xref: /openbmc/linux/net/sctp/input.c (revision 1407be30)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* SCTP kernel implementation
3  * Copyright (c) 1999-2000 Cisco, Inc.
4  * Copyright (c) 1999-2001 Motorola, Inc.
5  * Copyright (c) 2001-2003 International Business Machines, Corp.
6  * Copyright (c) 2001 Intel Corp.
7  * Copyright (c) 2001 Nokia, Inc.
8  * Copyright (c) 2001 La Monte H.P. Yarroll
9  *
10  * This file is part of the SCTP kernel implementation
11  *
12  * These functions handle all input from the IP layer into SCTP.
13  *
14  * Please send any bug reports or fixes you make to the
15  * email address(es):
16  *    lksctp developers <linux-sctp@vger.kernel.org>
17  *
18  * Written or modified by:
19  *    La Monte H.P. Yarroll <piggy@acm.org>
20  *    Karl Knutson <karl@athena.chicago.il.us>
21  *    Xingang Guo <xingang.guo@intel.com>
22  *    Jon Grimm <jgrimm@us.ibm.com>
23  *    Hui Huang <hui.huang@nokia.com>
24  *    Daisy Chang <daisyc@us.ibm.com>
25  *    Sridhar Samudrala <sri@us.ibm.com>
26  *    Ardelle Fan <ardelle.fan@intel.com>
27  */
28 
29 #include <linux/types.h>
30 #include <linux/list.h> /* For struct list_head */
31 #include <linux/socket.h>
32 #include <linux/ip.h>
33 #include <linux/time.h> /* For struct timeval */
34 #include <linux/slab.h>
35 #include <net/ip.h>
36 #include <net/icmp.h>
37 #include <net/snmp.h>
38 #include <net/sock.h>
39 #include <net/xfrm.h>
40 #include <net/sctp/sctp.h>
41 #include <net/sctp/sm.h>
42 #include <net/sctp/checksum.h>
43 #include <net/net_namespace.h>
44 #include <linux/rhashtable.h>
45 #include <net/sock_reuseport.h>
46 
47 /* Forward declarations for internal helpers. */
48 static int sctp_rcv_ootb(struct sk_buff *);
49 static struct sctp_association *__sctp_rcv_lookup(struct net *net,
50 				      struct sk_buff *skb,
51 				      const union sctp_addr *paddr,
52 				      const union sctp_addr *laddr,
53 				      struct sctp_transport **transportp,
54 				      int dif, int sdif);
55 static struct sctp_endpoint *__sctp_rcv_lookup_endpoint(
56 					struct net *net, struct sk_buff *skb,
57 					const union sctp_addr *laddr,
58 					const union sctp_addr *daddr,
59 					int dif, int sdif);
60 static struct sctp_association *__sctp_lookup_association(
61 					struct net *net,
62 					const union sctp_addr *local,
63 					const union sctp_addr *peer,
64 					struct sctp_transport **pt,
65 					int dif, int sdif);
66 
67 static int sctp_add_backlog(struct sock *sk, struct sk_buff *skb);
68 
69 
70 /* Calculate the SCTP checksum of an SCTP packet.  */
sctp_rcv_checksum(struct net * net,struct sk_buff * skb)71 static inline int sctp_rcv_checksum(struct net *net, struct sk_buff *skb)
72 {
73 	struct sctphdr *sh = sctp_hdr(skb);
74 	__le32 cmp = sh->checksum;
75 	__le32 val = sctp_compute_cksum(skb, 0);
76 
77 	if (val != cmp) {
78 		/* CRC failure, dump it. */
79 		__SCTP_INC_STATS(net, SCTP_MIB_CHECKSUMERRORS);
80 		return -1;
81 	}
82 	return 0;
83 }
84 
85 /*
86  * This is the routine which IP calls when receiving an SCTP packet.
87  */
sctp_rcv(struct sk_buff * skb)88 int sctp_rcv(struct sk_buff *skb)
89 {
90 	struct sock *sk;
91 	struct sctp_association *asoc;
92 	struct sctp_endpoint *ep = NULL;
93 	struct sctp_ep_common *rcvr;
94 	struct sctp_transport *transport = NULL;
95 	struct sctp_chunk *chunk;
96 	union sctp_addr src;
97 	union sctp_addr dest;
98 	int family;
99 	struct sctp_af *af;
100 	struct net *net = dev_net(skb->dev);
101 	bool is_gso = skb_is_gso(skb) && skb_is_gso_sctp(skb);
102 	int dif, sdif;
103 
104 	if (skb->pkt_type != PACKET_HOST)
105 		goto discard_it;
106 
107 	__SCTP_INC_STATS(net, SCTP_MIB_INSCTPPACKS);
108 
109 	/* If packet is too small to contain a single chunk, let's not
110 	 * waste time on it anymore.
111 	 */
112 	if (skb->len < sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr) +
113 		       skb_transport_offset(skb))
114 		goto discard_it;
115 
116 	/* If the packet is fragmented and we need to do crc checking,
117 	 * it's better to just linearize it otherwise crc computing
118 	 * takes longer.
119 	 */
120 	if ((!is_gso && skb_linearize(skb)) ||
121 	    !pskb_may_pull(skb, sizeof(struct sctphdr)))
122 		goto discard_it;
123 
124 	/* Pull up the IP header. */
125 	__skb_pull(skb, skb_transport_offset(skb));
126 
127 	skb->csum_valid = 0; /* Previous value not applicable */
128 	if (skb_csum_unnecessary(skb))
129 		__skb_decr_checksum_unnecessary(skb);
130 	else if (!sctp_checksum_disable &&
131 		 !is_gso &&
132 		 sctp_rcv_checksum(net, skb) < 0)
133 		goto discard_it;
134 	skb->csum_valid = 1;
135 
136 	__skb_pull(skb, sizeof(struct sctphdr));
137 
138 	family = ipver2af(ip_hdr(skb)->version);
139 	af = sctp_get_af_specific(family);
140 	if (unlikely(!af))
141 		goto discard_it;
142 	SCTP_INPUT_CB(skb)->af = af;
143 
144 	/* Initialize local addresses for lookups. */
145 	af->from_skb(&src, skb, 1);
146 	af->from_skb(&dest, skb, 0);
147 	dif = af->skb_iif(skb);
148 	sdif = af->skb_sdif(skb);
149 
150 	/* If the packet is to or from a non-unicast address,
151 	 * silently discard the packet.
152 	 *
153 	 * This is not clearly defined in the RFC except in section
154 	 * 8.4 - OOTB handling.  However, based on the book "Stream Control
155 	 * Transmission Protocol" 2.1, "It is important to note that the
156 	 * IP address of an SCTP transport address must be a routable
157 	 * unicast address.  In other words, IP multicast addresses and
158 	 * IP broadcast addresses cannot be used in an SCTP transport
159 	 * address."
160 	 */
161 	if (!af->addr_valid(&src, NULL, skb) ||
162 	    !af->addr_valid(&dest, NULL, skb))
163 		goto discard_it;
164 
165 	asoc = __sctp_rcv_lookup(net, skb, &src, &dest, &transport, dif, sdif);
166 
167 	if (!asoc)
168 		ep = __sctp_rcv_lookup_endpoint(net, skb, &dest, &src, dif, sdif);
169 
170 	/* Retrieve the common input handling substructure. */
171 	rcvr = asoc ? &asoc->base : &ep->base;
172 	sk = rcvr->sk;
173 
174 	/*
175 	 * RFC 2960, 8.4 - Handle "Out of the blue" Packets.
176 	 * An SCTP packet is called an "out of the blue" (OOTB)
177 	 * packet if it is correctly formed, i.e., passed the
178 	 * receiver's checksum check, but the receiver is not
179 	 * able to identify the association to which this
180 	 * packet belongs.
181 	 */
182 	if (!asoc) {
183 		if (sctp_rcv_ootb(skb)) {
184 			__SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
185 			goto discard_release;
186 		}
187 	}
188 
189 	if (!xfrm_policy_check(sk, XFRM_POLICY_IN, skb, family))
190 		goto discard_release;
191 	nf_reset_ct(skb);
192 
193 	if (sk_filter(sk, skb))
194 		goto discard_release;
195 
196 	/* Create an SCTP packet structure. */
197 	chunk = sctp_chunkify(skb, asoc, sk, GFP_ATOMIC);
198 	if (!chunk)
199 		goto discard_release;
200 	SCTP_INPUT_CB(skb)->chunk = chunk;
201 
202 	/* Remember what endpoint is to handle this packet. */
203 	chunk->rcvr = rcvr;
204 
205 	/* Remember the SCTP header. */
206 	chunk->sctp_hdr = sctp_hdr(skb);
207 
208 	/* Set the source and destination addresses of the incoming chunk.  */
209 	sctp_init_addrs(chunk, &src, &dest);
210 
211 	/* Remember where we came from.  */
212 	chunk->transport = transport;
213 
214 	/* Acquire access to the sock lock. Note: We are safe from other
215 	 * bottom halves on this lock, but a user may be in the lock too,
216 	 * so check if it is busy.
217 	 */
218 	bh_lock_sock(sk);
219 
220 	if (sk != rcvr->sk) {
221 		/* Our cached sk is different from the rcvr->sk.  This is
222 		 * because migrate()/accept() may have moved the association
223 		 * to a new socket and released all the sockets.  So now we
224 		 * are holding a lock on the old socket while the user may
225 		 * be doing something with the new socket.  Switch our veiw
226 		 * of the current sk.
227 		 */
228 		bh_unlock_sock(sk);
229 		sk = rcvr->sk;
230 		bh_lock_sock(sk);
231 	}
232 
233 	if (sock_owned_by_user(sk) || !sctp_newsk_ready(sk)) {
234 		if (sctp_add_backlog(sk, skb)) {
235 			bh_unlock_sock(sk);
236 			sctp_chunk_free(chunk);
237 			skb = NULL; /* sctp_chunk_free already freed the skb */
238 			goto discard_release;
239 		}
240 		__SCTP_INC_STATS(net, SCTP_MIB_IN_PKT_BACKLOG);
241 	} else {
242 		__SCTP_INC_STATS(net, SCTP_MIB_IN_PKT_SOFTIRQ);
243 		sctp_inq_push(&chunk->rcvr->inqueue, chunk);
244 	}
245 
246 	bh_unlock_sock(sk);
247 
248 	/* Release the asoc/ep ref we took in the lookup calls. */
249 	if (transport)
250 		sctp_transport_put(transport);
251 	else
252 		sctp_endpoint_put(ep);
253 
254 	return 0;
255 
256 discard_it:
257 	__SCTP_INC_STATS(net, SCTP_MIB_IN_PKT_DISCARDS);
258 	kfree_skb(skb);
259 	return 0;
260 
261 discard_release:
262 	/* Release the asoc/ep ref we took in the lookup calls. */
263 	if (transport)
264 		sctp_transport_put(transport);
265 	else
266 		sctp_endpoint_put(ep);
267 
268 	goto discard_it;
269 }
270 
271 /* Process the backlog queue of the socket.  Every skb on
272  * the backlog holds a ref on an association or endpoint.
273  * We hold this ref throughout the state machine to make
274  * sure that the structure we need is still around.
275  */
sctp_backlog_rcv(struct sock * sk,struct sk_buff * skb)276 int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
277 {
278 	struct sctp_chunk *chunk = SCTP_INPUT_CB(skb)->chunk;
279 	struct sctp_inq *inqueue = &chunk->rcvr->inqueue;
280 	struct sctp_transport *t = chunk->transport;
281 	struct sctp_ep_common *rcvr = NULL;
282 	int backloged = 0;
283 
284 	rcvr = chunk->rcvr;
285 
286 	/* If the rcvr is dead then the association or endpoint
287 	 * has been deleted and we can safely drop the chunk
288 	 * and refs that we are holding.
289 	 */
290 	if (rcvr->dead) {
291 		sctp_chunk_free(chunk);
292 		goto done;
293 	}
294 
295 	if (unlikely(rcvr->sk != sk)) {
296 		/* In this case, the association moved from one socket to
297 		 * another.  We are currently sitting on the backlog of the
298 		 * old socket, so we need to move.
299 		 * However, since we are here in the process context we
300 		 * need to take make sure that the user doesn't own
301 		 * the new socket when we process the packet.
302 		 * If the new socket is user-owned, queue the chunk to the
303 		 * backlog of the new socket without dropping any refs.
304 		 * Otherwise, we can safely push the chunk on the inqueue.
305 		 */
306 
307 		sk = rcvr->sk;
308 		local_bh_disable();
309 		bh_lock_sock(sk);
310 
311 		if (sock_owned_by_user(sk) || !sctp_newsk_ready(sk)) {
312 			if (sk_add_backlog(sk, skb, READ_ONCE(sk->sk_rcvbuf)))
313 				sctp_chunk_free(chunk);
314 			else
315 				backloged = 1;
316 		} else
317 			sctp_inq_push(inqueue, chunk);
318 
319 		bh_unlock_sock(sk);
320 		local_bh_enable();
321 
322 		/* If the chunk was backloged again, don't drop refs */
323 		if (backloged)
324 			return 0;
325 	} else {
326 		if (!sctp_newsk_ready(sk)) {
327 			if (!sk_add_backlog(sk, skb, READ_ONCE(sk->sk_rcvbuf)))
328 				return 0;
329 			sctp_chunk_free(chunk);
330 		} else {
331 			sctp_inq_push(inqueue, chunk);
332 		}
333 	}
334 
335 done:
336 	/* Release the refs we took in sctp_add_backlog */
337 	if (SCTP_EP_TYPE_ASSOCIATION == rcvr->type)
338 		sctp_transport_put(t);
339 	else if (SCTP_EP_TYPE_SOCKET == rcvr->type)
340 		sctp_endpoint_put(sctp_ep(rcvr));
341 	else
342 		BUG();
343 
344 	return 0;
345 }
346 
sctp_add_backlog(struct sock * sk,struct sk_buff * skb)347 static int sctp_add_backlog(struct sock *sk, struct sk_buff *skb)
348 {
349 	struct sctp_chunk *chunk = SCTP_INPUT_CB(skb)->chunk;
350 	struct sctp_transport *t = chunk->transport;
351 	struct sctp_ep_common *rcvr = chunk->rcvr;
352 	int ret;
353 
354 	ret = sk_add_backlog(sk, skb, READ_ONCE(sk->sk_rcvbuf));
355 	if (!ret) {
356 		/* Hold the assoc/ep while hanging on the backlog queue.
357 		 * This way, we know structures we need will not disappear
358 		 * from us
359 		 */
360 		if (SCTP_EP_TYPE_ASSOCIATION == rcvr->type)
361 			sctp_transport_hold(t);
362 		else if (SCTP_EP_TYPE_SOCKET == rcvr->type)
363 			sctp_endpoint_hold(sctp_ep(rcvr));
364 		else
365 			BUG();
366 	}
367 	return ret;
368 
369 }
370 
371 /* Handle icmp frag needed error. */
sctp_icmp_frag_needed(struct sock * sk,struct sctp_association * asoc,struct sctp_transport * t,__u32 pmtu)372 void sctp_icmp_frag_needed(struct sock *sk, struct sctp_association *asoc,
373 			   struct sctp_transport *t, __u32 pmtu)
374 {
375 	if (!t ||
376 	    (t->pathmtu <= pmtu &&
377 	     t->pl.probe_size + sctp_transport_pl_hlen(t) <= pmtu))
378 		return;
379 
380 	if (sock_owned_by_user(sk)) {
381 		atomic_set(&t->mtu_info, pmtu);
382 		asoc->pmtu_pending = 1;
383 		t->pmtu_pending = 1;
384 		return;
385 	}
386 
387 	if (!(t->param_flags & SPP_PMTUD_ENABLE))
388 		/* We can't allow retransmitting in such case, as the
389 		 * retransmission would be sized just as before, and thus we
390 		 * would get another icmp, and retransmit again.
391 		 */
392 		return;
393 
394 	/* Update transports view of the MTU. Return if no update was needed.
395 	 * If an update wasn't needed/possible, it also doesn't make sense to
396 	 * try to retransmit now.
397 	 */
398 	if (!sctp_transport_update_pmtu(t, pmtu))
399 		return;
400 
401 	/* Update association pmtu. */
402 	sctp_assoc_sync_pmtu(asoc);
403 
404 	/* Retransmit with the new pmtu setting. */
405 	sctp_retransmit(&asoc->outqueue, t, SCTP_RTXR_PMTUD);
406 }
407 
sctp_icmp_redirect(struct sock * sk,struct sctp_transport * t,struct sk_buff * skb)408 void sctp_icmp_redirect(struct sock *sk, struct sctp_transport *t,
409 			struct sk_buff *skb)
410 {
411 	struct dst_entry *dst;
412 
413 	if (sock_owned_by_user(sk) || !t)
414 		return;
415 	dst = sctp_transport_dst_check(t);
416 	if (dst)
417 		dst->ops->redirect(dst, sk, skb);
418 }
419 
420 /*
421  * SCTP Implementer's Guide, 2.37 ICMP handling procedures
422  *
423  * ICMP8) If the ICMP code is a "Unrecognized next header type encountered"
424  *        or a "Protocol Unreachable" treat this message as an abort
425  *        with the T bit set.
426  *
427  * This function sends an event to the state machine, which will abort the
428  * association.
429  *
430  */
sctp_icmp_proto_unreachable(struct sock * sk,struct sctp_association * asoc,struct sctp_transport * t)431 void sctp_icmp_proto_unreachable(struct sock *sk,
432 			   struct sctp_association *asoc,
433 			   struct sctp_transport *t)
434 {
435 	if (sock_owned_by_user(sk)) {
436 		if (timer_pending(&t->proto_unreach_timer))
437 			return;
438 		else {
439 			if (!mod_timer(&t->proto_unreach_timer,
440 						jiffies + (HZ/20)))
441 				sctp_transport_hold(t);
442 		}
443 	} else {
444 		struct net *net = sock_net(sk);
445 
446 		pr_debug("%s: unrecognized next header type "
447 			 "encountered!\n", __func__);
448 
449 		if (del_timer(&t->proto_unreach_timer))
450 			sctp_transport_put(t);
451 
452 		sctp_do_sm(net, SCTP_EVENT_T_OTHER,
453 			   SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
454 			   asoc->state, asoc->ep, asoc, t,
455 			   GFP_ATOMIC);
456 	}
457 }
458 
459 /* Common lookup code for icmp/icmpv6 error handler. */
sctp_err_lookup(struct net * net,int family,struct sk_buff * skb,struct sctphdr * sctphdr,struct sctp_association ** app,struct sctp_transport ** tpp)460 struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb,
461 			     struct sctphdr *sctphdr,
462 			     struct sctp_association **app,
463 			     struct sctp_transport **tpp)
464 {
465 	struct sctp_init_chunk *chunkhdr, _chunkhdr;
466 	union sctp_addr saddr;
467 	union sctp_addr daddr;
468 	struct sctp_af *af;
469 	struct sock *sk = NULL;
470 	struct sctp_association *asoc;
471 	struct sctp_transport *transport = NULL;
472 	__u32 vtag = ntohl(sctphdr->vtag);
473 	int sdif = inet_sdif(skb);
474 	int dif = inet_iif(skb);
475 
476 	*app = NULL; *tpp = NULL;
477 
478 	af = sctp_get_af_specific(family);
479 	if (unlikely(!af)) {
480 		return NULL;
481 	}
482 
483 	/* Initialize local addresses for lookups. */
484 	af->from_skb(&saddr, skb, 1);
485 	af->from_skb(&daddr, skb, 0);
486 
487 	/* Look for an association that matches the incoming ICMP error
488 	 * packet.
489 	 */
490 	asoc = __sctp_lookup_association(net, &saddr, &daddr, &transport, dif, sdif);
491 	if (!asoc)
492 		return NULL;
493 
494 	sk = asoc->base.sk;
495 
496 	/* RFC 4960, Appendix C. ICMP Handling
497 	 *
498 	 * ICMP6) An implementation MUST validate that the Verification Tag
499 	 * contained in the ICMP message matches the Verification Tag of
500 	 * the peer.  If the Verification Tag is not 0 and does NOT
501 	 * match, discard the ICMP message.  If it is 0 and the ICMP
502 	 * message contains enough bytes to verify that the chunk type is
503 	 * an INIT chunk and that the Initiate Tag matches the tag of the
504 	 * peer, continue with ICMP7.  If the ICMP message is too short
505 	 * or the chunk type or the Initiate Tag does not match, silently
506 	 * discard the packet.
507 	 */
508 	if (vtag == 0) {
509 		/* chunk header + first 4 octects of init header */
510 		chunkhdr = skb_header_pointer(skb, skb_transport_offset(skb) +
511 					      sizeof(struct sctphdr),
512 					      sizeof(struct sctp_chunkhdr) +
513 					      sizeof(__be32), &_chunkhdr);
514 		if (!chunkhdr ||
515 		    chunkhdr->chunk_hdr.type != SCTP_CID_INIT ||
516 		    ntohl(chunkhdr->init_hdr.init_tag) != asoc->c.my_vtag)
517 			goto out;
518 
519 	} else if (vtag != asoc->c.peer_vtag) {
520 		goto out;
521 	}
522 
523 	bh_lock_sock(sk);
524 
525 	/* If too many ICMPs get dropped on busy
526 	 * servers this needs to be solved differently.
527 	 */
528 	if (sock_owned_by_user(sk))
529 		__NET_INC_STATS(net, LINUX_MIB_LOCKDROPPEDICMPS);
530 
531 	*app = asoc;
532 	*tpp = transport;
533 	return sk;
534 
535 out:
536 	sctp_transport_put(transport);
537 	return NULL;
538 }
539 
540 /* Common cleanup code for icmp/icmpv6 error handler. */
sctp_err_finish(struct sock * sk,struct sctp_transport * t)541 void sctp_err_finish(struct sock *sk, struct sctp_transport *t)
542 	__releases(&((__sk)->sk_lock.slock))
543 {
544 	bh_unlock_sock(sk);
545 	sctp_transport_put(t);
546 }
547 
sctp_v4_err_handle(struct sctp_transport * t,struct sk_buff * skb,__u8 type,__u8 code,__u32 info)548 static void sctp_v4_err_handle(struct sctp_transport *t, struct sk_buff *skb,
549 			       __u8 type, __u8 code, __u32 info)
550 {
551 	struct sctp_association *asoc = t->asoc;
552 	struct sock *sk = asoc->base.sk;
553 	int err = 0;
554 
555 	switch (type) {
556 	case ICMP_PARAMETERPROB:
557 		err = EPROTO;
558 		break;
559 	case ICMP_DEST_UNREACH:
560 		if (code > NR_ICMP_UNREACH)
561 			return;
562 		if (code == ICMP_FRAG_NEEDED) {
563 			sctp_icmp_frag_needed(sk, asoc, t, SCTP_TRUNC4(info));
564 			return;
565 		}
566 		if (code == ICMP_PROT_UNREACH) {
567 			sctp_icmp_proto_unreachable(sk, asoc, t);
568 			return;
569 		}
570 		err = icmp_err_convert[code].errno;
571 		break;
572 	case ICMP_TIME_EXCEEDED:
573 		if (code == ICMP_EXC_FRAGTIME)
574 			return;
575 
576 		err = EHOSTUNREACH;
577 		break;
578 	case ICMP_REDIRECT:
579 		sctp_icmp_redirect(sk, t, skb);
580 		return;
581 	default:
582 		return;
583 	}
584 	if (!sock_owned_by_user(sk) && inet_test_bit(RECVERR, sk)) {
585 		sk->sk_err = err;
586 		sk_error_report(sk);
587 	} else {  /* Only an error on timeout */
588 		WRITE_ONCE(sk->sk_err_soft, err);
589 	}
590 }
591 
592 /*
593  * This routine is called by the ICMP module when it gets some
594  * sort of error condition.  If err < 0 then the socket should
595  * be closed and the error returned to the user.  If err > 0
596  * it's just the icmp type << 8 | icmp code.  After adjustment
597  * header points to the first 8 bytes of the sctp header.  We need
598  * to find the appropriate port.
599  *
600  * The locking strategy used here is very "optimistic". When
601  * someone else accesses the socket the ICMP is just dropped
602  * and for some paths there is no check at all.
603  * A more general error queue to queue errors for later handling
604  * is probably better.
605  *
606  */
sctp_v4_err(struct sk_buff * skb,__u32 info)607 int sctp_v4_err(struct sk_buff *skb, __u32 info)
608 {
609 	const struct iphdr *iph = (const struct iphdr *)skb->data;
610 	const int type = icmp_hdr(skb)->type;
611 	const int code = icmp_hdr(skb)->code;
612 	struct net *net = dev_net(skb->dev);
613 	struct sctp_transport *transport;
614 	struct sctp_association *asoc;
615 	__u16 saveip, savesctp;
616 	struct sock *sk;
617 
618 	/* Fix up skb to look at the embedded net header. */
619 	saveip = skb->network_header;
620 	savesctp = skb->transport_header;
621 	skb_reset_network_header(skb);
622 	skb_set_transport_header(skb, iph->ihl * 4);
623 	sk = sctp_err_lookup(net, AF_INET, skb, sctp_hdr(skb), &asoc, &transport);
624 	/* Put back, the original values. */
625 	skb->network_header = saveip;
626 	skb->transport_header = savesctp;
627 	if (!sk) {
628 		__ICMP_INC_STATS(net, ICMP_MIB_INERRORS);
629 		return -ENOENT;
630 	}
631 
632 	sctp_v4_err_handle(transport, skb, type, code, info);
633 	sctp_err_finish(sk, transport);
634 
635 	return 0;
636 }
637 
sctp_udp_v4_err(struct sock * sk,struct sk_buff * skb)638 int sctp_udp_v4_err(struct sock *sk, struct sk_buff *skb)
639 {
640 	struct net *net = dev_net(skb->dev);
641 	struct sctp_association *asoc;
642 	struct sctp_transport *t;
643 	struct icmphdr *hdr;
644 	__u32 info = 0;
645 
646 	skb->transport_header += sizeof(struct udphdr);
647 	sk = sctp_err_lookup(net, AF_INET, skb, sctp_hdr(skb), &asoc, &t);
648 	if (!sk) {
649 		__ICMP_INC_STATS(net, ICMP_MIB_INERRORS);
650 		return -ENOENT;
651 	}
652 
653 	skb->transport_header -= sizeof(struct udphdr);
654 	hdr = (struct icmphdr *)(skb_network_header(skb) - sizeof(struct icmphdr));
655 	if (hdr->type == ICMP_REDIRECT) {
656 		/* can't be handled without outer iphdr known, leave it to udp_err */
657 		sctp_err_finish(sk, t);
658 		return 0;
659 	}
660 	if (hdr->type == ICMP_DEST_UNREACH && hdr->code == ICMP_FRAG_NEEDED)
661 		info = ntohs(hdr->un.frag.mtu);
662 	sctp_v4_err_handle(t, skb, hdr->type, hdr->code, info);
663 
664 	sctp_err_finish(sk, t);
665 	return 1;
666 }
667 
668 /*
669  * RFC 2960, 8.4 - Handle "Out of the blue" Packets.
670  *
671  * This function scans all the chunks in the OOTB packet to determine if
672  * the packet should be discarded right away.  If a response might be needed
673  * for this packet, or, if further processing is possible, the packet will
674  * be queued to a proper inqueue for the next phase of handling.
675  *
676  * Output:
677  * Return 0 - If further processing is needed.
678  * Return 1 - If the packet can be discarded right away.
679  */
sctp_rcv_ootb(struct sk_buff * skb)680 static int sctp_rcv_ootb(struct sk_buff *skb)
681 {
682 	struct sctp_chunkhdr *ch, _ch;
683 	int ch_end, offset = 0;
684 
685 	/* Scan through all the chunks in the packet.  */
686 	do {
687 		/* Make sure we have at least the header there */
688 		if (offset + sizeof(_ch) > skb->len)
689 			break;
690 
691 		ch = skb_header_pointer(skb, offset, sizeof(*ch), &_ch);
692 
693 		/* Break out if chunk length is less then minimal. */
694 		if (!ch || ntohs(ch->length) < sizeof(_ch))
695 			break;
696 
697 		ch_end = offset + SCTP_PAD4(ntohs(ch->length));
698 		if (ch_end > skb->len)
699 			break;
700 
701 		/* RFC 8.4, 2) If the OOTB packet contains an ABORT chunk, the
702 		 * receiver MUST silently discard the OOTB packet and take no
703 		 * further action.
704 		 */
705 		if (SCTP_CID_ABORT == ch->type)
706 			goto discard;
707 
708 		/* RFC 8.4, 6) If the packet contains a SHUTDOWN COMPLETE
709 		 * chunk, the receiver should silently discard the packet
710 		 * and take no further action.
711 		 */
712 		if (SCTP_CID_SHUTDOWN_COMPLETE == ch->type)
713 			goto discard;
714 
715 		/* RFC 4460, 2.11.2
716 		 * This will discard packets with INIT chunk bundled as
717 		 * subsequent chunks in the packet.  When INIT is first,
718 		 * the normal INIT processing will discard the chunk.
719 		 */
720 		if (SCTP_CID_INIT == ch->type && (void *)ch != skb->data)
721 			goto discard;
722 
723 		offset = ch_end;
724 	} while (ch_end < skb->len);
725 
726 	return 0;
727 
728 discard:
729 	return 1;
730 }
731 
732 /* Insert endpoint into the hash table.  */
__sctp_hash_endpoint(struct sctp_endpoint * ep)733 static int __sctp_hash_endpoint(struct sctp_endpoint *ep)
734 {
735 	struct sock *sk = ep->base.sk;
736 	struct net *net = sock_net(sk);
737 	struct sctp_hashbucket *head;
738 	int err = 0;
739 
740 	ep->hashent = sctp_ep_hashfn(net, ep->base.bind_addr.port);
741 	head = &sctp_ep_hashtable[ep->hashent];
742 
743 	write_lock(&head->lock);
744 	if (sk->sk_reuseport) {
745 		bool any = sctp_is_ep_boundall(sk);
746 		struct sctp_endpoint *ep2;
747 		struct list_head *list;
748 		int cnt = 0;
749 
750 		err = 1;
751 
752 		list_for_each(list, &ep->base.bind_addr.address_list)
753 			cnt++;
754 
755 		sctp_for_each_hentry(ep2, &head->chain) {
756 			struct sock *sk2 = ep2->base.sk;
757 
758 			if (!net_eq(sock_net(sk2), net) || sk2 == sk ||
759 			    !uid_eq(sock_i_uid(sk2), sock_i_uid(sk)) ||
760 			    !sk2->sk_reuseport)
761 				continue;
762 
763 			err = sctp_bind_addrs_check(sctp_sk(sk2),
764 						    sctp_sk(sk), cnt);
765 			if (!err) {
766 				err = reuseport_add_sock(sk, sk2, any);
767 				if (err)
768 					goto out;
769 				break;
770 			} else if (err < 0) {
771 				goto out;
772 			}
773 		}
774 
775 		if (err) {
776 			err = reuseport_alloc(sk, any);
777 			if (err)
778 				goto out;
779 		}
780 	}
781 
782 	hlist_add_head(&ep->node, &head->chain);
783 out:
784 	write_unlock(&head->lock);
785 	return err;
786 }
787 
788 /* Add an endpoint to the hash. Local BH-safe. */
sctp_hash_endpoint(struct sctp_endpoint * ep)789 int sctp_hash_endpoint(struct sctp_endpoint *ep)
790 {
791 	int err;
792 
793 	local_bh_disable();
794 	err = __sctp_hash_endpoint(ep);
795 	local_bh_enable();
796 
797 	return err;
798 }
799 
800 /* Remove endpoint from the hash table.  */
__sctp_unhash_endpoint(struct sctp_endpoint * ep)801 static void __sctp_unhash_endpoint(struct sctp_endpoint *ep)
802 {
803 	struct sock *sk = ep->base.sk;
804 	struct sctp_hashbucket *head;
805 
806 	ep->hashent = sctp_ep_hashfn(sock_net(sk), ep->base.bind_addr.port);
807 
808 	head = &sctp_ep_hashtable[ep->hashent];
809 
810 	write_lock(&head->lock);
811 	if (rcu_access_pointer(sk->sk_reuseport_cb))
812 		reuseport_detach_sock(sk);
813 	hlist_del_init(&ep->node);
814 	write_unlock(&head->lock);
815 }
816 
817 /* Remove endpoint from the hash.  Local BH-safe. */
sctp_unhash_endpoint(struct sctp_endpoint * ep)818 void sctp_unhash_endpoint(struct sctp_endpoint *ep)
819 {
820 	local_bh_disable();
821 	__sctp_unhash_endpoint(ep);
822 	local_bh_enable();
823 }
824 
sctp_hashfn(const struct net * net,__be16 lport,const union sctp_addr * paddr,__u32 seed)825 static inline __u32 sctp_hashfn(const struct net *net, __be16 lport,
826 				const union sctp_addr *paddr, __u32 seed)
827 {
828 	__u32 addr;
829 
830 	if (paddr->sa.sa_family == AF_INET6)
831 		addr = jhash(&paddr->v6.sin6_addr, 16, seed);
832 	else
833 		addr = (__force __u32)paddr->v4.sin_addr.s_addr;
834 
835 	return  jhash_3words(addr, ((__force __u32)paddr->v4.sin_port) << 16 |
836 			     (__force __u32)lport, net_hash_mix(net), seed);
837 }
838 
839 /* Look up an endpoint. */
__sctp_rcv_lookup_endpoint(struct net * net,struct sk_buff * skb,const union sctp_addr * laddr,const union sctp_addr * paddr,int dif,int sdif)840 static struct sctp_endpoint *__sctp_rcv_lookup_endpoint(
841 					struct net *net, struct sk_buff *skb,
842 					const union sctp_addr *laddr,
843 					const union sctp_addr *paddr,
844 					int dif, int sdif)
845 {
846 	struct sctp_hashbucket *head;
847 	struct sctp_endpoint *ep;
848 	struct sock *sk;
849 	__be16 lport;
850 	int hash;
851 
852 	lport = laddr->v4.sin_port;
853 	hash = sctp_ep_hashfn(net, ntohs(lport));
854 	head = &sctp_ep_hashtable[hash];
855 	read_lock(&head->lock);
856 	sctp_for_each_hentry(ep, &head->chain) {
857 		if (sctp_endpoint_is_match(ep, net, laddr, dif, sdif))
858 			goto hit;
859 	}
860 
861 	ep = sctp_sk(net->sctp.ctl_sock)->ep;
862 
863 hit:
864 	sk = ep->base.sk;
865 	if (sk->sk_reuseport) {
866 		__u32 phash = sctp_hashfn(net, lport, paddr, 0);
867 
868 		sk = reuseport_select_sock(sk, phash, skb,
869 					   sizeof(struct sctphdr));
870 		if (sk)
871 			ep = sctp_sk(sk)->ep;
872 	}
873 	sctp_endpoint_hold(ep);
874 	read_unlock(&head->lock);
875 	return ep;
876 }
877 
878 /* rhashtable for transport */
879 struct sctp_hash_cmp_arg {
880 	const union sctp_addr	*paddr;
881 	const struct net	*net;
882 	__be16			lport;
883 };
884 
sctp_hash_cmp(struct rhashtable_compare_arg * arg,const void * ptr)885 static inline int sctp_hash_cmp(struct rhashtable_compare_arg *arg,
886 				const void *ptr)
887 {
888 	struct sctp_transport *t = (struct sctp_transport *)ptr;
889 	const struct sctp_hash_cmp_arg *x = arg->key;
890 	int err = 1;
891 
892 	if (!sctp_cmp_addr_exact(&t->ipaddr, x->paddr))
893 		return err;
894 	if (!sctp_transport_hold(t))
895 		return err;
896 
897 	if (!net_eq(t->asoc->base.net, x->net))
898 		goto out;
899 	if (x->lport != htons(t->asoc->base.bind_addr.port))
900 		goto out;
901 
902 	err = 0;
903 out:
904 	sctp_transport_put(t);
905 	return err;
906 }
907 
sctp_hash_obj(const void * data,u32 len,u32 seed)908 static inline __u32 sctp_hash_obj(const void *data, u32 len, u32 seed)
909 {
910 	const struct sctp_transport *t = data;
911 
912 	return sctp_hashfn(t->asoc->base.net,
913 			   htons(t->asoc->base.bind_addr.port),
914 			   &t->ipaddr, seed);
915 }
916 
sctp_hash_key(const void * data,u32 len,u32 seed)917 static inline __u32 sctp_hash_key(const void *data, u32 len, u32 seed)
918 {
919 	const struct sctp_hash_cmp_arg *x = data;
920 
921 	return sctp_hashfn(x->net, x->lport, x->paddr, seed);
922 }
923 
924 static const struct rhashtable_params sctp_hash_params = {
925 	.head_offset		= offsetof(struct sctp_transport, node),
926 	.hashfn			= sctp_hash_key,
927 	.obj_hashfn		= sctp_hash_obj,
928 	.obj_cmpfn		= sctp_hash_cmp,
929 	.automatic_shrinking	= true,
930 };
931 
sctp_transport_hashtable_init(void)932 int sctp_transport_hashtable_init(void)
933 {
934 	return rhltable_init(&sctp_transport_hashtable, &sctp_hash_params);
935 }
936 
sctp_transport_hashtable_destroy(void)937 void sctp_transport_hashtable_destroy(void)
938 {
939 	rhltable_destroy(&sctp_transport_hashtable);
940 }
941 
sctp_hash_transport(struct sctp_transport * t)942 int sctp_hash_transport(struct sctp_transport *t)
943 {
944 	struct sctp_transport *transport;
945 	struct rhlist_head *tmp, *list;
946 	struct sctp_hash_cmp_arg arg;
947 	int err;
948 
949 	if (t->asoc->temp)
950 		return 0;
951 
952 	arg.net   = t->asoc->base.net;
953 	arg.paddr = &t->ipaddr;
954 	arg.lport = htons(t->asoc->base.bind_addr.port);
955 
956 	rcu_read_lock();
957 	list = rhltable_lookup(&sctp_transport_hashtable, &arg,
958 			       sctp_hash_params);
959 
960 	rhl_for_each_entry_rcu(transport, tmp, list, node)
961 		if (transport->asoc->ep == t->asoc->ep) {
962 			rcu_read_unlock();
963 			return -EEXIST;
964 		}
965 	rcu_read_unlock();
966 
967 	err = rhltable_insert_key(&sctp_transport_hashtable, &arg,
968 				  &t->node, sctp_hash_params);
969 	if (err)
970 		pr_err_once("insert transport fail, errno %d\n", err);
971 
972 	return err;
973 }
974 
sctp_unhash_transport(struct sctp_transport * t)975 void sctp_unhash_transport(struct sctp_transport *t)
976 {
977 	if (t->asoc->temp)
978 		return;
979 
980 	rhltable_remove(&sctp_transport_hashtable, &t->node,
981 			sctp_hash_params);
982 }
983 
sctp_sk_bound_dev_eq(struct net * net,int bound_dev_if,int dif,int sdif)984 bool sctp_sk_bound_dev_eq(struct net *net, int bound_dev_if, int dif, int sdif)
985 {
986 	bool l3mdev_accept = true;
987 
988 #if IS_ENABLED(CONFIG_NET_L3_MASTER_DEV)
989 	l3mdev_accept = !!READ_ONCE(net->sctp.l3mdev_accept);
990 #endif
991 	return inet_bound_dev_eq(l3mdev_accept, bound_dev_if, dif, sdif);
992 }
993 
994 /* return a transport with holding it */
sctp_addrs_lookup_transport(struct net * net,const union sctp_addr * laddr,const union sctp_addr * paddr,int dif,int sdif)995 struct sctp_transport *sctp_addrs_lookup_transport(
996 				struct net *net,
997 				const union sctp_addr *laddr,
998 				const union sctp_addr *paddr,
999 				int dif, int sdif)
1000 {
1001 	struct rhlist_head *tmp, *list;
1002 	struct sctp_transport *t;
1003 	int bound_dev_if;
1004 	struct sctp_hash_cmp_arg arg = {
1005 		.paddr = paddr,
1006 		.net   = net,
1007 		.lport = laddr->v4.sin_port,
1008 	};
1009 
1010 	list = rhltable_lookup(&sctp_transport_hashtable, &arg,
1011 			       sctp_hash_params);
1012 
1013 	rhl_for_each_entry_rcu(t, tmp, list, node) {
1014 		if (!sctp_transport_hold(t))
1015 			continue;
1016 
1017 		bound_dev_if = READ_ONCE(t->asoc->base.sk->sk_bound_dev_if);
1018 		if (sctp_sk_bound_dev_eq(net, bound_dev_if, dif, sdif) &&
1019 		    sctp_bind_addr_match(&t->asoc->base.bind_addr,
1020 					 laddr, sctp_sk(t->asoc->base.sk)))
1021 			return t;
1022 		sctp_transport_put(t);
1023 	}
1024 
1025 	return NULL;
1026 }
1027 
1028 /* return a transport without holding it, as it's only used under sock lock */
sctp_epaddr_lookup_transport(const struct sctp_endpoint * ep,const union sctp_addr * paddr)1029 struct sctp_transport *sctp_epaddr_lookup_transport(
1030 				const struct sctp_endpoint *ep,
1031 				const union sctp_addr *paddr)
1032 {
1033 	struct rhlist_head *tmp, *list;
1034 	struct sctp_transport *t;
1035 	struct sctp_hash_cmp_arg arg = {
1036 		.paddr = paddr,
1037 		.net   = ep->base.net,
1038 		.lport = htons(ep->base.bind_addr.port),
1039 	};
1040 
1041 	list = rhltable_lookup(&sctp_transport_hashtable, &arg,
1042 			       sctp_hash_params);
1043 
1044 	rhl_for_each_entry_rcu(t, tmp, list, node)
1045 		if (ep == t->asoc->ep)
1046 			return t;
1047 
1048 	return NULL;
1049 }
1050 
1051 /* Look up an association. */
__sctp_lookup_association(struct net * net,const union sctp_addr * local,const union sctp_addr * peer,struct sctp_transport ** pt,int dif,int sdif)1052 static struct sctp_association *__sctp_lookup_association(
1053 					struct net *net,
1054 					const union sctp_addr *local,
1055 					const union sctp_addr *peer,
1056 					struct sctp_transport **pt,
1057 					int dif, int sdif)
1058 {
1059 	struct sctp_transport *t;
1060 	struct sctp_association *asoc = NULL;
1061 
1062 	t = sctp_addrs_lookup_transport(net, local, peer, dif, sdif);
1063 	if (!t)
1064 		goto out;
1065 
1066 	asoc = t->asoc;
1067 	*pt = t;
1068 
1069 out:
1070 	return asoc;
1071 }
1072 
1073 /* Look up an association. protected by RCU read lock */
1074 static
sctp_lookup_association(struct net * net,const union sctp_addr * laddr,const union sctp_addr * paddr,struct sctp_transport ** transportp,int dif,int sdif)1075 struct sctp_association *sctp_lookup_association(struct net *net,
1076 						 const union sctp_addr *laddr,
1077 						 const union sctp_addr *paddr,
1078 						 struct sctp_transport **transportp,
1079 						 int dif, int sdif)
1080 {
1081 	struct sctp_association *asoc;
1082 
1083 	rcu_read_lock();
1084 	asoc = __sctp_lookup_association(net, laddr, paddr, transportp, dif, sdif);
1085 	rcu_read_unlock();
1086 
1087 	return asoc;
1088 }
1089 
1090 /* Is there an association matching the given local and peer addresses? */
sctp_has_association(struct net * net,const union sctp_addr * laddr,const union sctp_addr * paddr,int dif,int sdif)1091 bool sctp_has_association(struct net *net,
1092 			  const union sctp_addr *laddr,
1093 			  const union sctp_addr *paddr,
1094 			  int dif, int sdif)
1095 {
1096 	struct sctp_transport *transport;
1097 
1098 	if (sctp_lookup_association(net, laddr, paddr, &transport, dif, sdif)) {
1099 		sctp_transport_put(transport);
1100 		return true;
1101 	}
1102 
1103 	return false;
1104 }
1105 
1106 /*
1107  * SCTP Implementors Guide, 2.18 Handling of address
1108  * parameters within the INIT or INIT-ACK.
1109  *
1110  * D) When searching for a matching TCB upon reception of an INIT
1111  *    or INIT-ACK chunk the receiver SHOULD use not only the
1112  *    source address of the packet (containing the INIT or
1113  *    INIT-ACK) but the receiver SHOULD also use all valid
1114  *    address parameters contained within the chunk.
1115  *
1116  * 2.18.3 Solution description
1117  *
1118  * This new text clearly specifies to an implementor the need
1119  * to look within the INIT or INIT-ACK. Any implementation that
1120  * does not do this, may not be able to establish associations
1121  * in certain circumstances.
1122  *
1123  */
__sctp_rcv_init_lookup(struct net * net,struct sk_buff * skb,const union sctp_addr * laddr,struct sctp_transport ** transportp,int dif,int sdif)1124 static struct sctp_association *__sctp_rcv_init_lookup(struct net *net,
1125 	struct sk_buff *skb,
1126 	const union sctp_addr *laddr, struct sctp_transport **transportp,
1127 	int dif, int sdif)
1128 {
1129 	struct sctp_association *asoc;
1130 	union sctp_addr addr;
1131 	union sctp_addr *paddr = &addr;
1132 	struct sctphdr *sh = sctp_hdr(skb);
1133 	union sctp_params params;
1134 	struct sctp_init_chunk *init;
1135 	struct sctp_af *af;
1136 
1137 	/*
1138 	 * This code will NOT touch anything inside the chunk--it is
1139 	 * strictly READ-ONLY.
1140 	 *
1141 	 * RFC 2960 3  SCTP packet Format
1142 	 *
1143 	 * Multiple chunks can be bundled into one SCTP packet up to
1144 	 * the MTU size, except for the INIT, INIT ACK, and SHUTDOWN
1145 	 * COMPLETE chunks.  These chunks MUST NOT be bundled with any
1146 	 * other chunk in a packet.  See Section 6.10 for more details
1147 	 * on chunk bundling.
1148 	 */
1149 
1150 	/* Find the start of the TLVs and the end of the chunk.  This is
1151 	 * the region we search for address parameters.
1152 	 */
1153 	init = (struct sctp_init_chunk *)skb->data;
1154 
1155 	/* Walk the parameters looking for embedded addresses. */
1156 	sctp_walk_params(params, init) {
1157 
1158 		/* Note: Ignoring hostname addresses. */
1159 		af = sctp_get_af_specific(param_type2af(params.p->type));
1160 		if (!af)
1161 			continue;
1162 
1163 		if (!af->from_addr_param(paddr, params.addr, sh->source, 0))
1164 			continue;
1165 
1166 		asoc = __sctp_lookup_association(net, laddr, paddr, transportp, dif, sdif);
1167 		if (asoc)
1168 			return asoc;
1169 	}
1170 
1171 	return NULL;
1172 }
1173 
1174 /* ADD-IP, Section 5.2
1175  * When an endpoint receives an ASCONF Chunk from the remote peer
1176  * special procedures may be needed to identify the association the
1177  * ASCONF Chunk is associated with. To properly find the association
1178  * the following procedures SHOULD be followed:
1179  *
1180  * D2) If the association is not found, use the address found in the
1181  * Address Parameter TLV combined with the port number found in the
1182  * SCTP common header. If found proceed to rule D4.
1183  *
1184  * D2-ext) If more than one ASCONF Chunks are packed together, use the
1185  * address found in the ASCONF Address Parameter TLV of each of the
1186  * subsequent ASCONF Chunks. If found, proceed to rule D4.
1187  */
__sctp_rcv_asconf_lookup(struct net * net,struct sctp_chunkhdr * ch,const union sctp_addr * laddr,__be16 peer_port,struct sctp_transport ** transportp,int dif,int sdif)1188 static struct sctp_association *__sctp_rcv_asconf_lookup(
1189 					struct net *net,
1190 					struct sctp_chunkhdr *ch,
1191 					const union sctp_addr *laddr,
1192 					__be16 peer_port,
1193 					struct sctp_transport **transportp,
1194 					int dif, int sdif)
1195 {
1196 	struct sctp_addip_chunk *asconf = (struct sctp_addip_chunk *)ch;
1197 	struct sctp_af *af;
1198 	union sctp_addr_param *param;
1199 	union sctp_addr paddr;
1200 
1201 	if (ntohs(ch->length) < sizeof(*asconf) + sizeof(struct sctp_paramhdr))
1202 		return NULL;
1203 
1204 	/* Skip over the ADDIP header and find the Address parameter */
1205 	param = (union sctp_addr_param *)(asconf + 1);
1206 
1207 	af = sctp_get_af_specific(param_type2af(param->p.type));
1208 	if (unlikely(!af))
1209 		return NULL;
1210 
1211 	if (!af->from_addr_param(&paddr, param, peer_port, 0))
1212 		return NULL;
1213 
1214 	return __sctp_lookup_association(net, laddr, &paddr, transportp, dif, sdif);
1215 }
1216 
1217 
1218 /* SCTP-AUTH, Section 6.3:
1219 *    If the receiver does not find a STCB for a packet containing an AUTH
1220 *    chunk as the first chunk and not a COOKIE-ECHO chunk as the second
1221 *    chunk, it MUST use the chunks after the AUTH chunk to look up an existing
1222 *    association.
1223 *
1224 * This means that any chunks that can help us identify the association need
1225 * to be looked at to find this association.
1226 */
__sctp_rcv_walk_lookup(struct net * net,struct sk_buff * skb,const union sctp_addr * laddr,struct sctp_transport ** transportp,int dif,int sdif)1227 static struct sctp_association *__sctp_rcv_walk_lookup(struct net *net,
1228 				      struct sk_buff *skb,
1229 				      const union sctp_addr *laddr,
1230 				      struct sctp_transport **transportp,
1231 				      int dif, int sdif)
1232 {
1233 	struct sctp_association *asoc = NULL;
1234 	struct sctp_chunkhdr *ch;
1235 	int have_auth = 0;
1236 	unsigned int chunk_num = 1;
1237 	__u8 *ch_end;
1238 
1239 	/* Walk through the chunks looking for AUTH or ASCONF chunks
1240 	 * to help us find the association.
1241 	 */
1242 	ch = (struct sctp_chunkhdr *)skb->data;
1243 	do {
1244 		/* Break out if chunk length is less then minimal. */
1245 		if (ntohs(ch->length) < sizeof(*ch))
1246 			break;
1247 
1248 		ch_end = ((__u8 *)ch) + SCTP_PAD4(ntohs(ch->length));
1249 		if (ch_end > skb_tail_pointer(skb))
1250 			break;
1251 
1252 		switch (ch->type) {
1253 		case SCTP_CID_AUTH:
1254 			have_auth = chunk_num;
1255 			break;
1256 
1257 		case SCTP_CID_COOKIE_ECHO:
1258 			/* If a packet arrives containing an AUTH chunk as
1259 			 * a first chunk, a COOKIE-ECHO chunk as the second
1260 			 * chunk, and possibly more chunks after them, and
1261 			 * the receiver does not have an STCB for that
1262 			 * packet, then authentication is based on
1263 			 * the contents of the COOKIE- ECHO chunk.
1264 			 */
1265 			if (have_auth == 1 && chunk_num == 2)
1266 				return NULL;
1267 			break;
1268 
1269 		case SCTP_CID_ASCONF:
1270 			if (have_auth || net->sctp.addip_noauth)
1271 				asoc = __sctp_rcv_asconf_lookup(
1272 						net, ch, laddr,
1273 						sctp_hdr(skb)->source,
1274 						transportp, dif, sdif);
1275 			break;
1276 		default:
1277 			break;
1278 		}
1279 
1280 		if (asoc)
1281 			break;
1282 
1283 		ch = (struct sctp_chunkhdr *)ch_end;
1284 		chunk_num++;
1285 	} while (ch_end + sizeof(*ch) < skb_tail_pointer(skb));
1286 
1287 	return asoc;
1288 }
1289 
1290 /*
1291  * There are circumstances when we need to look inside the SCTP packet
1292  * for information to help us find the association.   Examples
1293  * include looking inside of INIT/INIT-ACK chunks or after the AUTH
1294  * chunks.
1295  */
__sctp_rcv_lookup_harder(struct net * net,struct sk_buff * skb,const union sctp_addr * laddr,struct sctp_transport ** transportp,int dif,int sdif)1296 static struct sctp_association *__sctp_rcv_lookup_harder(struct net *net,
1297 				      struct sk_buff *skb,
1298 				      const union sctp_addr *laddr,
1299 				      struct sctp_transport **transportp,
1300 				      int dif, int sdif)
1301 {
1302 	struct sctp_chunkhdr *ch;
1303 
1304 	/* We do not allow GSO frames here as we need to linearize and
1305 	 * then cannot guarantee frame boundaries. This shouldn't be an
1306 	 * issue as packets hitting this are mostly INIT or INIT-ACK and
1307 	 * those cannot be on GSO-style anyway.
1308 	 */
1309 	if (skb_is_gso(skb) && skb_is_gso_sctp(skb))
1310 		return NULL;
1311 
1312 	ch = (struct sctp_chunkhdr *)skb->data;
1313 
1314 	/* The code below will attempt to walk the chunk and extract
1315 	 * parameter information.  Before we do that, we need to verify
1316 	 * that the chunk length doesn't cause overflow.  Otherwise, we'll
1317 	 * walk off the end.
1318 	 */
1319 	if (SCTP_PAD4(ntohs(ch->length)) > skb->len)
1320 		return NULL;
1321 
1322 	/* If this is INIT/INIT-ACK look inside the chunk too. */
1323 	if (ch->type == SCTP_CID_INIT || ch->type == SCTP_CID_INIT_ACK)
1324 		return __sctp_rcv_init_lookup(net, skb, laddr, transportp, dif, sdif);
1325 
1326 	return __sctp_rcv_walk_lookup(net, skb, laddr, transportp, dif, sdif);
1327 }
1328 
1329 /* Lookup an association for an inbound skb. */
__sctp_rcv_lookup(struct net * net,struct sk_buff * skb,const union sctp_addr * paddr,const union sctp_addr * laddr,struct sctp_transport ** transportp,int dif,int sdif)1330 static struct sctp_association *__sctp_rcv_lookup(struct net *net,
1331 				      struct sk_buff *skb,
1332 				      const union sctp_addr *paddr,
1333 				      const union sctp_addr *laddr,
1334 				      struct sctp_transport **transportp,
1335 				      int dif, int sdif)
1336 {
1337 	struct sctp_association *asoc;
1338 
1339 	asoc = __sctp_lookup_association(net, laddr, paddr, transportp, dif, sdif);
1340 	if (asoc)
1341 		goto out;
1342 
1343 	/* Further lookup for INIT/INIT-ACK packets.
1344 	 * SCTP Implementors Guide, 2.18 Handling of address
1345 	 * parameters within the INIT or INIT-ACK.
1346 	 */
1347 	asoc = __sctp_rcv_lookup_harder(net, skb, laddr, transportp, dif, sdif);
1348 	if (asoc)
1349 		goto out;
1350 
1351 	if (paddr->sa.sa_family == AF_INET)
1352 		pr_debug("sctp: asoc not found for src:%pI4:%d dst:%pI4:%d\n",
1353 			 &laddr->v4.sin_addr, ntohs(laddr->v4.sin_port),
1354 			 &paddr->v4.sin_addr, ntohs(paddr->v4.sin_port));
1355 	else
1356 		pr_debug("sctp: asoc not found for src:%pI6:%d dst:%pI6:%d\n",
1357 			 &laddr->v6.sin6_addr, ntohs(laddr->v6.sin6_port),
1358 			 &paddr->v6.sin6_addr, ntohs(paddr->v6.sin6_port));
1359 
1360 out:
1361 	return asoc;
1362 }
1363