blob: 339f7acfdb647b7eca56aa43c2a35e0aa9afb735 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/* SCTP kernel reference Implementation
2 * Copyright (c) 1999-2000 Cisco, Inc.
3 * Copyright (c) 1999-2001 Motorola, Inc.
4 * Copyright (c) 2001-2003 International Business Machines, Corp.
5 * Copyright (c) 2001 Intel Corp.
6 * Copyright (c) 2001 Nokia, Inc.
7 * Copyright (c) 2001 La Monte H.P. Yarroll
8 *
9 * This file is part of the SCTP kernel reference Implementation
10 *
11 * These functions handle all input from the IP layer into SCTP.
12 *
13 * The SCTP reference implementation is free software;
14 * you can redistribute it and/or modify it under the terms of
15 * the GNU General Public License as published by
16 * the Free Software Foundation; either version 2, or (at your option)
17 * any later version.
18 *
19 * The SCTP reference implementation is distributed in the hope that it
20 * will be useful, but WITHOUT ANY WARRANTY; without even the implied
21 * ************************
22 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
23 * See the GNU General Public License for more details.
24 *
25 * You should have received a copy of the GNU General Public License
26 * along with GNU CC; see the file COPYING. If not, write to
27 * the Free Software Foundation, 59 Temple Place - Suite 330,
28 * Boston, MA 02111-1307, USA.
29 *
30 * Please send any bug reports or fixes you make to the
31 * email address(es):
32 * lksctp developers <lksctp-developers@lists.sourceforge.net>
33 *
34 * Or submit a bug report through the following website:
35 * http://www.sf.net/projects/lksctp
36 *
37 * Written or modified by:
38 * La Monte H.P. Yarroll <piggy@acm.org>
39 * Karl Knutson <karl@athena.chicago.il.us>
40 * Xingang Guo <xingang.guo@intel.com>
41 * Jon Grimm <jgrimm@us.ibm.com>
42 * Hui Huang <hui.huang@nokia.com>
43 * Daisy Chang <daisyc@us.ibm.com>
44 * Sridhar Samudrala <sri@us.ibm.com>
45 * Ardelle Fan <ardelle.fan@intel.com>
46 *
47 * Any bugs reported given to us we will try to fix... any fixes shared will
48 * be incorporated into the next SCTP release.
49 */
50
51#include <linux/types.h>
52#include <linux/list.h> /* For struct list_head */
53#include <linux/socket.h>
54#include <linux/ip.h>
55#include <linux/time.h> /* For struct timeval */
56#include <net/ip.h>
57#include <net/icmp.h>
58#include <net/snmp.h>
59#include <net/sock.h>
60#include <net/xfrm.h>
61#include <net/sctp/sctp.h>
62#include <net/sctp/sm.h>
63
64/* Forward declarations for internal helpers. */
65static int sctp_rcv_ootb(struct sk_buff *);
66static struct sctp_association *__sctp_rcv_lookup(struct sk_buff *skb,
67 const union sctp_addr *laddr,
68 const union sctp_addr *paddr,
69 struct sctp_transport **transportp);
70static struct sctp_endpoint *__sctp_rcv_lookup_endpoint(const union sctp_addr *laddr);
71static struct sctp_association *__sctp_lookup_association(
72 const union sctp_addr *local,
73 const union sctp_addr *peer,
74 struct sctp_transport **pt);
75
76
77/* Calculate the SCTP checksum of an SCTP packet. */
78static inline int sctp_rcv_checksum(struct sk_buff *skb)
79{
80 struct sctphdr *sh;
81 __u32 cmp, val;
82 struct sk_buff *list = skb_shinfo(skb)->frag_list;
83
84 sh = (struct sctphdr *) skb->h.raw;
85 cmp = ntohl(sh->checksum);
86
87 val = sctp_start_cksum((__u8 *)sh, skb_headlen(skb));
88
89 for (; list; list = list->next)
90 val = sctp_update_cksum((__u8 *)list->data, skb_headlen(list),
91 val);
92
93 val = sctp_end_cksum(val);
94
95 if (val != cmp) {
96 /* CRC failure, dump it. */
97 SCTP_INC_STATS_BH(SCTP_MIB_CHECKSUMERRORS);
98 return -1;
99 }
100 return 0;
101}
102
103/* The free routine for skbuffs that sctp receives */
104static void sctp_rfree(struct sk_buff *skb)
105{
106 atomic_sub(sizeof(struct sctp_chunk),&skb->sk->sk_rmem_alloc);
107 sock_rfree(skb);
108}
109
110/* The ownership wrapper routine to do receive buffer accounting */
111static void sctp_rcv_set_owner_r(struct sk_buff *skb, struct sock *sk)
112{
113 skb_set_owner_r(skb,sk);
114 skb->destructor = sctp_rfree;
115 atomic_add(sizeof(struct sctp_chunk),&sk->sk_rmem_alloc);
116}
117
118/*
119 * This is the routine which IP calls when receiving an SCTP packet.
120 */
121int sctp_rcv(struct sk_buff *skb)
122{
123 struct sock *sk;
124 struct sctp_association *asoc;
125 struct sctp_endpoint *ep = NULL;
126 struct sctp_ep_common *rcvr;
127 struct sctp_transport *transport = NULL;
128 struct sctp_chunk *chunk;
129 struct sctphdr *sh;
130 union sctp_addr src;
131 union sctp_addr dest;
132 int family;
133 struct sctp_af *af;
134 int ret = 0;
135
136 if (skb->pkt_type!=PACKET_HOST)
137 goto discard_it;
138
139 SCTP_INC_STATS_BH(SCTP_MIB_INSCTPPACKS);
140
141 sh = (struct sctphdr *) skb->h.raw;
142
143 /* Pull up the IP and SCTP headers. */
144 __skb_pull(skb, skb->h.raw - skb->data);
145 if (skb->len < sizeof(struct sctphdr))
146 goto discard_it;
147 if (sctp_rcv_checksum(skb) < 0)
148 goto discard_it;
149
150 skb_pull(skb, sizeof(struct sctphdr));
151
152 /* Make sure we at least have chunk headers worth of data left. */
153 if (skb->len < sizeof(struct sctp_chunkhdr))
154 goto discard_it;
155
156 family = ipver2af(skb->nh.iph->version);
157 af = sctp_get_af_specific(family);
158 if (unlikely(!af))
159 goto discard_it;
160
161 /* Initialize local addresses for lookups. */
162 af->from_skb(&src, skb, 1);
163 af->from_skb(&dest, skb, 0);
164
165 /* If the packet is to or from a non-unicast address,
166 * silently discard the packet.
167 *
168 * This is not clearly defined in the RFC except in section
169 * 8.4 - OOTB handling. However, based on the book "Stream Control
170 * Transmission Protocol" 2.1, "It is important to note that the
171 * IP address of an SCTP transport address must be a routable
172 * unicast address. In other words, IP multicast addresses and
173 * IP broadcast addresses cannot be used in an SCTP transport
174 * address."
175 */
176 if (!af->addr_valid(&src, NULL) || !af->addr_valid(&dest, NULL))
177 goto discard_it;
178
179 asoc = __sctp_rcv_lookup(skb, &src, &dest, &transport);
180
Neil Horman0fd9a652005-06-13 15:11:24 -0700181 if (!asoc)
182 ep = __sctp_rcv_lookup_endpoint(&dest);
183
184 /* Retrieve the common input handling substructure. */
185 rcvr = asoc ? &asoc->base : &ep->base;
186 sk = rcvr->sk;
187
188 /*
189 * If a frame arrives on an interface and the receiving socket is
190 * bound to another interface, via SO_BINDTODEVICE, treat it as OOTB
191 */
192 if (sk->sk_bound_dev_if && (sk->sk_bound_dev_if != af->skb_iif(skb)))
193 {
194 sock_put(sk);
195 if (asoc) {
196 sctp_association_put(asoc);
197 asoc = NULL;
198 } else {
199 sctp_endpoint_put(ep);
200 ep = NULL;
201 }
202 sk = sctp_get_ctl_sock();
203 ep = sctp_sk(sk)->ep;
204 sctp_endpoint_hold(ep);
205 sock_hold(sk);
206 rcvr = &ep->base;
207 }
208
209 if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
210 goto discard_release;
211
Linus Torvalds1da177e2005-04-16 15:20:36 -0700212 /*
213 * RFC 2960, 8.4 - Handle "Out of the blue" Packets.
214 * An SCTP packet is called an "out of the blue" (OOTB)
215 * packet if it is correctly formed, i.e., passed the
216 * receiver's checksum check, but the receiver is not
217 * able to identify the association to which this
218 * packet belongs.
219 */
220 if (!asoc) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700221 if (sctp_rcv_ootb(skb)) {
222 SCTP_INC_STATS_BH(SCTP_MIB_OUTOFBLUES);
223 goto discard_release;
224 }
225 }
226
Linus Torvalds1da177e2005-04-16 15:20:36 -0700227 /* SCTP seems to always need a timestamp right now (FIXME) */
228 if (skb->stamp.tv_sec == 0) {
229 do_gettimeofday(&skb->stamp);
230 sock_enable_timestamp(sk);
231 }
232
233 if (!xfrm_policy_check(sk, XFRM_POLICY_IN, skb, family))
234 goto discard_release;
235
236 ret = sk_filter(sk, skb, 1);
237 if (ret)
238 goto discard_release;
239
240 /* Create an SCTP packet structure. */
241 chunk = sctp_chunkify(skb, asoc, sk);
242 if (!chunk) {
243 ret = -ENOMEM;
244 goto discard_release;
245 }
246
247 sctp_rcv_set_owner_r(skb,sk);
248
249 /* Remember what endpoint is to handle this packet. */
250 chunk->rcvr = rcvr;
251
252 /* Remember the SCTP header. */
253 chunk->sctp_hdr = sh;
254
255 /* Set the source and destination addresses of the incoming chunk. */
256 sctp_init_addrs(chunk, &src, &dest);
257
258 /* Remember where we came from. */
259 chunk->transport = transport;
260
261 /* Acquire access to the sock lock. Note: We are safe from other
262 * bottom halves on this lock, but a user may be in the lock too,
263 * so check if it is busy.
264 */
265 sctp_bh_lock_sock(sk);
266
267 if (sock_owned_by_user(sk))
268 sk_add_backlog(sk, (struct sk_buff *) chunk);
269 else
270 sctp_backlog_rcv(sk, (struct sk_buff *) chunk);
271
272 /* Release the sock and any reference counts we took in the
273 * lookup calls.
274 */
275 sctp_bh_unlock_sock(sk);
276 if (asoc)
277 sctp_association_put(asoc);
278 else
279 sctp_endpoint_put(ep);
280 sock_put(sk);
281 return ret;
282
283discard_it:
284 kfree_skb(skb);
285 return ret;
286
287discard_release:
288 /* Release any structures we may be holding. */
Neil Horman0fd9a652005-06-13 15:11:24 -0700289 sock_put(sk);
290 if (asoc)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700291 sctp_association_put(asoc);
Neil Horman0fd9a652005-06-13 15:11:24 -0700292 else
Linus Torvalds1da177e2005-04-16 15:20:36 -0700293 sctp_endpoint_put(ep);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700294
295 goto discard_it;
296}
297
298/* Handle second half of inbound skb processing. If the sock was busy,
299 * we may have need to delay processing until later when the sock is
300 * released (on the backlog). If not busy, we call this routine
301 * directly from the bottom half.
302 */
303int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
304{
305 struct sctp_chunk *chunk;
306 struct sctp_inq *inqueue;
307
308 /* One day chunk will live inside the skb, but for
309 * now this works.
310 */
311 chunk = (struct sctp_chunk *) skb;
312 inqueue = &chunk->rcvr->inqueue;
313
314 sctp_inq_push(inqueue, chunk);
315 return 0;
316}
317
318/* Handle icmp frag needed error. */
319void sctp_icmp_frag_needed(struct sock *sk, struct sctp_association *asoc,
320 struct sctp_transport *t, __u32 pmtu)
321{
322 if (unlikely(pmtu < SCTP_DEFAULT_MINSEGMENT)) {
323 printk(KERN_WARNING "%s: Reported pmtu %d too low, "
324 "using default minimum of %d\n", __FUNCTION__, pmtu,
325 SCTP_DEFAULT_MINSEGMENT);
326 pmtu = SCTP_DEFAULT_MINSEGMENT;
327 }
328
329 if (!sock_owned_by_user(sk) && t && (t->pmtu != pmtu)) {
330 t->pmtu = pmtu;
331 sctp_assoc_sync_pmtu(asoc);
332 sctp_retransmit(&asoc->outqueue, t, SCTP_RTXR_PMTUD);
333 }
334}
335
336/*
337 * SCTP Implementer's Guide, 2.37 ICMP handling procedures
338 *
339 * ICMP8) If the ICMP code is a "Unrecognized next header type encountered"
340 * or a "Protocol Unreachable" treat this message as an abort
341 * with the T bit set.
342 *
343 * This function sends an event to the state machine, which will abort the
344 * association.
345 *
346 */
347void sctp_icmp_proto_unreachable(struct sock *sk,
348 struct sctp_endpoint *ep,
349 struct sctp_association *asoc,
350 struct sctp_transport *t)
351{
352 SCTP_DEBUG_PRINTK("%s\n", __FUNCTION__);
353
354 sctp_do_sm(SCTP_EVENT_T_OTHER,
355 SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
Frank Filz3f7a87d2005-06-20 13:14:57 -0700356 asoc->state, asoc->ep, asoc, t,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700357 GFP_ATOMIC);
358
359}
360
361/* Common lookup code for icmp/icmpv6 error handler. */
362struct sock *sctp_err_lookup(int family, struct sk_buff *skb,
363 struct sctphdr *sctphdr,
364 struct sctp_endpoint **epp,
365 struct sctp_association **app,
366 struct sctp_transport **tpp)
367{
368 union sctp_addr saddr;
369 union sctp_addr daddr;
370 struct sctp_af *af;
371 struct sock *sk = NULL;
372 struct sctp_endpoint *ep = NULL;
373 struct sctp_association *asoc = NULL;
374 struct sctp_transport *transport = NULL;
375
376 *app = NULL; *epp = NULL; *tpp = NULL;
377
378 af = sctp_get_af_specific(family);
379 if (unlikely(!af)) {
380 return NULL;
381 }
382
383 /* Initialize local addresses for lookups. */
384 af->from_skb(&saddr, skb, 1);
385 af->from_skb(&daddr, skb, 0);
386
387 /* Look for an association that matches the incoming ICMP error
388 * packet.
389 */
390 asoc = __sctp_lookup_association(&saddr, &daddr, &transport);
391 if (!asoc) {
392 /* If there is no matching association, see if it matches any
393 * endpoint. This may happen for an ICMP error generated in
394 * response to an INIT_ACK.
395 */
396 ep = __sctp_rcv_lookup_endpoint(&daddr);
397 if (!ep) {
398 return NULL;
399 }
400 }
401
402 if (asoc) {
403 sk = asoc->base.sk;
404
405 if (ntohl(sctphdr->vtag) != asoc->c.peer_vtag) {
406 ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
407 goto out;
408 }
409 } else
410 sk = ep->base.sk;
411
412 sctp_bh_lock_sock(sk);
413
414 /* If too many ICMPs get dropped on busy
415 * servers this needs to be solved differently.
416 */
417 if (sock_owned_by_user(sk))
418 NET_INC_STATS_BH(LINUX_MIB_LOCKDROPPEDICMPS);
419
420 *epp = ep;
421 *app = asoc;
422 *tpp = transport;
423 return sk;
424
425out:
426 sock_put(sk);
427 if (asoc)
428 sctp_association_put(asoc);
429 if (ep)
430 sctp_endpoint_put(ep);
431 return NULL;
432}
433
434/* Common cleanup code for icmp/icmpv6 error handler. */
435void sctp_err_finish(struct sock *sk, struct sctp_endpoint *ep,
436 struct sctp_association *asoc)
437{
438 sctp_bh_unlock_sock(sk);
439 sock_put(sk);
440 if (asoc)
441 sctp_association_put(asoc);
442 if (ep)
443 sctp_endpoint_put(ep);
444}
445
446/*
447 * This routine is called by the ICMP module when it gets some
448 * sort of error condition. If err < 0 then the socket should
449 * be closed and the error returned to the user. If err > 0
450 * it's just the icmp type << 8 | icmp code. After adjustment
451 * header points to the first 8 bytes of the sctp header. We need
452 * to find the appropriate port.
453 *
454 * The locking strategy used here is very "optimistic". When
455 * someone else accesses the socket the ICMP is just dropped
456 * and for some paths there is no check at all.
457 * A more general error queue to queue errors for later handling
458 * is probably better.
459 *
460 */
461void sctp_v4_err(struct sk_buff *skb, __u32 info)
462{
463 struct iphdr *iph = (struct iphdr *)skb->data;
464 struct sctphdr *sh = (struct sctphdr *)(skb->data + (iph->ihl <<2));
465 int type = skb->h.icmph->type;
466 int code = skb->h.icmph->code;
467 struct sock *sk;
468 struct sctp_endpoint *ep;
469 struct sctp_association *asoc;
470 struct sctp_transport *transport;
471 struct inet_sock *inet;
472 char *saveip, *savesctp;
473 int err;
474
475 if (skb->len < ((iph->ihl << 2) + 8)) {
476 ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
477 return;
478 }
479
480 /* Fix up skb to look at the embedded net header. */
481 saveip = skb->nh.raw;
482 savesctp = skb->h.raw;
483 skb->nh.iph = iph;
484 skb->h.raw = (char *)sh;
485 sk = sctp_err_lookup(AF_INET, skb, sh, &ep, &asoc, &transport);
486 /* Put back, the original pointers. */
487 skb->nh.raw = saveip;
488 skb->h.raw = savesctp;
489 if (!sk) {
490 ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
491 return;
492 }
493 /* Warning: The sock lock is held. Remember to call
494 * sctp_err_finish!
495 */
496
497 switch (type) {
498 case ICMP_PARAMETERPROB:
499 err = EPROTO;
500 break;
501 case ICMP_DEST_UNREACH:
502 if (code > NR_ICMP_UNREACH)
503 goto out_unlock;
504
505 /* PMTU discovery (RFC1191) */
506 if (ICMP_FRAG_NEEDED == code) {
507 sctp_icmp_frag_needed(sk, asoc, transport, info);
508 goto out_unlock;
509 }
510 else {
511 if (ICMP_PROT_UNREACH == code) {
512 sctp_icmp_proto_unreachable(sk, ep, asoc,
513 transport);
514 goto out_unlock;
515 }
516 }
517 err = icmp_err_convert[code].errno;
518 break;
519 case ICMP_TIME_EXCEEDED:
520 /* Ignore any time exceeded errors due to fragment reassembly
521 * timeouts.
522 */
523 if (ICMP_EXC_FRAGTIME == code)
524 goto out_unlock;
525
526 err = EHOSTUNREACH;
527 break;
528 default:
529 goto out_unlock;
530 }
531
532 inet = inet_sk(sk);
533 if (!sock_owned_by_user(sk) && inet->recverr) {
534 sk->sk_err = err;
535 sk->sk_error_report(sk);
536 } else { /* Only an error on timeout */
537 sk->sk_err_soft = err;
538 }
539
540out_unlock:
541 sctp_err_finish(sk, ep, asoc);
542}
543
544/*
545 * RFC 2960, 8.4 - Handle "Out of the blue" Packets.
546 *
547 * This function scans all the chunks in the OOTB packet to determine if
548 * the packet should be discarded right away. If a response might be needed
549 * for this packet, or, if further processing is possible, the packet will
550 * be queued to a proper inqueue for the next phase of handling.
551 *
552 * Output:
553 * Return 0 - If further processing is needed.
554 * Return 1 - If the packet can be discarded right away.
555 */
556int sctp_rcv_ootb(struct sk_buff *skb)
557{
558 sctp_chunkhdr_t *ch;
559 __u8 *ch_end;
560 sctp_errhdr_t *err;
561
562 ch = (sctp_chunkhdr_t *) skb->data;
563 ch_end = ((__u8 *) ch) + WORD_ROUND(ntohs(ch->length));
564
565 /* Scan through all the chunks in the packet. */
566 while (ch_end > (__u8 *)ch && ch_end < skb->tail) {
567
568 /* RFC 8.4, 2) If the OOTB packet contains an ABORT chunk, the
569 * receiver MUST silently discard the OOTB packet and take no
570 * further action.
571 */
572 if (SCTP_CID_ABORT == ch->type)
573 goto discard;
574
575 /* RFC 8.4, 6) If the packet contains a SHUTDOWN COMPLETE
576 * chunk, the receiver should silently discard the packet
577 * and take no further action.
578 */
579 if (SCTP_CID_SHUTDOWN_COMPLETE == ch->type)
580 goto discard;
581
582 /* RFC 8.4, 7) If the packet contains a "Stale cookie" ERROR
583 * or a COOKIE ACK the SCTP Packet should be silently
584 * discarded.
585 */
586 if (SCTP_CID_COOKIE_ACK == ch->type)
587 goto discard;
588
589 if (SCTP_CID_ERROR == ch->type) {
590 sctp_walk_errors(err, ch) {
591 if (SCTP_ERROR_STALE_COOKIE == err->cause)
592 goto discard;
593 }
594 }
595
596 ch = (sctp_chunkhdr_t *) ch_end;
597 ch_end = ((__u8 *) ch) + WORD_ROUND(ntohs(ch->length));
598 }
599
600 return 0;
601
602discard:
603 return 1;
604}
605
606/* Insert endpoint into the hash table. */
607static void __sctp_hash_endpoint(struct sctp_endpoint *ep)
608{
609 struct sctp_ep_common **epp;
610 struct sctp_ep_common *epb;
611 struct sctp_hashbucket *head;
612
613 epb = &ep->base;
614
615 epb->hashent = sctp_ep_hashfn(epb->bind_addr.port);
616 head = &sctp_ep_hashtable[epb->hashent];
617
618 sctp_write_lock(&head->lock);
619 epp = &head->chain;
620 epb->next = *epp;
621 if (epb->next)
622 (*epp)->pprev = &epb->next;
623 *epp = epb;
624 epb->pprev = epp;
625 sctp_write_unlock(&head->lock);
626}
627
628/* Add an endpoint to the hash. Local BH-safe. */
629void sctp_hash_endpoint(struct sctp_endpoint *ep)
630{
631 sctp_local_bh_disable();
632 __sctp_hash_endpoint(ep);
633 sctp_local_bh_enable();
634}
635
636/* Remove endpoint from the hash table. */
637static void __sctp_unhash_endpoint(struct sctp_endpoint *ep)
638{
639 struct sctp_hashbucket *head;
640 struct sctp_ep_common *epb;
641
642 epb = &ep->base;
643
644 epb->hashent = sctp_ep_hashfn(epb->bind_addr.port);
645
646 head = &sctp_ep_hashtable[epb->hashent];
647
648 sctp_write_lock(&head->lock);
649
650 if (epb->pprev) {
651 if (epb->next)
652 epb->next->pprev = epb->pprev;
653 *epb->pprev = epb->next;
654 epb->pprev = NULL;
655 }
656
657 sctp_write_unlock(&head->lock);
658}
659
660/* Remove endpoint from the hash. Local BH-safe. */
661void sctp_unhash_endpoint(struct sctp_endpoint *ep)
662{
663 sctp_local_bh_disable();
664 __sctp_unhash_endpoint(ep);
665 sctp_local_bh_enable();
666}
667
668/* Look up an endpoint. */
669static struct sctp_endpoint *__sctp_rcv_lookup_endpoint(const union sctp_addr *laddr)
670{
671 struct sctp_hashbucket *head;
672 struct sctp_ep_common *epb;
673 struct sctp_endpoint *ep;
674 int hash;
675
676 hash = sctp_ep_hashfn(laddr->v4.sin_port);
677 head = &sctp_ep_hashtable[hash];
678 read_lock(&head->lock);
679 for (epb = head->chain; epb; epb = epb->next) {
680 ep = sctp_ep(epb);
681 if (sctp_endpoint_is_match(ep, laddr))
682 goto hit;
683 }
684
685 ep = sctp_sk((sctp_get_ctl_sock()))->ep;
686 epb = &ep->base;
687
688hit:
689 sctp_endpoint_hold(ep);
690 sock_hold(epb->sk);
691 read_unlock(&head->lock);
692 return ep;
693}
694
695/* Insert association into the hash table. */
696static void __sctp_hash_established(struct sctp_association *asoc)
697{
698 struct sctp_ep_common **epp;
699 struct sctp_ep_common *epb;
700 struct sctp_hashbucket *head;
701
702 epb = &asoc->base;
703
704 /* Calculate which chain this entry will belong to. */
705 epb->hashent = sctp_assoc_hashfn(epb->bind_addr.port, asoc->peer.port);
706
707 head = &sctp_assoc_hashtable[epb->hashent];
708
709 sctp_write_lock(&head->lock);
710 epp = &head->chain;
711 epb->next = *epp;
712 if (epb->next)
713 (*epp)->pprev = &epb->next;
714 *epp = epb;
715 epb->pprev = epp;
716 sctp_write_unlock(&head->lock);
717}
718
719/* Add an association to the hash. Local BH-safe. */
720void sctp_hash_established(struct sctp_association *asoc)
721{
722 sctp_local_bh_disable();
723 __sctp_hash_established(asoc);
724 sctp_local_bh_enable();
725}
726
727/* Remove association from the hash table. */
728static void __sctp_unhash_established(struct sctp_association *asoc)
729{
730 struct sctp_hashbucket *head;
731 struct sctp_ep_common *epb;
732
733 epb = &asoc->base;
734
735 epb->hashent = sctp_assoc_hashfn(epb->bind_addr.port,
736 asoc->peer.port);
737
738 head = &sctp_assoc_hashtable[epb->hashent];
739
740 sctp_write_lock(&head->lock);
741
742 if (epb->pprev) {
743 if (epb->next)
744 epb->next->pprev = epb->pprev;
745 *epb->pprev = epb->next;
746 epb->pprev = NULL;
747 }
748
749 sctp_write_unlock(&head->lock);
750}
751
752/* Remove association from the hash table. Local BH-safe. */
753void sctp_unhash_established(struct sctp_association *asoc)
754{
755 sctp_local_bh_disable();
756 __sctp_unhash_established(asoc);
757 sctp_local_bh_enable();
758}
759
760/* Look up an association. */
761static struct sctp_association *__sctp_lookup_association(
762 const union sctp_addr *local,
763 const union sctp_addr *peer,
764 struct sctp_transport **pt)
765{
766 struct sctp_hashbucket *head;
767 struct sctp_ep_common *epb;
768 struct sctp_association *asoc;
769 struct sctp_transport *transport;
770 int hash;
771
772 /* Optimize here for direct hit, only listening connections can
773 * have wildcards anyways.
774 */
775 hash = sctp_assoc_hashfn(local->v4.sin_port, peer->v4.sin_port);
776 head = &sctp_assoc_hashtable[hash];
777 read_lock(&head->lock);
778 for (epb = head->chain; epb; epb = epb->next) {
779 asoc = sctp_assoc(epb);
780 transport = sctp_assoc_is_match(asoc, local, peer);
781 if (transport)
782 goto hit;
783 }
784
785 read_unlock(&head->lock);
786
787 return NULL;
788
789hit:
790 *pt = transport;
791 sctp_association_hold(asoc);
792 sock_hold(epb->sk);
793 read_unlock(&head->lock);
794 return asoc;
795}
796
797/* Look up an association. BH-safe. */
798SCTP_STATIC
799struct sctp_association *sctp_lookup_association(const union sctp_addr *laddr,
800 const union sctp_addr *paddr,
801 struct sctp_transport **transportp)
802{
803 struct sctp_association *asoc;
804
805 sctp_local_bh_disable();
806 asoc = __sctp_lookup_association(laddr, paddr, transportp);
807 sctp_local_bh_enable();
808
809 return asoc;
810}
811
812/* Is there an association matching the given local and peer addresses? */
813int sctp_has_association(const union sctp_addr *laddr,
814 const union sctp_addr *paddr)
815{
816 struct sctp_association *asoc;
817 struct sctp_transport *transport;
818
819 if ((asoc = sctp_lookup_association(laddr, paddr, &transport))) {
820 sock_put(asoc->base.sk);
821 sctp_association_put(asoc);
822 return 1;
823 }
824
825 return 0;
826}
827
828/*
829 * SCTP Implementors Guide, 2.18 Handling of address
830 * parameters within the INIT or INIT-ACK.
831 *
832 * D) When searching for a matching TCB upon reception of an INIT
833 * or INIT-ACK chunk the receiver SHOULD use not only the
834 * source address of the packet (containing the INIT or
835 * INIT-ACK) but the receiver SHOULD also use all valid
836 * address parameters contained within the chunk.
837 *
838 * 2.18.3 Solution description
839 *
840 * This new text clearly specifies to an implementor the need
841 * to look within the INIT or INIT-ACK. Any implementation that
842 * does not do this, may not be able to establish associations
843 * in certain circumstances.
844 *
845 */
846static struct sctp_association *__sctp_rcv_init_lookup(struct sk_buff *skb,
847 const union sctp_addr *laddr, struct sctp_transport **transportp)
848{
849 struct sctp_association *asoc;
850 union sctp_addr addr;
851 union sctp_addr *paddr = &addr;
852 struct sctphdr *sh = (struct sctphdr *) skb->h.raw;
853 sctp_chunkhdr_t *ch;
854 union sctp_params params;
855 sctp_init_chunk_t *init;
856 struct sctp_transport *transport;
857 struct sctp_af *af;
858
859 ch = (sctp_chunkhdr_t *) skb->data;
860
861 /* If this is INIT/INIT-ACK look inside the chunk too. */
862 switch (ch->type) {
863 case SCTP_CID_INIT:
864 case SCTP_CID_INIT_ACK:
865 break;
866 default:
867 return NULL;
868 }
869
870 /* The code below will attempt to walk the chunk and extract
871 * parameter information. Before we do that, we need to verify
872 * that the chunk length doesn't cause overflow. Otherwise, we'll
873 * walk off the end.
874 */
875 if (WORD_ROUND(ntohs(ch->length)) > skb->len)
876 return NULL;
877
878 /*
879 * This code will NOT touch anything inside the chunk--it is
880 * strictly READ-ONLY.
881 *
882 * RFC 2960 3 SCTP packet Format
883 *
884 * Multiple chunks can be bundled into one SCTP packet up to
885 * the MTU size, except for the INIT, INIT ACK, and SHUTDOWN
886 * COMPLETE chunks. These chunks MUST NOT be bundled with any
887 * other chunk in a packet. See Section 6.10 for more details
888 * on chunk bundling.
889 */
890
891 /* Find the start of the TLVs and the end of the chunk. This is
892 * the region we search for address parameters.
893 */
894 init = (sctp_init_chunk_t *)skb->data;
895
896 /* Walk the parameters looking for embedded addresses. */
897 sctp_walk_params(params, init, init_hdr.params) {
898
899 /* Note: Ignoring hostname addresses. */
900 af = sctp_get_af_specific(param_type2af(params.p->type));
901 if (!af)
902 continue;
903
904 af->from_addr_param(paddr, params.addr, ntohs(sh->source), 0);
905
906 asoc = __sctp_lookup_association(laddr, paddr, &transport);
907 if (asoc)
908 return asoc;
909 }
910
911 return NULL;
912}
913
914/* Lookup an association for an inbound skb. */
915static struct sctp_association *__sctp_rcv_lookup(struct sk_buff *skb,
916 const union sctp_addr *paddr,
917 const union sctp_addr *laddr,
918 struct sctp_transport **transportp)
919{
920 struct sctp_association *asoc;
921
922 asoc = __sctp_lookup_association(laddr, paddr, transportp);
923
924 /* Further lookup for INIT/INIT-ACK packets.
925 * SCTP Implementors Guide, 2.18 Handling of address
926 * parameters within the INIT or INIT-ACK.
927 */
928 if (!asoc)
929 asoc = __sctp_rcv_init_lookup(skb, laddr, transportp);
930
931 return asoc;
932}