1 /* SCTP kernel reference Implementation
2 * (C) Copyright IBM Corp. 2001, 2004
3 * Copyright (c) 1999-2000 Cisco, Inc.
4 * Copyright (c) 1999-2001 Motorola, Inc.
5 * Copyright (c) 2001-2002 Intel Corp.
6 * Copyright (c) 2002 Nokia Corp.
8 * This file is part of the SCTP kernel reference Implementation
10 * This is part of the SCTP Linux Kernel Reference Implementation.
12 * These are the state functions for the state machine.
14 * The SCTP reference implementation is free software;
15 * you can redistribute it and/or modify it under the terms of
16 * the GNU General Public License as published by
17 * the Free Software Foundation; either version 2, or (at your option)
20 * The SCTP reference implementation is distributed in the hope that it
21 * will be useful, but WITHOUT ANY WARRANTY; without even the implied
22 * ************************
23 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
24 * See the GNU General Public License for more details.
26 * You should have received a copy of the GNU General Public License
27 * along with GNU CC; see the file COPYING. If not, write to
28 * the Free Software Foundation, 59 Temple Place - Suite 330,
29 * Boston, MA 02111-1307, USA.
31 * Please send any bug reports or fixes you make to the
33 * lksctp developers <lksctp-developers@lists.sourceforge.net>
35 * Or submit a bug report through the following website:
36 * http://www.sf.net/projects/lksctp
38 * Written or modified by:
39 * La Monte H.P. Yarroll <piggy@acm.org>
40 * Karl Knutson <karl@athena.chicago.il.us>
41 * Mathew Kotowsky <kotowsky@sctp.org>
42 * Sridhar Samudrala <samudrala@us.ibm.com>
43 * Jon Grimm <jgrimm@us.ibm.com>
44 * Hui Huang <hui.huang@nokia.com>
45 * Dajiang Zhang <dajiang.zhang@nokia.com>
46 * Daisy Chang <daisyc@us.ibm.com>
47 * Ardelle Fan <ardelle.fan@intel.com>
48 * Ryan Layer <rmlayer@us.ibm.com>
49 * Kevin Gao <kevin.gao@intel.com>
51 * Any bugs reported given to us we will try to fix... any fixes shared will
52 * be incorporated into the next SCTP release.
55 #include <linux/types.h>
56 #include <linux/kernel.h>
58 #include <linux/ipv6.h>
59 #include <linux/net.h>
60 #include <linux/inet.h>
62 #include <net/inet_ecn.h>
63 #include <linux/skbuff.h>
64 #include <net/sctp/sctp.h>
65 #include <net/sctp/sm.h>
66 #include <net/sctp/structs.h>
68 static struct sctp_packet
*sctp_abort_pkt_new(const struct sctp_endpoint
*ep
,
69 const struct sctp_association
*asoc
,
70 struct sctp_chunk
*chunk
,
73 static int sctp_eat_data(const struct sctp_association
*asoc
,
74 struct sctp_chunk
*chunk
,
75 sctp_cmd_seq_t
*commands
);
76 static struct sctp_packet
*sctp_ootb_pkt_new(const struct sctp_association
*asoc
,
77 const struct sctp_chunk
*chunk
);
78 static void sctp_send_stale_cookie_err(const struct sctp_endpoint
*ep
,
79 const struct sctp_association
*asoc
,
80 const struct sctp_chunk
*chunk
,
81 sctp_cmd_seq_t
*commands
,
82 struct sctp_chunk
*err_chunk
);
83 static sctp_disposition_t
sctp_sf_do_5_2_6_stale(const struct sctp_endpoint
*ep
,
84 const struct sctp_association
*asoc
,
85 const sctp_subtype_t type
,
87 sctp_cmd_seq_t
*commands
);
88 static sctp_disposition_t
sctp_sf_shut_8_4_5(const struct sctp_endpoint
*ep
,
89 const struct sctp_association
*asoc
,
90 const sctp_subtype_t type
,
92 sctp_cmd_seq_t
*commands
);
93 static struct sctp_sackhdr
*sctp_sm_pull_sack(struct sctp_chunk
*chunk
);
96 /* Small helper function that checks if the chunk length
97 * is of the appropriate length. The 'required_length' argument
98 * is set to be the size of a specific chunk we are testing.
99 * Return Values: 1 = Valid length
104 sctp_chunk_length_valid(struct sctp_chunk
*chunk
,
105 __u16 required_length
)
107 __u16 chunk_length
= ntohs(chunk
->chunk_hdr
->length
);
109 if (unlikely(chunk_length
< required_length
))
115 /**********************************************************
116 * These are the state functions for handling chunk events.
117 **********************************************************/
120 * Process the final SHUTDOWN COMPLETE.
122 * Section: 4 (C) (diagram), 9.2
123 * Upon reception of the SHUTDOWN COMPLETE chunk the endpoint will verify
124 * that it is in SHUTDOWN-ACK-SENT state, if it is not the chunk should be
125 * discarded. If the endpoint is in the SHUTDOWN-ACK-SENT state the endpoint
126 * should stop the T2-shutdown timer and remove all knowledge of the
127 * association (and thus the association enters the CLOSED state).
129 * Verification Tag: 8.5.1(C)
130 * C) Rules for packet carrying SHUTDOWN COMPLETE:
132 * - The receiver of a SHUTDOWN COMPLETE shall accept the packet if the
133 * Verification Tag field of the packet matches its own tag OR it is
134 * set to its peer's tag and the T bit is set in the Chunk Flags.
135 * Otherwise, the receiver MUST silently discard the packet and take
136 * no further action. An endpoint MUST ignore the SHUTDOWN COMPLETE if
137 * it is not in the SHUTDOWN-ACK-SENT state.
140 * (endpoint, asoc, chunk)
143 * (asoc, reply_msg, msg_up, timers, counters)
145 * The return value is the disposition of the chunk.
147 sctp_disposition_t
sctp_sf_do_4_C(const struct sctp_endpoint
*ep
,
148 const struct sctp_association
*asoc
,
149 const sctp_subtype_t type
,
151 sctp_cmd_seq_t
*commands
)
153 struct sctp_chunk
*chunk
= arg
;
154 struct sctp_ulpevent
*ev
;
156 /* RFC 2960 6.10 Bundling
158 * An endpoint MUST NOT bundle INIT, INIT ACK or
159 * SHUTDOWN COMPLETE with any other chunks.
161 if (!chunk
->singleton
)
162 return SCTP_DISPOSITION_VIOLATION
;
164 if (!sctp_vtag_verify_either(chunk
, asoc
))
165 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
167 /* RFC 2960 10.2 SCTP-to-ULP
169 * H) SHUTDOWN COMPLETE notification
171 * When SCTP completes the shutdown procedures (section 9.2) this
172 * notification is passed to the upper layer.
174 ev
= sctp_ulpevent_make_assoc_change(asoc
, 0, SCTP_SHUTDOWN_COMP
,
175 0, 0, 0, GFP_ATOMIC
);
179 sctp_add_cmd_sf(commands
, SCTP_CMD_EVENT_ULP
, SCTP_ULPEVENT(ev
));
181 /* Upon reception of the SHUTDOWN COMPLETE chunk the endpoint
182 * will verify that it is in SHUTDOWN-ACK-SENT state, if it is
183 * not the chunk should be discarded. If the endpoint is in
184 * the SHUTDOWN-ACK-SENT state the endpoint should stop the
185 * T2-shutdown timer and remove all knowledge of the
186 * association (and thus the association enters the CLOSED
189 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_STOP
,
190 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN
));
192 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_STOP
,
193 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD
));
195 sctp_add_cmd_sf(commands
, SCTP_CMD_NEW_STATE
,
196 SCTP_STATE(SCTP_STATE_CLOSED
));
198 SCTP_INC_STATS(SCTP_MIB_SHUTDOWNS
);
199 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB
);
201 sctp_add_cmd_sf(commands
, SCTP_CMD_DELETE_TCB
, SCTP_NULL());
203 return SCTP_DISPOSITION_DELETE_TCB
;
206 return SCTP_DISPOSITION_NOMEM
;
210 * Respond to a normal INIT chunk.
211 * We are the side that is being asked for an association.
213 * Section: 5.1 Normal Establishment of an Association, B
214 * B) "Z" shall respond immediately with an INIT ACK chunk. The
215 * destination IP address of the INIT ACK MUST be set to the source
216 * IP address of the INIT to which this INIT ACK is responding. In
217 * the response, besides filling in other parameters, "Z" must set the
218 * Verification Tag field to Tag_A, and also provide its own
219 * Verification Tag (Tag_Z) in the Initiate Tag field.
221 * Verification Tag: Must be 0.
224 * (endpoint, asoc, chunk)
227 * (asoc, reply_msg, msg_up, timers, counters)
229 * The return value is the disposition of the chunk.
231 sctp_disposition_t
sctp_sf_do_5_1B_init(const struct sctp_endpoint
*ep
,
232 const struct sctp_association
*asoc
,
233 const sctp_subtype_t type
,
235 sctp_cmd_seq_t
*commands
)
237 struct sctp_chunk
*chunk
= arg
;
238 struct sctp_chunk
*repl
;
239 struct sctp_association
*new_asoc
;
240 struct sctp_chunk
*err_chunk
;
241 struct sctp_packet
*packet
;
242 sctp_unrecognized_param_t
*unk_param
;
247 * An endpoint MUST NOT bundle INIT, INIT ACK or
248 * SHUTDOWN COMPLETE with any other chunks.
251 * Furthermore, we require that the receiver of an INIT chunk MUST
252 * enforce these rules by silently discarding an arriving packet
253 * with an INIT chunk that is bundled with other chunks.
255 if (!chunk
->singleton
)
256 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
258 /* If the packet is an OOTB packet which is temporarily on the
259 * control endpoint, respond with an ABORT.
261 if (ep
== sctp_sk((sctp_get_ctl_sock()))->ep
)
262 return sctp_sf_tabort_8_4_8(ep
, asoc
, type
, arg
, commands
);
265 /* If the endpoint is not listening or if the number of associations
266 * on the TCP-style socket exceed the max backlog, respond with an
269 if (!sctp_sstate(sk
, LISTENING
) ||
270 (sctp_style(sk
, TCP
) &&
271 sk_acceptq_is_full(sk
)))
272 return sctp_sf_tabort_8_4_8(ep
, asoc
, type
, arg
, commands
);
274 /* 3.1 A packet containing an INIT chunk MUST have a zero Verification
277 if (chunk
->sctp_hdr
->vtag
!= 0)
278 return sctp_sf_tabort_8_4_8(ep
, asoc
, type
, arg
, commands
);
280 /* Make sure that the INIT chunk has a valid length.
281 * Normally, this would cause an ABORT with a Protocol Violation
282 * error, but since we don't have an association, we'll
283 * just discard the packet.
285 if (!sctp_chunk_length_valid(chunk
, sizeof(sctp_init_chunk_t
)))
286 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
288 /* Verify the INIT chunk before processing it. */
290 if (!sctp_verify_init(asoc
, chunk
->chunk_hdr
->type
,
291 (sctp_init_chunk_t
*)chunk
->chunk_hdr
, chunk
,
293 /* This chunk contains fatal error. It is to be discarded.
294 * Send an ABORT, with causes if there is any.
297 packet
= sctp_abort_pkt_new(ep
, asoc
, arg
,
298 (__u8
*)(err_chunk
->chunk_hdr
) +
299 sizeof(sctp_chunkhdr_t
),
300 ntohs(err_chunk
->chunk_hdr
->length
) -
301 sizeof(sctp_chunkhdr_t
));
303 sctp_chunk_free(err_chunk
);
306 sctp_add_cmd_sf(commands
, SCTP_CMD_SEND_PKT
,
307 SCTP_PACKET(packet
));
308 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS
);
309 return SCTP_DISPOSITION_CONSUME
;
311 return SCTP_DISPOSITION_NOMEM
;
314 return sctp_sf_tabort_8_4_8(ep
, asoc
, type
, arg
,
319 /* Grab the INIT header. */
320 chunk
->subh
.init_hdr
= (sctp_inithdr_t
*)chunk
->skb
->data
;
322 /* Tag the variable length parameters. */
323 chunk
->param_hdr
.v
= skb_pull(chunk
->skb
, sizeof(sctp_inithdr_t
));
325 new_asoc
= sctp_make_temp_asoc(ep
, chunk
, GFP_ATOMIC
);
329 /* The call, sctp_process_init(), can fail on memory allocation. */
330 if (!sctp_process_init(new_asoc
, chunk
->chunk_hdr
->type
,
332 (sctp_init_chunk_t
*)chunk
->chunk_hdr
,
336 sctp_add_cmd_sf(commands
, SCTP_CMD_NEW_ASOC
, SCTP_ASOC(new_asoc
));
338 /* B) "Z" shall respond immediately with an INIT ACK chunk. */
340 /* If there are errors need to be reported for unknown parameters,
341 * make sure to reserve enough room in the INIT ACK for them.
345 len
= ntohs(err_chunk
->chunk_hdr
->length
) -
346 sizeof(sctp_chunkhdr_t
);
348 if (sctp_assoc_set_bind_addr_from_ep(new_asoc
, GFP_ATOMIC
) < 0)
351 repl
= sctp_make_init_ack(new_asoc
, chunk
, GFP_ATOMIC
, len
);
355 /* If there are errors need to be reported for unknown parameters,
356 * include them in the outgoing INIT ACK as "Unrecognized parameter"
360 /* Get the "Unrecognized parameter" parameter(s) out of the
361 * ERROR chunk generated by sctp_verify_init(). Since the
362 * error cause code for "unknown parameter" and the
363 * "Unrecognized parameter" type is the same, we can
364 * construct the parameters in INIT ACK by copying the
367 unk_param
= (sctp_unrecognized_param_t
*)
368 ((__u8
*)(err_chunk
->chunk_hdr
) +
369 sizeof(sctp_chunkhdr_t
));
370 /* Replace the cause code with the "Unrecognized parameter"
373 sctp_addto_chunk(repl
, len
, unk_param
);
374 sctp_chunk_free(err_chunk
);
377 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
, SCTP_CHUNK(repl
));
380 * Note: After sending out INIT ACK with the State Cookie parameter,
381 * "Z" MUST NOT allocate any resources, nor keep any states for the
382 * new association. Otherwise, "Z" will be vulnerable to resource
385 sctp_add_cmd_sf(commands
, SCTP_CMD_DELETE_TCB
, SCTP_NULL());
387 return SCTP_DISPOSITION_DELETE_TCB
;
391 sctp_chunk_free(err_chunk
);
393 sctp_association_free(new_asoc
);
395 return SCTP_DISPOSITION_NOMEM
;
399 * Respond to a normal INIT ACK chunk.
400 * We are the side that is initiating the association.
402 * Section: 5.1 Normal Establishment of an Association, C
403 * C) Upon reception of the INIT ACK from "Z", "A" shall stop the T1-init
404 * timer and leave COOKIE-WAIT state. "A" shall then send the State
405 * Cookie received in the INIT ACK chunk in a COOKIE ECHO chunk, start
406 * the T1-cookie timer, and enter the COOKIE-ECHOED state.
408 * Note: The COOKIE ECHO chunk can be bundled with any pending outbound
409 * DATA chunks, but it MUST be the first chunk in the packet and
410 * until the COOKIE ACK is returned the sender MUST NOT send any
411 * other packets to the peer.
413 * Verification Tag: 3.3.3
414 * If the value of the Initiate Tag in a received INIT ACK chunk is
415 * found to be 0, the receiver MUST treat it as an error and close the
416 * association by transmitting an ABORT.
419 * (endpoint, asoc, chunk)
422 * (asoc, reply_msg, msg_up, timers, counters)
424 * The return value is the disposition of the chunk.
426 sctp_disposition_t
sctp_sf_do_5_1C_ack(const struct sctp_endpoint
*ep
,
427 const struct sctp_association
*asoc
,
428 const sctp_subtype_t type
,
430 sctp_cmd_seq_t
*commands
)
432 struct sctp_chunk
*chunk
= arg
;
433 sctp_init_chunk_t
*initchunk
;
435 struct sctp_chunk
*err_chunk
;
436 struct sctp_packet
*packet
;
437 sctp_disposition_t ret
;
439 if (!sctp_vtag_verify(chunk
, asoc
))
440 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
442 /* Make sure that the INIT-ACK chunk has a valid length */
443 if (!sctp_chunk_length_valid(chunk
, sizeof(sctp_initack_chunk_t
)))
444 return sctp_sf_violation_chunklen(ep
, asoc
, type
, arg
,
447 * An endpoint MUST NOT bundle INIT, INIT ACK or
448 * SHUTDOWN COMPLETE with any other chunks.
450 if (!chunk
->singleton
)
451 return SCTP_DISPOSITION_VIOLATION
;
453 /* Grab the INIT header. */
454 chunk
->subh
.init_hdr
= (sctp_inithdr_t
*) chunk
->skb
->data
;
456 init_tag
= ntohl(chunk
->subh
.init_hdr
->init_tag
);
458 /* Verification Tag: 3.3.3
459 * If the value of the Initiate Tag in a received INIT ACK
460 * chunk is found to be 0, the receiver MUST treat it as an
461 * error and close the association by transmitting an ABORT.
464 struct sctp_chunk
*reply
= sctp_make_abort(asoc
, chunk
, 0);
468 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
, SCTP_CHUNK(reply
));
469 sctp_add_cmd_sf(commands
, SCTP_CMD_NEW_STATE
,
470 SCTP_STATE(SCTP_STATE_CLOSED
));
471 SCTP_INC_STATS(SCTP_MIB_ABORTEDS
);
472 sctp_add_cmd_sf(commands
, SCTP_CMD_DELETE_TCB
, SCTP_NULL());
473 return SCTP_DISPOSITION_DELETE_TCB
;
476 /* Verify the INIT chunk before processing it. */
478 if (!sctp_verify_init(asoc
, chunk
->chunk_hdr
->type
,
479 (sctp_init_chunk_t
*)chunk
->chunk_hdr
, chunk
,
482 SCTP_INC_STATS(SCTP_MIB_ABORTEDS
);
484 /* This chunk contains fatal error. It is to be discarded.
485 * Send an ABORT, with causes if there is any.
488 packet
= sctp_abort_pkt_new(ep
, asoc
, arg
,
489 (__u8
*)(err_chunk
->chunk_hdr
) +
490 sizeof(sctp_chunkhdr_t
),
491 ntohs(err_chunk
->chunk_hdr
->length
) -
492 sizeof(sctp_chunkhdr_t
));
494 sctp_chunk_free(err_chunk
);
497 sctp_add_cmd_sf(commands
, SCTP_CMD_SEND_PKT
,
498 SCTP_PACKET(packet
));
499 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS
);
500 sctp_add_cmd_sf(commands
, SCTP_CMD_NEW_STATE
,
501 SCTP_STATE(SCTP_STATE_CLOSED
));
502 sctp_add_cmd_sf(commands
, SCTP_CMD_DELETE_TCB
,
504 return SCTP_DISPOSITION_CONSUME
;
506 sctp_add_cmd_sf(commands
, SCTP_CMD_NEW_STATE
,
507 SCTP_STATE(SCTP_STATE_CLOSED
));
508 sctp_add_cmd_sf(commands
, SCTP_CMD_DELETE_TCB
,
510 return SCTP_DISPOSITION_NOMEM
;
513 ret
= sctp_sf_tabort_8_4_8(ep
, asoc
, type
, arg
,
515 sctp_add_cmd_sf(commands
, SCTP_CMD_NEW_STATE
,
516 SCTP_STATE(SCTP_STATE_CLOSED
));
517 sctp_add_cmd_sf(commands
, SCTP_CMD_DELETE_TCB
,
523 /* Tag the variable length parameters. Note that we never
524 * convert the parameters in an INIT chunk.
526 chunk
->param_hdr
.v
= skb_pull(chunk
->skb
, sizeof(sctp_inithdr_t
));
528 initchunk
= (sctp_init_chunk_t
*) chunk
->chunk_hdr
;
530 sctp_add_cmd_sf(commands
, SCTP_CMD_PEER_INIT
,
531 SCTP_PEER_INIT(initchunk
));
533 /* 5.1 C) "A" shall stop the T1-init timer and leave
534 * COOKIE-WAIT state. "A" shall then ... start the T1-cookie
535 * timer, and enter the COOKIE-ECHOED state.
537 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_STOP
,
538 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT
));
539 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_START
,
540 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE
));
541 sctp_add_cmd_sf(commands
, SCTP_CMD_NEW_STATE
,
542 SCTP_STATE(SCTP_STATE_COOKIE_ECHOED
));
544 /* 5.1 C) "A" shall then send the State Cookie received in the
545 * INIT ACK chunk in a COOKIE ECHO chunk, ...
547 /* If there is any errors to report, send the ERROR chunk generated
548 * for unknown parameters as well.
550 sctp_add_cmd_sf(commands
, SCTP_CMD_GEN_COOKIE_ECHO
,
551 SCTP_CHUNK(err_chunk
));
553 return SCTP_DISPOSITION_CONSUME
;
556 return SCTP_DISPOSITION_NOMEM
;
560 * Respond to a normal COOKIE ECHO chunk.
561 * We are the side that is being asked for an association.
563 * Section: 5.1 Normal Establishment of an Association, D
564 * D) Upon reception of the COOKIE ECHO chunk, Endpoint "Z" will reply
565 * with a COOKIE ACK chunk after building a TCB and moving to
566 * the ESTABLISHED state. A COOKIE ACK chunk may be bundled with
567 * any pending DATA chunks (and/or SACK chunks), but the COOKIE ACK
568 * chunk MUST be the first chunk in the packet.
570 * IMPLEMENTATION NOTE: An implementation may choose to send the
571 * Communication Up notification to the SCTP user upon reception
572 * of a valid COOKIE ECHO chunk.
574 * Verification Tag: 8.5.1 Exceptions in Verification Tag Rules
575 * D) Rules for packet carrying a COOKIE ECHO
577 * - When sending a COOKIE ECHO, the endpoint MUST use the value of the
578 * Initial Tag received in the INIT ACK.
580 * - The receiver of a COOKIE ECHO follows the procedures in Section 5.
583 * (endpoint, asoc, chunk)
586 * (asoc, reply_msg, msg_up, timers, counters)
588 * The return value is the disposition of the chunk.
590 sctp_disposition_t
sctp_sf_do_5_1D_ce(const struct sctp_endpoint
*ep
,
591 const struct sctp_association
*asoc
,
592 const sctp_subtype_t type
, void *arg
,
593 sctp_cmd_seq_t
*commands
)
595 struct sctp_chunk
*chunk
= arg
;
596 struct sctp_association
*new_asoc
;
597 sctp_init_chunk_t
*peer_init
;
598 struct sctp_chunk
*repl
;
599 struct sctp_ulpevent
*ev
;
601 struct sctp_chunk
*err_chk_p
;
603 /* If the packet is an OOTB packet which is temporarily on the
604 * control endpoint, respond with an ABORT.
606 if (ep
== sctp_sk((sctp_get_ctl_sock()))->ep
)
607 return sctp_sf_ootb(ep
, asoc
, type
, arg
, commands
);
609 /* Make sure that the COOKIE_ECHO chunk has a valid length.
610 * In this case, we check that we have enough for at least a
611 * chunk header. More detailed verification is done
612 * in sctp_unpack_cookie().
614 if (!sctp_chunk_length_valid(chunk
, sizeof(sctp_chunkhdr_t
)))
615 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
617 /* "Decode" the chunk. We have no optional parameters so we
620 chunk
->subh
.cookie_hdr
=
621 (struct sctp_signed_cookie
*)chunk
->skb
->data
;
623 ntohs(chunk
->chunk_hdr
->length
) - sizeof(sctp_chunkhdr_t
));
625 /* 5.1 D) Upon reception of the COOKIE ECHO chunk, Endpoint
626 * "Z" will reply with a COOKIE ACK chunk after building a TCB
627 * and moving to the ESTABLISHED state.
629 new_asoc
= sctp_unpack_cookie(ep
, asoc
, chunk
, GFP_ATOMIC
, &error
,
633 * If the re-build failed, what is the proper error path
636 * [We should abort the association. --piggy]
639 /* FIXME: Several errors are possible. A bad cookie should
640 * be silently discarded, but think about logging it too.
643 case -SCTP_IERROR_NOMEM
:
646 case -SCTP_IERROR_STALE_COOKIE
:
647 sctp_send_stale_cookie_err(ep
, asoc
, chunk
, commands
,
649 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
651 case -SCTP_IERROR_BAD_SIG
:
653 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
657 sctp_add_cmd_sf(commands
, SCTP_CMD_NEW_ASOC
, SCTP_ASOC(new_asoc
));
658 sctp_add_cmd_sf(commands
, SCTP_CMD_NEW_STATE
,
659 SCTP_STATE(SCTP_STATE_ESTABLISHED
));
660 SCTP_INC_STATS(SCTP_MIB_CURRESTAB
);
661 SCTP_INC_STATS(SCTP_MIB_PASSIVEESTABS
);
662 sctp_add_cmd_sf(commands
, SCTP_CMD_HB_TIMERS_START
, SCTP_NULL());
664 if (new_asoc
->autoclose
)
665 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_START
,
666 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE
));
668 sctp_add_cmd_sf(commands
, SCTP_CMD_TRANSMIT
, SCTP_NULL());
670 /* Re-build the bind address for the association is done in
671 * the sctp_unpack_cookie() already.
673 /* This is a brand-new association, so these are not yet side
674 * effects--it is safe to run them here.
676 peer_init
= &chunk
->subh
.cookie_hdr
->c
.peer_init
[0];
678 if (!sctp_process_init(new_asoc
, chunk
->chunk_hdr
->type
,
679 &chunk
->subh
.cookie_hdr
->c
.peer_addr
,
680 peer_init
, GFP_ATOMIC
))
683 repl
= sctp_make_cookie_ack(new_asoc
, chunk
);
687 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
, SCTP_CHUNK(repl
));
689 /* RFC 2960 5.1 Normal Establishment of an Association
691 * D) IMPLEMENTATION NOTE: An implementation may choose to
692 * send the Communication Up notification to the SCTP user
693 * upon reception of a valid COOKIE ECHO chunk.
695 ev
= sctp_ulpevent_make_assoc_change(new_asoc
, 0, SCTP_COMM_UP
, 0,
696 new_asoc
->c
.sinit_num_ostreams
,
697 new_asoc
->c
.sinit_max_instreams
,
702 sctp_add_cmd_sf(commands
, SCTP_CMD_EVENT_ULP
, SCTP_ULPEVENT(ev
));
704 /* Sockets API Draft Section 5.3.1.6
705 * When a peer sends a Adaption Layer Indication parameter , SCTP
706 * delivers this notification to inform the application that of the
707 * peers requested adaption layer.
709 if (new_asoc
->peer
.adaption_ind
) {
710 ev
= sctp_ulpevent_make_adaption_indication(new_asoc
,
715 sctp_add_cmd_sf(commands
, SCTP_CMD_EVENT_ULP
,
719 return SCTP_DISPOSITION_CONSUME
;
722 sctp_chunk_free(repl
);
725 sctp_association_free(new_asoc
);
727 return SCTP_DISPOSITION_NOMEM
;
731 * Respond to a normal COOKIE ACK chunk.
732 * We are the side that is being asked for an association.
734 * RFC 2960 5.1 Normal Establishment of an Association
736 * E) Upon reception of the COOKIE ACK, endpoint "A" will move from the
737 * COOKIE-ECHOED state to the ESTABLISHED state, stopping the T1-cookie
738 * timer. It may also notify its ULP about the successful
739 * establishment of the association with a Communication Up
740 * notification (see Section 10).
744 * (endpoint, asoc, chunk)
747 * (asoc, reply_msg, msg_up, timers, counters)
749 * The return value is the disposition of the chunk.
751 sctp_disposition_t
sctp_sf_do_5_1E_ca(const struct sctp_endpoint
*ep
,
752 const struct sctp_association
*asoc
,
753 const sctp_subtype_t type
, void *arg
,
754 sctp_cmd_seq_t
*commands
)
756 struct sctp_chunk
*chunk
= arg
;
757 struct sctp_ulpevent
*ev
;
759 if (!sctp_vtag_verify(chunk
, asoc
))
760 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
762 /* Verify that the chunk length for the COOKIE-ACK is OK.
763 * If we don't do this, any bundled chunks may be junked.
765 if (!sctp_chunk_length_valid(chunk
, sizeof(sctp_chunkhdr_t
)))
766 return sctp_sf_violation_chunklen(ep
, asoc
, type
, arg
,
769 /* Reset init error count upon receipt of COOKIE-ACK,
770 * to avoid problems with the managemement of this
771 * counter in stale cookie situations when a transition back
772 * from the COOKIE-ECHOED state to the COOKIE-WAIT
773 * state is performed.
775 sctp_add_cmd_sf(commands
, SCTP_CMD_COUNTER_RESET
,
776 SCTP_COUNTER(SCTP_COUNTER_INIT_ERROR
));
778 /* RFC 2960 5.1 Normal Establishment of an Association
780 * E) Upon reception of the COOKIE ACK, endpoint "A" will move
781 * from the COOKIE-ECHOED state to the ESTABLISHED state,
782 * stopping the T1-cookie timer.
784 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_STOP
,
785 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE
));
786 sctp_add_cmd_sf(commands
, SCTP_CMD_NEW_STATE
,
787 SCTP_STATE(SCTP_STATE_ESTABLISHED
));
788 SCTP_INC_STATS(SCTP_MIB_CURRESTAB
);
789 SCTP_INC_STATS(SCTP_MIB_ACTIVEESTABS
);
790 sctp_add_cmd_sf(commands
, SCTP_CMD_HB_TIMERS_START
, SCTP_NULL());
792 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_START
,
793 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE
));
794 sctp_add_cmd_sf(commands
, SCTP_CMD_TRANSMIT
, SCTP_NULL());
796 /* It may also notify its ULP about the successful
797 * establishment of the association with a Communication Up
798 * notification (see Section 10).
800 ev
= sctp_ulpevent_make_assoc_change(asoc
, 0, SCTP_COMM_UP
,
801 0, asoc
->c
.sinit_num_ostreams
,
802 asoc
->c
.sinit_max_instreams
,
808 sctp_add_cmd_sf(commands
, SCTP_CMD_EVENT_ULP
, SCTP_ULPEVENT(ev
));
810 /* Sockets API Draft Section 5.3.1.6
811 * When a peer sends a Adaption Layer Indication parameter , SCTP
812 * delivers this notification to inform the application that of the
813 * peers requested adaption layer.
815 if (asoc
->peer
.adaption_ind
) {
816 ev
= sctp_ulpevent_make_adaption_indication(asoc
, GFP_ATOMIC
);
820 sctp_add_cmd_sf(commands
, SCTP_CMD_EVENT_ULP
,
824 return SCTP_DISPOSITION_CONSUME
;
826 return SCTP_DISPOSITION_NOMEM
;
829 /* Generate and sendout a heartbeat packet. */
830 static sctp_disposition_t
sctp_sf_heartbeat(const struct sctp_endpoint
*ep
,
831 const struct sctp_association
*asoc
,
832 const sctp_subtype_t type
,
834 sctp_cmd_seq_t
*commands
)
836 struct sctp_transport
*transport
= (struct sctp_transport
*) arg
;
837 struct sctp_chunk
*reply
;
838 sctp_sender_hb_info_t hbinfo
;
841 hbinfo
.param_hdr
.type
= SCTP_PARAM_HEARTBEAT_INFO
;
842 hbinfo
.param_hdr
.length
= htons(sizeof(sctp_sender_hb_info_t
));
843 hbinfo
.daddr
= transport
->ipaddr
;
844 hbinfo
.sent_at
= jiffies
;
846 /* Send a heartbeat to our peer. */
847 paylen
= sizeof(sctp_sender_hb_info_t
);
848 reply
= sctp_make_heartbeat(asoc
, transport
, &hbinfo
, paylen
);
850 return SCTP_DISPOSITION_NOMEM
;
852 /* Set rto_pending indicating that an RTT measurement
853 * is started with this heartbeat chunk.
855 sctp_add_cmd_sf(commands
, SCTP_CMD_RTO_PENDING
,
856 SCTP_TRANSPORT(transport
));
858 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
, SCTP_CHUNK(reply
));
859 return SCTP_DISPOSITION_CONSUME
;
862 /* Generate a HEARTBEAT packet on the given transport. */
863 sctp_disposition_t
sctp_sf_sendbeat_8_3(const struct sctp_endpoint
*ep
,
864 const struct sctp_association
*asoc
,
865 const sctp_subtype_t type
,
867 sctp_cmd_seq_t
*commands
)
869 struct sctp_transport
*transport
= (struct sctp_transport
*) arg
;
871 if (asoc
->overall_error_count
> asoc
->max_retrans
) {
872 /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
873 sctp_add_cmd_sf(commands
, SCTP_CMD_ASSOC_FAILED
,
874 SCTP_U32(SCTP_ERROR_NO_ERROR
));
875 SCTP_INC_STATS(SCTP_MIB_ABORTEDS
);
876 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB
);
877 return SCTP_DISPOSITION_DELETE_TCB
;
881 * The Sender-specific Heartbeat Info field should normally include
882 * information about the sender's current time when this HEARTBEAT
883 * chunk is sent and the destination transport address to which this
884 * HEARTBEAT is sent (see Section 8.3).
887 if (transport
->hb_allowed
) {
888 if (SCTP_DISPOSITION_NOMEM
==
889 sctp_sf_heartbeat(ep
, asoc
, type
, arg
,
891 return SCTP_DISPOSITION_NOMEM
;
892 /* Set transport error counter and association error counter
893 * when sending heartbeat.
895 sctp_add_cmd_sf(commands
, SCTP_CMD_TRANSPORT_RESET
,
896 SCTP_TRANSPORT(transport
));
898 sctp_add_cmd_sf(commands
, SCTP_CMD_HB_TIMER_UPDATE
,
899 SCTP_TRANSPORT(transport
));
901 return SCTP_DISPOSITION_CONSUME
;
905 * Process an heartbeat request.
907 * Section: 8.3 Path Heartbeat
908 * The receiver of the HEARTBEAT should immediately respond with a
909 * HEARTBEAT ACK that contains the Heartbeat Information field copied
910 * from the received HEARTBEAT chunk.
912 * Verification Tag: 8.5 Verification Tag [Normal verification]
913 * When receiving an SCTP packet, the endpoint MUST ensure that the
914 * value in the Verification Tag field of the received SCTP packet
915 * matches its own Tag. If the received Verification Tag value does not
916 * match the receiver's own tag value, the receiver shall silently
917 * discard the packet and shall not process it any further except for
918 * those cases listed in Section 8.5.1 below.
921 * (endpoint, asoc, chunk)
924 * (asoc, reply_msg, msg_up, timers, counters)
926 * The return value is the disposition of the chunk.
928 sctp_disposition_t
sctp_sf_beat_8_3(const struct sctp_endpoint
*ep
,
929 const struct sctp_association
*asoc
,
930 const sctp_subtype_t type
,
932 sctp_cmd_seq_t
*commands
)
934 struct sctp_chunk
*chunk
= arg
;
935 struct sctp_chunk
*reply
;
938 if (!sctp_vtag_verify(chunk
, asoc
))
939 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
941 /* Make sure that the HEARTBEAT chunk has a valid length. */
942 if (!sctp_chunk_length_valid(chunk
, sizeof(sctp_heartbeat_chunk_t
)))
943 return sctp_sf_violation_chunklen(ep
, asoc
, type
, arg
,
946 /* 8.3 The receiver of the HEARTBEAT should immediately
947 * respond with a HEARTBEAT ACK that contains the Heartbeat
948 * Information field copied from the received HEARTBEAT chunk.
950 chunk
->subh
.hb_hdr
= (sctp_heartbeathdr_t
*) chunk
->skb
->data
;
951 paylen
= ntohs(chunk
->chunk_hdr
->length
) - sizeof(sctp_chunkhdr_t
);
952 skb_pull(chunk
->skb
, paylen
);
954 reply
= sctp_make_heartbeat_ack(asoc
, chunk
,
955 chunk
->subh
.hb_hdr
, paylen
);
959 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
, SCTP_CHUNK(reply
));
960 return SCTP_DISPOSITION_CONSUME
;
963 return SCTP_DISPOSITION_NOMEM
;
967 * Process the returning HEARTBEAT ACK.
969 * Section: 8.3 Path Heartbeat
970 * Upon the receipt of the HEARTBEAT ACK, the sender of the HEARTBEAT
971 * should clear the error counter of the destination transport
972 * address to which the HEARTBEAT was sent, and mark the destination
973 * transport address as active if it is not so marked. The endpoint may
974 * optionally report to the upper layer when an inactive destination
975 * address is marked as active due to the reception of the latest
976 * HEARTBEAT ACK. The receiver of the HEARTBEAT ACK must also
977 * clear the association overall error count as well (as defined
980 * The receiver of the HEARTBEAT ACK should also perform an RTT
981 * measurement for that destination transport address using the time
982 * value carried in the HEARTBEAT ACK chunk.
984 * Verification Tag: 8.5 Verification Tag [Normal verification]
987 * (endpoint, asoc, chunk)
990 * (asoc, reply_msg, msg_up, timers, counters)
992 * The return value is the disposition of the chunk.
994 sctp_disposition_t
sctp_sf_backbeat_8_3(const struct sctp_endpoint
*ep
,
995 const struct sctp_association
*asoc
,
996 const sctp_subtype_t type
,
998 sctp_cmd_seq_t
*commands
)
1000 struct sctp_chunk
*chunk
= arg
;
1001 union sctp_addr from_addr
;
1002 struct sctp_transport
*link
;
1003 sctp_sender_hb_info_t
*hbinfo
;
1004 unsigned long max_interval
;
1006 if (!sctp_vtag_verify(chunk
, asoc
))
1007 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
1009 /* Make sure that the HEARTBEAT-ACK chunk has a valid length. */
1010 if (!sctp_chunk_length_valid(chunk
, sizeof(sctp_heartbeat_chunk_t
)))
1011 return sctp_sf_violation_chunklen(ep
, asoc
, type
, arg
,
1014 hbinfo
= (sctp_sender_hb_info_t
*) chunk
->skb
->data
;
1015 from_addr
= hbinfo
->daddr
;
1016 link
= sctp_assoc_lookup_paddr(asoc
, &from_addr
);
1018 /* This should never happen, but lets log it if so. */
1021 "%s: Could not find address %d.%d.%d.%d\n",
1022 __FUNCTION__
, NIPQUAD(from_addr
.v4
.sin_addr
));
1023 return SCTP_DISPOSITION_DISCARD
;
1026 max_interval
= link
->hb_interval
+ link
->rto
;
1028 /* Check if the timestamp looks valid. */
1029 if (time_after(hbinfo
->sent_at
, jiffies
) ||
1030 time_after(jiffies
, hbinfo
->sent_at
+ max_interval
)) {
1031 SCTP_DEBUG_PRINTK("%s: HEARTBEAT ACK with invalid timestamp"
1032 "received for transport: %p\n",
1033 __FUNCTION__
, link
);
1034 return SCTP_DISPOSITION_DISCARD
;
1037 /* 8.3 Upon the receipt of the HEARTBEAT ACK, the sender of
1038 * the HEARTBEAT should clear the error counter of the
1039 * destination transport address to which the HEARTBEAT was
1040 * sent and mark the destination transport address as active if
1041 * it is not so marked.
1043 sctp_add_cmd_sf(commands
, SCTP_CMD_TRANSPORT_ON
, SCTP_TRANSPORT(link
));
1045 return SCTP_DISPOSITION_CONSUME
;
1048 /* Helper function to send out an abort for the restart
1051 static int sctp_sf_send_restart_abort(union sctp_addr
*ssa
,
1052 struct sctp_chunk
*init
,
1053 sctp_cmd_seq_t
*commands
)
1056 struct sctp_packet
*pkt
;
1057 union sctp_addr_param
*addrparm
;
1058 struct sctp_errhdr
*errhdr
;
1059 struct sctp_endpoint
*ep
;
1060 char buffer
[sizeof(struct sctp_errhdr
)+sizeof(union sctp_addr_param
)];
1061 struct sctp_af
*af
= sctp_get_af_specific(ssa
->v4
.sin_family
);
1063 /* Build the error on the stack. We are way to malloc crazy
1064 * throughout the code today.
1066 errhdr
= (struct sctp_errhdr
*)buffer
;
1067 addrparm
= (union sctp_addr_param
*)errhdr
->variable
;
1069 /* Copy into a parm format. */
1070 len
= af
->to_addr_param(ssa
, addrparm
);
1071 len
+= sizeof(sctp_errhdr_t
);
1073 errhdr
->cause
= SCTP_ERROR_RESTART
;
1074 errhdr
->length
= htons(len
);
1076 /* Assign to the control socket. */
1077 ep
= sctp_sk((sctp_get_ctl_sock()))->ep
;
1079 /* Association is NULL since this may be a restart attack and we
1080 * want to send back the attacker's vtag.
1082 pkt
= sctp_abort_pkt_new(ep
, NULL
, init
, errhdr
, len
);
1086 sctp_add_cmd_sf(commands
, SCTP_CMD_SEND_PKT
, SCTP_PACKET(pkt
));
1088 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS
);
1090 /* Discard the rest of the inbound packet. */
1091 sctp_add_cmd_sf(commands
, SCTP_CMD_DISCARD_PACKET
, SCTP_NULL());
1094 /* Even if there is no memory, treat as a failure so
1095 * the packet will get dropped.
1100 /* A restart is occurring, check to make sure no new addresses
1101 * are being added as we may be under a takeover attack.
1103 static int sctp_sf_check_restart_addrs(const struct sctp_association
*new_asoc
,
1104 const struct sctp_association
*asoc
,
1105 struct sctp_chunk
*init
,
1106 sctp_cmd_seq_t
*commands
)
1108 struct sctp_transport
*new_addr
, *addr
;
1109 struct list_head
*pos
, *pos2
;
1112 /* Implementor's Guide - Sectin 5.2.2
1114 * Before responding the endpoint MUST check to see if the
1115 * unexpected INIT adds new addresses to the association. If new
1116 * addresses are added to the association, the endpoint MUST respond
1120 /* Search through all current addresses and make sure
1121 * we aren't adding any new ones.
1126 list_for_each(pos
, &new_asoc
->peer
.transport_addr_list
) {
1127 new_addr
= list_entry(pos
, struct sctp_transport
, transports
);
1129 list_for_each(pos2
, &asoc
->peer
.transport_addr_list
) {
1130 addr
= list_entry(pos2
, struct sctp_transport
,
1132 if (sctp_cmp_addr_exact(&new_addr
->ipaddr
,
1142 /* If a new address was added, ABORT the sender. */
1143 if (!found
&& new_addr
) {
1144 sctp_sf_send_restart_abort(&new_addr
->ipaddr
, init
, commands
);
1147 /* Return success if all addresses were found. */
1151 /* Populate the verification/tie tags based on overlapping INIT
1154 * Note: Do not use in CLOSED or SHUTDOWN-ACK-SENT state.
1156 static void sctp_tietags_populate(struct sctp_association
*new_asoc
,
1157 const struct sctp_association
*asoc
)
1159 switch (asoc
->state
) {
1161 /* 5.2.1 INIT received in COOKIE-WAIT or COOKIE-ECHOED State */
1163 case SCTP_STATE_COOKIE_WAIT
:
1164 new_asoc
->c
.my_vtag
= asoc
->c
.my_vtag
;
1165 new_asoc
->c
.my_ttag
= asoc
->c
.my_vtag
;
1166 new_asoc
->c
.peer_ttag
= 0;
1169 case SCTP_STATE_COOKIE_ECHOED
:
1170 new_asoc
->c
.my_vtag
= asoc
->c
.my_vtag
;
1171 new_asoc
->c
.my_ttag
= asoc
->c
.my_vtag
;
1172 new_asoc
->c
.peer_ttag
= asoc
->c
.peer_vtag
;
1175 /* 5.2.2 Unexpected INIT in States Other than CLOSED, COOKIE-ECHOED,
1176 * COOKIE-WAIT and SHUTDOWN-ACK-SENT
1179 new_asoc
->c
.my_ttag
= asoc
->c
.my_vtag
;
1180 new_asoc
->c
.peer_ttag
= asoc
->c
.peer_vtag
;
1184 /* Other parameters for the endpoint SHOULD be copied from the
1185 * existing parameters of the association (e.g. number of
1186 * outbound streams) into the INIT ACK and cookie.
1188 new_asoc
->rwnd
= asoc
->rwnd
;
1189 new_asoc
->c
.sinit_num_ostreams
= asoc
->c
.sinit_num_ostreams
;
1190 new_asoc
->c
.sinit_max_instreams
= asoc
->c
.sinit_max_instreams
;
1191 new_asoc
->c
.initial_tsn
= asoc
->c
.initial_tsn
;
1195 * Compare vtag/tietag values to determine unexpected COOKIE-ECHO
1198 * RFC 2960 5.2.4 Handle a COOKIE ECHO when a TCB exists.
1200 * Returns value representing action to be taken. These action values
1201 * correspond to Action/Description values in RFC 2960, Table 2.
1203 static char sctp_tietags_compare(struct sctp_association
*new_asoc
,
1204 const struct sctp_association
*asoc
)
1206 /* In this case, the peer may have restarted. */
1207 if ((asoc
->c
.my_vtag
!= new_asoc
->c
.my_vtag
) &&
1208 (asoc
->c
.peer_vtag
!= new_asoc
->c
.peer_vtag
) &&
1209 (asoc
->c
.my_vtag
== new_asoc
->c
.my_ttag
) &&
1210 (asoc
->c
.peer_vtag
== new_asoc
->c
.peer_ttag
))
1213 /* Collision case B. */
1214 if ((asoc
->c
.my_vtag
== new_asoc
->c
.my_vtag
) &&
1215 ((asoc
->c
.peer_vtag
!= new_asoc
->c
.peer_vtag
) ||
1216 (0 == asoc
->c
.peer_vtag
))) {
1220 /* Collision case D. */
1221 if ((asoc
->c
.my_vtag
== new_asoc
->c
.my_vtag
) &&
1222 (asoc
->c
.peer_vtag
== new_asoc
->c
.peer_vtag
))
1225 /* Collision case C. */
1226 if ((asoc
->c
.my_vtag
!= new_asoc
->c
.my_vtag
) &&
1227 (asoc
->c
.peer_vtag
== new_asoc
->c
.peer_vtag
) &&
1228 (0 == new_asoc
->c
.my_ttag
) &&
1229 (0 == new_asoc
->c
.peer_ttag
))
1232 /* No match to any of the special cases; discard this packet. */
1236 /* Common helper routine for both duplicate and simulataneous INIT
1239 static sctp_disposition_t
sctp_sf_do_unexpected_init(
1240 const struct sctp_endpoint
*ep
,
1241 const struct sctp_association
*asoc
,
1242 const sctp_subtype_t type
,
1243 void *arg
, sctp_cmd_seq_t
*commands
)
1245 sctp_disposition_t retval
;
1246 struct sctp_chunk
*chunk
= arg
;
1247 struct sctp_chunk
*repl
;
1248 struct sctp_association
*new_asoc
;
1249 struct sctp_chunk
*err_chunk
;
1250 struct sctp_packet
*packet
;
1251 sctp_unrecognized_param_t
*unk_param
;
1255 * An endpoint MUST NOT bundle INIT, INIT ACK or
1256 * SHUTDOWN COMPLETE with any other chunks.
1259 * Furthermore, we require that the receiver of an INIT chunk MUST
1260 * enforce these rules by silently discarding an arriving packet
1261 * with an INIT chunk that is bundled with other chunks.
1263 if (!chunk
->singleton
)
1264 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
1266 /* 3.1 A packet containing an INIT chunk MUST have a zero Verification
1269 if (chunk
->sctp_hdr
->vtag
!= 0)
1270 return sctp_sf_tabort_8_4_8(ep
, asoc
, type
, arg
, commands
);
1272 /* Make sure that the INIT chunk has a valid length.
1273 * In this case, we generate a protocol violation since we have
1274 * an association established.
1276 if (!sctp_chunk_length_valid(chunk
, sizeof(sctp_init_chunk_t
)))
1277 return sctp_sf_violation_chunklen(ep
, asoc
, type
, arg
,
1279 /* Grab the INIT header. */
1280 chunk
->subh
.init_hdr
= (sctp_inithdr_t
*) chunk
->skb
->data
;
1282 /* Tag the variable length parameters. */
1283 chunk
->param_hdr
.v
= skb_pull(chunk
->skb
, sizeof(sctp_inithdr_t
));
1285 /* Verify the INIT chunk before processing it. */
1287 if (!sctp_verify_init(asoc
, chunk
->chunk_hdr
->type
,
1288 (sctp_init_chunk_t
*)chunk
->chunk_hdr
, chunk
,
1290 /* This chunk contains fatal error. It is to be discarded.
1291 * Send an ABORT, with causes if there is any.
1294 packet
= sctp_abort_pkt_new(ep
, asoc
, arg
,
1295 (__u8
*)(err_chunk
->chunk_hdr
) +
1296 sizeof(sctp_chunkhdr_t
),
1297 ntohs(err_chunk
->chunk_hdr
->length
) -
1298 sizeof(sctp_chunkhdr_t
));
1301 sctp_add_cmd_sf(commands
, SCTP_CMD_SEND_PKT
,
1302 SCTP_PACKET(packet
));
1303 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS
);
1304 retval
= SCTP_DISPOSITION_CONSUME
;
1306 retval
= SCTP_DISPOSITION_NOMEM
;
1310 return sctp_sf_tabort_8_4_8(ep
, asoc
, type
, arg
,
1316 * Other parameters for the endpoint SHOULD be copied from the
1317 * existing parameters of the association (e.g. number of
1318 * outbound streams) into the INIT ACK and cookie.
1319 * FIXME: We are copying parameters from the endpoint not the
1322 new_asoc
= sctp_make_temp_asoc(ep
, chunk
, GFP_ATOMIC
);
1326 /* In the outbound INIT ACK the endpoint MUST copy its current
1327 * Verification Tag and Peers Verification tag into a reserved
1328 * place (local tie-tag and per tie-tag) within the state cookie.
1330 if (!sctp_process_init(new_asoc
, chunk
->chunk_hdr
->type
,
1332 (sctp_init_chunk_t
*)chunk
->chunk_hdr
,
1334 retval
= SCTP_DISPOSITION_NOMEM
;
1338 /* Make sure no new addresses are being added during the
1339 * restart. Do not do this check for COOKIE-WAIT state,
1340 * since there are no peer addresses to check against.
1341 * Upon return an ABORT will have been sent if needed.
1343 if (!sctp_state(asoc
, COOKIE_WAIT
)) {
1344 if (!sctp_sf_check_restart_addrs(new_asoc
, asoc
, chunk
,
1346 retval
= SCTP_DISPOSITION_CONSUME
;
1351 sctp_tietags_populate(new_asoc
, asoc
);
1353 /* B) "Z" shall respond immediately with an INIT ACK chunk. */
1355 /* If there are errors need to be reported for unknown parameters,
1356 * make sure to reserve enough room in the INIT ACK for them.
1360 len
= ntohs(err_chunk
->chunk_hdr
->length
) -
1361 sizeof(sctp_chunkhdr_t
);
1364 if (sctp_assoc_set_bind_addr_from_ep(new_asoc
, GFP_ATOMIC
) < 0)
1367 repl
= sctp_make_init_ack(new_asoc
, chunk
, GFP_ATOMIC
, len
);
1371 /* If there are errors need to be reported for unknown parameters,
1372 * include them in the outgoing INIT ACK as "Unrecognized parameter"
1376 /* Get the "Unrecognized parameter" parameter(s) out of the
1377 * ERROR chunk generated by sctp_verify_init(). Since the
1378 * error cause code for "unknown parameter" and the
1379 * "Unrecognized parameter" type is the same, we can
1380 * construct the parameters in INIT ACK by copying the
1381 * ERROR causes over.
1383 unk_param
= (sctp_unrecognized_param_t
*)
1384 ((__u8
*)(err_chunk
->chunk_hdr
) +
1385 sizeof(sctp_chunkhdr_t
));
1386 /* Replace the cause code with the "Unrecognized parameter"
1389 sctp_addto_chunk(repl
, len
, unk_param
);
1392 sctp_add_cmd_sf(commands
, SCTP_CMD_NEW_ASOC
, SCTP_ASOC(new_asoc
));
1393 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
, SCTP_CHUNK(repl
));
1396 * Note: After sending out INIT ACK with the State Cookie parameter,
1397 * "Z" MUST NOT allocate any resources for this new association.
1398 * Otherwise, "Z" will be vulnerable to resource attacks.
1400 sctp_add_cmd_sf(commands
, SCTP_CMD_DELETE_TCB
, SCTP_NULL());
1401 retval
= SCTP_DISPOSITION_CONSUME
;
1405 sctp_chunk_free(err_chunk
);
1408 retval
= SCTP_DISPOSITION_NOMEM
;
1412 sctp_association_free(new_asoc
);
1417 * Handle simultanous INIT.
1418 * This means we started an INIT and then we got an INIT request from
1421 * Section: 5.2.1 INIT received in COOKIE-WAIT or COOKIE-ECHOED State (Item B)
1422 * This usually indicates an initialization collision, i.e., each
1423 * endpoint is attempting, at about the same time, to establish an
1424 * association with the other endpoint.
1426 * Upon receipt of an INIT in the COOKIE-WAIT or COOKIE-ECHOED state, an
1427 * endpoint MUST respond with an INIT ACK using the same parameters it
1428 * sent in its original INIT chunk (including its Verification Tag,
1429 * unchanged). These original parameters are combined with those from the
1430 * newly received INIT chunk. The endpoint shall also generate a State
1431 * Cookie with the INIT ACK. The endpoint uses the parameters sent in its
1432 * INIT to calculate the State Cookie.
1434 * After that, the endpoint MUST NOT change its state, the T1-init
1435 * timer shall be left running and the corresponding TCB MUST NOT be
1436 * destroyed. The normal procedures for handling State Cookies when
1437 * a TCB exists will resolve the duplicate INITs to a single association.
1439 * For an endpoint that is in the COOKIE-ECHOED state it MUST populate
1440 * its Tie-Tags with the Tag information of itself and its peer (see
1441 * section 5.2.2 for a description of the Tie-Tags).
1443 * Verification Tag: Not explicit, but an INIT can not have a valid
1444 * verification tag, so we skip the check.
1447 * (endpoint, asoc, chunk)
1450 * (asoc, reply_msg, msg_up, timers, counters)
1452 * The return value is the disposition of the chunk.
1454 sctp_disposition_t
sctp_sf_do_5_2_1_siminit(const struct sctp_endpoint
*ep
,
1455 const struct sctp_association
*asoc
,
1456 const sctp_subtype_t type
,
1458 sctp_cmd_seq_t
*commands
)
1460 /* Call helper to do the real work for both simulataneous and
1461 * duplicate INIT chunk handling.
1463 return sctp_sf_do_unexpected_init(ep
, asoc
, type
, arg
, commands
);
1467 * Handle duplicated INIT messages. These are usually delayed
1470 * Section: 5.2.2 Unexpected INIT in States Other than CLOSED,
1471 * COOKIE-ECHOED and COOKIE-WAIT
1473 * Unless otherwise stated, upon reception of an unexpected INIT for
1474 * this association, the endpoint shall generate an INIT ACK with a
1475 * State Cookie. In the outbound INIT ACK the endpoint MUST copy its
1476 * current Verification Tag and peer's Verification Tag into a reserved
1477 * place within the state cookie. We shall refer to these locations as
1478 * the Peer's-Tie-Tag and the Local-Tie-Tag. The outbound SCTP packet
1479 * containing this INIT ACK MUST carry a Verification Tag value equal to
1480 * the Initiation Tag found in the unexpected INIT. And the INIT ACK
1481 * MUST contain a new Initiation Tag (randomly generated see Section
1482 * 5.3.1). Other parameters for the endpoint SHOULD be copied from the
1483 * existing parameters of the association (e.g. number of outbound
1484 * streams) into the INIT ACK and cookie.
1486 * After sending out the INIT ACK, the endpoint shall take no further
1487 * actions, i.e., the existing association, including its current state,
1488 * and the corresponding TCB MUST NOT be changed.
1490 * Note: Only when a TCB exists and the association is not in a COOKIE-
1491 * WAIT state are the Tie-Tags populated. For a normal association INIT
1492 * (i.e. the endpoint is in a COOKIE-WAIT state), the Tie-Tags MUST be
1493 * set to 0 (indicating that no previous TCB existed). The INIT ACK and
1494 * State Cookie are populated as specified in section 5.2.1.
1496 * Verification Tag: Not specified, but an INIT has no way of knowing
1497 * what the verification tag could be, so we ignore it.
1500 * (endpoint, asoc, chunk)
1503 * (asoc, reply_msg, msg_up, timers, counters)
1505 * The return value is the disposition of the chunk.
1507 sctp_disposition_t
sctp_sf_do_5_2_2_dupinit(const struct sctp_endpoint
*ep
,
1508 const struct sctp_association
*asoc
,
1509 const sctp_subtype_t type
,
1511 sctp_cmd_seq_t
*commands
)
1513 /* Call helper to do the real work for both simulataneous and
1514 * duplicate INIT chunk handling.
1516 return sctp_sf_do_unexpected_init(ep
, asoc
, type
, arg
, commands
);
1521 /* Unexpected COOKIE-ECHO handler for peer restart (Table 2, action 'A')
1524 * A) In this case, the peer may have restarted.
1526 static sctp_disposition_t
sctp_sf_do_dupcook_a(const struct sctp_endpoint
*ep
,
1527 const struct sctp_association
*asoc
,
1528 struct sctp_chunk
*chunk
,
1529 sctp_cmd_seq_t
*commands
,
1530 struct sctp_association
*new_asoc
)
1532 sctp_init_chunk_t
*peer_init
;
1533 struct sctp_ulpevent
*ev
;
1534 struct sctp_chunk
*repl
;
1535 struct sctp_chunk
*err
;
1536 sctp_disposition_t disposition
;
1538 /* new_asoc is a brand-new association, so these are not yet
1539 * side effects--it is safe to run them here.
1541 peer_init
= &chunk
->subh
.cookie_hdr
->c
.peer_init
[0];
1543 if (!sctp_process_init(new_asoc
, chunk
->chunk_hdr
->type
,
1544 sctp_source(chunk
), peer_init
,
1548 /* Make sure no new addresses are being added during the
1549 * restart. Though this is a pretty complicated attack
1550 * since you'd have to get inside the cookie.
1552 if (!sctp_sf_check_restart_addrs(new_asoc
, asoc
, chunk
, commands
)) {
1553 return SCTP_DISPOSITION_CONSUME
;
1556 /* If the endpoint is in the SHUTDOWN-ACK-SENT state and recognizes
1557 * the peer has restarted (Action A), it MUST NOT setup a new
1558 * association but instead resend the SHUTDOWN ACK and send an ERROR
1559 * chunk with a "Cookie Received while Shutting Down" error cause to
1562 if (sctp_state(asoc
, SHUTDOWN_ACK_SENT
)) {
1563 disposition
= sctp_sf_do_9_2_reshutack(ep
, asoc
,
1564 SCTP_ST_CHUNK(chunk
->chunk_hdr
->type
),
1566 if (SCTP_DISPOSITION_NOMEM
== disposition
)
1569 err
= sctp_make_op_error(asoc
, chunk
,
1570 SCTP_ERROR_COOKIE_IN_SHUTDOWN
,
1573 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
,
1576 return SCTP_DISPOSITION_CONSUME
;
1579 /* For now, fail any unsent/unacked data. Consider the optional
1580 * choice of resending of this data.
1582 sctp_add_cmd_sf(commands
, SCTP_CMD_PURGE_OUTQUEUE
, SCTP_NULL());
1584 /* Update the content of current association. */
1585 sctp_add_cmd_sf(commands
, SCTP_CMD_UPDATE_ASSOC
, SCTP_ASOC(new_asoc
));
1587 repl
= sctp_make_cookie_ack(new_asoc
, chunk
);
1591 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
, SCTP_CHUNK(repl
));
1593 /* Report association restart to upper layer. */
1594 ev
= sctp_ulpevent_make_assoc_change(asoc
, 0, SCTP_RESTART
, 0,
1595 new_asoc
->c
.sinit_num_ostreams
,
1596 new_asoc
->c
.sinit_max_instreams
,
1601 sctp_add_cmd_sf(commands
, SCTP_CMD_EVENT_ULP
, SCTP_ULPEVENT(ev
));
1602 return SCTP_DISPOSITION_CONSUME
;
1605 sctp_chunk_free(repl
);
1607 return SCTP_DISPOSITION_NOMEM
;
1610 /* Unexpected COOKIE-ECHO handler for setup collision (Table 2, action 'B')
1613 * B) In this case, both sides may be attempting to start an association
1614 * at about the same time but the peer endpoint started its INIT
1615 * after responding to the local endpoint's INIT
1617 /* This case represents an initialization collision. */
1618 static sctp_disposition_t
sctp_sf_do_dupcook_b(const struct sctp_endpoint
*ep
,
1619 const struct sctp_association
*asoc
,
1620 struct sctp_chunk
*chunk
,
1621 sctp_cmd_seq_t
*commands
,
1622 struct sctp_association
*new_asoc
)
1624 sctp_init_chunk_t
*peer_init
;
1625 struct sctp_ulpevent
*ev
;
1626 struct sctp_chunk
*repl
;
1628 /* new_asoc is a brand-new association, so these are not yet
1629 * side effects--it is safe to run them here.
1631 peer_init
= &chunk
->subh
.cookie_hdr
->c
.peer_init
[0];
1632 if (!sctp_process_init(new_asoc
, chunk
->chunk_hdr
->type
,
1633 sctp_source(chunk
), peer_init
,
1637 /* Update the content of current association. */
1638 sctp_add_cmd_sf(commands
, SCTP_CMD_UPDATE_ASSOC
, SCTP_ASOC(new_asoc
));
1639 sctp_add_cmd_sf(commands
, SCTP_CMD_NEW_STATE
,
1640 SCTP_STATE(SCTP_STATE_ESTABLISHED
));
1641 SCTP_INC_STATS(SCTP_MIB_CURRESTAB
);
1642 sctp_add_cmd_sf(commands
, SCTP_CMD_HB_TIMERS_START
, SCTP_NULL());
1644 repl
= sctp_make_cookie_ack(new_asoc
, chunk
);
1648 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
, SCTP_CHUNK(repl
));
1649 sctp_add_cmd_sf(commands
, SCTP_CMD_TRANSMIT
, SCTP_NULL());
1651 /* RFC 2960 5.1 Normal Establishment of an Association
1653 * D) IMPLEMENTATION NOTE: An implementation may choose to
1654 * send the Communication Up notification to the SCTP user
1655 * upon reception of a valid COOKIE ECHO chunk.
1657 ev
= sctp_ulpevent_make_assoc_change(asoc
, 0, SCTP_COMM_UP
, 0,
1658 new_asoc
->c
.sinit_num_ostreams
,
1659 new_asoc
->c
.sinit_max_instreams
,
1664 sctp_add_cmd_sf(commands
, SCTP_CMD_EVENT_ULP
, SCTP_ULPEVENT(ev
));
1666 /* Sockets API Draft Section 5.3.1.6
1667 * When a peer sends a Adaption Layer Indication parameter , SCTP
1668 * delivers this notification to inform the application that of the
1669 * peers requested adaption layer.
1671 if (asoc
->peer
.adaption_ind
) {
1672 ev
= sctp_ulpevent_make_adaption_indication(asoc
, GFP_ATOMIC
);
1676 sctp_add_cmd_sf(commands
, SCTP_CMD_EVENT_ULP
,
1680 return SCTP_DISPOSITION_CONSUME
;
1683 sctp_chunk_free(repl
);
1685 return SCTP_DISPOSITION_NOMEM
;
1688 /* Unexpected COOKIE-ECHO handler for setup collision (Table 2, action 'C')
1691 * C) In this case, the local endpoint's cookie has arrived late.
1692 * Before it arrived, the local endpoint sent an INIT and received an
1693 * INIT-ACK and finally sent a COOKIE ECHO with the peer's same tag
1694 * but a new tag of its own.
1696 /* This case represents an initialization collision. */
1697 static sctp_disposition_t
sctp_sf_do_dupcook_c(const struct sctp_endpoint
*ep
,
1698 const struct sctp_association
*asoc
,
1699 struct sctp_chunk
*chunk
,
1700 sctp_cmd_seq_t
*commands
,
1701 struct sctp_association
*new_asoc
)
1703 /* The cookie should be silently discarded.
1704 * The endpoint SHOULD NOT change states and should leave
1705 * any timers running.
1707 return SCTP_DISPOSITION_DISCARD
;
1710 /* Unexpected COOKIE-ECHO handler lost chunk (Table 2, action 'D')
1714 * D) When both local and remote tags match the endpoint should always
1715 * enter the ESTABLISHED state, if it has not already done so.
1717 /* This case represents an initialization collision. */
1718 static sctp_disposition_t
sctp_sf_do_dupcook_d(const struct sctp_endpoint
*ep
,
1719 const struct sctp_association
*asoc
,
1720 struct sctp_chunk
*chunk
,
1721 sctp_cmd_seq_t
*commands
,
1722 struct sctp_association
*new_asoc
)
1724 struct sctp_ulpevent
*ev
= NULL
;
1725 struct sctp_chunk
*repl
;
1727 /* Clarification from Implementor's Guide:
1728 * D) When both local and remote tags match the endpoint should
1729 * enter the ESTABLISHED state, if it is in the COOKIE-ECHOED state.
1730 * It should stop any cookie timer that may be running and send
1734 /* Don't accidentally move back into established state. */
1735 if (asoc
->state
< SCTP_STATE_ESTABLISHED
) {
1736 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_STOP
,
1737 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE
));
1738 sctp_add_cmd_sf(commands
, SCTP_CMD_NEW_STATE
,
1739 SCTP_STATE(SCTP_STATE_ESTABLISHED
));
1740 SCTP_INC_STATS(SCTP_MIB_CURRESTAB
);
1741 sctp_add_cmd_sf(commands
, SCTP_CMD_HB_TIMERS_START
,
1744 /* RFC 2960 5.1 Normal Establishment of an Association
1746 * D) IMPLEMENTATION NOTE: An implementation may choose
1747 * to send the Communication Up notification to the
1748 * SCTP user upon reception of a valid COOKIE
1751 ev
= sctp_ulpevent_make_assoc_change(new_asoc
, 0,
1753 new_asoc
->c
.sinit_num_ostreams
,
1754 new_asoc
->c
.sinit_max_instreams
,
1758 sctp_add_cmd_sf(commands
, SCTP_CMD_EVENT_ULP
,
1761 /* Sockets API Draft Section 5.3.1.6
1762 * When a peer sends a Adaption Layer Indication parameter,
1763 * SCTP delivers this notification to inform the application
1764 * that of the peers requested adaption layer.
1766 if (new_asoc
->peer
.adaption_ind
) {
1767 ev
= sctp_ulpevent_make_adaption_indication(new_asoc
,
1772 sctp_add_cmd_sf(commands
, SCTP_CMD_EVENT_ULP
,
1776 sctp_add_cmd_sf(commands
, SCTP_CMD_TRANSMIT
, SCTP_NULL());
1778 repl
= sctp_make_cookie_ack(new_asoc
, chunk
);
1782 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
, SCTP_CHUNK(repl
));
1783 sctp_add_cmd_sf(commands
, SCTP_CMD_TRANSMIT
, SCTP_NULL());
1785 return SCTP_DISPOSITION_CONSUME
;
1789 sctp_ulpevent_free(ev
);
1790 return SCTP_DISPOSITION_NOMEM
;
1794 * Handle a duplicate COOKIE-ECHO. This usually means a cookie-carrying
1795 * chunk was retransmitted and then delayed in the network.
1797 * Section: 5.2.4 Handle a COOKIE ECHO when a TCB exists
1799 * Verification Tag: None. Do cookie validation.
1802 * (endpoint, asoc, chunk)
1805 * (asoc, reply_msg, msg_up, timers, counters)
1807 * The return value is the disposition of the chunk.
1809 sctp_disposition_t
sctp_sf_do_5_2_4_dupcook(const struct sctp_endpoint
*ep
,
1810 const struct sctp_association
*asoc
,
1811 const sctp_subtype_t type
,
1813 sctp_cmd_seq_t
*commands
)
1815 sctp_disposition_t retval
;
1816 struct sctp_chunk
*chunk
= arg
;
1817 struct sctp_association
*new_asoc
;
1820 struct sctp_chunk
*err_chk_p
;
1822 /* Make sure that the chunk has a valid length from the protocol
1823 * perspective. In this case check to make sure we have at least
1824 * enough for the chunk header. Cookie length verification is
1827 if (!sctp_chunk_length_valid(chunk
, sizeof(sctp_chunkhdr_t
)))
1828 return sctp_sf_violation_chunklen(ep
, asoc
, type
, arg
,
1831 /* "Decode" the chunk. We have no optional parameters so we
1832 * are in good shape.
1834 chunk
->subh
.cookie_hdr
= (struct sctp_signed_cookie
*)chunk
->skb
->data
;
1835 skb_pull(chunk
->skb
, ntohs(chunk
->chunk_hdr
->length
) -
1836 sizeof(sctp_chunkhdr_t
));
1838 /* In RFC 2960 5.2.4 3, if both Verification Tags in the State Cookie
1839 * of a duplicate COOKIE ECHO match the Verification Tags of the
1840 * current association, consider the State Cookie valid even if
1841 * the lifespan is exceeded.
1843 new_asoc
= sctp_unpack_cookie(ep
, asoc
, chunk
, GFP_ATOMIC
, &error
,
1847 * If the re-build failed, what is the proper error path
1850 * [We should abort the association. --piggy]
1853 /* FIXME: Several errors are possible. A bad cookie should
1854 * be silently discarded, but think about logging it too.
1857 case -SCTP_IERROR_NOMEM
:
1860 case -SCTP_IERROR_STALE_COOKIE
:
1861 sctp_send_stale_cookie_err(ep
, asoc
, chunk
, commands
,
1863 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
1864 case -SCTP_IERROR_BAD_SIG
:
1866 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
1870 /* Compare the tie_tag in cookie with the verification tag of
1871 * current association.
1873 action
= sctp_tietags_compare(new_asoc
, asoc
);
1876 case 'A': /* Association restart. */
1877 retval
= sctp_sf_do_dupcook_a(ep
, asoc
, chunk
, commands
,
1881 case 'B': /* Collision case B. */
1882 retval
= sctp_sf_do_dupcook_b(ep
, asoc
, chunk
, commands
,
1886 case 'C': /* Collision case C. */
1887 retval
= sctp_sf_do_dupcook_c(ep
, asoc
, chunk
, commands
,
1891 case 'D': /* Collision case D. */
1892 retval
= sctp_sf_do_dupcook_d(ep
, asoc
, chunk
, commands
,
1896 default: /* Discard packet for all others. */
1897 retval
= sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
1901 /* Delete the tempory new association. */
1902 sctp_add_cmd_sf(commands
, SCTP_CMD_NEW_ASOC
, SCTP_ASOC(new_asoc
));
1903 sctp_add_cmd_sf(commands
, SCTP_CMD_DELETE_TCB
, SCTP_NULL());
1908 return SCTP_DISPOSITION_NOMEM
;
1912 * Process an ABORT. (SHUTDOWN-PENDING state)
1914 * See sctp_sf_do_9_1_abort().
1916 sctp_disposition_t
sctp_sf_shutdown_pending_abort(
1917 const struct sctp_endpoint
*ep
,
1918 const struct sctp_association
*asoc
,
1919 const sctp_subtype_t type
,
1921 sctp_cmd_seq_t
*commands
)
1923 struct sctp_chunk
*chunk
= arg
;
1925 if (!sctp_vtag_verify_either(chunk
, asoc
))
1926 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
1928 /* Make sure that the ABORT chunk has a valid length.
1929 * Since this is an ABORT chunk, we have to discard it
1930 * because of the following text:
1931 * RFC 2960, Section 3.3.7
1932 * If an endpoint receives an ABORT with a format error or for an
1933 * association that doesn't exist, it MUST silently discard it.
1934 * Becasue the length is "invalid", we can't really discard just
1935 * as we do not know its true length. So, to be safe, discard the
1938 if (!sctp_chunk_length_valid(chunk
, sizeof(sctp_abort_chunk_t
)))
1939 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
1941 /* Stop the T5-shutdown guard timer. */
1942 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_STOP
,
1943 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD
));
1945 return sctp_sf_do_9_1_abort(ep
, asoc
, type
, arg
, commands
);
1949 * Process an ABORT. (SHUTDOWN-SENT state)
1951 * See sctp_sf_do_9_1_abort().
1953 sctp_disposition_t
sctp_sf_shutdown_sent_abort(const struct sctp_endpoint
*ep
,
1954 const struct sctp_association
*asoc
,
1955 const sctp_subtype_t type
,
1957 sctp_cmd_seq_t
*commands
)
1959 struct sctp_chunk
*chunk
= arg
;
1961 if (!sctp_vtag_verify_either(chunk
, asoc
))
1962 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
1964 /* Make sure that the ABORT chunk has a valid length.
1965 * Since this is an ABORT chunk, we have to discard it
1966 * because of the following text:
1967 * RFC 2960, Section 3.3.7
1968 * If an endpoint receives an ABORT with a format error or for an
1969 * association that doesn't exist, it MUST silently discard it.
1970 * Becasue the length is "invalid", we can't really discard just
1971 * as we do not know its true length. So, to be safe, discard the
1974 if (!sctp_chunk_length_valid(chunk
, sizeof(sctp_abort_chunk_t
)))
1975 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
1977 /* Stop the T2-shutdown timer. */
1978 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_STOP
,
1979 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN
));
1981 /* Stop the T5-shutdown guard timer. */
1982 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_STOP
,
1983 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD
));
1985 return sctp_sf_do_9_1_abort(ep
, asoc
, type
, arg
, commands
);
1989 * Process an ABORT. (SHUTDOWN-ACK-SENT state)
1991 * See sctp_sf_do_9_1_abort().
1993 sctp_disposition_t
sctp_sf_shutdown_ack_sent_abort(
1994 const struct sctp_endpoint
*ep
,
1995 const struct sctp_association
*asoc
,
1996 const sctp_subtype_t type
,
1998 sctp_cmd_seq_t
*commands
)
2000 /* The same T2 timer, so we should be able to use
2001 * common function with the SHUTDOWN-SENT state.
2003 return sctp_sf_shutdown_sent_abort(ep
, asoc
, type
, arg
, commands
);
2007 * Handle an Error received in COOKIE_ECHOED state.
2009 * Only handle the error type of stale COOKIE Error, the other errors will
2013 * (endpoint, asoc, chunk)
2016 * (asoc, reply_msg, msg_up, timers, counters)
2018 * The return value is the disposition of the chunk.
2020 sctp_disposition_t
sctp_sf_cookie_echoed_err(const struct sctp_endpoint
*ep
,
2021 const struct sctp_association
*asoc
,
2022 const sctp_subtype_t type
,
2024 sctp_cmd_seq_t
*commands
)
2026 struct sctp_chunk
*chunk
= arg
;
2029 if (!sctp_vtag_verify(chunk
, asoc
))
2030 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
2032 /* Make sure that the ERROR chunk has a valid length.
2033 * The parameter walking depends on this as well.
2035 if (!sctp_chunk_length_valid(chunk
, sizeof(sctp_operr_chunk_t
)))
2036 return sctp_sf_violation_chunklen(ep
, asoc
, type
, arg
,
2039 /* Process the error here */
2040 /* FUTURE FIXME: When PR-SCTP related and other optional
2041 * parms are emitted, this will have to change to handle multiple
2044 sctp_walk_errors(err
, chunk
->chunk_hdr
) {
2045 if (SCTP_ERROR_STALE_COOKIE
== err
->cause
)
2046 return sctp_sf_do_5_2_6_stale(ep
, asoc
, type
,
2050 /* It is possible to have malformed error causes, and that
2051 * will cause us to end the walk early. However, since
2052 * we are discarding the packet, there should be no adverse
2055 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
2059 * Handle a Stale COOKIE Error
2061 * Section: 5.2.6 Handle Stale COOKIE Error
2062 * If the association is in the COOKIE-ECHOED state, the endpoint may elect
2063 * one of the following three alternatives.
2065 * 3) Send a new INIT chunk to the endpoint, adding a Cookie
2066 * Preservative parameter requesting an extension to the lifetime of
2067 * the State Cookie. When calculating the time extension, an
2068 * implementation SHOULD use the RTT information measured based on the
2069 * previous COOKIE ECHO / ERROR exchange, and should add no more
2070 * than 1 second beyond the measured RTT, due to long State Cookie
2071 * lifetimes making the endpoint more subject to a replay attack.
2073 * Verification Tag: Not explicit, but safe to ignore.
2076 * (endpoint, asoc, chunk)
2079 * (asoc, reply_msg, msg_up, timers, counters)
2081 * The return value is the disposition of the chunk.
2083 static sctp_disposition_t
sctp_sf_do_5_2_6_stale(const struct sctp_endpoint
*ep
,
2084 const struct sctp_association
*asoc
,
2085 const sctp_subtype_t type
,
2087 sctp_cmd_seq_t
*commands
)
2089 struct sctp_chunk
*chunk
= arg
;
2091 sctp_cookie_preserve_param_t bht
;
2093 struct sctp_chunk
*reply
;
2094 struct sctp_bind_addr
*bp
;
2097 attempts
= asoc
->counters
[SCTP_COUNTER_INIT_ERROR
] + 1;
2099 if (attempts
>= asoc
->max_init_attempts
) {
2100 sctp_add_cmd_sf(commands
, SCTP_CMD_INIT_FAILED
,
2101 SCTP_U32(SCTP_ERROR_STALE_COOKIE
));
2102 return SCTP_DISPOSITION_DELETE_TCB
;
2105 err
= (sctp_errhdr_t
*)(chunk
->skb
->data
);
2107 /* When calculating the time extension, an implementation
2108 * SHOULD use the RTT information measured based on the
2109 * previous COOKIE ECHO / ERROR exchange, and should add no
2110 * more than 1 second beyond the measured RTT, due to long
2111 * State Cookie lifetimes making the endpoint more subject to
2113 * Measure of Staleness's unit is usec. (1/1000000 sec)
2114 * Suggested Cookie Life-span Increment's unit is msec.
2116 * In general, if you use the suggested cookie life, the value
2117 * found in the field of measure of staleness should be doubled
2118 * to give ample time to retransmit the new cookie and thus
2119 * yield a higher probability of success on the reattempt.
2121 stale
= ntohl(*(suseconds_t
*)((u8
*)err
+ sizeof(sctp_errhdr_t
)));
2122 stale
= (stale
* 2) / 1000;
2124 bht
.param_hdr
.type
= SCTP_PARAM_COOKIE_PRESERVATIVE
;
2125 bht
.param_hdr
.length
= htons(sizeof(bht
));
2126 bht
.lifespan_increment
= htonl(stale
);
2128 /* Build that new INIT chunk. */
2129 bp
= (struct sctp_bind_addr
*) &asoc
->base
.bind_addr
;
2130 reply
= sctp_make_init(asoc
, bp
, GFP_ATOMIC
, sizeof(bht
));
2134 sctp_addto_chunk(reply
, sizeof(bht
), &bht
);
2136 /* Clear peer's init_tag cached in assoc as we are sending a new INIT */
2137 sctp_add_cmd_sf(commands
, SCTP_CMD_CLEAR_INIT_TAG
, SCTP_NULL());
2139 /* Stop pending T3-rtx and heartbeat timers */
2140 sctp_add_cmd_sf(commands
, SCTP_CMD_T3_RTX_TIMERS_STOP
, SCTP_NULL());
2141 sctp_add_cmd_sf(commands
, SCTP_CMD_HB_TIMERS_STOP
, SCTP_NULL());
2143 /* Delete non-primary peer ip addresses since we are transitioning
2144 * back to the COOKIE-WAIT state
2146 sctp_add_cmd_sf(commands
, SCTP_CMD_DEL_NON_PRIMARY
, SCTP_NULL());
2148 /* If we've sent any data bundled with COOKIE-ECHO we will need to
2151 sctp_add_cmd_sf(commands
, SCTP_CMD_RETRAN
,
2152 SCTP_TRANSPORT(asoc
->peer
.primary_path
));
2154 /* Cast away the const modifier, as we want to just
2155 * rerun it through as a sideffect.
2157 sctp_add_cmd_sf(commands
, SCTP_CMD_COUNTER_INC
,
2158 SCTP_COUNTER(SCTP_COUNTER_INIT_ERROR
));
2160 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_STOP
,
2161 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE
));
2162 sctp_add_cmd_sf(commands
, SCTP_CMD_NEW_STATE
,
2163 SCTP_STATE(SCTP_STATE_COOKIE_WAIT
));
2164 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_START
,
2165 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT
));
2167 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
, SCTP_CHUNK(reply
));
2169 return SCTP_DISPOSITION_CONSUME
;
2172 return SCTP_DISPOSITION_NOMEM
;
2179 * After checking the Verification Tag, the receiving endpoint shall
2180 * remove the association from its record, and shall report the
2181 * termination to its upper layer.
2183 * Verification Tag: 8.5.1 Exceptions in Verification Tag Rules
2184 * B) Rules for packet carrying ABORT:
2186 * - The endpoint shall always fill in the Verification Tag field of the
2187 * outbound packet with the destination endpoint's tag value if it
2190 * - If the ABORT is sent in response to an OOTB packet, the endpoint
2191 * MUST follow the procedure described in Section 8.4.
2193 * - The receiver MUST accept the packet if the Verification Tag
2194 * matches either its own tag, OR the tag of its peer. Otherwise, the
2195 * receiver MUST silently discard the packet and take no further
2199 * (endpoint, asoc, chunk)
2202 * (asoc, reply_msg, msg_up, timers, counters)
2204 * The return value is the disposition of the chunk.
2206 sctp_disposition_t
sctp_sf_do_9_1_abort(const struct sctp_endpoint
*ep
,
2207 const struct sctp_association
*asoc
,
2208 const sctp_subtype_t type
,
2210 sctp_cmd_seq_t
*commands
)
2212 struct sctp_chunk
*chunk
= arg
;
2214 __u16 error
= SCTP_ERROR_NO_ERROR
;
2216 if (!sctp_vtag_verify_either(chunk
, asoc
))
2217 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
2219 /* Make sure that the ABORT chunk has a valid length.
2220 * Since this is an ABORT chunk, we have to discard it
2221 * because of the following text:
2222 * RFC 2960, Section 3.3.7
2223 * If an endpoint receives an ABORT with a format error or for an
2224 * association that doesn't exist, it MUST silently discard it.
2225 * Becasue the length is "invalid", we can't really discard just
2226 * as we do not know its true length. So, to be safe, discard the
2229 if (!sctp_chunk_length_valid(chunk
, sizeof(sctp_abort_chunk_t
)))
2230 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
2232 /* See if we have an error cause code in the chunk. */
2233 len
= ntohs(chunk
->chunk_hdr
->length
);
2234 if (len
>= sizeof(struct sctp_chunkhdr
) + sizeof(struct sctp_errhdr
))
2235 error
= ((sctp_errhdr_t
*)chunk
->skb
->data
)->cause
;
2237 /* ASSOC_FAILED will DELETE_TCB. */
2238 sctp_add_cmd_sf(commands
, SCTP_CMD_ASSOC_FAILED
, SCTP_U32(error
));
2239 SCTP_INC_STATS(SCTP_MIB_ABORTEDS
);
2240 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB
);
2242 return SCTP_DISPOSITION_ABORT
;
2246 * Process an ABORT. (COOKIE-WAIT state)
2248 * See sctp_sf_do_9_1_abort() above.
2250 sctp_disposition_t
sctp_sf_cookie_wait_abort(const struct sctp_endpoint
*ep
,
2251 const struct sctp_association
*asoc
,
2252 const sctp_subtype_t type
,
2254 sctp_cmd_seq_t
*commands
)
2256 struct sctp_chunk
*chunk
= arg
;
2258 __u16 error
= SCTP_ERROR_NO_ERROR
;
2260 if (!sctp_vtag_verify_either(chunk
, asoc
))
2261 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
2263 /* Make sure that the ABORT chunk has a valid length.
2264 * Since this is an ABORT chunk, we have to discard it
2265 * because of the following text:
2266 * RFC 2960, Section 3.3.7
2267 * If an endpoint receives an ABORT with a format error or for an
2268 * association that doesn't exist, it MUST silently discard it.
2269 * Becasue the length is "invalid", we can't really discard just
2270 * as we do not know its true length. So, to be safe, discard the
2273 if (!sctp_chunk_length_valid(chunk
, sizeof(sctp_abort_chunk_t
)))
2274 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
2276 /* See if we have an error cause code in the chunk. */
2277 len
= ntohs(chunk
->chunk_hdr
->length
);
2278 if (len
>= sizeof(struct sctp_chunkhdr
) + sizeof(struct sctp_errhdr
))
2279 error
= ((sctp_errhdr_t
*)chunk
->skb
->data
)->cause
;
2281 sctp_stop_t1_and_abort(commands
, error
);
2282 return SCTP_DISPOSITION_ABORT
;
2286 * Process an incoming ICMP as an ABORT. (COOKIE-WAIT state)
2288 sctp_disposition_t
sctp_sf_cookie_wait_icmp_abort(const struct sctp_endpoint
*ep
,
2289 const struct sctp_association
*asoc
,
2290 const sctp_subtype_t type
,
2292 sctp_cmd_seq_t
*commands
)
2294 sctp_stop_t1_and_abort(commands
, SCTP_ERROR_NO_ERROR
);
2295 return SCTP_DISPOSITION_ABORT
;
2299 * Process an ABORT. (COOKIE-ECHOED state)
2301 sctp_disposition_t
sctp_sf_cookie_echoed_abort(const struct sctp_endpoint
*ep
,
2302 const struct sctp_association
*asoc
,
2303 const sctp_subtype_t type
,
2305 sctp_cmd_seq_t
*commands
)
2307 /* There is a single T1 timer, so we should be able to use
2308 * common function with the COOKIE-WAIT state.
2310 return sctp_sf_cookie_wait_abort(ep
, asoc
, type
, arg
, commands
);
2314 * Stop T1 timer and abort association with "INIT failed".
2316 * This is common code called by several sctp_sf_*_abort() functions above.
2318 void sctp_stop_t1_and_abort(sctp_cmd_seq_t
*commands
, __u16 error
)
2320 sctp_add_cmd_sf(commands
, SCTP_CMD_NEW_STATE
,
2321 SCTP_STATE(SCTP_STATE_CLOSED
));
2322 SCTP_INC_STATS(SCTP_MIB_ABORTEDS
);
2323 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_STOP
,
2324 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT
));
2325 /* CMD_INIT_FAILED will DELETE_TCB. */
2326 sctp_add_cmd_sf(commands
, SCTP_CMD_INIT_FAILED
,
2331 * sctp_sf_do_9_2_shut
2334 * Upon the reception of the SHUTDOWN, the peer endpoint shall
2335 * - enter the SHUTDOWN-RECEIVED state,
2337 * - stop accepting new data from its SCTP user
2339 * - verify, by checking the Cumulative TSN Ack field of the chunk,
2340 * that all its outstanding DATA chunks have been received by the
2343 * Once an endpoint as reached the SHUTDOWN-RECEIVED state it MUST NOT
2344 * send a SHUTDOWN in response to a ULP request. And should discard
2345 * subsequent SHUTDOWN chunks.
2347 * If there are still outstanding DATA chunks left, the SHUTDOWN
2348 * receiver shall continue to follow normal data transmission
2349 * procedures defined in Section 6 until all outstanding DATA chunks
2350 * are acknowledged; however, the SHUTDOWN receiver MUST NOT accept
2351 * new data from its SCTP user.
2353 * Verification Tag: 8.5 Verification Tag [Normal verification]
2356 * (endpoint, asoc, chunk)
2359 * (asoc, reply_msg, msg_up, timers, counters)
2361 * The return value is the disposition of the chunk.
2363 sctp_disposition_t
sctp_sf_do_9_2_shutdown(const struct sctp_endpoint
*ep
,
2364 const struct sctp_association
*asoc
,
2365 const sctp_subtype_t type
,
2367 sctp_cmd_seq_t
*commands
)
2369 struct sctp_chunk
*chunk
= arg
;
2370 sctp_shutdownhdr_t
*sdh
;
2371 sctp_disposition_t disposition
;
2372 struct sctp_ulpevent
*ev
;
2374 if (!sctp_vtag_verify(chunk
, asoc
))
2375 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
2377 /* Make sure that the SHUTDOWN chunk has a valid length. */
2378 if (!sctp_chunk_length_valid(chunk
,
2379 sizeof(struct sctp_shutdown_chunk_t
)))
2380 return sctp_sf_violation_chunklen(ep
, asoc
, type
, arg
,
2383 /* Convert the elaborate header. */
2384 sdh
= (sctp_shutdownhdr_t
*)chunk
->skb
->data
;
2385 skb_pull(chunk
->skb
, sizeof(sctp_shutdownhdr_t
));
2386 chunk
->subh
.shutdown_hdr
= sdh
;
2388 /* Upon the reception of the SHUTDOWN, the peer endpoint shall
2389 * - enter the SHUTDOWN-RECEIVED state,
2390 * - stop accepting new data from its SCTP user
2392 * [This is implicit in the new state.]
2394 sctp_add_cmd_sf(commands
, SCTP_CMD_NEW_STATE
,
2395 SCTP_STATE(SCTP_STATE_SHUTDOWN_RECEIVED
));
2396 disposition
= SCTP_DISPOSITION_CONSUME
;
2398 if (sctp_outq_is_empty(&asoc
->outqueue
)) {
2399 disposition
= sctp_sf_do_9_2_shutdown_ack(ep
, asoc
, type
,
2403 if (SCTP_DISPOSITION_NOMEM
== disposition
)
2406 /* - verify, by checking the Cumulative TSN Ack field of the
2407 * chunk, that all its outstanding DATA chunks have been
2408 * received by the SHUTDOWN sender.
2410 sctp_add_cmd_sf(commands
, SCTP_CMD_PROCESS_CTSN
,
2411 SCTP_U32(chunk
->subh
.shutdown_hdr
->cum_tsn_ack
));
2413 /* API 5.3.1.5 SCTP_SHUTDOWN_EVENT
2414 * When a peer sends a SHUTDOWN, SCTP delivers this notification to
2415 * inform the application that it should cease sending data.
2417 ev
= sctp_ulpevent_make_shutdown_event(asoc
, 0, GFP_ATOMIC
);
2419 disposition
= SCTP_DISPOSITION_NOMEM
;
2422 sctp_add_cmd_sf(commands
, SCTP_CMD_EVENT_ULP
, SCTP_ULPEVENT(ev
));
2429 * If an endpoint is in SHUTDOWN-ACK-SENT state and receives an INIT chunk
2430 * (e.g., if the SHUTDOWN COMPLETE was lost) with source and destination
2431 * transport addresses (either in the IP addresses or in the INIT chunk)
2432 * that belong to this association, it should discard the INIT chunk and
2433 * retransmit the SHUTDOWN ACK chunk.
2435 sctp_disposition_t
sctp_sf_do_9_2_reshutack(const struct sctp_endpoint
*ep
,
2436 const struct sctp_association
*asoc
,
2437 const sctp_subtype_t type
,
2439 sctp_cmd_seq_t
*commands
)
2441 struct sctp_chunk
*chunk
= (struct sctp_chunk
*) arg
;
2442 struct sctp_chunk
*reply
;
2444 /* Since we are not going to really process this INIT, there
2445 * is no point in verifying chunk boundries. Just generate
2448 reply
= sctp_make_shutdown_ack(asoc
, chunk
);
2452 /* Set the transport for the SHUTDOWN ACK chunk and the timeout for
2453 * the T2-SHUTDOWN timer.
2455 sctp_add_cmd_sf(commands
, SCTP_CMD_SETUP_T2
, SCTP_CHUNK(reply
));
2457 /* and restart the T2-shutdown timer. */
2458 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_RESTART
,
2459 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN
));
2461 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
, SCTP_CHUNK(reply
));
2463 return SCTP_DISPOSITION_CONSUME
;
2465 return SCTP_DISPOSITION_NOMEM
;
2469 * sctp_sf_do_ecn_cwr
2471 * Section: Appendix A: Explicit Congestion Notification
2475 * RFC 2481 details a specific bit for a sender to send in the header of
2476 * its next outbound TCP segment to indicate to its peer that it has
2477 * reduced its congestion window. This is termed the CWR bit. For
2478 * SCTP the same indication is made by including the CWR chunk.
2479 * This chunk contains one data element, i.e. the TSN number that
2480 * was sent in the ECNE chunk. This element represents the lowest
2481 * TSN number in the datagram that was originally marked with the
2484 * Verification Tag: 8.5 Verification Tag [Normal verification]
2486 * (endpoint, asoc, chunk)
2489 * (asoc, reply_msg, msg_up, timers, counters)
2491 * The return value is the disposition of the chunk.
2493 sctp_disposition_t
sctp_sf_do_ecn_cwr(const struct sctp_endpoint
*ep
,
2494 const struct sctp_association
*asoc
,
2495 const sctp_subtype_t type
,
2497 sctp_cmd_seq_t
*commands
)
2500 struct sctp_chunk
*chunk
= arg
;
2502 if (!sctp_vtag_verify(chunk
, asoc
))
2503 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
2505 if (!sctp_chunk_length_valid(chunk
, sizeof(sctp_ecne_chunk_t
)))
2506 return sctp_sf_violation_chunklen(ep
, asoc
, type
, arg
,
2509 cwr
= (sctp_cwrhdr_t
*) chunk
->skb
->data
;
2510 skb_pull(chunk
->skb
, sizeof(sctp_cwrhdr_t
));
2512 cwr
->lowest_tsn
= ntohl(cwr
->lowest_tsn
);
2514 /* Does this CWR ack the last sent congestion notification? */
2515 if (TSN_lte(asoc
->last_ecne_tsn
, cwr
->lowest_tsn
)) {
2516 /* Stop sending ECNE. */
2517 sctp_add_cmd_sf(commands
,
2519 SCTP_U32(cwr
->lowest_tsn
));
2521 return SCTP_DISPOSITION_CONSUME
;
2527 * Section: Appendix A: Explicit Congestion Notification
2531 * RFC 2481 details a specific bit for a receiver to send back in its
2532 * TCP acknowledgements to notify the sender of the Congestion
2533 * Experienced (CE) bit having arrived from the network. For SCTP this
2534 * same indication is made by including the ECNE chunk. This chunk
2535 * contains one data element, i.e. the lowest TSN associated with the IP
2536 * datagram marked with the CE bit.....
2538 * Verification Tag: 8.5 Verification Tag [Normal verification]
2540 * (endpoint, asoc, chunk)
2543 * (asoc, reply_msg, msg_up, timers, counters)
2545 * The return value is the disposition of the chunk.
2547 sctp_disposition_t
sctp_sf_do_ecne(const struct sctp_endpoint
*ep
,
2548 const struct sctp_association
*asoc
,
2549 const sctp_subtype_t type
,
2551 sctp_cmd_seq_t
*commands
)
2553 sctp_ecnehdr_t
*ecne
;
2554 struct sctp_chunk
*chunk
= arg
;
2556 if (!sctp_vtag_verify(chunk
, asoc
))
2557 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
2559 if (!sctp_chunk_length_valid(chunk
, sizeof(sctp_ecne_chunk_t
)))
2560 return sctp_sf_violation_chunklen(ep
, asoc
, type
, arg
,
2563 ecne
= (sctp_ecnehdr_t
*) chunk
->skb
->data
;
2564 skb_pull(chunk
->skb
, sizeof(sctp_ecnehdr_t
));
2566 /* If this is a newer ECNE than the last CWR packet we sent out */
2567 sctp_add_cmd_sf(commands
, SCTP_CMD_ECN_ECNE
,
2568 SCTP_U32(ntohl(ecne
->lowest_tsn
)));
2570 return SCTP_DISPOSITION_CONSUME
;
2574 * Section: 6.2 Acknowledgement on Reception of DATA Chunks
2576 * The SCTP endpoint MUST always acknowledge the reception of each valid
2579 * The guidelines on delayed acknowledgement algorithm specified in
2580 * Section 4.2 of [RFC2581] SHOULD be followed. Specifically, an
2581 * acknowledgement SHOULD be generated for at least every second packet
2582 * (not every second DATA chunk) received, and SHOULD be generated within
2583 * 200 ms of the arrival of any unacknowledged DATA chunk. In some
2584 * situations it may be beneficial for an SCTP transmitter to be more
2585 * conservative than the algorithms detailed in this document allow.
2586 * However, an SCTP transmitter MUST NOT be more aggressive than the
2587 * following algorithms allow.
2589 * A SCTP receiver MUST NOT generate more than one SACK for every
2590 * incoming packet, other than to update the offered window as the
2591 * receiving application consumes new data.
2593 * Verification Tag: 8.5 Verification Tag [Normal verification]
2596 * (endpoint, asoc, chunk)
2599 * (asoc, reply_msg, msg_up, timers, counters)
2601 * The return value is the disposition of the chunk.
2603 sctp_disposition_t
sctp_sf_eat_data_6_2(const struct sctp_endpoint
*ep
,
2604 const struct sctp_association
*asoc
,
2605 const sctp_subtype_t type
,
2607 sctp_cmd_seq_t
*commands
)
2609 struct sctp_chunk
*chunk
= arg
;
2612 if (!sctp_vtag_verify(chunk
, asoc
)) {
2613 sctp_add_cmd_sf(commands
, SCTP_CMD_REPORT_BAD_TAG
,
2615 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
2618 if (!sctp_chunk_length_valid(chunk
, sizeof(sctp_data_chunk_t
)))
2619 return sctp_sf_violation_chunklen(ep
, asoc
, type
, arg
,
2622 error
= sctp_eat_data(asoc
, chunk
, commands
);
2624 case SCTP_IERROR_NO_ERROR
:
2626 case SCTP_IERROR_HIGH_TSN
:
2627 case SCTP_IERROR_BAD_STREAM
:
2628 goto discard_noforce
;
2629 case SCTP_IERROR_DUP_TSN
:
2630 case SCTP_IERROR_IGNORE_TSN
:
2632 case SCTP_IERROR_NO_DATA
:
2638 if (asoc
->autoclose
) {
2639 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_RESTART
,
2640 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE
));
2643 /* If this is the last chunk in a packet, we need to count it
2644 * toward sack generation. Note that we need to SACK every
2645 * OTHER packet containing data chunks, EVEN IF WE DISCARD
2646 * THEM. We elect to NOT generate SACK's if the chunk fails
2647 * the verification tag test.
2649 * RFC 2960 6.2 Acknowledgement on Reception of DATA Chunks
2651 * The SCTP endpoint MUST always acknowledge the reception of
2652 * each valid DATA chunk.
2654 * The guidelines on delayed acknowledgement algorithm
2655 * specified in Section 4.2 of [RFC2581] SHOULD be followed.
2656 * Specifically, an acknowledgement SHOULD be generated for at
2657 * least every second packet (not every second DATA chunk)
2658 * received, and SHOULD be generated within 200 ms of the
2659 * arrival of any unacknowledged DATA chunk. In some
2660 * situations it may be beneficial for an SCTP transmitter to
2661 * be more conservative than the algorithms detailed in this
2662 * document allow. However, an SCTP transmitter MUST NOT be
2663 * more aggressive than the following algorithms allow.
2665 if (chunk
->end_of_packet
) {
2666 sctp_add_cmd_sf(commands
, SCTP_CMD_GEN_SACK
, SCTP_NOFORCE());
2668 /* Start the SACK timer. */
2669 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_RESTART
,
2670 SCTP_TO(SCTP_EVENT_TIMEOUT_SACK
));
2673 return SCTP_DISPOSITION_CONSUME
;
2676 /* RFC 2960 6.2 Acknowledgement on Reception of DATA Chunks
2678 * When a packet arrives with duplicate DATA chunk(s) and with
2679 * no new DATA chunk(s), the endpoint MUST immediately send a
2680 * SACK with no delay. If a packet arrives with duplicate
2681 * DATA chunk(s) bundled with new DATA chunks, the endpoint
2682 * MAY immediately send a SACK. Normally receipt of duplicate
2683 * DATA chunks will occur when the original SACK chunk was lost
2684 * and the peer's RTO has expired. The duplicate TSN number(s)
2685 * SHOULD be reported in the SACK as duplicate.
2687 /* In our case, we split the MAY SACK advice up whether or not
2688 * the last chunk is a duplicate.'
2690 if (chunk
->end_of_packet
)
2691 sctp_add_cmd_sf(commands
, SCTP_CMD_GEN_SACK
, SCTP_FORCE());
2692 return SCTP_DISPOSITION_DISCARD
;
2695 if (chunk
->end_of_packet
) {
2696 sctp_add_cmd_sf(commands
, SCTP_CMD_GEN_SACK
, SCTP_NOFORCE());
2698 /* Start the SACK timer. */
2699 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_RESTART
,
2700 SCTP_TO(SCTP_EVENT_TIMEOUT_SACK
));
2702 return SCTP_DISPOSITION_DISCARD
;
2704 return SCTP_DISPOSITION_CONSUME
;
2709 * sctp_sf_eat_data_fast_4_4
2712 * (4) In SHUTDOWN-SENT state the endpoint MUST acknowledge any received
2713 * DATA chunks without delay.
2715 * Verification Tag: 8.5 Verification Tag [Normal verification]
2717 * (endpoint, asoc, chunk)
2720 * (asoc, reply_msg, msg_up, timers, counters)
2722 * The return value is the disposition of the chunk.
2724 sctp_disposition_t
sctp_sf_eat_data_fast_4_4(const struct sctp_endpoint
*ep
,
2725 const struct sctp_association
*asoc
,
2726 const sctp_subtype_t type
,
2728 sctp_cmd_seq_t
*commands
)
2730 struct sctp_chunk
*chunk
= arg
;
2733 if (!sctp_vtag_verify(chunk
, asoc
)) {
2734 sctp_add_cmd_sf(commands
, SCTP_CMD_REPORT_BAD_TAG
,
2736 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
2739 if (!sctp_chunk_length_valid(chunk
, sizeof(sctp_data_chunk_t
)))
2740 return sctp_sf_violation_chunklen(ep
, asoc
, type
, arg
,
2743 error
= sctp_eat_data(asoc
, chunk
, commands
);
2745 case SCTP_IERROR_NO_ERROR
:
2746 case SCTP_IERROR_HIGH_TSN
:
2747 case SCTP_IERROR_DUP_TSN
:
2748 case SCTP_IERROR_IGNORE_TSN
:
2749 case SCTP_IERROR_BAD_STREAM
:
2751 case SCTP_IERROR_NO_DATA
:
2757 /* Go a head and force a SACK, since we are shutting down. */
2759 /* Implementor's Guide.
2761 * While in SHUTDOWN-SENT state, the SHUTDOWN sender MUST immediately
2762 * respond to each received packet containing one or more DATA chunk(s)
2763 * with a SACK, a SHUTDOWN chunk, and restart the T2-shutdown timer
2765 if (chunk
->end_of_packet
) {
2766 /* We must delay the chunk creation since the cumulative
2767 * TSN has not been updated yet.
2769 sctp_add_cmd_sf(commands
, SCTP_CMD_GEN_SHUTDOWN
, SCTP_NULL());
2770 sctp_add_cmd_sf(commands
, SCTP_CMD_GEN_SACK
, SCTP_FORCE());
2771 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_RESTART
,
2772 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN
));
2776 return SCTP_DISPOSITION_CONSUME
;
2780 * Section: 6.2 Processing a Received SACK
2781 * D) Any time a SACK arrives, the endpoint performs the following:
2783 * i) If Cumulative TSN Ack is less than the Cumulative TSN Ack Point,
2784 * then drop the SACK. Since Cumulative TSN Ack is monotonically
2785 * increasing, a SACK whose Cumulative TSN Ack is less than the
2786 * Cumulative TSN Ack Point indicates an out-of-order SACK.
2788 * ii) Set rwnd equal to the newly received a_rwnd minus the number
2789 * of bytes still outstanding after processing the Cumulative TSN Ack
2790 * and the Gap Ack Blocks.
2792 * iii) If the SACK is missing a TSN that was previously
2793 * acknowledged via a Gap Ack Block (e.g., the data receiver
2794 * reneged on the data), then mark the corresponding DATA chunk
2795 * as available for retransmit: Mark it as missing for fast
2796 * retransmit as described in Section 7.2.4 and if no retransmit
2797 * timer is running for the destination address to which the DATA
2798 * chunk was originally transmitted, then T3-rtx is started for
2799 * that destination address.
2801 * Verification Tag: 8.5 Verification Tag [Normal verification]
2804 * (endpoint, asoc, chunk)
2807 * (asoc, reply_msg, msg_up, timers, counters)
2809 * The return value is the disposition of the chunk.
2811 sctp_disposition_t
sctp_sf_eat_sack_6_2(const struct sctp_endpoint
*ep
,
2812 const struct sctp_association
*asoc
,
2813 const sctp_subtype_t type
,
2815 sctp_cmd_seq_t
*commands
)
2817 struct sctp_chunk
*chunk
= arg
;
2818 sctp_sackhdr_t
*sackh
;
2821 if (!sctp_vtag_verify(chunk
, asoc
))
2822 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
2824 /* Make sure that the SACK chunk has a valid length. */
2825 if (!sctp_chunk_length_valid(chunk
, sizeof(sctp_sack_chunk_t
)))
2826 return sctp_sf_violation_chunklen(ep
, asoc
, type
, arg
,
2829 /* Pull the SACK chunk from the data buffer */
2830 sackh
= sctp_sm_pull_sack(chunk
);
2831 /* Was this a bogus SACK? */
2833 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
2834 chunk
->subh
.sack_hdr
= sackh
;
2835 ctsn
= ntohl(sackh
->cum_tsn_ack
);
2837 /* i) If Cumulative TSN Ack is less than the Cumulative TSN
2838 * Ack Point, then drop the SACK. Since Cumulative TSN
2839 * Ack is monotonically increasing, a SACK whose
2840 * Cumulative TSN Ack is less than the Cumulative TSN Ack
2841 * Point indicates an out-of-order SACK.
2843 if (TSN_lt(ctsn
, asoc
->ctsn_ack_point
)) {
2844 SCTP_DEBUG_PRINTK("ctsn %x\n", ctsn
);
2845 SCTP_DEBUG_PRINTK("ctsn_ack_point %x\n", asoc
->ctsn_ack_point
);
2846 return SCTP_DISPOSITION_DISCARD
;
2849 /* Return this SACK for further processing. */
2850 sctp_add_cmd_sf(commands
, SCTP_CMD_PROCESS_SACK
, SCTP_SACKH(sackh
));
2852 /* Note: We do the rest of the work on the PROCESS_SACK
2855 return SCTP_DISPOSITION_CONSUME
;
2859 * Generate an ABORT in response to a packet.
2861 * Section: 8.4 Handle "Out of the blue" Packets
2863 * 8) The receiver should respond to the sender of the OOTB packet
2864 * with an ABORT. When sending the ABORT, the receiver of the
2865 * OOTB packet MUST fill in the Verification Tag field of the
2866 * outbound packet with the value found in the Verification Tag
2867 * field of the OOTB packet and set the T-bit in the Chunk Flags
2868 * to indicate that no TCB was found. After sending this ABORT,
2869 * the receiver of the OOTB packet shall discard the OOTB packet
2870 * and take no further action.
2874 * The return value is the disposition of the chunk.
2876 sctp_disposition_t
sctp_sf_tabort_8_4_8(const struct sctp_endpoint
*ep
,
2877 const struct sctp_association
*asoc
,
2878 const sctp_subtype_t type
,
2880 sctp_cmd_seq_t
*commands
)
2882 struct sctp_packet
*packet
= NULL
;
2883 struct sctp_chunk
*chunk
= arg
;
2884 struct sctp_chunk
*abort
;
2886 packet
= sctp_ootb_pkt_new(asoc
, chunk
);
2889 /* Make an ABORT. The T bit will be set if the asoc
2892 abort
= sctp_make_abort(asoc
, chunk
, 0);
2894 sctp_ootb_pkt_free(packet
);
2895 return SCTP_DISPOSITION_NOMEM
;
2898 /* Set the skb to the belonging sock for accounting. */
2899 abort
->skb
->sk
= ep
->base
.sk
;
2901 sctp_packet_append_chunk(packet
, abort
);
2903 sctp_add_cmd_sf(commands
, SCTP_CMD_SEND_PKT
,
2904 SCTP_PACKET(packet
));
2906 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS
);
2908 return SCTP_DISPOSITION_CONSUME
;
2911 return SCTP_DISPOSITION_NOMEM
;
2915 * Received an ERROR chunk from peer. Generate SCTP_REMOTE_ERROR
2916 * event as ULP notification for each cause included in the chunk.
2918 * API 5.3.1.3 - SCTP_REMOTE_ERROR
2920 * The return value is the disposition of the chunk.
2922 sctp_disposition_t
sctp_sf_operr_notify(const struct sctp_endpoint
*ep
,
2923 const struct sctp_association
*asoc
,
2924 const sctp_subtype_t type
,
2926 sctp_cmd_seq_t
*commands
)
2928 struct sctp_chunk
*chunk
= arg
;
2929 struct sctp_ulpevent
*ev
;
2931 if (!sctp_vtag_verify(chunk
, asoc
))
2932 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
2934 /* Make sure that the ERROR chunk has a valid length. */
2935 if (!sctp_chunk_length_valid(chunk
, sizeof(sctp_operr_chunk_t
)))
2936 return sctp_sf_violation_chunklen(ep
, asoc
, type
, arg
,
2939 while (chunk
->chunk_end
> chunk
->skb
->data
) {
2940 ev
= sctp_ulpevent_make_remote_error(asoc
, chunk
, 0,
2945 if (!sctp_add_cmd(commands
, SCTP_CMD_EVENT_ULP
,
2946 SCTP_ULPEVENT(ev
))) {
2947 sctp_ulpevent_free(ev
);
2951 sctp_add_cmd_sf(commands
, SCTP_CMD_PROCESS_OPERR
,
2954 return SCTP_DISPOSITION_CONSUME
;
2957 return SCTP_DISPOSITION_NOMEM
;
2961 * Process an inbound SHUTDOWN ACK.
2964 * Upon the receipt of the SHUTDOWN ACK, the SHUTDOWN sender shall
2965 * stop the T2-shutdown timer, send a SHUTDOWN COMPLETE chunk to its
2966 * peer, and remove all record of the association.
2968 * The return value is the disposition.
2970 sctp_disposition_t
sctp_sf_do_9_2_final(const struct sctp_endpoint
*ep
,
2971 const struct sctp_association
*asoc
,
2972 const sctp_subtype_t type
,
2974 sctp_cmd_seq_t
*commands
)
2976 struct sctp_chunk
*chunk
= arg
;
2977 struct sctp_chunk
*reply
;
2978 struct sctp_ulpevent
*ev
;
2980 if (!sctp_vtag_verify(chunk
, asoc
))
2981 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
2983 /* Make sure that the SHUTDOWN_ACK chunk has a valid length. */
2984 if (!sctp_chunk_length_valid(chunk
, sizeof(sctp_chunkhdr_t
)))
2985 return sctp_sf_violation_chunklen(ep
, asoc
, type
, arg
,
2988 /* 10.2 H) SHUTDOWN COMPLETE notification
2990 * When SCTP completes the shutdown procedures (section 9.2) this
2991 * notification is passed to the upper layer.
2993 ev
= sctp_ulpevent_make_assoc_change(asoc
, 0, SCTP_SHUTDOWN_COMP
,
2994 0, 0, 0, GFP_ATOMIC
);
2998 sctp_add_cmd_sf(commands
, SCTP_CMD_EVENT_ULP
, SCTP_ULPEVENT(ev
));
3000 /* Upon the receipt of the SHUTDOWN ACK, the SHUTDOWN sender shall
3001 * stop the T2-shutdown timer,
3003 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_STOP
,
3004 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN
));
3006 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_STOP
,
3007 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD
));
3009 /* ...send a SHUTDOWN COMPLETE chunk to its peer, */
3010 reply
= sctp_make_shutdown_complete(asoc
, chunk
);
3014 sctp_add_cmd_sf(commands
, SCTP_CMD_NEW_STATE
,
3015 SCTP_STATE(SCTP_STATE_CLOSED
));
3016 SCTP_INC_STATS(SCTP_MIB_SHUTDOWNS
);
3017 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB
);
3018 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
, SCTP_CHUNK(reply
));
3020 /* ...and remove all record of the association. */
3021 sctp_add_cmd_sf(commands
, SCTP_CMD_DELETE_TCB
, SCTP_NULL());
3022 return SCTP_DISPOSITION_DELETE_TCB
;
3025 return SCTP_DISPOSITION_NOMEM
;
3029 * RFC 2960, 8.4 - Handle "Out of the blue" Packets
3030 * 5) If the packet contains a SHUTDOWN ACK chunk, the receiver should
3031 * respond to the sender of the OOTB packet with a SHUTDOWN COMPLETE.
3032 * When sending the SHUTDOWN COMPLETE, the receiver of the OOTB
3033 * packet must fill in the Verification Tag field of the outbound
3034 * packet with the Verification Tag received in the SHUTDOWN ACK and
3035 * set the T-bit in the Chunk Flags to indicate that no TCB was
3038 * 8) The receiver should respond to the sender of the OOTB packet with
3039 * an ABORT. When sending the ABORT, the receiver of the OOTB packet
3040 * MUST fill in the Verification Tag field of the outbound packet
3041 * with the value found in the Verification Tag field of the OOTB
3042 * packet and set the T-bit in the Chunk Flags to indicate that no
3043 * TCB was found. After sending this ABORT, the receiver of the OOTB
3044 * packet shall discard the OOTB packet and take no further action.
3046 sctp_disposition_t
sctp_sf_ootb(const struct sctp_endpoint
*ep
,
3047 const struct sctp_association
*asoc
,
3048 const sctp_subtype_t type
,
3050 sctp_cmd_seq_t
*commands
)
3052 struct sctp_chunk
*chunk
= arg
;
3053 struct sk_buff
*skb
= chunk
->skb
;
3054 sctp_chunkhdr_t
*ch
;
3056 int ootb_shut_ack
= 0;
3058 SCTP_INC_STATS(SCTP_MIB_OUTOFBLUES
);
3060 ch
= (sctp_chunkhdr_t
*) chunk
->chunk_hdr
;
3062 /* Break out if chunk length is less then minimal. */
3063 if (ntohs(ch
->length
) < sizeof(sctp_chunkhdr_t
))
3066 ch_end
= ((__u8
*)ch
) + WORD_ROUND(ntohs(ch
->length
));
3068 if (SCTP_CID_SHUTDOWN_ACK
== ch
->type
)
3071 /* RFC 2960, Section 3.3.7
3072 * Moreover, under any circumstances, an endpoint that
3073 * receives an ABORT MUST NOT respond to that ABORT by
3074 * sending an ABORT of its own.
3076 if (SCTP_CID_ABORT
== ch
->type
)
3077 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
3079 ch
= (sctp_chunkhdr_t
*) ch_end
;
3080 } while (ch_end
< skb
->tail
);
3083 sctp_sf_shut_8_4_5(ep
, asoc
, type
, arg
, commands
);
3085 sctp_sf_tabort_8_4_8(ep
, asoc
, type
, arg
, commands
);
3087 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
3091 * Handle an "Out of the blue" SHUTDOWN ACK.
3094 * 5) If the packet contains a SHUTDOWN ACK chunk, the receiver should
3095 * respond to the sender of the OOTB packet with a SHUTDOWN COMPLETE.
3096 * When sending the SHUTDOWN COMPLETE, the receiver of the OOTB packet
3097 * must fill in the Verification Tag field of the outbound packet with
3098 * the Verification Tag received in the SHUTDOWN ACK and set the
3099 * T-bit in the Chunk Flags to indicate that no TCB was found.
3102 * (endpoint, asoc, type, arg, commands)
3105 * (sctp_disposition_t)
3107 * The return value is the disposition of the chunk.
3109 static sctp_disposition_t
sctp_sf_shut_8_4_5(const struct sctp_endpoint
*ep
,
3110 const struct sctp_association
*asoc
,
3111 const sctp_subtype_t type
,
3113 sctp_cmd_seq_t
*commands
)
3115 struct sctp_packet
*packet
= NULL
;
3116 struct sctp_chunk
*chunk
= arg
;
3117 struct sctp_chunk
*shut
;
3119 packet
= sctp_ootb_pkt_new(asoc
, chunk
);
3122 /* Make an SHUTDOWN_COMPLETE.
3123 * The T bit will be set if the asoc is NULL.
3125 shut
= sctp_make_shutdown_complete(asoc
, chunk
);
3127 sctp_ootb_pkt_free(packet
);
3128 return SCTP_DISPOSITION_NOMEM
;
3131 /* Set the skb to the belonging sock for accounting. */
3132 shut
->skb
->sk
= ep
->base
.sk
;
3134 sctp_packet_append_chunk(packet
, shut
);
3136 sctp_add_cmd_sf(commands
, SCTP_CMD_SEND_PKT
,
3137 SCTP_PACKET(packet
));
3139 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS
);
3141 /* If the chunk length is invalid, we don't want to process
3142 * the reset of the packet.
3144 if (!sctp_chunk_length_valid(chunk
, sizeof(sctp_chunkhdr_t
)))
3145 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
3147 return SCTP_DISPOSITION_CONSUME
;
3150 return SCTP_DISPOSITION_NOMEM
;
3154 * Handle SHUTDOWN ACK in COOKIE_ECHOED or COOKIE_WAIT state.
3156 * Verification Tag: 8.5.1 E) Rules for packet carrying a SHUTDOWN ACK
3157 * If the receiver is in COOKIE-ECHOED or COOKIE-WAIT state the
3158 * procedures in section 8.4 SHOULD be followed, in other words it
3159 * should be treated as an Out Of The Blue packet.
3160 * [This means that we do NOT check the Verification Tag on these
3164 sctp_disposition_t
sctp_sf_do_8_5_1_E_sa(const struct sctp_endpoint
*ep
,
3165 const struct sctp_association
*asoc
,
3166 const sctp_subtype_t type
,
3168 sctp_cmd_seq_t
*commands
)
3170 /* Although we do have an association in this case, it corresponds
3171 * to a restarted association. So the packet is treated as an OOTB
3172 * packet and the state function that handles OOTB SHUTDOWN_ACK is
3173 * called with a NULL association.
3175 return sctp_sf_shut_8_4_5(ep
, NULL
, type
, arg
, commands
);
3178 /* ADDIP Section 4.2 Upon reception of an ASCONF Chunk. */
3179 sctp_disposition_t
sctp_sf_do_asconf(const struct sctp_endpoint
*ep
,
3180 const struct sctp_association
*asoc
,
3181 const sctp_subtype_t type
, void *arg
,
3182 sctp_cmd_seq_t
*commands
)
3184 struct sctp_chunk
*chunk
= arg
;
3185 struct sctp_chunk
*asconf_ack
= NULL
;
3186 sctp_addiphdr_t
*hdr
;
3189 if (!sctp_vtag_verify(chunk
, asoc
)) {
3190 sctp_add_cmd_sf(commands
, SCTP_CMD_REPORT_BAD_TAG
,
3192 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
3195 /* Make sure that the ASCONF ADDIP chunk has a valid length. */
3196 if (!sctp_chunk_length_valid(chunk
, sizeof(sctp_addip_chunk_t
)))
3197 return sctp_sf_violation_chunklen(ep
, asoc
, type
, arg
,
3200 hdr
= (sctp_addiphdr_t
*)chunk
->skb
->data
;
3201 serial
= ntohl(hdr
->serial
);
3203 /* ADDIP 4.2 C1) Compare the value of the serial number to the value
3204 * the endpoint stored in a new association variable
3205 * 'Peer-Serial-Number'.
3207 if (serial
== asoc
->peer
.addip_serial
+ 1) {
3208 /* ADDIP 4.2 C2) If the value found in the serial number is
3209 * equal to the ('Peer-Serial-Number' + 1), the endpoint MUST
3212 asconf_ack
= sctp_process_asconf((struct sctp_association
*)
3215 return SCTP_DISPOSITION_NOMEM
;
3216 } else if (serial
== asoc
->peer
.addip_serial
) {
3217 /* ADDIP 4.2 C3) If the value found in the serial number is
3218 * equal to the value stored in the 'Peer-Serial-Number'
3219 * IMPLEMENTATION NOTE: As an optimization a receiver may wish
3220 * to save the last ASCONF-ACK for some predetermined period of
3221 * time and instead of re-processing the ASCONF (with the same
3222 * serial number) it may just re-transmit the ASCONF-ACK.
3224 if (asoc
->addip_last_asconf_ack
)
3225 asconf_ack
= asoc
->addip_last_asconf_ack
;
3227 return SCTP_DISPOSITION_DISCARD
;
3229 /* ADDIP 4.2 C4) Otherwise, the ASCONF Chunk is discarded since
3230 * it must be either a stale packet or from an attacker.
3232 return SCTP_DISPOSITION_DISCARD
;
3235 /* ADDIP 4.2 C5) In both cases C2 and C3 the ASCONF-ACK MUST be sent
3236 * back to the source address contained in the IP header of the ASCONF
3237 * being responded to.
3239 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
, SCTP_CHUNK(asconf_ack
));
3241 return SCTP_DISPOSITION_CONSUME
;
3245 * ADDIP Section 4.3 General rules for address manipulation
3246 * When building TLV parameters for the ASCONF Chunk that will add or
3247 * delete IP addresses the D0 to D13 rules should be applied:
3249 sctp_disposition_t
sctp_sf_do_asconf_ack(const struct sctp_endpoint
*ep
,
3250 const struct sctp_association
*asoc
,
3251 const sctp_subtype_t type
, void *arg
,
3252 sctp_cmd_seq_t
*commands
)
3254 struct sctp_chunk
*asconf_ack
= arg
;
3255 struct sctp_chunk
*last_asconf
= asoc
->addip_last_asconf
;
3256 struct sctp_chunk
*abort
;
3257 sctp_addiphdr_t
*addip_hdr
;
3258 __u32 sent_serial
, rcvd_serial
;
3260 if (!sctp_vtag_verify(asconf_ack
, asoc
)) {
3261 sctp_add_cmd_sf(commands
, SCTP_CMD_REPORT_BAD_TAG
,
3263 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
3266 /* Make sure that the ADDIP chunk has a valid length. */
3267 if (!sctp_chunk_length_valid(asconf_ack
, sizeof(sctp_addip_chunk_t
)))
3268 return sctp_sf_violation_chunklen(ep
, asoc
, type
, arg
,
3271 addip_hdr
= (sctp_addiphdr_t
*)asconf_ack
->skb
->data
;
3272 rcvd_serial
= ntohl(addip_hdr
->serial
);
3275 addip_hdr
= (sctp_addiphdr_t
*)last_asconf
->subh
.addip_hdr
;
3276 sent_serial
= ntohl(addip_hdr
->serial
);
3278 sent_serial
= asoc
->addip_serial
- 1;
3281 /* D0) If an endpoint receives an ASCONF-ACK that is greater than or
3282 * equal to the next serial number to be used but no ASCONF chunk is
3283 * outstanding the endpoint MUST ABORT the association. Note that a
3284 * sequence number is greater than if it is no more than 2^^31-1
3285 * larger than the current sequence number (using serial arithmetic).
3287 if (ADDIP_SERIAL_gte(rcvd_serial
, sent_serial
+ 1) &&
3288 !(asoc
->addip_last_asconf
)) {
3289 abort
= sctp_make_abort(asoc
, asconf_ack
,
3290 sizeof(sctp_errhdr_t
));
3292 sctp_init_cause(abort
, SCTP_ERROR_ASCONF_ACK
, NULL
, 0);
3293 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
,
3296 /* We are going to ABORT, so we might as well stop
3297 * processing the rest of the chunks in the packet.
3299 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_STOP
,
3300 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO
));
3301 sctp_add_cmd_sf(commands
, SCTP_CMD_DISCARD_PACKET
,SCTP_NULL());
3302 sctp_add_cmd_sf(commands
, SCTP_CMD_ASSOC_FAILED
,
3303 SCTP_U32(SCTP_ERROR_ASCONF_ACK
));
3304 SCTP_INC_STATS(SCTP_MIB_ABORTEDS
);
3305 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB
);
3306 return SCTP_DISPOSITION_ABORT
;
3309 if ((rcvd_serial
== sent_serial
) && asoc
->addip_last_asconf
) {
3310 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_STOP
,
3311 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO
));
3313 if (!sctp_process_asconf_ack((struct sctp_association
*)asoc
,
3315 return SCTP_DISPOSITION_CONSUME
;
3317 abort
= sctp_make_abort(asoc
, asconf_ack
,
3318 sizeof(sctp_errhdr_t
));
3320 sctp_init_cause(abort
, SCTP_ERROR_RSRC_LOW
, NULL
, 0);
3321 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
,
3324 /* We are going to ABORT, so we might as well stop
3325 * processing the rest of the chunks in the packet.
3327 sctp_add_cmd_sf(commands
, SCTP_CMD_DISCARD_PACKET
,SCTP_NULL());
3328 sctp_add_cmd_sf(commands
, SCTP_CMD_ASSOC_FAILED
,
3329 SCTP_U32(SCTP_ERROR_ASCONF_ACK
));
3330 SCTP_INC_STATS(SCTP_MIB_ABORTEDS
);
3331 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB
);
3332 return SCTP_DISPOSITION_ABORT
;
3335 return SCTP_DISPOSITION_DISCARD
;
3339 * PR-SCTP Section 3.6 Receiver Side Implementation of PR-SCTP
3341 * When a FORWARD TSN chunk arrives, the data receiver MUST first update
3342 * its cumulative TSN point to the value carried in the FORWARD TSN
3343 * chunk, and then MUST further advance its cumulative TSN point locally
3345 * After the above processing, the data receiver MUST stop reporting any
3346 * missing TSNs earlier than or equal to the new cumulative TSN point.
3348 * Verification Tag: 8.5 Verification Tag [Normal verification]
3350 * The return value is the disposition of the chunk.
3352 sctp_disposition_t
sctp_sf_eat_fwd_tsn(const struct sctp_endpoint
*ep
,
3353 const struct sctp_association
*asoc
,
3354 const sctp_subtype_t type
,
3356 sctp_cmd_seq_t
*commands
)
3358 struct sctp_chunk
*chunk
= arg
;
3359 struct sctp_fwdtsn_hdr
*fwdtsn_hdr
;
3363 if (!sctp_vtag_verify(chunk
, asoc
)) {
3364 sctp_add_cmd_sf(commands
, SCTP_CMD_REPORT_BAD_TAG
,
3366 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
3369 /* Make sure that the FORWARD_TSN chunk has valid length. */
3370 if (!sctp_chunk_length_valid(chunk
, sizeof(struct sctp_fwdtsn_chunk
)))
3371 return sctp_sf_violation_chunklen(ep
, asoc
, type
, arg
,
3374 fwdtsn_hdr
= (struct sctp_fwdtsn_hdr
*)chunk
->skb
->data
;
3375 chunk
->subh
.fwdtsn_hdr
= fwdtsn_hdr
;
3376 len
= ntohs(chunk
->chunk_hdr
->length
);
3377 len
-= sizeof(struct sctp_chunkhdr
);
3378 skb_pull(chunk
->skb
, len
);
3380 tsn
= ntohl(fwdtsn_hdr
->new_cum_tsn
);
3381 SCTP_DEBUG_PRINTK("%s: TSN 0x%x.\n", __FUNCTION__
, tsn
);
3383 /* The TSN is too high--silently discard the chunk and count on it
3384 * getting retransmitted later.
3386 if (sctp_tsnmap_check(&asoc
->peer
.tsn_map
, tsn
) < 0)
3387 goto discard_noforce
;
3389 sctp_add_cmd_sf(commands
, SCTP_CMD_REPORT_FWDTSN
, SCTP_U32(tsn
));
3390 if (len
> sizeof(struct sctp_fwdtsn_hdr
))
3391 sctp_add_cmd_sf(commands
, SCTP_CMD_PROCESS_FWDTSN
,
3394 /* Count this as receiving DATA. */
3395 if (asoc
->autoclose
) {
3396 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_RESTART
,
3397 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE
));
3400 /* FIXME: For now send a SACK, but DATA processing may
3403 sctp_add_cmd_sf(commands
, SCTP_CMD_GEN_SACK
, SCTP_NOFORCE());
3404 /* Start the SACK timer. */
3405 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_RESTART
,
3406 SCTP_TO(SCTP_EVENT_TIMEOUT_SACK
));
3408 return SCTP_DISPOSITION_CONSUME
;
3411 return SCTP_DISPOSITION_DISCARD
;
3414 sctp_disposition_t
sctp_sf_eat_fwd_tsn_fast(
3415 const struct sctp_endpoint
*ep
,
3416 const struct sctp_association
*asoc
,
3417 const sctp_subtype_t type
,
3419 sctp_cmd_seq_t
*commands
)
3421 struct sctp_chunk
*chunk
= arg
;
3422 struct sctp_fwdtsn_hdr
*fwdtsn_hdr
;
3426 if (!sctp_vtag_verify(chunk
, asoc
)) {
3427 sctp_add_cmd_sf(commands
, SCTP_CMD_REPORT_BAD_TAG
,
3429 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
3432 /* Make sure that the FORWARD_TSN chunk has a valid length. */
3433 if (!sctp_chunk_length_valid(chunk
, sizeof(struct sctp_fwdtsn_chunk
)))
3434 return sctp_sf_violation_chunklen(ep
, asoc
, type
, arg
,
3437 fwdtsn_hdr
= (struct sctp_fwdtsn_hdr
*)chunk
->skb
->data
;
3438 chunk
->subh
.fwdtsn_hdr
= fwdtsn_hdr
;
3439 len
= ntohs(chunk
->chunk_hdr
->length
);
3440 len
-= sizeof(struct sctp_chunkhdr
);
3441 skb_pull(chunk
->skb
, len
);
3443 tsn
= ntohl(fwdtsn_hdr
->new_cum_tsn
);
3444 SCTP_DEBUG_PRINTK("%s: TSN 0x%x.\n", __FUNCTION__
, tsn
);
3446 /* The TSN is too high--silently discard the chunk and count on it
3447 * getting retransmitted later.
3449 if (sctp_tsnmap_check(&asoc
->peer
.tsn_map
, tsn
) < 0)
3452 sctp_add_cmd_sf(commands
, SCTP_CMD_REPORT_FWDTSN
, SCTP_U32(tsn
));
3453 if (len
> sizeof(struct sctp_fwdtsn_hdr
))
3454 sctp_add_cmd_sf(commands
, SCTP_CMD_PROCESS_FWDTSN
,
3457 /* Go a head and force a SACK, since we are shutting down. */
3459 /* Implementor's Guide.
3461 * While in SHUTDOWN-SENT state, the SHUTDOWN sender MUST immediately
3462 * respond to each received packet containing one or more DATA chunk(s)
3463 * with a SACK, a SHUTDOWN chunk, and restart the T2-shutdown timer
3465 sctp_add_cmd_sf(commands
, SCTP_CMD_GEN_SHUTDOWN
, SCTP_NULL());
3466 sctp_add_cmd_sf(commands
, SCTP_CMD_GEN_SACK
, SCTP_FORCE());
3467 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_RESTART
,
3468 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN
));
3470 return SCTP_DISPOSITION_CONSUME
;
3474 * Process an unknown chunk.
3476 * Section: 3.2. Also, 2.1 in the implementor's guide.
3478 * Chunk Types are encoded such that the highest-order two bits specify
3479 * the action that must be taken if the processing endpoint does not
3480 * recognize the Chunk Type.
3482 * 00 - Stop processing this SCTP packet and discard it, do not process
3483 * any further chunks within it.
3485 * 01 - Stop processing this SCTP packet and discard it, do not process
3486 * any further chunks within it, and report the unrecognized
3487 * chunk in an 'Unrecognized Chunk Type'.
3489 * 10 - Skip this chunk and continue processing.
3491 * 11 - Skip this chunk and continue processing, but report in an ERROR
3492 * Chunk using the 'Unrecognized Chunk Type' cause of error.
3494 * The return value is the disposition of the chunk.
3496 sctp_disposition_t
sctp_sf_unk_chunk(const struct sctp_endpoint
*ep
,
3497 const struct sctp_association
*asoc
,
3498 const sctp_subtype_t type
,
3500 sctp_cmd_seq_t
*commands
)
3502 struct sctp_chunk
*unk_chunk
= arg
;
3503 struct sctp_chunk
*err_chunk
;
3504 sctp_chunkhdr_t
*hdr
;
3506 SCTP_DEBUG_PRINTK("Processing the unknown chunk id %d.\n", type
.chunk
);
3508 if (!sctp_vtag_verify(unk_chunk
, asoc
))
3509 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
3511 /* Make sure that the chunk has a valid length.
3512 * Since we don't know the chunk type, we use a general
3513 * chunkhdr structure to make a comparison.
3515 if (!sctp_chunk_length_valid(unk_chunk
, sizeof(sctp_chunkhdr_t
)))
3516 return sctp_sf_violation_chunklen(ep
, asoc
, type
, arg
,
3519 switch (type
.chunk
& SCTP_CID_ACTION_MASK
) {
3520 case SCTP_CID_ACTION_DISCARD
:
3521 /* Discard the packet. */
3522 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
3524 case SCTP_CID_ACTION_DISCARD_ERR
:
3525 /* Discard the packet. */
3526 sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
3528 /* Generate an ERROR chunk as response. */
3529 hdr
= unk_chunk
->chunk_hdr
;
3530 err_chunk
= sctp_make_op_error(asoc
, unk_chunk
,
3531 SCTP_ERROR_UNKNOWN_CHUNK
, hdr
,
3532 WORD_ROUND(ntohs(hdr
->length
)));
3534 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
,
3535 SCTP_CHUNK(err_chunk
));
3537 return SCTP_DISPOSITION_CONSUME
;
3539 case SCTP_CID_ACTION_SKIP
:
3540 /* Skip the chunk. */
3541 return SCTP_DISPOSITION_DISCARD
;
3543 case SCTP_CID_ACTION_SKIP_ERR
:
3544 /* Generate an ERROR chunk as response. */
3545 hdr
= unk_chunk
->chunk_hdr
;
3546 err_chunk
= sctp_make_op_error(asoc
, unk_chunk
,
3547 SCTP_ERROR_UNKNOWN_CHUNK
, hdr
,
3548 WORD_ROUND(ntohs(hdr
->length
)));
3550 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
,
3551 SCTP_CHUNK(err_chunk
));
3553 /* Skip the chunk. */
3554 return SCTP_DISPOSITION_CONSUME
;
3560 return SCTP_DISPOSITION_DISCARD
;
3564 * Discard the chunk.
3566 * Section: 0.2, 5.2.3, 5.2.5, 5.2.6, 6.0, 8.4.6, 8.5.1c, 9.2
3567 * [Too numerous to mention...]
3568 * Verification Tag: No verification needed.
3570 * (endpoint, asoc, chunk)
3573 * (asoc, reply_msg, msg_up, timers, counters)
3575 * The return value is the disposition of the chunk.
3577 sctp_disposition_t
sctp_sf_discard_chunk(const struct sctp_endpoint
*ep
,
3578 const struct sctp_association
*asoc
,
3579 const sctp_subtype_t type
,
3581 sctp_cmd_seq_t
*commands
)
3583 SCTP_DEBUG_PRINTK("Chunk %d is discarded\n", type
.chunk
);
3584 return SCTP_DISPOSITION_DISCARD
;
3588 * Discard the whole packet.
3592 * 2) If the OOTB packet contains an ABORT chunk, the receiver MUST
3593 * silently discard the OOTB packet and take no further action.
3596 * Verification Tag: No verification necessary
3599 * (endpoint, asoc, chunk)
3602 * (asoc, reply_msg, msg_up, timers, counters)
3604 * The return value is the disposition of the chunk.
3606 sctp_disposition_t
sctp_sf_pdiscard(const struct sctp_endpoint
*ep
,
3607 const struct sctp_association
*asoc
,
3608 const sctp_subtype_t type
,
3610 sctp_cmd_seq_t
*commands
)
3612 sctp_add_cmd_sf(commands
, SCTP_CMD_DISCARD_PACKET
, SCTP_NULL());
3614 return SCTP_DISPOSITION_CONSUME
;
3619 * The other end is violating protocol.
3621 * Section: Not specified
3622 * Verification Tag: Not specified
3624 * (endpoint, asoc, chunk)
3627 * (asoc, reply_msg, msg_up, timers, counters)
3629 * We simply tag the chunk as a violation. The state machine will log
3630 * the violation and continue.
3632 sctp_disposition_t
sctp_sf_violation(const struct sctp_endpoint
*ep
,
3633 const struct sctp_association
*asoc
,
3634 const sctp_subtype_t type
,
3636 sctp_cmd_seq_t
*commands
)
3638 return SCTP_DISPOSITION_VIOLATION
;
3643 * Handle a protocol violation when the chunk length is invalid.
3644 * "Invalid" length is identified as smaller then the minimal length a
3645 * given chunk can be. For example, a SACK chunk has invalid length
3646 * if it's length is set to be smaller then the size of sctp_sack_chunk_t.
3648 * We inform the other end by sending an ABORT with a Protocol Violation
3651 * Section: Not specified
3652 * Verification Tag: Nothing to do
3654 * (endpoint, asoc, chunk)
3657 * (reply_msg, msg_up, counters)
3659 * Generate an ABORT chunk and terminate the association.
3661 sctp_disposition_t
sctp_sf_violation_chunklen(const struct sctp_endpoint
*ep
,
3662 const struct sctp_association
*asoc
,
3663 const sctp_subtype_t type
,
3665 sctp_cmd_seq_t
*commands
)
3667 struct sctp_chunk
*chunk
= arg
;
3668 struct sctp_chunk
*abort
= NULL
;
3669 char err_str
[]="The following chunk had invalid length:";
3671 /* Make the abort chunk. */
3672 abort
= sctp_make_abort_violation(asoc
, chunk
, err_str
,
3677 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
, SCTP_CHUNK(abort
));
3678 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS
);
3680 if (asoc
->state
<= SCTP_STATE_COOKIE_ECHOED
) {
3681 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_STOP
,
3682 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT
));
3683 sctp_add_cmd_sf(commands
, SCTP_CMD_INIT_FAILED
,
3684 SCTP_U32(SCTP_ERROR_PROTO_VIOLATION
));
3686 sctp_add_cmd_sf(commands
, SCTP_CMD_ASSOC_FAILED
,
3687 SCTP_U32(SCTP_ERROR_PROTO_VIOLATION
));
3688 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB
);
3691 sctp_add_cmd_sf(commands
, SCTP_CMD_DISCARD_PACKET
, SCTP_NULL());
3693 SCTP_INC_STATS(SCTP_MIB_ABORTEDS
);
3695 return SCTP_DISPOSITION_ABORT
;
3698 return SCTP_DISPOSITION_NOMEM
;
3701 /***************************************************************************
3702 * These are the state functions for handling primitive (Section 10) events.
3703 ***************************************************************************/
3705 * sctp_sf_do_prm_asoc
3707 * Section: 10.1 ULP-to-SCTP
3710 * Format: ASSOCIATE(local SCTP instance name, destination transport addr,
3711 * outbound stream count)
3712 * -> association id [,destination transport addr list] [,outbound stream
3715 * This primitive allows the upper layer to initiate an association to a
3716 * specific peer endpoint.
3718 * The peer endpoint shall be specified by one of the transport addresses
3719 * which defines the endpoint (see Section 1.4). If the local SCTP
3720 * instance has not been initialized, the ASSOCIATE is considered an
3722 * [This is not relevant for the kernel implementation since we do all
3723 * initialization at boot time. It we hadn't initialized we wouldn't
3724 * get anywhere near this code.]
3726 * An association id, which is a local handle to the SCTP association,
3727 * will be returned on successful establishment of the association. If
3728 * SCTP is not able to open an SCTP association with the peer endpoint,
3729 * an error is returned.
3730 * [In the kernel implementation, the struct sctp_association needs to
3731 * be created BEFORE causing this primitive to run.]
3733 * Other association parameters may be returned, including the
3734 * complete destination transport addresses of the peer as well as the
3735 * outbound stream count of the local endpoint. One of the transport
3736 * address from the returned destination addresses will be selected by
3737 * the local endpoint as default primary path for sending SCTP packets
3738 * to this peer. The returned "destination transport addr list" can
3739 * be used by the ULP to change the default primary path or to force
3740 * sending a packet to a specific transport address. [All of this
3741 * stuff happens when the INIT ACK arrives. This is a NON-BLOCKING
3744 * Mandatory attributes:
3746 * o local SCTP instance name - obtained from the INITIALIZE operation.
3747 * [This is the argument asoc.]
3748 * o destination transport addr - specified as one of the transport
3749 * addresses of the peer endpoint with which the association is to be
3751 * [This is asoc->peer.active_path.]
3752 * o outbound stream count - the number of outbound streams the ULP
3753 * would like to open towards this peer endpoint.
3754 * [BUG: This is not currently implemented.]
3755 * Optional attributes:
3759 * The return value is a disposition.
3761 sctp_disposition_t
sctp_sf_do_prm_asoc(const struct sctp_endpoint
*ep
,
3762 const struct sctp_association
*asoc
,
3763 const sctp_subtype_t type
,
3765 sctp_cmd_seq_t
*commands
)
3767 struct sctp_chunk
*repl
;
3769 /* The comment below says that we enter COOKIE-WAIT AFTER
3770 * sending the INIT, but that doesn't actually work in our
3773 sctp_add_cmd_sf(commands
, SCTP_CMD_NEW_STATE
,
3774 SCTP_STATE(SCTP_STATE_COOKIE_WAIT
));
3776 /* RFC 2960 5.1 Normal Establishment of an Association
3778 * A) "A" first sends an INIT chunk to "Z". In the INIT, "A"
3779 * must provide its Verification Tag (Tag_A) in the Initiate
3780 * Tag field. Tag_A SHOULD be a random number in the range of
3781 * 1 to 4294967295 (see 5.3.1 for Tag value selection). ...
3784 repl
= sctp_make_init(asoc
, &asoc
->base
.bind_addr
, GFP_ATOMIC
, 0);
3788 /* Cast away the const modifier, as we want to just
3789 * rerun it through as a sideffect.
3791 sctp_add_cmd_sf(commands
, SCTP_CMD_NEW_ASOC
,
3792 SCTP_ASOC((struct sctp_association
*) asoc
));
3794 /* After sending the INIT, "A" starts the T1-init timer and
3795 * enters the COOKIE-WAIT state.
3797 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_START
,
3798 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT
));
3799 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
, SCTP_CHUNK(repl
));
3800 return SCTP_DISPOSITION_CONSUME
;
3803 return SCTP_DISPOSITION_NOMEM
;
3807 * Process the SEND primitive.
3809 * Section: 10.1 ULP-to-SCTP
3812 * Format: SEND(association id, buffer address, byte count [,context]
3813 * [,stream id] [,life time] [,destination transport address]
3814 * [,unorder flag] [,no-bundle flag] [,payload protocol-id] )
3817 * This is the main method to send user data via SCTP.
3819 * Mandatory attributes:
3821 * o association id - local handle to the SCTP association
3823 * o buffer address - the location where the user message to be
3824 * transmitted is stored;
3826 * o byte count - The size of the user data in number of bytes;
3828 * Optional attributes:
3830 * o context - an optional 32 bit integer that will be carried in the
3831 * sending failure notification to the ULP if the transportation of
3832 * this User Message fails.
3834 * o stream id - to indicate which stream to send the data on. If not
3835 * specified, stream 0 will be used.
3837 * o life time - specifies the life time of the user data. The user data
3838 * will not be sent by SCTP after the life time expires. This
3839 * parameter can be used to avoid efforts to transmit stale
3840 * user messages. SCTP notifies the ULP if the data cannot be
3841 * initiated to transport (i.e. sent to the destination via SCTP's
3842 * send primitive) within the life time variable. However, the
3843 * user data will be transmitted if SCTP has attempted to transmit a
3844 * chunk before the life time expired.
3846 * o destination transport address - specified as one of the destination
3847 * transport addresses of the peer endpoint to which this packet
3848 * should be sent. Whenever possible, SCTP should use this destination
3849 * transport address for sending the packets, instead of the current
3852 * o unorder flag - this flag, if present, indicates that the user
3853 * would like the data delivered in an unordered fashion to the peer
3854 * (i.e., the U flag is set to 1 on all DATA chunks carrying this
3857 * o no-bundle flag - instructs SCTP not to bundle this user data with
3858 * other outbound DATA chunks. SCTP MAY still bundle even when
3859 * this flag is present, when faced with network congestion.
3861 * o payload protocol-id - A 32 bit unsigned integer that is to be
3862 * passed to the peer indicating the type of payload protocol data
3863 * being transmitted. This value is passed as opaque data by SCTP.
3865 * The return value is the disposition.
3867 sctp_disposition_t
sctp_sf_do_prm_send(const struct sctp_endpoint
*ep
,
3868 const struct sctp_association
*asoc
,
3869 const sctp_subtype_t type
,
3871 sctp_cmd_seq_t
*commands
)
3873 struct sctp_chunk
*chunk
= arg
;
3875 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
, SCTP_CHUNK(chunk
));
3876 return SCTP_DISPOSITION_CONSUME
;
3880 * Process the SHUTDOWN primitive.
3885 * Format: SHUTDOWN(association id)
3888 * Gracefully closes an association. Any locally queued user data
3889 * will be delivered to the peer. The association will be terminated only
3890 * after the peer acknowledges all the SCTP packets sent. A success code
3891 * will be returned on successful termination of the association. If
3892 * attempting to terminate the association results in a failure, an error
3893 * code shall be returned.
3895 * Mandatory attributes:
3897 * o association id - local handle to the SCTP association
3899 * Optional attributes:
3903 * The return value is the disposition.
3905 sctp_disposition_t
sctp_sf_do_9_2_prm_shutdown(
3906 const struct sctp_endpoint
*ep
,
3907 const struct sctp_association
*asoc
,
3908 const sctp_subtype_t type
,
3910 sctp_cmd_seq_t
*commands
)
3914 /* From 9.2 Shutdown of an Association
3915 * Upon receipt of the SHUTDOWN primitive from its upper
3916 * layer, the endpoint enters SHUTDOWN-PENDING state and
3917 * remains there until all outstanding data has been
3918 * acknowledged by its peer. The endpoint accepts no new data
3919 * from its upper layer, but retransmits data to the far end
3920 * if necessary to fill gaps.
3922 sctp_add_cmd_sf(commands
, SCTP_CMD_NEW_STATE
,
3923 SCTP_STATE(SCTP_STATE_SHUTDOWN_PENDING
));
3925 /* sctpimpguide-05 Section 2.12.2
3926 * The sender of the SHUTDOWN MAY also start an overall guard timer
3927 * 'T5-shutdown-guard' to bound the overall time for shutdown sequence.
3929 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_START
,
3930 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD
));
3932 disposition
= SCTP_DISPOSITION_CONSUME
;
3933 if (sctp_outq_is_empty(&asoc
->outqueue
)) {
3934 disposition
= sctp_sf_do_9_2_start_shutdown(ep
, asoc
, type
,
3941 * Process the ABORT primitive.
3946 * Format: Abort(association id [, cause code])
3949 * Ungracefully closes an association. Any locally queued user data
3950 * will be discarded and an ABORT chunk is sent to the peer. A success code
3951 * will be returned on successful abortion of the association. If
3952 * attempting to abort the association results in a failure, an error
3953 * code shall be returned.
3955 * Mandatory attributes:
3957 * o association id - local handle to the SCTP association
3959 * Optional attributes:
3961 * o cause code - reason of the abort to be passed to the peer
3965 * The return value is the disposition.
3967 sctp_disposition_t
sctp_sf_do_9_1_prm_abort(
3968 const struct sctp_endpoint
*ep
,
3969 const struct sctp_association
*asoc
,
3970 const sctp_subtype_t type
,
3972 sctp_cmd_seq_t
*commands
)
3974 /* From 9.1 Abort of an Association
3975 * Upon receipt of the ABORT primitive from its upper
3976 * layer, the endpoint enters CLOSED state and
3977 * discard all outstanding data has been
3978 * acknowledged by its peer. The endpoint accepts no new data
3979 * from its upper layer, but retransmits data to the far end
3980 * if necessary to fill gaps.
3982 struct msghdr
*msg
= arg
;
3983 struct sctp_chunk
*abort
;
3984 sctp_disposition_t retval
;
3986 retval
= SCTP_DISPOSITION_CONSUME
;
3988 /* Generate ABORT chunk to send the peer. */
3989 abort
= sctp_make_abort_user(asoc
, NULL
, msg
);
3991 retval
= SCTP_DISPOSITION_NOMEM
;
3993 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
, SCTP_CHUNK(abort
));
3995 /* Even if we can't send the ABORT due to low memory delete the
3996 * TCB. This is a departure from our typical NOMEM handling.
3999 /* Delete the established association. */
4000 sctp_add_cmd_sf(commands
, SCTP_CMD_ASSOC_FAILED
,
4001 SCTP_U32(SCTP_ERROR_USER_ABORT
));
4003 SCTP_INC_STATS(SCTP_MIB_ABORTEDS
);
4004 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB
);
4009 /* We tried an illegal operation on an association which is closed. */
4010 sctp_disposition_t
sctp_sf_error_closed(const struct sctp_endpoint
*ep
,
4011 const struct sctp_association
*asoc
,
4012 const sctp_subtype_t type
,
4014 sctp_cmd_seq_t
*commands
)
4016 sctp_add_cmd_sf(commands
, SCTP_CMD_REPORT_ERROR
, SCTP_ERROR(-EINVAL
));
4017 return SCTP_DISPOSITION_CONSUME
;
4020 /* We tried an illegal operation on an association which is shutting
4023 sctp_disposition_t
sctp_sf_error_shutdown(const struct sctp_endpoint
*ep
,
4024 const struct sctp_association
*asoc
,
4025 const sctp_subtype_t type
,
4027 sctp_cmd_seq_t
*commands
)
4029 sctp_add_cmd_sf(commands
, SCTP_CMD_REPORT_ERROR
,
4030 SCTP_ERROR(-ESHUTDOWN
));
4031 return SCTP_DISPOSITION_CONSUME
;
4035 * sctp_cookie_wait_prm_shutdown
4037 * Section: 4 Note: 2
4042 * The RFC does not explicitly address this issue, but is the route through the
4043 * state table when someone issues a shutdown while in COOKIE_WAIT state.
4048 sctp_disposition_t
sctp_sf_cookie_wait_prm_shutdown(
4049 const struct sctp_endpoint
*ep
,
4050 const struct sctp_association
*asoc
,
4051 const sctp_subtype_t type
,
4053 sctp_cmd_seq_t
*commands
)
4055 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_STOP
,
4056 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT
));
4058 sctp_add_cmd_sf(commands
, SCTP_CMD_NEW_STATE
,
4059 SCTP_STATE(SCTP_STATE_CLOSED
));
4061 SCTP_INC_STATS(SCTP_MIB_SHUTDOWNS
);
4063 sctp_add_cmd_sf(commands
, SCTP_CMD_DELETE_TCB
, SCTP_NULL());
4065 return SCTP_DISPOSITION_DELETE_TCB
;
4069 * sctp_cookie_echoed_prm_shutdown
4071 * Section: 4 Note: 2
4076 * The RFC does not explcitly address this issue, but is the route through the
4077 * state table when someone issues a shutdown while in COOKIE_ECHOED state.
4082 sctp_disposition_t
sctp_sf_cookie_echoed_prm_shutdown(
4083 const struct sctp_endpoint
*ep
,
4084 const struct sctp_association
*asoc
,
4085 const sctp_subtype_t type
,
4086 void *arg
, sctp_cmd_seq_t
*commands
)
4088 /* There is a single T1 timer, so we should be able to use
4089 * common function with the COOKIE-WAIT state.
4091 return sctp_sf_cookie_wait_prm_shutdown(ep
, asoc
, type
, arg
, commands
);
4095 * sctp_sf_cookie_wait_prm_abort
4097 * Section: 4 Note: 2
4102 * The RFC does not explicitly address this issue, but is the route through the
4103 * state table when someone issues an abort while in COOKIE_WAIT state.
4108 sctp_disposition_t
sctp_sf_cookie_wait_prm_abort(
4109 const struct sctp_endpoint
*ep
,
4110 const struct sctp_association
*asoc
,
4111 const sctp_subtype_t type
,
4113 sctp_cmd_seq_t
*commands
)
4115 struct msghdr
*msg
= arg
;
4116 struct sctp_chunk
*abort
;
4117 sctp_disposition_t retval
;
4119 /* Stop T1-init timer */
4120 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_STOP
,
4121 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT
));
4122 retval
= SCTP_DISPOSITION_CONSUME
;
4124 /* Generate ABORT chunk to send the peer */
4125 abort
= sctp_make_abort_user(asoc
, NULL
, msg
);
4127 retval
= SCTP_DISPOSITION_NOMEM
;
4129 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
, SCTP_CHUNK(abort
));
4131 sctp_add_cmd_sf(commands
, SCTP_CMD_NEW_STATE
,
4132 SCTP_STATE(SCTP_STATE_CLOSED
));
4134 SCTP_INC_STATS(SCTP_MIB_ABORTEDS
);
4136 /* Even if we can't send the ABORT due to low memory delete the
4137 * TCB. This is a departure from our typical NOMEM handling.
4140 /* Delete the established association. */
4141 sctp_add_cmd_sf(commands
, SCTP_CMD_INIT_FAILED
,
4142 SCTP_U32(SCTP_ERROR_USER_ABORT
));
4148 * sctp_sf_cookie_echoed_prm_abort
4150 * Section: 4 Note: 3
4155 * The RFC does not explcitly address this issue, but is the route through the
4156 * state table when someone issues an abort while in COOKIE_ECHOED state.
4161 sctp_disposition_t
sctp_sf_cookie_echoed_prm_abort(
4162 const struct sctp_endpoint
*ep
,
4163 const struct sctp_association
*asoc
,
4164 const sctp_subtype_t type
,
4166 sctp_cmd_seq_t
*commands
)
4168 /* There is a single T1 timer, so we should be able to use
4169 * common function with the COOKIE-WAIT state.
4171 return sctp_sf_cookie_wait_prm_abort(ep
, asoc
, type
, arg
, commands
);
4175 * sctp_sf_shutdown_pending_prm_abort
4180 * The RFC does not explicitly address this issue, but is the route through the
4181 * state table when someone issues an abort while in SHUTDOWN-PENDING state.
4186 sctp_disposition_t
sctp_sf_shutdown_pending_prm_abort(
4187 const struct sctp_endpoint
*ep
,
4188 const struct sctp_association
*asoc
,
4189 const sctp_subtype_t type
,
4191 sctp_cmd_seq_t
*commands
)
4193 /* Stop the T5-shutdown guard timer. */
4194 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_STOP
,
4195 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD
));
4197 return sctp_sf_do_9_1_prm_abort(ep
, asoc
, type
, arg
, commands
);
4201 * sctp_sf_shutdown_sent_prm_abort
4206 * The RFC does not explicitly address this issue, but is the route through the
4207 * state table when someone issues an abort while in SHUTDOWN-SENT state.
4212 sctp_disposition_t
sctp_sf_shutdown_sent_prm_abort(
4213 const struct sctp_endpoint
*ep
,
4214 const struct sctp_association
*asoc
,
4215 const sctp_subtype_t type
,
4217 sctp_cmd_seq_t
*commands
)
4219 /* Stop the T2-shutdown timer. */
4220 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_STOP
,
4221 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN
));
4223 /* Stop the T5-shutdown guard timer. */
4224 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_STOP
,
4225 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD
));
4227 return sctp_sf_do_9_1_prm_abort(ep
, asoc
, type
, arg
, commands
);
4231 * sctp_sf_cookie_echoed_prm_abort
4236 * The RFC does not explcitly address this issue, but is the route through the
4237 * state table when someone issues an abort while in COOKIE_ECHOED state.
4242 sctp_disposition_t
sctp_sf_shutdown_ack_sent_prm_abort(
4243 const struct sctp_endpoint
*ep
,
4244 const struct sctp_association
*asoc
,
4245 const sctp_subtype_t type
,
4247 sctp_cmd_seq_t
*commands
)
4249 /* The same T2 timer, so we should be able to use
4250 * common function with the SHUTDOWN-SENT state.
4252 return sctp_sf_shutdown_sent_prm_abort(ep
, asoc
, type
, arg
, commands
);
4256 * Process the REQUESTHEARTBEAT primitive
4259 * J) Request Heartbeat
4261 * Format: REQUESTHEARTBEAT(association id, destination transport address)
4265 * Instructs the local endpoint to perform a HeartBeat on the specified
4266 * destination transport address of the given association. The returned
4267 * result should indicate whether the transmission of the HEARTBEAT
4268 * chunk to the destination address is successful.
4270 * Mandatory attributes:
4272 * o association id - local handle to the SCTP association
4274 * o destination transport address - the transport address of the
4275 * association on which a heartbeat should be issued.
4277 sctp_disposition_t
sctp_sf_do_prm_requestheartbeat(
4278 const struct sctp_endpoint
*ep
,
4279 const struct sctp_association
*asoc
,
4280 const sctp_subtype_t type
,
4282 sctp_cmd_seq_t
*commands
)
4284 return sctp_sf_heartbeat(ep
, asoc
, type
, (struct sctp_transport
*)arg
,
4289 * ADDIP Section 4.1 ASCONF Chunk Procedures
4290 * When an endpoint has an ASCONF signaled change to be sent to the
4291 * remote endpoint it should do A1 to A9
4293 sctp_disposition_t
sctp_sf_do_prm_asconf(const struct sctp_endpoint
*ep
,
4294 const struct sctp_association
*asoc
,
4295 const sctp_subtype_t type
,
4297 sctp_cmd_seq_t
*commands
)
4299 struct sctp_chunk
*chunk
= arg
;
4301 sctp_add_cmd_sf(commands
, SCTP_CMD_SETUP_T4
, SCTP_CHUNK(chunk
));
4302 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_START
,
4303 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO
));
4304 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
, SCTP_CHUNK(chunk
));
4305 return SCTP_DISPOSITION_CONSUME
;
4309 * Ignore the primitive event
4311 * The return value is the disposition of the primitive.
4313 sctp_disposition_t
sctp_sf_ignore_primitive(
4314 const struct sctp_endpoint
*ep
,
4315 const struct sctp_association
*asoc
,
4316 const sctp_subtype_t type
,
4318 sctp_cmd_seq_t
*commands
)
4320 SCTP_DEBUG_PRINTK("Primitive type %d is ignored.\n", type
.primitive
);
4321 return SCTP_DISPOSITION_DISCARD
;
4324 /***************************************************************************
4325 * These are the state functions for the OTHER events.
4326 ***************************************************************************/
4329 * Start the shutdown negotiation.
4332 * Once all its outstanding data has been acknowledged, the endpoint
4333 * shall send a SHUTDOWN chunk to its peer including in the Cumulative
4334 * TSN Ack field the last sequential TSN it has received from the peer.
4335 * It shall then start the T2-shutdown timer and enter the SHUTDOWN-SENT
4336 * state. If the timer expires, the endpoint must re-send the SHUTDOWN
4337 * with the updated last sequential TSN received from its peer.
4339 * The return value is the disposition.
4341 sctp_disposition_t
sctp_sf_do_9_2_start_shutdown(
4342 const struct sctp_endpoint
*ep
,
4343 const struct sctp_association
*asoc
,
4344 const sctp_subtype_t type
,
4346 sctp_cmd_seq_t
*commands
)
4348 struct sctp_chunk
*reply
;
4350 /* Once all its outstanding data has been acknowledged, the
4351 * endpoint shall send a SHUTDOWN chunk to its peer including
4352 * in the Cumulative TSN Ack field the last sequential TSN it
4353 * has received from the peer.
4355 reply
= sctp_make_shutdown(asoc
, NULL
);
4359 /* Set the transport for the SHUTDOWN chunk and the timeout for the
4360 * T2-shutdown timer.
4362 sctp_add_cmd_sf(commands
, SCTP_CMD_SETUP_T2
, SCTP_CHUNK(reply
));
4364 /* It shall then start the T2-shutdown timer */
4365 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_START
,
4366 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN
));
4368 if (asoc
->autoclose
)
4369 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_STOP
,
4370 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE
));
4372 /* and enter the SHUTDOWN-SENT state. */
4373 sctp_add_cmd_sf(commands
, SCTP_CMD_NEW_STATE
,
4374 SCTP_STATE(SCTP_STATE_SHUTDOWN_SENT
));
4376 /* sctp-implguide 2.10 Issues with Heartbeating and failover
4378 * HEARTBEAT ... is discontinued after sending either SHUTDOWN
4381 sctp_add_cmd_sf(commands
, SCTP_CMD_HB_TIMERS_STOP
, SCTP_NULL());
4383 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
, SCTP_CHUNK(reply
));
4385 return SCTP_DISPOSITION_CONSUME
;
4388 return SCTP_DISPOSITION_NOMEM
;
4392 * Generate a SHUTDOWN ACK now that everything is SACK'd.
4396 * If it has no more outstanding DATA chunks, the SHUTDOWN receiver
4397 * shall send a SHUTDOWN ACK and start a T2-shutdown timer of its own,
4398 * entering the SHUTDOWN-ACK-SENT state. If the timer expires, the
4399 * endpoint must re-send the SHUTDOWN ACK.
4401 * The return value is the disposition.
4403 sctp_disposition_t
sctp_sf_do_9_2_shutdown_ack(
4404 const struct sctp_endpoint
*ep
,
4405 const struct sctp_association
*asoc
,
4406 const sctp_subtype_t type
,
4408 sctp_cmd_seq_t
*commands
)
4410 struct sctp_chunk
*chunk
= (struct sctp_chunk
*) arg
;
4411 struct sctp_chunk
*reply
;
4413 /* There are 2 ways of getting here:
4414 * 1) called in response to a SHUTDOWN chunk
4415 * 2) called when SCTP_EVENT_NO_PENDING_TSN event is issued.
4417 * For the case (2), the arg parameter is set to NULL. We need
4418 * to check that we have a chunk before accessing it's fields.
4421 if (!sctp_vtag_verify(chunk
, asoc
))
4422 return sctp_sf_pdiscard(ep
, asoc
, type
, arg
, commands
);
4424 /* Make sure that the SHUTDOWN chunk has a valid length. */
4425 if (!sctp_chunk_length_valid(chunk
, sizeof(struct sctp_shutdown_chunk_t
)))
4426 return sctp_sf_violation_chunklen(ep
, asoc
, type
, arg
,
4430 /* If it has no more outstanding DATA chunks, the SHUTDOWN receiver
4431 * shall send a SHUTDOWN ACK ...
4433 reply
= sctp_make_shutdown_ack(asoc
, chunk
);
4437 /* Set the transport for the SHUTDOWN ACK chunk and the timeout for
4438 * the T2-shutdown timer.
4440 sctp_add_cmd_sf(commands
, SCTP_CMD_SETUP_T2
, SCTP_CHUNK(reply
));
4442 /* and start/restart a T2-shutdown timer of its own, */
4443 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_RESTART
,
4444 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN
));
4446 if (asoc
->autoclose
)
4447 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_STOP
,
4448 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE
));
4450 /* Enter the SHUTDOWN-ACK-SENT state. */
4451 sctp_add_cmd_sf(commands
, SCTP_CMD_NEW_STATE
,
4452 SCTP_STATE(SCTP_STATE_SHUTDOWN_ACK_SENT
));
4454 /* sctp-implguide 2.10 Issues with Heartbeating and failover
4456 * HEARTBEAT ... is discontinued after sending either SHUTDOWN
4459 sctp_add_cmd_sf(commands
, SCTP_CMD_HB_TIMERS_STOP
, SCTP_NULL());
4461 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
, SCTP_CHUNK(reply
));
4463 return SCTP_DISPOSITION_CONSUME
;
4466 return SCTP_DISPOSITION_NOMEM
;
4470 * Ignore the event defined as other
4472 * The return value is the disposition of the event.
4474 sctp_disposition_t
sctp_sf_ignore_other(const struct sctp_endpoint
*ep
,
4475 const struct sctp_association
*asoc
,
4476 const sctp_subtype_t type
,
4478 sctp_cmd_seq_t
*commands
)
4480 SCTP_DEBUG_PRINTK("The event other type %d is ignored\n", type
.other
);
4481 return SCTP_DISPOSITION_DISCARD
;
4484 /************************************************************
4485 * These are the state functions for handling timeout events.
4486 ************************************************************/
4491 * Section: 6.3.3 Handle T3-rtx Expiration
4493 * Whenever the retransmission timer T3-rtx expires for a destination
4494 * address, do the following:
4497 * The return value is the disposition of the chunk.
4499 sctp_disposition_t
sctp_sf_do_6_3_3_rtx(const struct sctp_endpoint
*ep
,
4500 const struct sctp_association
*asoc
,
4501 const sctp_subtype_t type
,
4503 sctp_cmd_seq_t
*commands
)
4505 struct sctp_transport
*transport
= arg
;
4507 if (asoc
->overall_error_count
>= asoc
->max_retrans
) {
4508 /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
4509 sctp_add_cmd_sf(commands
, SCTP_CMD_ASSOC_FAILED
,
4510 SCTP_U32(SCTP_ERROR_NO_ERROR
));
4511 SCTP_INC_STATS(SCTP_MIB_ABORTEDS
);
4512 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB
);
4513 return SCTP_DISPOSITION_DELETE_TCB
;
4516 /* E1) For the destination address for which the timer
4517 * expires, adjust its ssthresh with rules defined in Section
4518 * 7.2.3 and set the cwnd <- MTU.
4521 /* E2) For the destination address for which the timer
4522 * expires, set RTO <- RTO * 2 ("back off the timer"). The
4523 * maximum value discussed in rule C7 above (RTO.max) may be
4524 * used to provide an upper bound to this doubling operation.
4527 /* E3) Determine how many of the earliest (i.e., lowest TSN)
4528 * outstanding DATA chunks for the address for which the
4529 * T3-rtx has expired will fit into a single packet, subject
4530 * to the MTU constraint for the path corresponding to the
4531 * destination transport address to which the retransmission
4532 * is being sent (this may be different from the address for
4533 * which the timer expires [see Section 6.4]). Call this
4534 * value K. Bundle and retransmit those K DATA chunks in a
4535 * single packet to the destination endpoint.
4537 * Note: Any DATA chunks that were sent to the address for
4538 * which the T3-rtx timer expired but did not fit in one MTU
4539 * (rule E3 above), should be marked for retransmission and
4540 * sent as soon as cwnd allows (normally when a SACK arrives).
4543 /* NB: Rules E4 and F1 are implicit in R1. */
4544 sctp_add_cmd_sf(commands
, SCTP_CMD_RETRAN
, SCTP_TRANSPORT(transport
));
4546 /* Do some failure management (Section 8.2). */
4547 sctp_add_cmd_sf(commands
, SCTP_CMD_STRIKE
, SCTP_TRANSPORT(transport
));
4549 return SCTP_DISPOSITION_CONSUME
;
4553 * Generate delayed SACK on timeout
4555 * Section: 6.2 Acknowledgement on Reception of DATA Chunks
4557 * The guidelines on delayed acknowledgement algorithm specified in
4558 * Section 4.2 of [RFC2581] SHOULD be followed. Specifically, an
4559 * acknowledgement SHOULD be generated for at least every second packet
4560 * (not every second DATA chunk) received, and SHOULD be generated
4561 * within 200 ms of the arrival of any unacknowledged DATA chunk. In
4562 * some situations it may be beneficial for an SCTP transmitter to be
4563 * more conservative than the algorithms detailed in this document
4564 * allow. However, an SCTP transmitter MUST NOT be more aggressive than
4565 * the following algorithms allow.
4567 sctp_disposition_t
sctp_sf_do_6_2_sack(const struct sctp_endpoint
*ep
,
4568 const struct sctp_association
*asoc
,
4569 const sctp_subtype_t type
,
4571 sctp_cmd_seq_t
*commands
)
4573 sctp_add_cmd_sf(commands
, SCTP_CMD_GEN_SACK
, SCTP_FORCE());
4574 return SCTP_DISPOSITION_CONSUME
;
4578 * sctp_sf_t1_timer_expire
4580 * Section: 4 Note: 2
4585 * RFC 2960 Section 4 Notes
4586 * 2) If the T1-init timer expires, the endpoint MUST retransmit INIT
4587 * and re-start the T1-init timer without changing state. This MUST
4588 * be repeated up to 'Max.Init.Retransmits' times. After that, the
4589 * endpoint MUST abort the initialization process and report the
4590 * error to SCTP user.
4592 * 3) If the T1-cookie timer expires, the endpoint MUST retransmit
4593 * COOKIE ECHO and re-start the T1-cookie timer without changing
4594 * state. This MUST be repeated up to 'Max.Init.Retransmits' times.
4595 * After that, the endpoint MUST abort the initialization process and
4596 * report the error to SCTP user.
4602 sctp_disposition_t
sctp_sf_t1_timer_expire(const struct sctp_endpoint
*ep
,
4603 const struct sctp_association
*asoc
,
4604 const sctp_subtype_t type
,
4606 sctp_cmd_seq_t
*commands
)
4608 struct sctp_chunk
*repl
;
4609 struct sctp_bind_addr
*bp
;
4610 sctp_event_timeout_t timer
= (sctp_event_timeout_t
) arg
;
4614 timeout
= asoc
->timeouts
[timer
];
4615 attempts
= asoc
->counters
[SCTP_COUNTER_INIT_ERROR
] + 1;
4618 SCTP_DEBUG_PRINTK("Timer T1 expired.\n");
4620 if (attempts
< asoc
->max_init_attempts
) {
4622 case SCTP_EVENT_TIMEOUT_T1_INIT
:
4623 bp
= (struct sctp_bind_addr
*) &asoc
->base
.bind_addr
;
4624 repl
= sctp_make_init(asoc
, bp
, GFP_ATOMIC
, 0);
4627 case SCTP_EVENT_TIMEOUT_T1_COOKIE
:
4628 repl
= sctp_make_cookie_echo(asoc
, NULL
);
4639 /* Issue a sideeffect to do the needed accounting. */
4640 sctp_add_cmd_sf(commands
, SCTP_CMD_INIT_RESTART
,
4642 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
, SCTP_CHUNK(repl
));
4644 sctp_add_cmd_sf(commands
, SCTP_CMD_INIT_FAILED
,
4645 SCTP_U32(SCTP_ERROR_NO_ERROR
));
4646 return SCTP_DISPOSITION_DELETE_TCB
;
4649 return SCTP_DISPOSITION_CONSUME
;
4652 return SCTP_DISPOSITION_NOMEM
;
4655 /* RFC2960 9.2 If the timer expires, the endpoint must re-send the SHUTDOWN
4656 * with the updated last sequential TSN received from its peer.
4658 * An endpoint should limit the number of retransmissions of the
4659 * SHUTDOWN chunk to the protocol parameter 'Association.Max.Retrans'.
4660 * If this threshold is exceeded the endpoint should destroy the TCB and
4661 * MUST report the peer endpoint unreachable to the upper layer (and
4662 * thus the association enters the CLOSED state). The reception of any
4663 * packet from its peer (i.e. as the peer sends all of its queued DATA
4664 * chunks) should clear the endpoint's retransmission count and restart
4665 * the T2-Shutdown timer, giving its peer ample opportunity to transmit
4666 * all of its queued DATA chunks that have not yet been sent.
4668 sctp_disposition_t
sctp_sf_t2_timer_expire(const struct sctp_endpoint
*ep
,
4669 const struct sctp_association
*asoc
,
4670 const sctp_subtype_t type
,
4672 sctp_cmd_seq_t
*commands
)
4674 struct sctp_chunk
*reply
= NULL
;
4676 SCTP_DEBUG_PRINTK("Timer T2 expired.\n");
4677 if (asoc
->overall_error_count
>= asoc
->max_retrans
) {
4678 /* Note: CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
4679 sctp_add_cmd_sf(commands
, SCTP_CMD_ASSOC_FAILED
,
4680 SCTP_U32(SCTP_ERROR_NO_ERROR
));
4681 SCTP_INC_STATS(SCTP_MIB_ABORTEDS
);
4682 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB
);
4683 return SCTP_DISPOSITION_DELETE_TCB
;
4686 switch (asoc
->state
) {
4687 case SCTP_STATE_SHUTDOWN_SENT
:
4688 reply
= sctp_make_shutdown(asoc
, NULL
);
4691 case SCTP_STATE_SHUTDOWN_ACK_SENT
:
4692 reply
= sctp_make_shutdown_ack(asoc
, NULL
);
4703 /* Do some failure management (Section 8.2). */
4704 sctp_add_cmd_sf(commands
, SCTP_CMD_STRIKE
,
4705 SCTP_TRANSPORT(asoc
->shutdown_last_sent_to
));
4707 /* Set the transport for the SHUTDOWN/ACK chunk and the timeout for
4708 * the T2-shutdown timer.
4710 sctp_add_cmd_sf(commands
, SCTP_CMD_SETUP_T2
, SCTP_CHUNK(reply
));
4712 /* Restart the T2-shutdown timer. */
4713 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_RESTART
,
4714 SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN
));
4715 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
, SCTP_CHUNK(reply
));
4716 return SCTP_DISPOSITION_CONSUME
;
4719 return SCTP_DISPOSITION_NOMEM
;
4723 * ADDIP Section 4.1 ASCONF CHunk Procedures
4724 * If the T4 RTO timer expires the endpoint should do B1 to B5
4726 sctp_disposition_t
sctp_sf_t4_timer_expire(
4727 const struct sctp_endpoint
*ep
,
4728 const struct sctp_association
*asoc
,
4729 const sctp_subtype_t type
,
4731 sctp_cmd_seq_t
*commands
)
4733 struct sctp_chunk
*chunk
= asoc
->addip_last_asconf
;
4734 struct sctp_transport
*transport
= chunk
->transport
;
4736 /* ADDIP 4.1 B1) Increment the error counters and perform path failure
4737 * detection on the appropriate destination address as defined in
4738 * RFC2960 [5] section 8.1 and 8.2.
4740 sctp_add_cmd_sf(commands
, SCTP_CMD_STRIKE
, SCTP_TRANSPORT(transport
));
4742 /* Reconfig T4 timer and transport. */
4743 sctp_add_cmd_sf(commands
, SCTP_CMD_SETUP_T4
, SCTP_CHUNK(chunk
));
4745 /* ADDIP 4.1 B2) Increment the association error counters and perform
4746 * endpoint failure detection on the association as defined in
4747 * RFC2960 [5] section 8.1 and 8.2.
4748 * association error counter is incremented in SCTP_CMD_STRIKE.
4750 if (asoc
->overall_error_count
>= asoc
->max_retrans
) {
4751 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_STOP
,
4752 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO
));
4753 sctp_add_cmd_sf(commands
, SCTP_CMD_ASSOC_FAILED
,
4754 SCTP_U32(SCTP_ERROR_NO_ERROR
));
4755 SCTP_INC_STATS(SCTP_MIB_ABORTEDS
);
4756 SCTP_INC_STATS(SCTP_MIB_CURRESTAB
);
4757 return SCTP_DISPOSITION_ABORT
;
4760 /* ADDIP 4.1 B3) Back-off the destination address RTO value to which
4761 * the ASCONF chunk was sent by doubling the RTO timer value.
4762 * This is done in SCTP_CMD_STRIKE.
4765 /* ADDIP 4.1 B4) Re-transmit the ASCONF Chunk last sent and if possible
4766 * choose an alternate destination address (please refer to RFC2960
4767 * [5] section 6.4.1). An endpoint MUST NOT add new parameters to this
4768 * chunk, it MUST be the same (including its serial number) as the last
4771 sctp_chunk_hold(asoc
->addip_last_asconf
);
4772 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
,
4773 SCTP_CHUNK(asoc
->addip_last_asconf
));
4775 /* ADDIP 4.1 B5) Restart the T-4 RTO timer. Note that if a different
4776 * destination is selected, then the RTO used will be that of the new
4777 * destination address.
4779 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_RESTART
,
4780 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO
));
4782 return SCTP_DISPOSITION_CONSUME
;
4785 /* sctpimpguide-05 Section 2.12.2
4786 * The sender of the SHUTDOWN MAY also start an overall guard timer
4787 * 'T5-shutdown-guard' to bound the overall time for shutdown sequence.
4788 * At the expiration of this timer the sender SHOULD abort the association
4789 * by sending an ABORT chunk.
4791 sctp_disposition_t
sctp_sf_t5_timer_expire(const struct sctp_endpoint
*ep
,
4792 const struct sctp_association
*asoc
,
4793 const sctp_subtype_t type
,
4795 sctp_cmd_seq_t
*commands
)
4797 struct sctp_chunk
*reply
= NULL
;
4799 SCTP_DEBUG_PRINTK("Timer T5 expired.\n");
4801 reply
= sctp_make_abort(asoc
, NULL
, 0);
4805 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
, SCTP_CHUNK(reply
));
4806 sctp_add_cmd_sf(commands
, SCTP_CMD_ASSOC_FAILED
,
4807 SCTP_U32(SCTP_ERROR_NO_ERROR
));
4809 return SCTP_DISPOSITION_DELETE_TCB
;
4811 return SCTP_DISPOSITION_NOMEM
;
4814 /* Handle expiration of AUTOCLOSE timer. When the autoclose timer expires,
4815 * the association is automatically closed by starting the shutdown process.
4816 * The work that needs to be done is same as when SHUTDOWN is initiated by
4817 * the user. So this routine looks same as sctp_sf_do_9_2_prm_shutdown().
4819 sctp_disposition_t
sctp_sf_autoclose_timer_expire(
4820 const struct sctp_endpoint
*ep
,
4821 const struct sctp_association
*asoc
,
4822 const sctp_subtype_t type
,
4824 sctp_cmd_seq_t
*commands
)
4828 /* From 9.2 Shutdown of an Association
4829 * Upon receipt of the SHUTDOWN primitive from its upper
4830 * layer, the endpoint enters SHUTDOWN-PENDING state and
4831 * remains there until all outstanding data has been
4832 * acknowledged by its peer. The endpoint accepts no new data
4833 * from its upper layer, but retransmits data to the far end
4834 * if necessary to fill gaps.
4836 sctp_add_cmd_sf(commands
, SCTP_CMD_NEW_STATE
,
4837 SCTP_STATE(SCTP_STATE_SHUTDOWN_PENDING
));
4839 /* sctpimpguide-05 Section 2.12.2
4840 * The sender of the SHUTDOWN MAY also start an overall guard timer
4841 * 'T5-shutdown-guard' to bound the overall time for shutdown sequence.
4843 sctp_add_cmd_sf(commands
, SCTP_CMD_TIMER_START
,
4844 SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD
));
4845 disposition
= SCTP_DISPOSITION_CONSUME
;
4846 if (sctp_outq_is_empty(&asoc
->outqueue
)) {
4847 disposition
= sctp_sf_do_9_2_start_shutdown(ep
, asoc
, type
,
4853 /*****************************************************************************
4854 * These are sa state functions which could apply to all types of events.
4855 ****************************************************************************/
4858 * This table entry is not implemented.
4861 * (endpoint, asoc, chunk)
4863 * The return value is the disposition of the chunk.
4865 sctp_disposition_t
sctp_sf_not_impl(const struct sctp_endpoint
*ep
,
4866 const struct sctp_association
*asoc
,
4867 const sctp_subtype_t type
,
4869 sctp_cmd_seq_t
*commands
)
4871 return SCTP_DISPOSITION_NOT_IMPL
;
4875 * This table entry represents a bug.
4878 * (endpoint, asoc, chunk)
4880 * The return value is the disposition of the chunk.
4882 sctp_disposition_t
sctp_sf_bug(const struct sctp_endpoint
*ep
,
4883 const struct sctp_association
*asoc
,
4884 const sctp_subtype_t type
,
4886 sctp_cmd_seq_t
*commands
)
4888 return SCTP_DISPOSITION_BUG
;
4892 * This table entry represents the firing of a timer in the wrong state.
4893 * Since timer deletion cannot be guaranteed a timer 'may' end up firing
4894 * when the association is in the wrong state. This event should
4895 * be ignored, so as to prevent any rearming of the timer.
4898 * (endpoint, asoc, chunk)
4900 * The return value is the disposition of the chunk.
4902 sctp_disposition_t
sctp_sf_timer_ignore(const struct sctp_endpoint
*ep
,
4903 const struct sctp_association
*asoc
,
4904 const sctp_subtype_t type
,
4906 sctp_cmd_seq_t
*commands
)
4908 SCTP_DEBUG_PRINTK("Timer %d ignored.\n", type
.chunk
);
4909 return SCTP_DISPOSITION_CONSUME
;
4912 /********************************************************************
4913 * 2nd Level Abstractions
4914 ********************************************************************/
4916 /* Pull the SACK chunk based on the SACK header. */
4917 static struct sctp_sackhdr
*sctp_sm_pull_sack(struct sctp_chunk
*chunk
)
4919 struct sctp_sackhdr
*sack
;
4924 /* Protect ourselves from reading too far into
4925 * the skb from a bogus sender.
4927 sack
= (struct sctp_sackhdr
*) chunk
->skb
->data
;
4929 num_blocks
= ntohs(sack
->num_gap_ack_blocks
);
4930 num_dup_tsns
= ntohs(sack
->num_dup_tsns
);
4931 len
= sizeof(struct sctp_sackhdr
);
4932 len
+= (num_blocks
+ num_dup_tsns
) * sizeof(__u32
);
4933 if (len
> chunk
->skb
->len
)
4936 skb_pull(chunk
->skb
, len
);
4941 /* Create an ABORT packet to be sent as a response, with the specified
4944 static struct sctp_packet
*sctp_abort_pkt_new(const struct sctp_endpoint
*ep
,
4945 const struct sctp_association
*asoc
,
4946 struct sctp_chunk
*chunk
,
4947 const void *payload
,
4950 struct sctp_packet
*packet
;
4951 struct sctp_chunk
*abort
;
4953 packet
= sctp_ootb_pkt_new(asoc
, chunk
);
4957 * The T bit will be set if the asoc is NULL.
4959 abort
= sctp_make_abort(asoc
, chunk
, paylen
);
4961 sctp_ootb_pkt_free(packet
);
4964 /* Add specified error causes, i.e., payload, to the
4967 sctp_addto_chunk(abort
, paylen
, payload
);
4969 /* Set the skb to the belonging sock for accounting. */
4970 abort
->skb
->sk
= ep
->base
.sk
;
4972 sctp_packet_append_chunk(packet
, abort
);
4979 /* Allocate a packet for responding in the OOTB conditions. */
4980 static struct sctp_packet
*sctp_ootb_pkt_new(const struct sctp_association
*asoc
,
4981 const struct sctp_chunk
*chunk
)
4983 struct sctp_packet
*packet
;
4984 struct sctp_transport
*transport
;
4989 /* Get the source and destination port from the inbound packet. */
4990 sport
= ntohs(chunk
->sctp_hdr
->dest
);
4991 dport
= ntohs(chunk
->sctp_hdr
->source
);
4993 /* The V-tag is going to be the same as the inbound packet if no
4994 * association exists, otherwise, use the peer's vtag.
4997 vtag
= asoc
->peer
.i
.init_tag
;
4999 /* Special case the INIT and stale COOKIE_ECHO as there is no
5002 switch(chunk
->chunk_hdr
->type
) {
5005 sctp_init_chunk_t
*init
;
5007 init
= (sctp_init_chunk_t
*)chunk
->chunk_hdr
;
5008 vtag
= ntohl(init
->init_hdr
.init_tag
);
5012 vtag
= ntohl(chunk
->sctp_hdr
->vtag
);
5017 /* Make a transport for the bucket, Eliza... */
5018 transport
= sctp_transport_new(sctp_source(chunk
), GFP_ATOMIC
);
5022 /* Cache a route for the transport with the chunk's destination as
5023 * the source address.
5025 sctp_transport_route(transport
, (union sctp_addr
*)&chunk
->dest
,
5026 sctp_sk(sctp_get_ctl_sock()));
5028 packet
= sctp_packet_init(&transport
->packet
, transport
, sport
, dport
);
5029 packet
= sctp_packet_config(packet
, vtag
, 0);
5037 /* Free the packet allocated earlier for responding in the OOTB condition. */
5038 void sctp_ootb_pkt_free(struct sctp_packet
*packet
)
5040 sctp_transport_free(packet
->transport
);
5043 /* Send a stale cookie error when a invalid COOKIE ECHO chunk is found */
5044 static void sctp_send_stale_cookie_err(const struct sctp_endpoint
*ep
,
5045 const struct sctp_association
*asoc
,
5046 const struct sctp_chunk
*chunk
,
5047 sctp_cmd_seq_t
*commands
,
5048 struct sctp_chunk
*err_chunk
)
5050 struct sctp_packet
*packet
;
5053 packet
= sctp_ootb_pkt_new(asoc
, chunk
);
5055 struct sctp_signed_cookie
*cookie
;
5057 /* Override the OOTB vtag from the cookie. */
5058 cookie
= chunk
->subh
.cookie_hdr
;
5059 packet
->vtag
= cookie
->c
.peer_vtag
;
5061 /* Set the skb to the belonging sock for accounting. */
5062 err_chunk
->skb
->sk
= ep
->base
.sk
;
5063 sctp_packet_append_chunk(packet
, err_chunk
);
5064 sctp_add_cmd_sf(commands
, SCTP_CMD_SEND_PKT
,
5065 SCTP_PACKET(packet
));
5066 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS
);
5068 sctp_chunk_free (err_chunk
);
5073 /* Process a data chunk */
5074 static int sctp_eat_data(const struct sctp_association
*asoc
,
5075 struct sctp_chunk
*chunk
,
5076 sctp_cmd_seq_t
*commands
)
5078 sctp_datahdr_t
*data_hdr
;
5079 struct sctp_chunk
*err
;
5081 sctp_verb_t deliver
;
5085 data_hdr
= chunk
->subh
.data_hdr
= (sctp_datahdr_t
*)chunk
->skb
->data
;
5086 skb_pull(chunk
->skb
, sizeof(sctp_datahdr_t
));
5088 tsn
= ntohl(data_hdr
->tsn
);
5089 SCTP_DEBUG_PRINTK("eat_data: TSN 0x%x.\n", tsn
);
5091 /* ASSERT: Now skb->data is really the user data. */
5093 /* Process ECN based congestion.
5095 * Since the chunk structure is reused for all chunks within
5096 * a packet, we use ecn_ce_done to track if we've already
5097 * done CE processing for this packet.
5099 * We need to do ECN processing even if we plan to discard the
5103 if (!chunk
->ecn_ce_done
) {
5105 chunk
->ecn_ce_done
= 1;
5107 af
= sctp_get_af_specific(
5108 ipver2af(chunk
->skb
->nh
.iph
->version
));
5110 if (af
&& af
->is_ce(chunk
->skb
) && asoc
->peer
.ecn_capable
) {
5111 /* Do real work as sideffect. */
5112 sctp_add_cmd_sf(commands
, SCTP_CMD_ECN_CE
,
5117 tmp
= sctp_tsnmap_check(&asoc
->peer
.tsn_map
, tsn
);
5119 /* The TSN is too high--silently discard the chunk and
5120 * count on it getting retransmitted later.
5122 return SCTP_IERROR_HIGH_TSN
;
5123 } else if (tmp
> 0) {
5124 /* This is a duplicate. Record it. */
5125 sctp_add_cmd_sf(commands
, SCTP_CMD_REPORT_DUP
, SCTP_U32(tsn
));
5126 return SCTP_IERROR_DUP_TSN
;
5129 /* This is a new TSN. */
5131 /* Discard if there is no room in the receive window.
5132 * Actually, allow a little bit of overflow (up to a MTU).
5134 datalen
= ntohs(chunk
->chunk_hdr
->length
);
5135 datalen
-= sizeof(sctp_data_chunk_t
);
5137 deliver
= SCTP_CMD_CHUNK_ULP
;
5139 /* Think about partial delivery. */
5140 if ((datalen
>= asoc
->rwnd
) && (!asoc
->ulpq
.pd_mode
)) {
5142 /* Even if we don't accept this chunk there is
5145 sctp_add_cmd_sf(commands
, SCTP_CMD_PART_DELIVER
, SCTP_NULL());
5148 /* Spill over rwnd a little bit. Note: While allowed, this spill over
5149 * seems a bit troublesome in that frag_point varies based on
5150 * PMTU. In cases, such as loopback, this might be a rather
5153 if (!asoc
->rwnd
|| asoc
->rwnd_over
||
5154 (datalen
> asoc
->rwnd
+ asoc
->frag_point
)) {
5156 /* If this is the next TSN, consider reneging to make
5157 * room. Note: Playing nice with a confused sender. A
5158 * malicious sender can still eat up all our buffer
5159 * space and in the future we may want to detect and
5160 * do more drastic reneging.
5162 if (sctp_tsnmap_has_gap(&asoc
->peer
.tsn_map
) &&
5163 (sctp_tsnmap_get_ctsn(&asoc
->peer
.tsn_map
) + 1) == tsn
) {
5164 SCTP_DEBUG_PRINTK("Reneging for tsn:%u\n", tsn
);
5165 deliver
= SCTP_CMD_RENEGE
;
5167 SCTP_DEBUG_PRINTK("Discard tsn: %u len: %Zd, "
5168 "rwnd: %d\n", tsn
, datalen
,
5170 return SCTP_IERROR_IGNORE_TSN
;
5175 * Section 3.3.10.9 No User Data (9)
5179 * No User Data: This error cause is returned to the originator of a
5180 * DATA chunk if a received DATA chunk has no user data.
5182 if (unlikely(0 == datalen
)) {
5183 err
= sctp_make_abort_no_data(asoc
, chunk
, tsn
);
5185 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
,
5188 /* We are going to ABORT, so we might as well stop
5189 * processing the rest of the chunks in the packet.
5191 sctp_add_cmd_sf(commands
, SCTP_CMD_DISCARD_PACKET
,SCTP_NULL());
5192 sctp_add_cmd_sf(commands
, SCTP_CMD_ASSOC_FAILED
,
5193 SCTP_U32(SCTP_ERROR_NO_DATA
));
5194 SCTP_INC_STATS(SCTP_MIB_ABORTEDS
);
5195 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB
);
5196 return SCTP_IERROR_NO_DATA
;
5199 /* If definately accepting the DATA chunk, record its TSN, otherwise
5200 * wait for renege processing.
5202 if (SCTP_CMD_CHUNK_ULP
== deliver
)
5203 sctp_add_cmd_sf(commands
, SCTP_CMD_REPORT_TSN
, SCTP_U32(tsn
));
5205 /* Note: Some chunks may get overcounted (if we drop) or overcounted
5206 * if we renege and the chunk arrives again.
5208 if (chunk
->chunk_hdr
->flags
& SCTP_DATA_UNORDERED
)
5209 SCTP_INC_STATS(SCTP_MIB_INUNORDERCHUNKS
);
5211 SCTP_INC_STATS(SCTP_MIB_INORDERCHUNKS
);
5213 /* RFC 2960 6.5 Stream Identifier and Stream Sequence Number
5215 * If an endpoint receive a DATA chunk with an invalid stream
5216 * identifier, it shall acknowledge the reception of the DATA chunk
5217 * following the normal procedure, immediately send an ERROR chunk
5218 * with cause set to "Invalid Stream Identifier" (See Section 3.3.10)
5219 * and discard the DATA chunk.
5221 if (ntohs(data_hdr
->stream
) >= asoc
->c
.sinit_max_instreams
) {
5222 err
= sctp_make_op_error(asoc
, chunk
, SCTP_ERROR_INV_STRM
,
5224 sizeof(data_hdr
->stream
));
5226 sctp_add_cmd_sf(commands
, SCTP_CMD_REPLY
,
5228 return SCTP_IERROR_BAD_STREAM
;
5231 /* Send the data up to the user. Note: Schedule the
5232 * SCTP_CMD_CHUNK_ULP cmd before the SCTP_CMD_GEN_SACK, as the SACK
5233 * chunk needs the updated rwnd.
5235 sctp_add_cmd_sf(commands
, deliver
, SCTP_CHUNK(chunk
));
5237 return SCTP_IERROR_NO_ERROR
;