unpack_cookie().
702          */
703         if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
704                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
705
706         /* If the endpoint is not listening or if the number of associations
707          * on the TCP-style socket exceed the max backlog, respond with an
708          * ABORT.
709          */
710         sk = ep->base.sk;
711         if (!sctp_sstate(sk, LISTENING) ||
712             (sctp_style(sk, TCP) && sk_acceptq_is_full(sk)))
713                 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
714
715         /* "Decode" the chunk.  We have no optional parameters so we
716          * are in good shape.
717          */
718         chunk->subh.cookie_hdr =
719                 (struct sctp_signed_cookie *)chunk->skb->data;
720         if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
721                                          sizeof(struct sctp_chunkhdr)))
722                 goto nomem;
723
724         /* 5.1 D) Upon reception of the COOKIE ECHO chunk, Endpoint
725          * "Z" will reply with a COOKIE ACK chunk after building a TCB
726          * and moving to the ESTABLISHED state.
727          */
728         new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, &error,
729                                       &err_chk_p);
730
731         /* FIXME:
732          * If the re-build failed, what is the proper error path
733          * from here?
734          *
735          * [We should abort the association. --piggy]
736          */
737         if (!new_asoc) {
738                 /* FIXME: Several errors are possible.  A bad cookie should
739                  * be silently discarded, but think about logging it too.
740                  */
741                 switch (error) {
742                 case -SCTP_IERROR_NOMEM:
743                         goto nomem;
744
745                 case -SCTP_IERROR_STALE_COOKIE:
746                         sctp_send_stale_cookie_err(net, ep, asoc, chunk, commands,
747                                                    err_chk_p);
748                         return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
749
750                 case -SCTP_IERROR_BAD_SIG:
751                 default:
752                         return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
753                 }
754         }
755
756
757         /* Delay state machine commands until later.
758          *
759          * Re-build the bind address for the association is done in
760          * the sctp_unpack_cookie() already.
761          */
762         /* This is a brand-new association, so these are not yet side
763          * effects--it is safe to run them here.
764          */
765         peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
766
767         if (!sctp_process_init(new_asoc, chunk,
768                                &chunk->subh.cookie_hdr->c.peer_addr,
769                                peer_init, GFP_ATOMIC))
770                 goto nomem_init;
771
772         /* SCTP-AUTH:  Now that we've populate required fields in
773          * sctp_process_init, set up the assocaition shared keys as
774          * necessary so that we can potentially authenticate the ACK
775          */
776         error = sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC);
777         if (error)
778                 goto nomem_init;
779
780         if (!sctp_auth_chunk_verify(net, chunk, new_asoc)) {
781                 sctp_association_free(new_asoc);
782                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
783         }
784
785         repl = sctp_make_cookie_ack(new_asoc, chunk);
786         if (!repl)
787                 goto nomem_init;
788
789         /* RFC 2960 5.1 Normal Establishment of an Association
790          *
791          * D) IMPLEMENTATION NOTE: An implementation may choose to
792          * send the Communication Up notification to the SCTP user
793          * upon reception of a valid COOKIE ECHO chunk.
794          */
795         ev = sctp_ulpevent_make_assoc_change(new_asoc, 0, SCTP_COMM_UP, 0,
796                                              new_asoc->c.sinit_num_ostreams,
797                                              new_asoc->c.sinit_max_instreams,
798                                              NULL, GFP_ATOMIC);
799         if (!ev)
800                 goto nomem_ev;
801
802         /* Sockets API Draft Section 5.3.1.6
803          * When a peer sends a Adaptation Layer Indication parameter , SCTP
804          * delivers this notification to inform the application that of the
805          * peers requested adaptation layer.
806          */
807         if (new_asoc->peer.adaptation_ind) {
808                 ai_ev = sctp_ulpevent_make_adaptation_indication(new_asoc,
809                                                             GFP_ATOMIC);
810                 if (!ai_ev)
811                         goto nomem_aiev;
812         }
813
814         if (!new_asoc->peer.auth_capable) {
815                 auth_ev = sctp_ulpevent_make_authkey(new_asoc, 0,
816                                                      SCTP_AUTH_NO_AUTH,
817                                                      GFP_ATOMIC);
818                 if (!auth_ev)
819                         goto nomem_authev;
820         }
821
822         /* Add all the state machine commands now since we've created
823          * everything.  This way we don't introduce memory corruptions
824          * during side-effect processing and correclty count established
825          * associations.
826          */
827         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
828         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
829                         SCTP_STATE(SCTP_STATE_ESTABLISHED));
830         SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
831         SCTP_INC_STATS(net, SCTP_MIB_PASSIVEESTABS);
832         sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
833
834         if (new_asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
835                 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
836                                 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
837
838         /* This will send the COOKIE ACK */
839         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
840
841         /* Queue the ASSOC_CHANGE event */
842         sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
843
844         /* Send up the Adaptation Layer Indication event */
845         if (ai_ev)
846                 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
847                                 SCTP_ULPEVENT(ai_ev));
848
849         if (auth_ev)
850                 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
851                                 SCTP_ULPEVENT(auth_ev));
852
853         return SCTP_DISPOSITION_CONSUME;
854
855 nomem_authev:
856         sctp_ulpevent_free(ai_ev);
857 nomem_aiev:
858         sctp_ulpevent_free(ev);
859 nomem_ev:
860         sctp_chunk_free(repl);
861 nomem_init:
862         sctp_association_free(new_asoc);
863 nomem:
864         return SCTP_DISPOSITION_NOMEM;
865 }
866
867 /*
868  * Respond to a normal COOKIE ACK chunk.
869  * We are the side that is asking for an association.
870  *
871  * RFC 2960 5.1 Normal Establishment of an Association
872  *
873  * E) Upon reception of the COOKIE ACK, endpoint "A" will move from the
874  *    COOKIE-ECHOED state to the ESTABLISHED state, stopping the T1-cookie
875  *    timer. It may also notify its ULP about the successful
876  *    establishment of the association with a Communication Up
877  *    notification (see Section 10).
878  *
879  * Verification Tag:
880  * Inputs
881  * (endpoint, asoc, chunk)
882  *
883  * Outputs
884  * (asoc, reply_msg, msg_up, timers, counters)
885  *
886  * The return value is the disposition of the chunk.
887  */
888 enum sctp_disposition sctp_sf_do_5_1E_ca(struct net *net,
889                                          const struct sctp_endpoint *ep,
890                                          const struct sctp_association *asoc,
891                                          const union sctp_subtype type,
892                                          void *arg,
893                                          struct sctp_cmd_seq *commands)
894 {
895         struct sctp_chunk *chunk = arg;
896         struct sctp_ulpevent *ev;
897
898         if (!sctp_vtag_verify(chunk, asoc))
899                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
900
901         /* Verify that the chunk length for the COOKIE-ACK is OK.
902          * If we don't do this, any bundled chunks may be junked.
903          */
904         if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
905                 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
906                                                   commands);
907
908         /* Reset init error count upon receipt of COOKIE-ACK,
909          * to avoid problems with the managemement of this
910          * counter in stale cookie situations when a transition back
911          * from the COOKIE-ECHOED state to the COOKIE-WAIT
912          * state is performed.
913          */
914         sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());
915
916         /* Set peer label for connection. */
917         security_inet_conn_established(ep->base.sk, chunk->skb);
918
919         /* RFC 2960 5.1 Normal Establishment of an Association
920          *
921          * E) Upon reception of the COOKIE ACK, endpoint "A" will move
922          * from the COOKIE-ECHOED state to the ESTABLISHED state,
923          * stopping the T1-cookie timer.
924          */
925         sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
926                         SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
927         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
928                         SCTP_STATE(SCTP_STATE_ESTABLISHED));
929         SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
930         SCTP_INC_STATS(net, SCTP_MIB_ACTIVEESTABS);
931         sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
932         if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
933                 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
934                                 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
935
936         /* It may also notify its ULP about the successful
937          * establishment of the association with a Communication Up
938          * notification (see Section 10).
939          */
940         ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_COMM_UP,
941                                              0, asoc->c.sinit_num_ostreams,
942                                              asoc->c.sinit_max_instreams,
943                                              NULL, GFP_ATOMIC);
944
945         if (!ev)
946                 goto nomem;
947
948         sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
949
950         /* Sockets API Draft Section 5.3.1.6
951          * When a peer sends a Adaptation Layer Indication parameter , SCTP
952          * delivers this notification to inform the application that of the
953          * peers requested adaptation layer.
954          */
955         if (asoc->peer.adaptation_ind) {
956                 ev = sctp_ulpevent_make_adaptation_indication(asoc, GFP_ATOMIC);
957                 if (!ev)
958                         goto nomem;
959
960                 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
961                                 SCTP_ULPEVENT(ev));
962         }
963
964         if (!asoc->peer.auth_capable) {
965                 ev = sctp_ulpevent_make_authkey(asoc, 0, SCTP_AUTH_NO_AUTH,
966                                                 GFP_ATOMIC);
967                 if (!ev)
968                         goto nomem;
969                 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
970                                 SCTP_ULPEVENT(ev));
971         }
972
973         return SCTP_DISPOSITION_CONSUME;
974 nomem:
975         return SCTP_DISPOSITION_NOMEM;
976 }
977
978 /* Generate and sendout a heartbeat packet.  */
979 static enum sctp_disposition sctp_sf_heartbeat(
980                                         const struct sctp_endpoint *ep,
981                                         const struct sctp_association *asoc,
982                                         const union sctp_subtype type,
983                                         void *arg,
984                                         struct sctp_cmd_seq *commands)
985 {
986         struct sctp_transport *transport = (struct sctp_transport *) arg;
987         struct sctp_chunk *reply;
988
989         /* Send a heartbeat to our peer.  */
990         reply = sctp_make_heartbeat(asoc, transport);
991         if (!reply)
992                 return SCTP_DISPOSITION_NOMEM;
993
994         /* Set rto_pending indicating that an RTT measurement
995          * is started with this heartbeat chunk.
996          */
997         sctp_add_cmd_sf(commands, SCTP_CMD_RTO_PENDING,
998                         SCTP_TRANSPORT(transport));
999
1000         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
1001         return SCTP_DISPOSITION_CONSUME;
1002 }
1003
1004 /* Generate a HEARTBEAT packet on the given transport.  */
1005 enum sctp_disposition sctp_sf_sendbeat_8_3(struct net *net,
1006                                            const struct sctp_endpoint *ep,
1007                                            const struct sctp_association *asoc,
1008                                            const union sctp_subtype type,
1009                                            void *arg,
1010                                            struct sctp_cmd_seq *commands)
1011 {
1012         struct sctp_transport *transport = (struct sctp_transport *) arg;
1013
1014         if (asoc->overall_error_count >= asoc->max_retrans) {
1015                 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
1016                                 SCTP_ERROR(ETIMEDOUT));
1017                 /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
1018                 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
1019                                 SCTP_PERR(SCTP_ERROR_NO_ERROR));
1020                 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
1021                 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
1022                 return SCTP_DISPOSITION_DELETE_TCB;
1023         }
1024
1025         /* Section 3.3.5.
1026          * The Sender-specific Heartbeat Info field should normally include
1027          * information about the sender's current time when this HEARTBEAT
1028          * chunk is sent and the destination transport address to which this
1029          * HEARTBEAT is sent (see Section 8.3).
1030          */
1031
1032         if (transport->param_flags & SPP_HB_ENABLE) {
1033                 if (SCTP_DISPOSITION_NOMEM ==
1034                                 sctp_sf_heartbeat(ep, asoc, type, arg,
1035                                                   commands))
1036                         return SCTP_DISPOSITION_NOMEM;
1037
1038                 /* Set transport error counter and association error counter
1039                  * when sending heartbeat.
1040                  */
1041                 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_HB_SENT,
1042                                 SCTP_TRANSPORT(transport));
1043         }
1044         sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_IDLE,
1045                         SCTP_TRANSPORT(transport));
1046         sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMER_UPDATE,
1047                         SCTP_TRANSPORT(transport));
1048
1049         return SCTP_DISPOSITION_CONSUME;
1050 }
1051
1052 /* resend asoc strreset_chunk.  */
1053 enum sctp_disposition sctp_sf_send_reconf(struct net *net,
1054                                           const struct sctp_endpoint *ep,
1055                                           const struct sctp_association *asoc,
1056                                           const union sctp_subtype type,
1057                                           void *arg,
1058                                           struct sctp_cmd_seq *commands)
1059 {
1060         struct sctp_transport *transport = arg;
1061
1062         if (asoc->overall_error_count >= asoc->max_retrans) {
1063                 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
1064                                 SCTP_ERROR(ETIMEDOUT));
1065                 /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
1066                 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
1067                                 SCTP_PERR(SCTP_ERROR_NO_ERROR));
1068                 SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
1069                 SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
1070                 return SCTP_DISPOSITION_DELETE_TCB;
1071         }
1072
1073         sctp_chunk_hold(asoc->strreset_chunk);
1074         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
1075                         SCTP_CHUNK(asoc->strreset_chunk));
1076         sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE, SCTP_TRANSPORT(transport));
1077
1078         return SCTP_DISPOSITION_CONSUME;
1079 }
1080
1081 /*
1082  * Process an heartbeat request.
1083  *
1084  * Section: 8.3 Path Heartbeat
1085  * The receiver of the HEARTBEAT should immediately respond with a
1086  * HEARTBEAT ACK that contains the Heartbeat Information field copied
1087  * from the received HEARTBEAT chunk.
1088  *
1089  * Verification Tag:  8.5 Verification Tag [Normal verification]
1090  * When receiving an SCTP packet, the endpoint MUST ensure that the
1091  * value in the Verification Tag field of the received SCTP packet
1092  * matches its own Tag. If the received Verification Tag value does not
1093  * match the receiver's own tag value, the receiver shall silently
1094  * discard the packet and shall not process it any further except for
1095  * those cases listed in Section 8.5.1 below.
1096  *
1097  * Inputs
1098  * (endpoint, asoc, chunk)
1099  *
1100  * Outputs
1101  * (asoc, reply_msg, msg_up, timers, counters)
1102  *
1103  * The return value is the disposition of the chunk.
1104  */
1105 enum sctp_disposition sctp_sf_beat_8_3(struct net *net,
1106                                        const struct sctp_endpoint *ep,
1107                                        const struct sctp_association *asoc,
1108                                        const union sctp_subtype type,
1109                                        void *arg, struct sctp_cmd_seq *commands)
1110 {
1111         struct sctp_paramhdr *param_hdr;
1112         struct sctp_chunk *chunk = arg;
1113         struct sctp_chunk *reply;
1114         size_t paylen = 0;
1115
1116         if (!sctp_vtag_verify(chunk, asoc))
1117                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1118
1119         /* Make sure that the HEARTBEAT chunk has a valid length. */
1120         if (!sctp_chunk_length_valid(chunk,
1121                                      sizeof(struct sctp_heartbeat_chunk)))
1122                 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1123                                                   commands);
1124
1125         /* 8.3 The receiver of the HEARTBEAT should immediately
1126          * respond with a HEARTBEAT ACK that contains the Heartbeat
1127          * Information field copied from the received HEARTBEAT chunk.
1128          */
1129         chunk->subh.hb_hdr = (struct sctp_heartbeathdr *)chunk->skb->data;
1130         param_hdr = (struct sctp_paramhdr *)chunk->subh.hb_hdr;
1131         paylen = ntohs(chunk->chunk_hdr->length) - sizeof(struct sctp_chunkhdr);
1132
1133         if (ntohs(param_hdr->length) > paylen)
1134                 return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
1135                                                   param_hdr, commands);
1136
1137         if (!pskb_pull(chunk->skb, paylen))
1138                 goto nomem;
1139
1140         reply = sctp_make_heartbeat_ack(asoc, chunk, param_hdr, paylen);
1141         if (!reply)
1142                 goto nomem;
1143
1144         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
1145         return SCTP_DISPOSITION_CONSUME;
1146
1147 nomem:
1148         return SCTP_DISPOSITION_NOMEM;
1149 }
1150
1151 /*
1152  * Process the returning HEARTBEAT ACK.
1153  *
1154  * Section: 8.3 Path Heartbeat
1155  * Upon the receipt of the HEARTBEAT ACK, the sender of the HEARTBEAT
1156  * should clear the error counter of the destination transport
1157  * address to which the HEARTBEAT was sent, and mark the destination
1158  * transport address as active if it is not so marked. The endpoint may
1159  * optionally report to the upper layer when an inactive destination
1160  * address is marked as active due to the reception of the latest
1161  * HEARTBEAT ACK. The receiver of the HEARTBEAT ACK must also
1162  * clear the association overall error count as well (as defined
1163  * in section 8.1).
1164  *
1165  * The receiver of the HEARTBEAT ACK should also perform an RTT
1166  * measurement for that destination transport address using the time
1167  * value carried in the HEARTBEAT ACK chunk.
1168  *
1169  * Verification Tag:  8.5 Verification Tag [Normal verification]
1170  *
1171  * Inputs
1172  * (endpoint, asoc, chunk)
1173  *
1174  * Outputs
1175  * (asoc, reply_msg, msg_up, timers, counters)
1176  *
1177  * The return value is the disposition of the chunk.
1178  */
1179 enum sctp_disposition sctp_sf_backbeat_8_3(struct net *net,
1180                                            const struct sctp_endpoint *ep,
1181                                            const struct sctp_association *asoc,
1182                                            const union sctp_subtype type,
1183                                            void *arg,
1184                                            struct sctp_cmd_seq *commands)
1185 {
1186         struct sctp_sender_hb_info *hbinfo;
1187         struct sctp_chunk *chunk = arg;
1188         struct sctp_transport *link;
1189         unsigned long max_interval;
1190         union sctp_addr from_addr;
1191
1192         if (!sctp_vtag_verify(chunk, asoc))
1193                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1194
1195         /* Make sure that the HEARTBEAT-ACK chunk has a valid length.  */
1196         if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr) +
1197                                             sizeof(*hbinfo)))
1198                 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1199                                                   commands);
1200
1201         hbinfo = (struct sctp_sender_hb_info *)chunk->skb->data;
1202         /* Make sure that the length of the parameter is what we expect */
1203         if (ntohs(hbinfo->param_hdr.length) != sizeof(*hbinfo))
1204                 return SCTP_DISPOSITION_DISCARD;
1205
1206         from_addr = hbinfo->daddr;
1207         link = sctp_assoc_lookup_paddr(asoc, &from_addr);
1208
1209         /* This should never happen, but lets log it if so.  */
1210         if (unlikely(!link)) {
1211                 if (from_addr.sa.sa_family == AF_INET6) {
1212                         net_warn_ratelimited("%s association %p could not find address %pI6\n",
1213                                              __func__,
1214                                              asoc,
1215                                              &from_addr.v6.sin6_addr);
1216                 } else {
1217                         net_warn_ratelimited("%s association %p could not find address %pI4\n",
1218                                              __func__,
1219                                              asoc,
1220                                              &from_addr.v4.sin_addr.s_addr);
1221                 }
1222                 return SCTP_DISPOSITION_DISCARD;
1223         }
1224
1225         /* Validate the 64-bit random nonce. */
1226         if (hbinfo->hb_nonce != link->hb_nonce)
1227                 return SCTP_DISPOSITION_DISCARD;
1228
1229         max_interval = link->hbinterval + link->rto;
1230
1231         /* Check if the timestamp looks valid.  */
1232         if (time_after(hbinfo->sent_at, jiffies) ||
1233             time_after(jiffies, hbinfo->sent_at + max_interval)) {
1234                 pr_debug("%s: HEARTBEAT ACK with invalid timestamp received "
1235                          "for transport:%p\n", __func__, link);
1236
1237                 return SCTP_DISPOSITION_DISCARD;
1238         }
1239
1240         /* 8.3 Upon the receipt of the HEARTBEAT ACK, the sender of
1241          * the HEARTBEAT should clear the error counter of the
1242          * destination transport address to which the HEARTBEAT was
1243          * sent and mark the destination transport address as active if
1244          * it is not so marked.
1245          */
1246         sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_ON, SCTP_TRANSPORT(link));
1247
1248         return SCTP_DISPOSITION_CONSUME;
1249 }
1250
1251 /* Helper function to send out an abort for the restart
1252  * condition.
1253  */
1254 static int sctp_sf_send_restart_abort(struct net *net, union sctp_addr *ssa,
1255                                       struct sctp_chunk *init,
1256                                       struct sctp_cmd_seq *commands)
1257 {
1258         struct sctp_af *af = sctp_get_af_specific(ssa->v4.sin_family);
1259         union sctp_addr_param *addrparm;
1260         struct sctp_errhdr *errhdr;
1261         char buffer[sizeof(*errhdr) + sizeof(*addrparm)];
1262         struct sctp_endpoint *ep;
1263         struct sctp_packet *pkt;
1264         int len;
1265
1266         /* Build the error on the stack.   We are way to malloc crazy
1267          * throughout the code today.
1268          */
1269         errhdr = (struct sctp_errhdr *)buffer;
1270         addrparm = (union sctp_addr_param *)errhdr->variable;
1271
1272         /* Copy into a parm format. */
1273         len = af->to_addr_param(ssa, addrparm);
1274         len += sizeof(*errhdr);
1275
1276         errhdr->cause = SCTP_ERROR_RESTART;
1277         errhdr->length = htons(len);
1278
1279         /* Assign to the control socket. */
1280         ep = sctp_sk(net->sctp.ctl_sock)->ep;
1281
1282         /* Association is NULL since this may be a restart attack and we
1283          * want to send back the attacker's vtag.
1284          */
1285         pkt = sctp_abort_pkt_new(net, ep, NULL, init, errhdr, len);
1286
1287         if (!pkt)
1288                 goto out;
1289         sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT, SCTP_PACKET(pkt));
1290
1291         SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
1292
1293         /* Discard the rest of the inbound packet. */
1294         sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
1295
1296 out:
1297         /* Even if there is no memory, treat as a failure so
1298          * the packet will get dropped.
1299          */
1300         return 0;
1301 }
1302
1303 static bool list_has_sctp_addr(const struct list_head *list,
1304                                union sctp_addr *ipaddr)
1305 {
1306         struct sctp_transport *addr;
1307
1308         list_for_each_entry(addr, list, transports) {
1309                 if (sctp_cmp_addr_exact(ipaddr, &addr->ipaddr))
1310                         return true;
1311         }
1312
1313         return false;
1314 }
1315 /* A restart is occurring, check to make sure no new addresses
1316  * are being added as we may be under a takeover attack.
1317  */
1318 static int sctp_sf_check_restart_addrs(const struct sctp_association *new_asoc,
1319                                        const struct sctp_association *asoc,
1320                                        struct sctp_chunk *init,
1321                                        struct sctp_cmd_seq *commands)
1322 {
1323         struct net *net = sock_net(new_asoc->base.sk);
1324         struct sctp_transport *new_addr;
1325         int ret = 1;
1326
1327         /* Implementor's Guide - Section 5.2.2
1328          * ...
1329          * Before responding the endpoint MUST check to see if the
1330          * unexpected INIT adds new addresses to the association. If new
1331          * addresses are added to the association, the endpoint MUST respond
1332          * with an ABORT..
1333          */
1334
1335         /* Search through all current addresses and make sure
1336          * we aren't adding any new ones.
1337          */
1338         list_for_each_entry(new_addr, &new_asoc->peer.transport_addr_list,
1339                             transports) {
1340                 if (!list_has_sctp_addr(&asoc->peer.transport_addr_list,
1341                                         &new_addr->ipaddr)) {
1342                         sctp_sf_send_restart_abort(net, &new_addr->ipaddr, init,
1343                                                    commands);
1344                         ret = 0;
1345                         break;
1346                 }
1347         }
1348
1349         /* Return success if all addresses were found. */
1350         return ret;
1351 }
1352
1353 /* Populate the verification/tie tags based on overlapping INIT
1354  * scenario.
1355  *
1356  * Note: Do not use in CLOSED or SHUTDOWN-ACK-SENT state.
1357  */
1358 static void sctp_tietags_populate(struct sctp_association *new_asoc,
1359                                   const struct sctp_association *asoc)
1360 {
1361         switch (asoc->state) {
1362
1363         /* 5.2.1 INIT received in COOKIE-WAIT or COOKIE-ECHOED State */
1364
1365         case SCTP_STATE_COOKIE_WAIT:
1366                 new_asoc->c.my_vtag     = asoc->c.my_vtag;
1367                 new_asoc->c.my_ttag     = asoc->c.my_vtag;
1368                 new_asoc->c.peer_ttag   = 0;
1369                 break;
1370
1371         case SCTP_STATE_COOKIE_ECHOED:
1372                 new_asoc->c.my_vtag     = asoc->c.my_vtag;
1373                 new_asoc->c.my_ttag     = asoc->c.my_vtag;
1374                 new_asoc->c.peer_ttag   = asoc->c.peer_vtag;
1375                 break;
1376
1377         /* 5.2.2 Unexpected INIT in States Other than CLOSED, COOKIE-ECHOED,
1378          * COOKIE-WAIT and SHUTDOWN-ACK-SENT
1379          */
1380         default:
1381                 new_asoc->c.my_ttag   = asoc->c.my_vtag;
1382                 new_asoc->c.peer_ttag = asoc->c.peer_vtag;
1383                 break;
1384         }
1385
1386         /* Other parameters for the endpoint SHOULD be copied from the
1387          * existing parameters of the association (e.g. number of
1388          * outbound streams) into the INIT ACK and cookie.
1389          */
1390         new_asoc->rwnd                  = asoc->rwnd;
1391         new_asoc->c.sinit_num_ostreams  = asoc->c.sinit_num_ostreams;
1392         new_asoc->c.sinit_max_instreams = asoc->c.sinit_max_instreams;
1393         new_asoc->c.initial_tsn         = asoc->c.initial_tsn;
1394 }
1395
1396 /*
1397  * Compare vtag/tietag values to determine unexpected COOKIE-ECHO
1398  * handling action.
1399  *
1400  * RFC 2960 5.2.4 Handle a COOKIE ECHO when a TCB exists.
1401  *
1402  * Returns value representing action to be taken.   These action values
1403  * correspond to Action/Description values in RFC 2960, Table 2.
1404  */
1405 static char sctp_tietags_compare(struct sctp_association *new_asoc,
1406                                  const struct sctp_association *asoc)
1407 {
1408         /* In this case, the peer may have restarted.  */
1409         if ((asoc->c.my_vtag != new_asoc->c.my_vtag) &&
1410             (asoc->c.peer_vtag != new_asoc->c.peer_vtag) &&
1411             (asoc->c.my_vtag == new_asoc->c.my_ttag) &&
1412             (asoc->c.peer_vtag == new_asoc->c.peer_ttag))
1413                 return 'A';
1414
1415         /* Collision case B. */
1416         if ((asoc->c.my_vtag == new_asoc->c.my_vtag) &&
1417             ((asoc->c.peer_vtag != new_asoc->c.peer_vtag) ||
1418              (0 == asoc->c.peer_vtag))) {
1419                 return 'B';
1420         }
1421
1422         /* Collision case D. */
1423         if ((asoc->c.my_vtag == new_asoc->c.my_vtag) &&
1424             (asoc->c.peer_vtag == new_asoc->c.peer_vtag))
1425                 return 'D';
1426
1427         /* Collision case C. */
1428         if ((asoc->c.my_vtag != new_asoc->c.my_vtag) &&
1429             (asoc->c.peer_vtag == new_asoc->c.peer_vtag) &&
1430             (0 == new_asoc->c.my_ttag) &&
1431             (0 == new_asoc->c.peer_ttag))
1432                 return 'C';
1433
1434         /* No match to any of the special cases; discard this packet. */
1435         return 'E';
1436 }
1437
1438 /* Common helper routine for both duplicate and simulataneous INIT
1439  * chunk handling.
1440  */
1441 static enum sctp_disposition sctp_sf_do_unexpected_init(
1442                                         struct net *net,
1443                                         const struct sctp_endpoint *ep,
1444                                         const struct sctp_association *asoc,
1445                                         const union sctp_subtype type,
1446                                         void *arg,
1447                                         struct sctp_cmd_seq *commands)
1448 {
1449         struct sctp_chunk *chunk = arg, *repl, *err_chunk;
1450         struct sctp_unrecognized_param *unk_param;
1451         struct sctp_association *new_asoc;
1452         enum sctp_disposition retval;
1453         struct sctp_packet *packet;
1454         int len;
1455
1456         /* Update socket peer label if first association. */
1457         if (security_sctp_assoc_request((struct sctp_endpoint *)ep,
1458                                         chunk->skb))
1459                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1460
1461         /* 6.10 Bundling
1462          * An endpoint MUST NOT bundle INIT, INIT ACK or
1463          * SHUTDOWN COMPLETE with any other chunks.
1464          *
1465          * IG Section 2.11.2
1466          * Furthermore, we require that the receiver of an INIT chunk MUST
1467          * enforce these rules by silently discarding an arriving packet
1468          * with an INIT chunk that is bundled with other chunks.
1469          */
1470         if (!chunk->singleton)
1471                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1472
1473         /* 3.1 A packet containing an INIT chunk MUST have a zero Verification
1474          * Tag.
1475          */
1476         if (chunk->sctp_hdr->vtag != 0)
1477                 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
1478
1479         /* Make sure that the INIT chunk has a valid length.
1480          * In this case, we generate a protocol violation since we have
1481          * an association established.
1482          */
1483         if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
1484                 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1485                                                   commands);
1486         /* Grab the INIT header.  */
1487         chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data;
1488
1489         /* Tag the variable length parameters.  */
1490         chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(struct sctp_inithdr));
1491
1492         /* Verify the INIT chunk before processing it. */
1493         err_chunk = NULL;
1494         if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type,
1495                               (struct sctp_init_chunk *)chunk->chunk_hdr, chunk,
1496                               &err_chunk)) {
1497                 /* This chunk contains fatal error. It is to be discarded.
1498                  * Send an ABORT, with causes if there is any.
1499                  */
1500                 if (err_chunk) {
1501                         packet = sctp_abort_pkt_new(net, ep, asoc, arg,
1502                                         (__u8 *)(err_chunk->chunk_hdr) +
1503                                         sizeof(struct sctp_chunkhdr),
1504                                         ntohs(err_chunk->chunk_hdr->length) -
1505                                         sizeof(struct sctp_chunkhdr));
1506
1507                         if (packet) {
1508                                 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
1509                                                 SCTP_PACKET(packet));
1510                                 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
1511                                 retval = SCTP_DISPOSITION_CONSUME;
1512                         } else {
1513                                 retval = SCTP_DISPOSITION_NOMEM;
1514                         }
1515                         goto cleanup;
1516                 } else {
1517                         return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg,
1518                                                     commands);
1519                 }
1520         }
1521
1522         /*
1523          * Other parameters for the endpoint SHOULD be copied from the
1524          * existing parameters of the association (e.g. number of
1525          * outbound streams) into the INIT ACK and cookie.
1526          * FIXME:  We are copying parameters from the endpoint not the
1527          * association.
1528          */
1529         new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC);
1530         if (!new_asoc)
1531                 goto nomem;
1532
1533         if (sctp_assoc_set_bind_addr_from_ep(new_asoc,
1534                                 sctp_scope(sctp_source(chunk)), GFP_ATOMIC) < 0)
1535                 goto nomem;
1536
1537         /* In the outbound INIT ACK the endpoint MUST copy its current
1538          * Verification Tag and Peers Verification tag into a reserved
1539          * place (local tie-tag and per tie-tag) within the state cookie.
1540          */
1541         if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk),
1542                                (struct sctp_init_chunk *)chunk->chunk_hdr,
1543                                GFP_ATOMIC))
1544                 goto nomem;
1545
1546         /* Make sure no new addresses are being added during the
1547          * restart.   Do not do this check for COOKIE-WAIT state,
1548          * since there are no peer addresses to check against.
1549          * Upon return an ABORT will have been sent if needed.
1550          */
1551         if (!sctp_state(asoc, COOKIE_WAIT)) {
1552                 if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk,
1553                                                  commands)) {
1554                         retval = SCTP_DISPOSITION_CONSUME;
1555                         goto nomem_retval;
1556                 }
1557         }
1558
1559         sctp_tietags_populate(new_asoc, asoc);
1560
1561         /* B) "Z" shall respond immediately with an INIT ACK chunk.  */
1562
1563         /* If there are errors need to be reported for unknown parameters,
1564          * make sure to reserve enough room in the INIT ACK for them.
1565          */
1566         len = 0;
1567         if (err_chunk) {
1568                 len = ntohs(err_chunk->chunk_hdr->length) -
1569                       sizeof(struct sctp_chunkhdr);
1570         }
1571
1572         repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
1573         if (!repl)
1574                 goto nomem;
1575
1576         /* If there are errors need to be reported for unknown parameters,
1577          * include them in the outgoing INIT ACK as "Unrecognized parameter"
1578          * parameter.
1579          */
1580         if (err_chunk) {
1581                 /* Get the "Unrecognized parameter" parameter(s) out of the
1582                  * ERROR chunk generated by sctp_verify_init(). Since the
1583                  * error cause code for "unknown parameter" and the
1584                  * "Unrecognized parameter" type is the same, we can
1585                  * construct the parameters in INIT ACK by copying the
1586                  * ERROR causes over.
1587                  */
1588                 unk_param = (struct sctp_unrecognized_param *)
1589                             ((__u8 *)(err_chunk->chunk_hdr) +
1590                             sizeof(struct sctp_chunkhdr));
1591                 /* Replace the cause code with the "Unrecognized parameter"
1592                  * parameter type.
1593                  */
1594                 sctp_addto_chunk(repl, len, unk_param);
1595         }
1596
1597         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
1598         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1599
1600         /*
1601          * Note: After sending out INIT ACK with the State Cookie parameter,
1602          * "Z" MUST NOT allocate any resources for this new association.
1603          * Otherwise, "Z" will be vulnerable to resource attacks.
1604          */
1605         sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
1606         retval = SCTP_DISPOSITION_CONSUME;
1607
1608         return retval;
1609
1610 nomem:
1611         retval = SCTP_DISPOSITION_NOMEM;
1612 nomem_retval:
1613         if (new_asoc)
1614                 sctp_association_free(new_asoc);
1615 cleanup:
1616         if (err_chunk)
1617                 sctp_chunk_free(err_chunk);
1618         return retval;
1619 }
1620
1621 /*
1622  * Handle simultaneous INIT.
1623  * This means we started an INIT and then we got an INIT request from
1624  * our peer.
1625  *
1626  * Section: 5.2.1 INIT received in COOKIE-WAIT or COOKIE-ECHOED State (Item B)
1627  * This usually indicates an initialization collision, i.e., each
1628  * endpoint is attempting, at about the same time, to establish an
1629  * association with the other endpoint.
1630  *
1631  * Upon receipt of an INIT in the COOKIE-WAIT or COOKIE-ECHOED state, an
1632  * endpoint MUST respond with an INIT ACK using the same parameters it
1633  * sent in its original INIT chunk (including its Verification Tag,
1634  * unchanged). These original parameters are combined with those from the
1635  * newly received INIT chunk. The endpoint shall also generate a State
1636  * Cookie with the INIT ACK. The endpoint uses the parameters sent in its
1637  * INIT to calculate the State Cookie.
1638  *
1639  * After that, the endpoint MUST NOT change its state, the T1-init
1640  * timer shall be left running and the corresponding TCB MUST NOT be
1641  * destroyed. The normal procedures for handling State Cookies when
1642  * a TCB exists will resolve the duplicate INITs to a single association.
1643  *
1644  * For an endpoint that is in the COOKIE-ECHOED state it MUST populate
1645  * its Tie-Tags with the Tag information of itself and its peer (see
1646  * section 5.2.2 for a description of the Tie-Tags).
1647  *
1648  * Verification Tag: Not explicit, but an INIT can not have a valid
1649  * verification tag, so we skip the check.
1650  *
1651  * Inputs
1652  * (endpoint, asoc, chunk)
1653  *
1654  * Outputs
1655  * (asoc, reply_msg, msg_up, timers, counters)
1656  *
1657  * The return value is the disposition of the chunk.
1658  */
1659 enum sctp_disposition sctp_sf_do_5_2_1_siminit(
1660                                         struct net *net,
1661                                         const struct sctp_endpoint *ep,
1662                                         const struct sctp_association *asoc,
1663                                         const union sctp_subtype type,
1664                                         void *arg,
1665                                         struct sctp_cmd_seq *commands)
1666 {
1667         /* Call helper to do the real work for both simulataneous and
1668          * duplicate INIT chunk handling.
1669          */
1670         return sctp_sf_do_unexpected_init(net, ep, asoc, type, arg, commands);
1671 }
1672
1673 /*
1674  * Handle duplicated INIT messages.  These are usually delayed
1675  * restransmissions.
1676  *
1677  * Section: 5.2.2 Unexpected INIT in States Other than CLOSED,
1678  * COOKIE-ECHOED and COOKIE-WAIT
1679  *
1680  * Unless otherwise stated, upon reception of an unexpected INIT for
1681  * this association, the endpoint shall generate an INIT ACK with a
1682  * State Cookie.  In the outbound INIT ACK the endpoint MUST copy its
1683  * current Verification Tag and peer's Verification Tag into a reserved
1684  * place within the state cookie.  We shall refer to these locations as
1685  * the Peer's-Tie-Tag and the Local-Tie-Tag.  The outbound SCTP packet
1686  * containing this INIT ACK MUST carry a Verification Tag value equal to
1687  * the Initiation Tag found in the unexpected INIT.  And the INIT ACK
1688  * MUST contain a new Initiation Tag (randomly generated see Section
1689  * 5.3.1).  Other parameters for the endpoint SHOULD be copied from the
1690  * existing parameters of the association (e.g. number of outbound
1691  * streams) into the INIT ACK and cookie.
1692  *
1693  * After sending out the INIT ACK, the endpoint shall take no further
1694  * actions, i.e., the existing association, including its current state,
1695  * and the corresponding TCB MUST NOT be changed.
1696  *
1697  * Note: Only when a TCB exists and the association is not in a COOKIE-
1698  * WAIT state are the Tie-Tags populated.  For a normal association INIT
1699  * (i.e. the endpoint is in a COOKIE-WAIT state), the Tie-Tags MUST be
1700  * set to 0 (indicating that no previous TCB existed).  The INIT ACK and
1701  * State Cookie are populated as specified in section 5.2.1.
1702  *
1703  * Verification Tag: Not specified, but an INIT has no way of knowing
1704  * what the verification tag could be, so we ignore it.
1705  *
1706  * Inputs
1707  * (endpoint, asoc, chunk)
1708  *
1709  * Outputs
1710  * (asoc, reply_msg, msg_up, timers, counters)
1711  *
1712  * The return value is the disposition of the chunk.
1713  */
1714 enum sctp_disposition sctp_sf_do_5_2_2_dupinit(
1715                                         struct net *net,
1716                                         const struct sctp_endpoint *ep,
1717                                         const struct sctp_association *asoc,
1718                                         const union sctp_subtype type,
1719                                         void *arg,
1720                                         struct sctp_cmd_seq *commands)
1721 {
1722         /* Call helper to do the real work for both simulataneous and
1723          * duplicate INIT chunk handling.
1724          */
1725         return sctp_sf_do_unexpected_init(net, ep, asoc, type, arg, commands);
1726 }
1727
1728
1729 /*
1730  * Unexpected INIT-ACK handler.
1731  *
1732  * Section 5.2.3
1733  * If an INIT ACK received by an endpoint in any state other than the
1734  * COOKIE-WAIT state, the endpoint should discard the INIT ACK chunk.
1735  * An unexpected INIT ACK usually indicates the processing of an old or
1736  * duplicated INIT chunk.
1737 */
1738 enum sctp_disposition sctp_sf_do_5_2_3_initack(
1739                                         struct net *net,
1740                                         const struct sctp_endpoint *ep,
1741                                         const struct sctp_association *asoc,
1742                                         const union sctp_subtype type,
1743                                         void *arg,
1744                                         struct sctp_cmd_seq *commands)
1745 {
1746         /* Per the above section, we'll discard the chunk if we have an
1747          * endpoint.  If this is an OOTB INIT-ACK, treat it as such.
1748          */
1749         if (ep == sctp_sk(net->sctp.ctl_sock)->ep)
1750                 return sctp_sf_ootb(net, ep, asoc, type, arg, commands);
1751         else
1752                 return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
1753 }
1754
1755 /* Unexpected COOKIE-ECHO handler for peer restart (Table 2, action 'A')
1756  *
1757  * Section 5.2.4
1758  *  A)  In this case, the peer may have restarted.
1759  */
1760 static enum sctp_disposition sctp_sf_do_dupcook_a(
1761                                         struct net *net,
1762                                         const struct sctp_endpoint *ep,
1763                                         const struct sctp_association *asoc,
1764                                         struct sctp_chunk *chunk,
1765                                         struct sctp_cmd_seq *commands,
1766                                         struct sctp_association *new_asoc)
1767 {
1768         struct sctp_init_chunk *peer_init;
1769         enum sctp_disposition disposition;
1770         struct sctp_ulpevent *ev;
1771         struct sctp_chunk *repl;
1772         struct sctp_chunk *err;
1773
1774         /* new_asoc is a brand-new association, so these are not yet
1775          * side effects--it is safe to run them here.
1776          */
1777         peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
1778
1779         if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk), peer_init,
1780                                GFP_ATOMIC))
1781                 goto nomem;
1782
1783         if (sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC))
1784                 goto nomem;
1785
1786         if (!sctp_auth_chunk_verify(net, chunk, new_asoc))
1787                 return SCTP_DISPOSITION_DISCARD;
1788
1789         /* Make sure no new addresses are being added during the
1790          * restart.  Though this is a pretty complicated attack
1791          * since you'd have to get inside the cookie.
1792          */
1793         if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk, commands))
1794                 return SCTP_DISPOSITION_CONSUME;
1795
1796         /* If the endpoint is in the SHUTDOWN-ACK-SENT state and recognizes
1797          * the peer has restarted (Action A), it MUST NOT setup a new
1798          * association but instead resend the SHUTDOWN ACK and send an ERROR
1799          * chunk with a "Cookie Received while Shutting Down" error cause to
1800          * its peer.
1801         */
1802         if (sctp_state(asoc, SHUTDOWN_ACK_SENT)) {
1803                 disposition = sctp_sf_do_9_2_reshutack(net, ep, asoc,
1804                                 SCTP_ST_CHUNK(chunk->chunk_hdr->type),
1805                                 chunk, commands);
1806                 if (SCTP_DISPOSITION_NOMEM == disposition)
1807                         goto nomem;
1808
1809                 err = sctp_make_op_error(asoc, chunk,
1810                                          SCTP_ERROR_COOKIE_IN_SHUTDOWN,
1811                                          NULL, 0, 0);
1812                 if (err)
1813                         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
1814                                         SCTP_CHUNK(err));
1815
1816                 return SCTP_DISPOSITION_CONSUME;
1817         }
1818
1819         /* For now, stop pending T3-rtx and SACK timers, fail any unsent/unacked
1820          * data. Consider the optional choice of resending of this data.
1821          */
1822         sctp_add_cmd_sf(commands, SCTP_CMD_T3_RTX_TIMERS_STOP, SCTP_NULL());
1823         sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
1824                         SCTP_TO(SCTP_EVENT_TIMEOUT_SACK));
1825         sctp_add_cmd_sf(commands, SCTP_CMD_PURGE_OUTQUEUE, SCTP_NULL());
1826
1827         /* Stop pending T4-rto timer, teardown ASCONF queue, ASCONF-ACK queue
1828          * and ASCONF-ACK cache.
1829          */
1830         sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
1831                         SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
1832         sctp_add_cmd_sf(commands, SCTP_CMD_PURGE_ASCONF_QUEUE, SCTP_NULL());
1833
1834         repl = sctp_make_cookie_ack(new_asoc, chunk);
1835         if (!repl)
1836                 goto nomem;
1837
1838         /* Report association restart to upper layer. */
1839         ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_RESTART, 0,
1840                                              new_asoc->c.sinit_num_ostreams,
1841                                              new_asoc->c.sinit_max_instreams,
1842                                              NULL, GFP_ATOMIC);
1843         if (!ev)
1844                 goto nomem_ev;
1845
1846         /* Update the content of current association. */
1847         sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
1848         sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
1849         if (sctp_state(asoc, SHUTDOWN_PENDING) &&
1850             (sctp_sstate(asoc->base.sk, CLOSING) ||
1851              sock_flag(asoc->base.sk, SOCK_DEAD))) {
1852                 /* if were currently in SHUTDOWN_PENDING, but the socket
1853                  * has been closed by user, don't transition to ESTABLISHED.
1854                  * Instead trigger SHUTDOWN bundled with COOKIE_ACK.
1855                  */
1856                 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1857                 return sctp_sf_do_9_2_start_shutdown(net, ep, asoc,
1858                                                      SCTP_ST_CHUNK(0), NULL,
1859                                                      commands);
1860         } else {
1861                 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
1862                                 SCTP_STATE(SCTP_STATE_ESTABLISHED));
1863                 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1864         }
1865         return SCTP_DISPOSITION_CONSUME;
1866
1867 nomem_ev:
1868         sctp_chunk_free(repl);
1869 nomem:
1870         return SCTP_DISPOSITION_NOMEM;
1871 }
1872
1873 /* Unexpected COOKIE-ECHO handler for setup collision (Table 2, action 'B')
1874  *
1875  * Section 5.2.4
1876  *   B) In this case, both sides may be attempting to start an association
1877  *      at about the same time but the peer endpoint started its INIT
1878  *      after responding to the local endpoint's INIT
1879  */
1880 /* This case represents an initialization collision.  */
1881 static enum sctp_disposition sctp_sf_do_dupcook_b(
1882                                         struct net *net,
1883                                         const struct sctp_endpoint *ep,
1884                                         const struct sctp_association *asoc,
1885                                         struct sctp_chunk *chunk,
1886                                         struct sctp_cmd_seq *commands,
1887                                         struct sctp_association *new_asoc)
1888 {
1889         struct sctp_init_chunk *peer_init;
1890         struct sctp_chunk *repl;
1891
1892         /* new_asoc is a brand-new association, so these are not yet
1893          * side effects--it is safe to run them here.
1894          */
1895         peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
1896         if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk), peer_init,
1897                                GFP_ATOMIC))
1898                 goto nomem;
1899
1900         if (sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC))
1901                 goto nomem;
1902
1903         if (!sctp_auth_chunk_verify(net, chunk, new_asoc))
1904                 return SCTP_DISPOSITION_DISCARD;
1905
1906         /* Update the content of current association.  */
1907         sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
1908         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
1909                         SCTP_STATE(SCTP_STATE_ESTABLISHED));
1910         SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
1911         sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
1912
1913         repl = sctp_make_cookie_ack(new_asoc, chunk);
1914         if (!repl)
1915                 goto nomem;
1916
1917         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1918
1919         /* RFC 2960 5.1 Normal Establishment of an Association
1920          *
1921          * D) IMPLEMENTATION NOTE: An implementation may choose to
1922          * send the Communication Up notification to the SCTP user
1923          * upon reception of a valid COOKIE ECHO chunk.
1924          *
1925          * Sadly, this needs to be implemented as a side-effect, because
1926          * we are not guaranteed to have set the association id of the real
1927          * association and so these notifications need to be delayed until
1928          * the association id is allocated.
1929          */
1930
1931         sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_CHANGE, SCTP_U8(SCTP_COMM_UP));
1932
1933         /* Sockets API Draft Section 5.3.1.6
1934          * When a peer sends a Adaptation Layer Indication parameter , SCTP
1935          * delivers this notification to inform the application that of the
1936          * peers requested adaptation layer.
1937          *
1938          * This also needs to be done as a side effect for the same reason as
1939          * above.
1940          */
1941         if (asoc->peer.adaptation_ind)
1942                 sctp_add_cmd_sf(commands, SCTP_CMD_ADAPTATION_IND, SCTP_NULL());
1943
1944         if (!asoc->peer.auth_capable)
1945                 sctp_add_cmd_sf(commands, SCTP_CMD_PEER_NO_AUTH, SCTP_NULL());
1946
1947         return SCTP_DISPOSITION_CONSUME;
1948
1949 nomem:
1950         return SCTP_DISPOSITION_NOMEM;
1951 }
1952
1953 /* Unexpected COOKIE-ECHO handler for setup collision (Table 2, action 'C')
1954  *
1955  * Section 5.2.4
1956  *  C) In this case, the local endpoint's cookie has arrived late.
1957  *     Before it arrived, the local endpoint sent an INIT and received an
1958  *     INIT-ACK and finally sent a COOKIE ECHO with the peer's same tag
1959  *     but a new tag of its own.
1960  */
1961 /* This case represents an initialization collision.  */
1962 static enum sctp_disposition sctp_sf_do_dupcook_c(
1963                                         struct net *net,
1964                                         const struct sctp_endpoint *ep,
1965                                         const struct sctp_association *asoc,
1966                                         struct sctp_chunk *chunk,
1967                                         struct sctp_cmd_seq *commands,
1968                                         struct sctp_association *new_asoc)
1969 {
1970         /* The cookie should be silently discarded.
1971          * The endpoint SHOULD NOT change states and should leave
1972          * any timers running.
1973          */
1974         return SCTP_DISPOSITION_DISCARD;
1975 }
1976
1977 /* Unexpected COOKIE-ECHO handler lost chunk (Table 2, action 'D')
1978  *
1979  * Section 5.2.4
1980  *
1981  * D) When both local and remote tags match the endpoint should always
1982  *    enter the ESTABLISHED state, if it has not already done so.
1983  */
1984 /* This case represents an initialization collision.  */
1985 static enum sctp_disposition sctp_sf_do_dupcook_d(
1986                                         struct net *net,
1987                                         const struct sctp_endpoint *ep,
1988                                         const struct sctp_association *asoc,
1989                                         struct sctp_chunk *chunk,
1990                                         struct sctp_cmd_seq *commands,
1991                                         struct sctp_association *new_asoc)
1992 {
1993         struct sctp_ulpevent *ev = NULL, *ai_ev = NULL, *auth_ev = NULL;
1994         struct sctp_chunk *repl;
1995
1996         /* Clarification from Implementor's Guide:
1997          * D) When both local and remote tags match the endpoint should
1998          * enter the ESTABLISHED state, if it is in the COOKIE-ECHOED state.
1999          * It should stop any cookie timer that may be running and send
2000          * a COOKIE ACK.
2001          */
2002
2003         if (!sctp_auth_chunk_verify(net, chunk, asoc))
2004                 return SCTP_DISPOSITION_DISCARD;
2005
2006         /* Don't accidentally move back into established state. */
2007         if (asoc->state < SCTP_STATE_ESTABLISHED) {
2008                 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2009                                 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
2010                 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2011                                 SCTP_STATE(SCTP_STATE_ESTABLISHED));
2012                 SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
2013                 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START,
2014                                 SCTP_NULL());
2015
2016                 /* RFC 2960 5.1 Normal Establishment of an Association
2017                  *
2018                  * D) IMPLEMENTATION NOTE: An implementation may choose
2019                  * to send the Communication Up notification to the
2020                  * SCTP user upon reception of a valid COOKIE
2021                  * ECHO chunk.
2022                  */
2023                 ev = sctp_ulpevent_make_assoc_change(asoc, 0,
2024                                              SCTP_COMM_UP, 0,
2025                                              asoc->c.sinit_num_ostreams,
2026                                              asoc->c.sinit_max_instreams,
2027                                              NULL, GFP_ATOMIC);
2028                 if (!ev)
2029                         goto nomem;
2030
2031                 /* Sockets API Draft Section 5.3.1.6
2032                  * When a peer sends a Adaptation Layer Indication parameter,
2033                  * SCTP delivers this notification to inform the application
2034                  * that of the peers requested adaptation layer.
2035                  */
2036                 if (asoc->peer.adaptation_ind) {
2037                         ai_ev = sctp_ulpevent_make_adaptation_indication(asoc,
2038                                                                  GFP_ATOMIC);
2039                         if (!ai_ev)
2040                                 goto nomem;
2041
2042                 }
2043
2044                 if (!asoc->peer.auth_capable) {
2045                         auth_ev = sctp_ulpevent_make_authkey(asoc, 0,
2046                                                              SCTP_AUTH_NO_AUTH,
2047                                                              GFP_ATOMIC);
2048                         if (!auth_ev)
2049                                 goto nomem;
2050                 }
2051         }
2052
2053         repl = sctp_make_cookie_ack(asoc, chunk);
2054         if (!repl)
2055                 goto nomem;
2056
2057         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
2058
2059         if (ev)
2060                 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
2061                                 SCTP_ULPEVENT(ev));
2062         if (ai_ev)
2063                 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
2064                                         SCTP_ULPEVENT(ai_ev));
2065         if (auth_ev)
2066                 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
2067                                 SCTP_ULPEVENT(auth_ev));
2068
2069         return SCTP_DISPOSITION_CONSUME;
2070
2071 nomem:
2072         if (auth_ev)
2073                 sctp_ulpevent_free(auth_ev);
2074         if (ai_ev)
2075                 sctp_ulpevent_free(ai_ev);
2076         if (ev)
2077                 sctp_ulpevent_free(ev);
2078         return SCTP_DISPOSITION_NOMEM;
2079 }
2080
2081 /*
2082  * Handle a duplicate COOKIE-ECHO.  This usually means a cookie-carrying
2083  * chunk was retransmitted and then delayed in the network.
2084  *
2085  * Section: 5.2.4 Handle a COOKIE ECHO when a TCB exists
2086  *
2087  * Verification Tag: None.  Do cookie validation.
2088  *
2089  * Inputs
2090  * (endpoint, asoc, chunk)
2091  *
2092  * Outputs
2093  * (asoc, reply_msg, msg_up, timers, counters)
2094  *
2095  * The return value is the disposition of the chunk.
2096  */
2097 enum sctp_disposition sctp_sf_do_5_2_4_dupcook(
2098                                         struct net *net,
2099                                         const struct sctp_endpoint *ep,
2100                                         const struct sctp_association *asoc,
2101                                         const union sctp_subtype type,
2102                                         void *arg,
2103                                         struct sctp_cmd_seq *commands)
2104 {
2105         struct sctp_association *new_asoc;
2106         struct sctp_chunk *chunk = arg;
2107         enum sctp_disposition retval;
2108         struct sctp_chunk *err_chk_p;
2109         int error = 0;
2110         char action;
2111
2112         /* Make sure that the chunk has a valid length from the protocol
2113          * perspective.  In this case check to make sure we have at least
2114          * enough for the chunk header.  Cookie length verification is
2115          * done later.
2116          */
2117         if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
2118                 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2119                                                   commands);
2120
2121         /* "Decode" the chunk.  We have no optional parameters so we
2122          * are in good shape.
2123          */
2124         chunk->subh.cookie_hdr = (struct sctp_signed_cookie *)chunk->skb->data;
2125         if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
2126                                         sizeof(struct sctp_chunkhdr)))
2127                 goto nomem;
2128
2129         /* In RFC 2960 5.2.4 3, if both Verification Tags in the State Cookie
2130          * of a duplicate COOKIE ECHO match the Verification Tags of the
2131          * current association, consider the State Cookie valid even if
2132          * the lifespan is exceeded.
2133          */
2134         new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, &error,
2135                                       &err_chk_p);
2136
2137         /* FIXME:
2138          * If the re-build failed, what is the proper error path
2139          * from here?
2140          *
2141          * [We should abort the association. --piggy]
2142          */
2143         if (!new_asoc) {
2144                 /* FIXME: Several errors are possible.  A bad cookie should
2145                  * be silently discarded, but think about logging it too.
2146                  */
2147                 switch (error) {
2148                 case -SCTP_IERROR_NOMEM:
2149                         goto nomem;
2150
2151                 case -SCTP_IERROR_STALE_COOKIE:
2152                         sctp_send_stale_cookie_err(net, ep, asoc, chunk, commands,
2153                                                    err_chk_p);
2154                         return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2155                 case -SCTP_IERROR_BAD_SIG:
2156                 default:
2157                         return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2158                 }
2159         }
2160
2161         /* Update socket peer label if first association. */
2162         if (security_sctp_assoc_request((struct sctp_endpoint *)ep,
2163                                         chunk->skb))
2164                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2165
2166         /* Set temp so that it won't be added into hashtable */
2167         new_asoc->temp = 1;
2168
2169         /* Compare the tie_tag in cookie with the verification tag of
2170          * current association.
2171          */
2172         action = sctp_tietags_compare(new_asoc, asoc);
2173
2174         switch (action) {
2175         case 'A': /* Association restart. */
2176                 retval = sctp_sf_do_dupcook_a(net, ep, asoc, chunk, commands,
2177                                               new_asoc);
2178                 break;
2179
2180         case 'B': /* Collision case B. */
2181                 retval = sctp_sf_do_dupcook_b(net, ep, asoc, chunk, commands,
2182                                               new_asoc);
2183                 break;
2184
2185         case 'C': /* Collision case C. */
2186                 retval = sctp_sf_do_dupcook_c(net, ep, asoc, chunk, commands,
2187                                               new_asoc);
2188                 break;
2189
2190         case 'D': /* Collision case D. */
2191                 retval = sctp_sf_do_dupcook_d(net, ep, asoc, chunk, commands,
2192                                               new_asoc);
2193                 break;
2194
2195         default: /* Discard packet for all others. */
2196                 retval = sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2197                 break;
2198         }
2199
2200         /* Delete the tempory new association. */
2201         sctp_add_cmd_sf(commands, SCTP_CMD_SET_ASOC, SCTP_ASOC(new_asoc));
2202         sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
2203
2204         /* Restore association pointer to provide SCTP command interpeter
2205          * with a valid context in case it needs to manipulate
2206          * the queues */
2207         sctp_add_cmd_sf(commands, SCTP_CMD_SET_ASOC,
2208                          SCTP_ASOC((struct sctp_association *)asoc));
2209
2210         return retval;
2211
2212 nomem:
2213         return SCTP_DISPOSITION_NOMEM;
2214 }
2215
2216 /*
2217  * Process an ABORT.  (SHUTDOWN-PENDING state)
2218  *
2219  * See sctp_sf_do_9_1_abort().
2220  */
2221 enum sctp_disposition sctp_sf_shutdown_pending_abort(
2222                                         struct net *net,
2223                                         const struct sctp_endpoint *ep,
2224                                         const struct sctp_association *asoc,
2225                                         const union sctp_subtype type,
2226                                         void *arg,
2227                                         struct sctp_cmd_seq *commands)
2228 {
2229         struct sctp_chunk *chunk = arg;
2230
2231         if (!sctp_vtag_verify_either(chunk, asoc))
2232                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2233
2234         /* Make sure that the ABORT chunk has a valid length.
2235          * Since this is an ABORT chunk, we have to discard it
2236          * because of the following text:
2237          * RFC 2960, Section 3.3.7
2238          *    If an endpoint receives an ABORT with a format error or for an
2239          *    association that doesn't exist, it MUST silently discard it.
2240          * Because the length is "invalid", we can't really discard just
2241          * as we do not know its true length.  So, to be safe, discard the
2242          * packet.
2243          */
2244         if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_abort_chunk)))
2245                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2246
2247         /* ADD-IP: Special case for ABORT chunks
2248          * F4)  One special consideration is that ABORT Chunks arriving
2249          * destined to the IP address being deleted MUST be
2250          * ignored (see Section 5.3.1 for further details).
2251          */
2252         if (SCTP_ADDR_DEL ==
2253                     sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2254                 return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
2255
2256         return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
2257 }
2258
2259 /*
2260  * Process an ABORT.  (SHUTDOWN-SENT state)
2261  *
2262  * See sctp_sf_do_9_1_abort().
2263  */
2264 enum sctp_disposition sctp_sf_shutdown_sent_abort(
2265                                         struct net *net,
2266                                         const struct sctp_endpoint *ep,
2267                                         const struct sctp_association *asoc,
2268                                         const union sctp_subtype type,
2269                                         void *arg,
2270                                         struct sctp_cmd_seq *commands)
2271 {
2272         struct sctp_chunk *chunk = arg;
2273
2274         if (!sctp_vtag_verify_either(chunk, asoc))
2275                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2276
2277         /* Make sure that the ABORT chunk has a valid length.
2278          * Since this is an ABORT chunk, we have to discard it
2279          * because of the following text:
2280          * RFC 2960, Section 3.3.7
2281          *    If an endpoint receives an ABORT with a format error or for an
2282          *    association that doesn't exist, it MUST silently discard it.
2283          * Because the length is "invalid", we can't really discard just
2284          * as we do not know its true length.  So, to be safe, discard the
2285          * packet.
2286          */
2287         if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_abort_chunk)))
2288                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2289
2290         /* ADD-IP: Special case for ABORT chunks
2291          * F4)  One special consideration is that ABORT Chunks arriving
2292          * destined to the IP address being deleted MUST be
2293          * ignored (see Section 5.3.1 for further details).
2294          */
2295         if (SCTP_ADDR_DEL ==
2296                     sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2297                 return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
2298
2299         /* Stop the T2-shutdown timer. */
2300         sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2301                         SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
2302
2303         /* Stop the T5-shutdown guard timer.  */
2304         sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2305                         SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
2306
2307         return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
2308 }
2309
2310 /*
2311  * Process an ABORT.  (SHUTDOWN-ACK-SENT state)
2312  *
2313  * See sctp_sf_do_9_1_abort().
2314  */
2315 enum sctp_disposition sctp_sf_shutdown_ack_sent_abort(
2316                                         struct net *net,
2317                                         const struct sctp_endpoint *ep,
2318                                         const struct sctp_association *asoc,
2319                                         const union sctp_subtype type,
2320                                         void *arg,
2321                                         struct sctp_cmd_seq *commands)
2322 {
2323         /* The same T2 timer, so we should be able to use
2324          * common function with the SHUTDOWN-SENT state.
2325          */
2326         return sctp_sf_shutdown_sent_abort(net, ep, asoc, type, arg, commands);
2327 }
2328
2329 /*
2330  * Handle an Error received in COOKIE_ECHOED state.
2331  *
2332  * Only handle the error type of stale COOKIE Error, the other errors will
2333  * be ignored.
2334  *
2335  * Inputs
2336  * (endpoint, asoc, chunk)
2337  *
2338  * Outputs
2339  * (asoc, reply_msg, msg_up, timers, counters)
2340  *
2341  * The return value is the disposition of the chunk.
2342  */
2343 enum sctp_disposition sctp_sf_cookie_echoed_err(
2344                                         struct net *net,
2345                                         const struct sctp_endpoint *ep,
2346                                         const struct sctp_association *asoc,
2347                                         const union sctp_subtype type,
2348                                         void *arg,
2349                                         struct sctp_cmd_seq *commands)
2350 {
2351         struct sctp_chunk *chunk = arg;
2352         struct sctp_errhdr *err;
2353
2354         if (!sctp_vtag_verify(chunk, asoc))
2355                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2356
2357         /* Make sure that the ERROR chunk has a valid length.
2358          * The parameter walking depends on this as well.
2359          */
2360         if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_operr_chunk)))
2361                 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2362                                                   commands);
2363
2364         /* Process the error here */
2365         /* FUTURE FIXME:  When PR-SCTP related and other optional
2366          * parms are emitted, this will have to change to handle multiple
2367          * errors.
2368          */
2369         sctp_walk_errors(err, chunk->chunk_hdr) {
2370                 if (SCTP_ERROR_STALE_COOKIE == err->cause)
2371                         return sctp_sf_do_5_2_6_stale(net, ep, asoc, type,
2372                                                         arg, commands);
2373         }
2374
2375         /* It is possible to have malformed error causes, and that
2376          * will cause us to end the walk early.  However, since
2377          * we are discarding the packet, there should be no adverse
2378          * affects.
2379          */
2380         return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2381 }
2382
2383 /*
2384  * Handle a Stale COOKIE Error
2385  *
2386  * Section: 5.2.6 Handle Stale COOKIE Error
2387  * If the association is in the COOKIE-ECHOED state, the endpoint may elect
2388  * one of the following three alternatives.
2389  * ...
2390  * 3) Send a new INIT chunk to the endpoint, adding a Cookie
2391  *    Preservative parameter requesting an extension to the lifetime of
2392  *    the State Cookie. When calculating the time extension, an
2393  *    implementation SHOULD use the RTT information measured based on the
2394  *    previous COOKIE ECHO / ERROR exchange, and should add no more
2395  *    than 1 second beyond the measured RTT, due to long State Cookie
2396  *    lifetimes making the endpoint more subject to a replay attack.
2397  *
2398  * Verification Tag:  Not explicit, but safe to ignore.
2399  *
2400  * Inputs
2401  * (endpoint, asoc, chunk)
2402  *
2403  * Outputs
2404  * (asoc, reply_msg, msg_up, timers, counters)
2405  *
2406  * The return value is the disposition of the chunk.
2407  */
2408 static enum sctp_disposition sctp_sf_do_5_2_6_stale(
2409                                         struct net *net,
2410                                         const struct sctp_endpoint *ep,
2411                                         const struct sctp_association *asoc,
2412                                         const union sctp_subtype type,
2413                                         void *arg,
2414                                         struct sctp_cmd_seq *commands)
2415 {
2416         int attempts = asoc->init_err_counter + 1;
2417         struct sctp_chunk *chunk = arg, *reply;
2418         struct sctp_cookie_preserve_param bht;
2419         struct sctp_bind_addr *bp;
2420         struct sctp_errhdr *err;
2421         u32 stale;
2422
2423         if (attempts > asoc->max_init_attempts) {
2424                 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
2425                                 SCTP_ERROR(ETIMEDOUT));
2426                 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
2427                                 SCTP_PERR(SCTP_ERROR_STALE_COOKIE));
2428                 return SCTP_DISPOSITION_DELETE_TCB;
2429         }
2430
2431         err = (struct sctp_errhdr *)(chunk->skb->data);
2432
2433         /* When calculating the time extension, an implementation
2434          * SHOULD use the RTT information measured based on the
2435          * previous COOKIE ECHO / ERROR exchange, and should add no
2436          * more than 1 second beyond the measured RTT, due to long
2437          * State Cookie lifetimes making the endpoint more subject to
2438          * a replay attack.
2439          * Measure of Staleness's unit is usec. (1/1000000 sec)
2440          * Suggested Cookie Life-span Increment's unit is msec.
2441          * (1/1000 sec)
2442          * In general, if you use the suggested cookie life, the value
2443          * found in the field of measure of staleness should be doubled
2444          * to give ample time to retransmit the new cookie and thus
2445          * yield a higher probability of success on the reattempt.
2446          */
2447         stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err)));
2448         stale = (stale * 2) / 1000;
2449
2450         bht.param_hdr.type = SCTP_PARAM_COOKIE_PRESERVATIVE;
2451         bht.param_hdr.length = htons(sizeof(bht));
2452         bht.lifespan_increment = htonl(stale);
2453
2454         /* Build that new INIT chunk.  */
2455         bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
2456         reply = sctp_make_init(asoc, bp, GFP_ATOMIC, sizeof(bht));
2457         if (!reply)
2458                 goto nomem;
2459
2460         sctp_addto_chunk(reply, sizeof(bht), &bht);
2461
2462         /* Clear peer's init_tag cached in assoc as we are sending a new INIT */
2463         sctp_add_cmd_sf(commands, SCTP_CMD_CLEAR_INIT_TAG, SCTP_NULL());
2464
2465         /* Stop pending T3-rtx and heartbeat timers */
2466         sctp_add_cmd_sf(commands, SCTP_CMD_T3_RTX_TIMERS_STOP, SCTP_NULL());
2467         sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
2468
2469         /* Delete non-primary peer ip addresses since we are transitioning
2470          * back to the COOKIE-WAIT state
2471          */
2472         sctp_add_cmd_sf(commands, SCTP_CMD_DEL_NON_PRIMARY, SCTP_NULL());
2473
2474         /* If we've sent any data bundled with COOKIE-ECHO we will need to
2475          * resend
2476          */
2477         sctp_add_cmd_sf(commands, SCTP_CMD_T1_RETRAN,
2478                         SCTP_TRANSPORT(asoc->peer.primary_path));
2479
2480         /* Cast away the const modifier, as we want to just
2481          * rerun it through as a sideffect.
2482          */
2483         sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_INC, SCTP_NULL());
2484
2485         sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2486                         SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
2487         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2488                         SCTP_STATE(SCTP_STATE_COOKIE_WAIT));
2489         sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
2490                         SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
2491
2492         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
2493
2494         return SCTP_DISPOSITION_CONSUME;
2495
2496 nomem:
2497         return SCTP_DISPOSITION_NOMEM;
2498 }
2499
2500 /*
2501  * Process an ABORT.
2502  *
2503  * Section: 9.1
2504  * After checking the Verification Tag, the receiving endpoint shall
2505  * remove the association from its record, and shall report the
2506  * termination to its upper layer.
2507  *
2508  * Verification Tag: 8.5.1 Exceptions in Verification Tag Rules
2509  * B) Rules for packet carrying ABORT:
2510  *
2511  *  - The endpoint shall always fill in the Verification Tag field of the
2512  *    outbound packet with the destination endpoint's tag value if it
2513  *    is known.
2514  *
2515  *  - If the ABORT is sent in response to an OOTB packet, the endpoint
2516  *    MUST follow the procedure described in Section 8.4.
2517  *
2518  *  - The receiver MUST accept the packet if the Verification Tag
2519  *    matches either its own tag, OR the tag of its peer. Otherwise, the
2520  *    receiver MUST silently discard the packet and take no further
2521  *    action.
2522  *
2523  * Inputs
2524  * (endpoint, asoc, chunk)
2525  *
2526  * Outputs
2527  * (asoc, reply_msg, msg_up, timers, counters)
2528  *
2529  * The return value is the disposition of the chunk.
2530  */
2531 enum sctp_disposition sctp_sf_do_9_1_abort(
2532                                         struct net *net,
2533                                         const struct sctp_endpoint *ep,
2534                                         const struct sctp_association *asoc,
2535                                         const union sctp_subtype type,
2536                                         void *arg,
2537                                         struct sctp_cmd_seq *commands)
2538 {
2539         struct sctp_chunk *chunk = arg;
2540
2541         if (!sctp_vtag_verify_either(chunk, asoc))
2542                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2543
2544         /* Make sure that the ABORT chunk has a valid length.
2545          * Since this is an ABORT chunk, we have to discard it
2546          * because of the following text:
2547          * RFC 2960, Section 3.3.7
2548          *    If an endpoint receives an ABORT with a format error or for an
2549          *    association that doesn't exist, it MUST silently discard it.
2550          * Because the length is "invalid", we can't really discard just
2551          * as we do not know its true length.  So, to be safe, discard the
2552          * packet.
2553          */
2554         if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_abort_chunk)))
2555                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2556
2557         /* ADD-IP: Special case for ABORT chunks
2558          * F4)  One special consideration is that ABORT Chunks arriving
2559          * destined to the IP address being deleted MUST be
2560          * ignored (see Section 5.3.1 for further details).
2561          */
2562         if (SCTP_ADDR_DEL ==
2563                     sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
2564                 return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
2565
2566         return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
2567 }
2568
2569 static enum sctp_disposition __sctp_sf_do_9_1_abort(
2570                                         struct net *net,
2571                                         const struct sctp_endpoint *ep,
2572                                         const struct sctp_association *asoc,
2573                                         const union sctp_subtype type,
2574                                         void *arg,
2575                                         struct sctp_cmd_seq *commands)
2576 {
2577         __be16 error = SCTP_ERROR_NO_ERROR;
2578         struct sctp_chunk *chunk = arg;
2579         unsigned int len;
2580
2581         /* See if we have an error cause code in the chunk.  */
2582         len = ntohs(chunk->chunk_hdr->length);
2583         if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr)) {
2584                 struct sctp_errhdr *err;
2585
2586                 sctp_walk_errors(err, chunk->chunk_hdr);
2587                 if ((void *)err != (void *)chunk->chunk_end)
2588                         return sctp_sf_pdiscard(net, ep, asoc, type, arg,
2589                                                 commands);
2590
2591                 error = ((struct sctp_errhdr *)chunk->skb->data)->cause;
2592         }
2593
2594         sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(ECONNRESET));
2595         /* ASSOC_FAILED will DELETE_TCB. */
2596         sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, SCTP_PERR(error));
2597         SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
2598         SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
2599
2600         return SCTP_DISPOSITION_ABORT;
2601 }
2602
2603 /*
2604  * Process an ABORT.  (COOKIE-WAIT state)
2605  *
2606  * See sctp_sf_do_9_1_abort() above.
2607  */
2608 enum sctp_disposition sctp_sf_cookie_wait_abort(
2609                                         struct net *net,
2610                                         const struct sctp_endpoint *ep,
2611                                         const struct sctp_association *asoc,
2612                                         const union sctp_subtype type,
2613                                         void *arg,
2614                                         struct sctp_cmd_seq *commands)
2615 {
2616         __be16 error = SCTP_ERROR_NO_ERROR;
2617         struct sctp_chunk *chunk = arg;
2618         unsigned int len;
2619
2620         if (!sctp_vtag_verify_either(chunk, asoc))
2621                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2622
2623         /* Make sure that the ABORT chunk has a valid length.
2624          * Since this is an ABORT chunk, we have to discard it
2625          * because of the following text:
2626          * RFC 2960, Section 3.3.7
2627          *    If an endpoint receives an ABORT with a format error or for an
2628          *    association that doesn't exist, it MUST silently discard it.
2629          * Because the length is "invalid", we can't really discard just
2630          * as we do not know its true length.  So, to be safe, discard the
2631          * packet.
2632          */
2633         if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_abort_chunk)))
2634                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2635
2636         /* See if we have an error cause code in the chunk.  */
2637         len = ntohs(chunk->chunk_hdr->length);
2638         if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
2639                 error = ((struct sctp_errhdr *)chunk->skb->data)->cause;
2640
2641         return sctp_stop_t1_and_abort(net, commands, error, ECONNREFUSED, asoc,
2642                                       chunk->transport);
2643 }
2644
2645 /*
2646  * Process an incoming ICMP as an ABORT.  (COOKIE-WAIT state)
2647  */
2648 enum sctp_disposition sctp_sf_cookie_wait_icmp_abort(
2649                                         struct net *net,
2650                                         const struct sctp_endpoint *ep,
2651                                         const struct sctp_association *asoc,
2652                                         const union sctp_subtype type,
2653                                         void *arg,
2654                                         struct sctp_cmd_seq *commands)
2655 {
2656         return sctp_stop_t1_and_abort(net, commands, SCTP_ERROR_NO_ERROR,
2657                                       ENOPROTOOPT, asoc,
2658                                       (struct sctp_transport *)arg);
2659 }
2660
2661 /*
2662  * Process an ABORT.  (COOKIE-ECHOED state)
2663  */
2664 enum sctp_disposition sctp_sf_cookie_echoed_abort(
2665                                         struct net *net,
2666                                         const struct sctp_endpoint *ep,
2667                                         const struct sctp_association *asoc,
2668                                         const union sctp_subtype type,
2669                                         void *arg,
2670                                         struct sctp_cmd_seq *commands)
2671 {
2672         /* There is a single T1 timer, so we should be able to use
2673          * common function with the COOKIE-WAIT state.
2674          */
2675         return sctp_sf_cookie_wait_abort(net, ep, asoc, type, arg, commands);
2676 }
2677
2678 /*
2679  * Stop T1 timer and abort association with "INIT failed".
2680  *
2681  * This is common code called by several sctp_sf_*_abort() functions above.
2682  */
2683 static enum sctp_disposition sctp_stop_t1_and_abort(
2684                                         struct net *net,
2685                                         struct sctp_cmd_seq *commands,
2686                                         __be16 error, int sk_err,
2687                                         const struct sctp_association *asoc,
2688                                         struct sctp_transport *transport)
2689 {
2690         pr_debug("%s: ABORT received (INIT)\n", __func__);
2691
2692         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2693                         SCTP_STATE(SCTP_STATE_CLOSED));
2694         SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
2695         sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
2696                         SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
2697         sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(sk_err));
2698         /* CMD_INIT_FAILED will DELETE_TCB. */
2699         sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
2700                         SCTP_PERR(error));
2701
2702         return SCTP_DISPOSITION_ABORT;
2703 }
2704
2705 /*
2706  * sctp_sf_do_9_2_shut
2707  *
2708  * Section: 9.2
2709  * Upon the reception of the SHUTDOWN, the peer endpoint shall
2710  *  - enter the SHUTDOWN-RECEIVED state,
2711  *
2712  *  - stop accepting new data from its SCTP user
2713  *
2714  *  - verify, by checking the Cumulative TSN Ack field of the chunk,
2715  *    that all its outstanding DATA chunks have been received by the
2716  *    SHUTDOWN sender.
2717  *
2718  * Once an endpoint as reached the SHUTDOWN-RECEIVED state it MUST NOT
2719  * send a SHUTDOWN in response to a ULP request. And should discard
2720  * subsequent SHUTDOWN chunks.
2721  *
2722  * If there are still outstanding DATA chunks left, the SHUTDOWN
2723  * receiver shall continue to follow normal data transmission
2724  * procedures defined in Section 6 until all outstanding DATA chunks
2725  * are acknowledged; however, the SHUTDOWN receiver MUST NOT accept
2726  * new data from its SCTP user.
2727  *
2728  * Verification Tag:  8.5 Verification Tag [Normal verification]
2729  *
2730  * Inputs
2731  * (endpoint, asoc, chunk)
2732  *
2733  * Outputs
2734  * (asoc, reply_msg, msg_up, timers, counters)
2735  *
2736  * The return value is the disposition of the chunk.
2737  */
2738 enum sctp_disposition sctp_sf_do_9_2_shutdown(
2739                                         struct net *net,
2740                                         const struct sctp_endpoint *ep,
2741                                         const struct sctp_association *asoc,
2742                                         const union sctp_subtype type,
2743                                         void *arg,
2744                                         struct sctp_cmd_seq *commands)
2745 {
2746         enum sctp_disposition disposition;
2747         struct sctp_chunk *chunk = arg;
2748         struct sctp_shutdownhdr *sdh;
2749         struct sctp_ulpevent *ev;
2750         __u32 ctsn;
2751
2752         if (!sctp_vtag_verify(chunk, asoc))
2753                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2754
2755         /* Make sure that the SHUTDOWN chunk has a valid length. */
2756         if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_shutdown_chunk)))
2757                 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2758                                                   commands);
2759
2760         /* Convert the elaborate header.  */
2761         sdh = (struct sctp_shutdownhdr *)chunk->skb->data;
2762         skb_pull(chunk->skb, sizeof(*sdh));
2763         chunk->subh.shutdown_hdr = sdh;
2764         ctsn = ntohl(sdh->cum_tsn_ack);
2765
2766         if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
2767                 pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn,
2768                          asoc->ctsn_ack_point);
2769
2770                 return SCTP_DISPOSITION_DISCARD;
2771         }
2772
2773         /* If Cumulative TSN Ack beyond the max tsn currently
2774          * send, terminating the association and respond to the
2775          * sender with an ABORT.
2776          */
2777         if (!TSN_lt(ctsn, asoc->next_tsn))
2778                 return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands);
2779
2780         /* API 5.3.1.5 SCTP_SHUTDOWN_EVENT
2781          * When a peer sends a SHUTDOWN, SCTP delivers this notification to
2782          * inform the application that it should cease sending data.
2783          */
2784         ev = sctp_ulpevent_make_shutdown_event(asoc, 0, GFP_ATOMIC);
2785         if (!ev) {
2786                 disposition = SCTP_DISPOSITION_NOMEM;
2787                 goto out;
2788         }
2789         sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
2790
2791         /* Upon the reception of the SHUTDOWN, the peer endpoint shall
2792          *  - enter the SHUTDOWN-RECEIVED state,
2793          *  - stop accepting new data from its SCTP user
2794          *
2795          * [This is implicit in the new state.]
2796          */
2797         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
2798                         SCTP_STATE(SCTP_STATE_SHUTDOWN_RECEIVED));
2799         disposition = SCTP_DISPOSITION_CONSUME;
2800
2801         if (sctp_outq_is_empty(&asoc->outqueue)) {
2802                 disposition = sctp_sf_do_9_2_shutdown_ack(net, ep, asoc, type,
2803                                                           arg, commands);
2804         }
2805
2806         if (SCTP_DISPOSITION_NOMEM == disposition)
2807                 goto out;
2808
2809         /*  - verify, by checking the Cumulative TSN Ack field of the
2810          *    chunk, that all its outstanding DATA chunks have been
2811          *    received by the SHUTDOWN sender.
2812          */
2813         sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_CTSN,
2814                         SCTP_BE32(chunk->subh.shutdown_hdr->cum_tsn_ack));
2815
2816 out:
2817         return disposition;
2818 }
2819
2820 /*
2821  * sctp_sf_do_9_2_shut_ctsn
2822  *
2823  * Once an endpoint has reached the SHUTDOWN-RECEIVED state,
2824  * it MUST NOT send a SHUTDOWN in response to a ULP request.
2825  * The Cumulative TSN Ack of the received SHUTDOWN chunk
2826  * MUST be processed.
2827  */
2828 enum sctp_disposition sctp_sf_do_9_2_shut_ctsn(
2829                                         struct net *net,
2830                                         const struct sctp_endpoint *ep,
2831                                         const struct sctp_association *asoc,
2832                                         const union sctp_subtype type,
2833                                         void *arg,
2834                                         struct sctp_cmd_seq *commands)
2835 {
2836         struct sctp_chunk *chunk = arg;
2837         struct sctp_shutdownhdr *sdh;
2838         __u32 ctsn;
2839
2840         if (!sctp_vtag_verify(chunk, asoc))
2841                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2842
2843         /* Make sure that the SHUTDOWN chunk has a valid length. */
2844         if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_shutdown_chunk)))
2845                 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2846                                                   commands);
2847
2848         sdh = (struct sctp_shutdownhdr *)chunk->skb->data;
2849         ctsn = ntohl(sdh->cum_tsn_ack);
2850
2851         if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
2852                 pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn,
2853                          asoc->ctsn_ack_point);
2854
2855                 return SCTP_DISPOSITION_DISCARD;
2856         }
2857
2858         /* If Cumulative TSN Ack beyond the max tsn currently
2859          * send, terminating the association and respond to the
2860          * sender with an ABORT.
2861          */
2862         if (!TSN_lt(ctsn, asoc->next_tsn))
2863                 return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands);
2864
2865         /* verify, by checking the Cumulative TSN Ack field of the
2866          * chunk, that all its outstanding DATA chunks have been
2867          * received by the SHUTDOWN sender.
2868          */
2869         sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_CTSN,
2870                         SCTP_BE32(sdh->cum_tsn_ack));
2871
2872         return SCTP_DISPOSITION_CONSUME;
2873 }
2874
2875 /* RFC 2960 9.2
2876  * If an endpoint is in SHUTDOWN-ACK-SENT state and receives an INIT chunk
2877  * (e.g., if the SHUTDOWN COMPLETE was lost) with source and destination
2878  * transport addresses (either in the IP addresses or in the INIT chunk)
2879  * that belong to this association, it should discard the INIT chunk and
2880  * retransmit the SHUTDOWN ACK chunk.
2881  */
2882 enum sctp_disposition sctp_sf_do_9_2_reshutack(
2883                                         struct net *net,
2884                                         const struct sctp_endpoint *ep,
2885                                         const struct sctp_association *asoc,
2886                                         const union sctp_subtype type,
2887                                         void *arg,
2888                                         struct sctp_cmd_seq *commands)
2889 {
2890         struct sctp_chunk *chunk = arg;
2891         struct sctp_chunk *reply;
2892
2893         /* Make sure that the chunk has a valid length */
2894         if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
2895                 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2896                                                   commands);
2897
2898         /* Since we are not going to really process this INIT, there
2899          * is no point in verifying chunk boundries.  Just generate
2900          * the SHUTDOWN ACK.
2901          */
2902         reply = sctp_make_shutdown_ack(asoc, chunk);
2903         if (NULL == reply)
2904                 goto nomem;
2905
2906         /* Set the transport for the SHUTDOWN ACK chunk and the timeout for
2907          * the T2-SHUTDOWN timer.
2908          */
2909         sctp_add_cmd_sf(commands, SCTP_CMD_SETUP_T2, SCTP_CHUNK(reply));
2910
2911         /* and restart the T2-shutdown timer. */
2912         sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
2913                         SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
2914
2915         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
2916
2917         return SCTP_DISPOSITION_CONSUME;
2918 nomem:
2919         return SCTP_DISPOSITION_NOMEM;
2920 }
2921
2922 /*
2923  * sctp_sf_do_ecn_cwr
2924  *
2925  * Section:  Appendix A: Explicit Congestion Notification
2926  *
2927  * CWR:
2928  *
2929  * RFC 2481 details a specific bit for a sender to send in the header of
2930  * its next outbound TCP segment to indicate to its peer that it has
2931  * reduced its congestion window.  This is termed the CWR bit.  For
2932  * SCTP the same indication is made by including the CWR chunk.
2933  * This chunk contains one data element, i.e. the TSN number that
2934  * was sent in the ECNE chunk.  This element represents the lowest
2935  * TSN number in the datagram that was originally marked with the
2936  * CE bit.
2937  *
2938  * Verification Tag: 8.5 Verification Tag [Normal verification]
2939  * Inputs
2940  * (endpoint, asoc, chunk)
2941  *
2942  * Outputs
2943  * (asoc, reply_msg, msg_up, timers, counters)
2944  *
2945  * The return value is the disposition of the chunk.
2946  */
2947 enum sctp_disposition sctp_sf_do_ecn_cwr(struct net *net,
2948                                          const struct sctp_endpoint *ep,
2949                                          const struct sctp_association *asoc,
2950                                          const union sctp_subtype type,
2951                                          void *arg,
2952                                          struct sctp_cmd_seq *commands)
2953 {
2954         struct sctp_chunk *chunk = arg;
2955         struct sctp_cwrhdr *cwr;
2956         u32 lowest_tsn;
2957
2958         if (!sctp_vtag_verify(chunk, asoc))
2959                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2960
2961         if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_ecne_chunk)))
2962                 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2963                                                   commands);
2964
2965         cwr = (struct sctp_cwrhdr *)chunk->skb->data;
2966         skb_pull(chunk->skb, sizeof(*cwr));
2967
2968         lowest_tsn = ntohl(cwr->lowest_tsn);
2969
2970         /* Does this CWR ack the last sent congestion notification? */
2971         if (TSN_lte(asoc->last_ecne_tsn, lowest_tsn)) {
2972                 /* Stop sending ECNE. */
2973                 sctp_add_cmd_sf(commands,
2974                                 SCTP_CMD_ECN_CWR,
2975                                 SCTP_U32(lowest_tsn));
2976         }
2977         return SCTP_DISPOSITION_CONSUME;
2978 }
2979
2980 /*
2981  * sctp_sf_do_ecne
2982  *
2983  * Section:  Appendix A: Explicit Congestion Notification
2984  *
2985  * ECN-Echo
2986  *
2987  * RFC 2481 details a specific bit for a receiver to send back in its
2988  * TCP acknowledgements to notify the sender of the Congestion
2989  * Experienced (CE) bit having arrived from the network.  For SCTP this
2990  * same indication is made by including the ECNE chunk.  This chunk
2991  * contains one data element, i.e. the lowest TSN associated with the IP
2992  * datagram marked with the CE bit.....
2993  *
2994  * Verification Tag: 8.5 Verification Tag [Normal verification]
2995  * Inputs
2996  * (endpoint, asoc, chunk)
2997  *
2998  * Outputs
2999  * (asoc, reply_msg, msg_up, timers, counters)
3000  *
3001  * The return value is the disposition of the chunk.
3002  */
3003 enum sctp_disposition sctp_sf_do_ecne(struct net *net,
3004                                       const struct sctp_endpoint *ep,
3005                                       const struct sctp_association *asoc,
3006                                       const union sctp_subtype type,
3007                                       void *arg, struct sctp_cmd_seq *commands)
3008 {
3009         struct sctp_chunk *chunk = arg;
3010         struct sctp_ecnehdr *ecne;
3011
3012         if (!sctp_vtag_verify(chunk, asoc))
3013                 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3014
3015         if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_ecne_chunk)))
3016                 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3017                                                   commands);
3018
3019         ecne = (struct sctp_ecnehdr *)chunk->skb->data;
3020         skb_pull(chunk->skb, sizeof(*ecne));
3021
3022         /* If this is a newer ECNE than the last CWR packet we sent out */
3023         sctp_add_cmd_sf(commands, SCTP_CMD_ECN_ECNE,
3024                         SCTP_U32(ntohl(ecne->lowest_tsn)));
3025
3026         return SCTP_DISPOSITION_CONSUME;
3027 }
3028
3029 /*
3030  * Section: 6.2  Acknowledgement on Reception of DATA Chunks
3031  *
3032  * The SCTP endpoint MUST always acknowledge the reception of each valid
3033  * DATA chunk.
3034  *
3035  * The guidelines on delayed acknowledgement algorithm specified in
3036  * Section 4.2 of [RFC2581] SHOULD be followed. Specifically, an
3037  * acknowledgement SHOULD be generated for at least every second packet
3038  * (not every second DATA chunk) received, and SHOULD be generated within
3039  * 200 ms of the arrival of any unacknowledged DATA chunk. In some
3040 &nbs