1 /* 2 * net/dccp/options.c 3 * 4 * An implementation of the DCCP protocol 5 * Copyright (c) 2005 Aristeu Sergio Rozanski Filho <aris@cathedrallabs.org> 6 * Copyright (c) 2005 Arnaldo Carvalho de Melo <acme@ghostprotocols.net> 7 * Copyright (c) 2005 Ian McDonald <ian.mcdonald@jandi.co.nz> 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of the GNU General Public License 11 * as published by the Free Software Foundation; either version 12 * 2 of the License, or (at your option) any later version. 13 */ 14 #include <linux/dccp.h> 15 #include <linux/module.h> 16 #include <linux/types.h> 17 #include <asm/unaligned.h> 18 #include <linux/kernel.h> 19 #include <linux/skbuff.h> 20 21 #include "ackvec.h" 22 #include "ccid.h" 23 #include "dccp.h" 24 #include "feat.h" 25 26 u64 dccp_decode_value_var(const u8 *bf, const u8 len) 27 { 28 u64 value = 0; 29 30 if (len >= DCCP_OPTVAL_MAXLEN) 31 value += ((u64)*bf++) << 40; 32 if (len > 4) 33 value += ((u64)*bf++) << 32; 34 if (len > 3) 35 value += ((u64)*bf++) << 24; 36 if (len > 2) 37 value += ((u64)*bf++) << 16; 38 if (len > 1) 39 value += ((u64)*bf++) << 8; 40 if (len > 0) 41 value += *bf; 42 43 return value; 44 } 45 46 /** 47 * dccp_parse_options - Parse DCCP options present in @skb 48 * @sk: client|server|listening dccp socket (when @dreq != NULL) 49 * @dreq: request socket to use during connection setup, or NULL 50 */ 51 int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq, 52 struct sk_buff *skb) 53 { 54 struct dccp_sock *dp = dccp_sk(sk); 55 const struct dccp_hdr *dh = dccp_hdr(skb); 56 const u8 pkt_type = DCCP_SKB_CB(skb)->dccpd_type; 57 unsigned char *options = (unsigned char *)dh + dccp_hdr_len(skb); 58 unsigned char *opt_ptr = options; 59 const unsigned char *opt_end = (unsigned char *)dh + 60 (dh->dccph_doff * 4); 61 struct dccp_options_received *opt_recv = &dp->dccps_options_received; 62 unsigned char opt, len; 63 unsigned char *uninitialized_var(value); 64 u32 elapsed_time; 65 __be32 opt_val; 66 int rc; 67 int mandatory = 0; 68 69 memset(opt_recv, 0, sizeof(*opt_recv)); 70 71 opt = len = 0; 72 while (opt_ptr != opt_end) { 73 opt = *opt_ptr++; 74 len = 0; 75 value = NULL; 76 77 /* Check if this isn't a single byte option */ 78 if (opt > DCCPO_MAX_RESERVED) { 79 if (opt_ptr == opt_end) 80 goto out_nonsensical_length; 81 82 len = *opt_ptr++; 83 if (len < 2) 84 goto out_nonsensical_length; 85 /* 86 * Remove the type and len fields, leaving 87 * just the value size 88 */ 89 len -= 2; 90 value = opt_ptr; 91 opt_ptr += len; 92 93 if (opt_ptr > opt_end) 94 goto out_nonsensical_length; 95 } 96 97 /* 98 * CCID-specific options are ignored during connection setup, as 99 * negotiation may still be in progress (see RFC 4340, 10.3). 100 * The same applies to Ack Vectors, as these depend on the CCID. 101 */ 102 if (dreq != NULL && (opt >= DCCPO_MIN_RX_CCID_SPECIFIC || 103 opt == DCCPO_ACK_VECTOR_0 || opt == DCCPO_ACK_VECTOR_1)) 104 goto ignore_option; 105 106 switch (opt) { 107 case DCCPO_PADDING: 108 break; 109 case DCCPO_MANDATORY: 110 if (mandatory) 111 goto out_invalid_option; 112 if (pkt_type != DCCP_PKT_DATA) 113 mandatory = 1; 114 break; 115 case DCCPO_NDP_COUNT: 116 if (len > 6) 117 goto out_invalid_option; 118 119 opt_recv->dccpor_ndp = dccp_decode_value_var(value, len); 120 dccp_pr_debug("%s opt: NDP count=%llu\n", dccp_role(sk), 121 (unsigned long long)opt_recv->dccpor_ndp); 122 break; 123 case DCCPO_CHANGE_L ... DCCPO_CONFIRM_R: 124 if (pkt_type == DCCP_PKT_DATA) /* RFC 4340, 6 */ 125 break; 126 if (len == 0) 127 goto out_invalid_option; 128 rc = dccp_feat_parse_options(sk, dreq, mandatory, opt, 129 *value, value + 1, len - 1); 130 if (rc) 131 goto out_featneg_failed; 132 break; 133 case DCCPO_TIMESTAMP: 134 if (len != 4) 135 goto out_invalid_option; 136 /* 137 * RFC 4340 13.1: "The precise time corresponding to 138 * Timestamp Value zero is not specified". We use 139 * zero to indicate absence of a meaningful timestamp. 140 */ 141 opt_val = get_unaligned((__be32 *)value); 142 if (unlikely(opt_val == 0)) { 143 DCCP_WARN("Timestamp with zero value\n"); 144 break; 145 } 146 147 if (dreq != NULL) { 148 dreq->dreq_timestamp_echo = ntohl(opt_val); 149 dreq->dreq_timestamp_time = dccp_timestamp(); 150 } else { 151 opt_recv->dccpor_timestamp = 152 dp->dccps_timestamp_echo = ntohl(opt_val); 153 dp->dccps_timestamp_time = dccp_timestamp(); 154 } 155 dccp_pr_debug("%s rx opt: TIMESTAMP=%u, ackno=%llu\n", 156 dccp_role(sk), ntohl(opt_val), 157 (unsigned long long) 158 DCCP_SKB_CB(skb)->dccpd_ack_seq); 159 /* schedule an Ack in case this sender is quiescent */ 160 inet_csk_schedule_ack(sk); 161 break; 162 case DCCPO_TIMESTAMP_ECHO: 163 if (len != 4 && len != 6 && len != 8) 164 goto out_invalid_option; 165 166 opt_val = get_unaligned((__be32 *)value); 167 opt_recv->dccpor_timestamp_echo = ntohl(opt_val); 168 169 dccp_pr_debug("%s rx opt: TIMESTAMP_ECHO=%u, len=%d, " 170 "ackno=%llu", dccp_role(sk), 171 opt_recv->dccpor_timestamp_echo, 172 len + 2, 173 (unsigned long long) 174 DCCP_SKB_CB(skb)->dccpd_ack_seq); 175 176 value += 4; 177 178 if (len == 4) { /* no elapsed time included */ 179 dccp_pr_debug_cat("\n"); 180 break; 181 } 182 183 if (len == 6) { /* 2-byte elapsed time */ 184 __be16 opt_val2 = get_unaligned((__be16 *)value); 185 elapsed_time = ntohs(opt_val2); 186 } else { /* 4-byte elapsed time */ 187 opt_val = get_unaligned((__be32 *)value); 188 elapsed_time = ntohl(opt_val); 189 } 190 191 dccp_pr_debug_cat(", ELAPSED_TIME=%u\n", elapsed_time); 192 193 /* Give precedence to the biggest ELAPSED_TIME */ 194 if (elapsed_time > opt_recv->dccpor_elapsed_time) 195 opt_recv->dccpor_elapsed_time = elapsed_time; 196 break; 197 case DCCPO_ELAPSED_TIME: 198 if (dccp_packet_without_ack(skb)) /* RFC 4340, 13.2 */ 199 break; 200 201 if (len == 2) { 202 __be16 opt_val2 = get_unaligned((__be16 *)value); 203 elapsed_time = ntohs(opt_val2); 204 } else if (len == 4) { 205 opt_val = get_unaligned((__be32 *)value); 206 elapsed_time = ntohl(opt_val); 207 } else { 208 goto out_invalid_option; 209 } 210 211 if (elapsed_time > opt_recv->dccpor_elapsed_time) 212 opt_recv->dccpor_elapsed_time = elapsed_time; 213 214 dccp_pr_debug("%s rx opt: ELAPSED_TIME=%d\n", 215 dccp_role(sk), elapsed_time); 216 break; 217 case DCCPO_MIN_RX_CCID_SPECIFIC ... DCCPO_MAX_RX_CCID_SPECIFIC: 218 if (ccid_hc_rx_parse_options(dp->dccps_hc_rx_ccid, sk, 219 pkt_type, opt, value, len)) 220 goto out_invalid_option; 221 break; 222 case DCCPO_ACK_VECTOR_0: 223 case DCCPO_ACK_VECTOR_1: 224 if (dccp_packet_without_ack(skb)) /* RFC 4340, 11.4 */ 225 break; 226 /* 227 * Ack vectors are processed by the TX CCID if it is 228 * interested. The RX CCID need not parse Ack Vectors, 229 * since it is only interested in clearing old state. 230 * Fall through. 231 */ 232 case DCCPO_MIN_TX_CCID_SPECIFIC ... DCCPO_MAX_TX_CCID_SPECIFIC: 233 if (ccid_hc_tx_parse_options(dp->dccps_hc_tx_ccid, sk, 234 pkt_type, opt, value, len)) 235 goto out_invalid_option; 236 break; 237 default: 238 DCCP_CRIT("DCCP(%p): option %d(len=%d) not " 239 "implemented, ignoring", sk, opt, len); 240 break; 241 } 242 ignore_option: 243 if (opt != DCCPO_MANDATORY) 244 mandatory = 0; 245 } 246 247 /* mandatory was the last byte in option list -> reset connection */ 248 if (mandatory) 249 goto out_invalid_option; 250 251 out_nonsensical_length: 252 /* RFC 4340, 5.8: ignore option and all remaining option space */ 253 return 0; 254 255 out_invalid_option: 256 DCCP_INC_STATS_BH(DCCP_MIB_INVALIDOPT); 257 rc = DCCP_RESET_CODE_OPTION_ERROR; 258 out_featneg_failed: 259 DCCP_WARN("DCCP(%p): Option %d (len=%d) error=%u\n", sk, opt, len, rc); 260 DCCP_SKB_CB(skb)->dccpd_reset_code = rc; 261 DCCP_SKB_CB(skb)->dccpd_reset_data[0] = opt; 262 DCCP_SKB_CB(skb)->dccpd_reset_data[1] = len > 0 ? value[0] : 0; 263 DCCP_SKB_CB(skb)->dccpd_reset_data[2] = len > 1 ? value[1] : 0; 264 return -1; 265 } 266 267 EXPORT_SYMBOL_GPL(dccp_parse_options); 268 269 void dccp_encode_value_var(const u64 value, u8 *to, const u8 len) 270 { 271 if (len >= DCCP_OPTVAL_MAXLEN) 272 *to++ = (value & 0xFF0000000000ull) >> 40; 273 if (len > 4) 274 *to++ = (value & 0xFF00000000ull) >> 32; 275 if (len > 3) 276 *to++ = (value & 0xFF000000) >> 24; 277 if (len > 2) 278 *to++ = (value & 0xFF0000) >> 16; 279 if (len > 1) 280 *to++ = (value & 0xFF00) >> 8; 281 if (len > 0) 282 *to++ = (value & 0xFF); 283 } 284 285 static inline u8 dccp_ndp_len(const u64 ndp) 286 { 287 if (likely(ndp <= 0xFF)) 288 return 1; 289 return likely(ndp <= USHRT_MAX) ? 2 : (ndp <= UINT_MAX ? 4 : 6); 290 } 291 292 int dccp_insert_option(struct sk_buff *skb, const unsigned char option, 293 const void *value, const unsigned char len) 294 { 295 unsigned char *to; 296 297 if (DCCP_SKB_CB(skb)->dccpd_opt_len + len + 2 > DCCP_MAX_OPT_LEN) 298 return -1; 299 300 DCCP_SKB_CB(skb)->dccpd_opt_len += len + 2; 301 302 to = skb_push(skb, len + 2); 303 *to++ = option; 304 *to++ = len + 2; 305 306 memcpy(to, value, len); 307 return 0; 308 } 309 310 EXPORT_SYMBOL_GPL(dccp_insert_option); 311 312 static int dccp_insert_option_ndp(struct sock *sk, struct sk_buff *skb) 313 { 314 struct dccp_sock *dp = dccp_sk(sk); 315 u64 ndp = dp->dccps_ndp_count; 316 317 if (dccp_non_data_packet(skb)) 318 ++dp->dccps_ndp_count; 319 else 320 dp->dccps_ndp_count = 0; 321 322 if (ndp > 0) { 323 unsigned char *ptr; 324 const int ndp_len = dccp_ndp_len(ndp); 325 const int len = ndp_len + 2; 326 327 if (DCCP_SKB_CB(skb)->dccpd_opt_len + len > DCCP_MAX_OPT_LEN) 328 return -1; 329 330 DCCP_SKB_CB(skb)->dccpd_opt_len += len; 331 332 ptr = skb_push(skb, len); 333 *ptr++ = DCCPO_NDP_COUNT; 334 *ptr++ = len; 335 dccp_encode_value_var(ndp, ptr, ndp_len); 336 } 337 338 return 0; 339 } 340 341 static inline int dccp_elapsed_time_len(const u32 elapsed_time) 342 { 343 return elapsed_time == 0 ? 0 : elapsed_time <= 0xFFFF ? 2 : 4; 344 } 345 346 static int dccp_insert_option_timestamp(struct sk_buff *skb) 347 { 348 __be32 now = htonl(dccp_timestamp()); 349 /* yes this will overflow but that is the point as we want a 350 * 10 usec 32 bit timer which mean it wraps every 11.9 hours */ 351 352 return dccp_insert_option(skb, DCCPO_TIMESTAMP, &now, sizeof(now)); 353 } 354 355 static int dccp_insert_option_timestamp_echo(struct dccp_sock *dp, 356 struct dccp_request_sock *dreq, 357 struct sk_buff *skb) 358 { 359 __be32 tstamp_echo; 360 unsigned char *to; 361 u32 elapsed_time, elapsed_time_len, len; 362 363 if (dreq != NULL) { 364 elapsed_time = dccp_timestamp() - dreq->dreq_timestamp_time; 365 tstamp_echo = htonl(dreq->dreq_timestamp_echo); 366 dreq->dreq_timestamp_echo = 0; 367 } else { 368 elapsed_time = dccp_timestamp() - dp->dccps_timestamp_time; 369 tstamp_echo = htonl(dp->dccps_timestamp_echo); 370 dp->dccps_timestamp_echo = 0; 371 } 372 373 elapsed_time_len = dccp_elapsed_time_len(elapsed_time); 374 len = 6 + elapsed_time_len; 375 376 if (DCCP_SKB_CB(skb)->dccpd_opt_len + len > DCCP_MAX_OPT_LEN) 377 return -1; 378 379 DCCP_SKB_CB(skb)->dccpd_opt_len += len; 380 381 to = skb_push(skb, len); 382 *to++ = DCCPO_TIMESTAMP_ECHO; 383 *to++ = len; 384 385 memcpy(to, &tstamp_echo, 4); 386 to += 4; 387 388 if (elapsed_time_len == 2) { 389 const __be16 var16 = htons((u16)elapsed_time); 390 memcpy(to, &var16, 2); 391 } else if (elapsed_time_len == 4) { 392 const __be32 var32 = htonl(elapsed_time); 393 memcpy(to, &var32, 4); 394 } 395 396 return 0; 397 } 398 399 static int dccp_insert_option_ackvec(struct sock *sk, struct sk_buff *skb) 400 { 401 struct dccp_sock *dp = dccp_sk(sk); 402 struct dccp_ackvec *av = dp->dccps_hc_rx_ackvec; 403 struct dccp_skb_cb *dcb = DCCP_SKB_CB(skb); 404 const u16 buflen = dccp_ackvec_buflen(av); 405 /* Figure out how many options do we need to represent the ackvec */ 406 const u8 nr_opts = DIV_ROUND_UP(buflen, DCCP_SINGLE_OPT_MAXLEN); 407 u16 len = buflen + 2 * nr_opts; 408 u8 i, nonce = 0; 409 const unsigned char *tail, *from; 410 unsigned char *to; 411 412 if (dcb->dccpd_opt_len + len > DCCP_MAX_OPT_LEN) { 413 DCCP_WARN("Lacking space for %u bytes on %s packet\n", len, 414 dccp_packet_name(dcb->dccpd_type)); 415 return -1; 416 } 417 /* 418 * Since Ack Vectors are variable-length, we can not always predict 419 * their size. To catch exception cases where the space is running out 420 * on the skb, a separate Sync is scheduled to carry the Ack Vector. 421 */ 422 if (len > DCCPAV_MIN_OPTLEN && 423 len + dcb->dccpd_opt_len + skb->len > dp->dccps_mss_cache) { 424 DCCP_WARN("No space left for Ack Vector (%u) on skb (%u+%u), " 425 "MPS=%u ==> reduce payload size?\n", len, skb->len, 426 dcb->dccpd_opt_len, dp->dccps_mss_cache); 427 dp->dccps_sync_scheduled = 1; 428 return 0; 429 } 430 dcb->dccpd_opt_len += len; 431 432 to = skb_push(skb, len); 433 len = buflen; 434 from = av->av_buf + av->av_buf_head; 435 tail = av->av_buf + DCCPAV_MAX_ACKVEC_LEN; 436 437 for (i = 0; i < nr_opts; ++i) { 438 int copylen = len; 439 440 if (len > DCCP_SINGLE_OPT_MAXLEN) 441 copylen = DCCP_SINGLE_OPT_MAXLEN; 442 443 /* 444 * RFC 4340, 12.2: Encode the Nonce Echo for this Ack Vector via 445 * its type; ack_nonce is the sum of all individual buf_nonce's. 446 */ 447 nonce ^= av->av_buf_nonce[i]; 448 449 *to++ = DCCPO_ACK_VECTOR_0 + av->av_buf_nonce[i]; 450 *to++ = copylen + 2; 451 452 /* Check if buf_head wraps */ 453 if (from + copylen > tail) { 454 const u16 tailsize = tail - from; 455 456 memcpy(to, from, tailsize); 457 to += tailsize; 458 len -= tailsize; 459 copylen -= tailsize; 460 from = av->av_buf; 461 } 462 463 memcpy(to, from, copylen); 464 from += copylen; 465 to += copylen; 466 len -= copylen; 467 } 468 /* 469 * Each sent Ack Vector is recorded in the list, as per A.2 of RFC 4340. 470 */ 471 if (dccp_ackvec_update_records(av, dcb->dccpd_seq, nonce)) 472 return -ENOBUFS; 473 return 0; 474 } 475 476 /** 477 * dccp_insert_option_mandatory - Mandatory option (5.8.2) 478 * Note that since we are using skb_push, this function needs to be called 479 * _after_ inserting the option it is supposed to influence (stack order). 480 */ 481 int dccp_insert_option_mandatory(struct sk_buff *skb) 482 { 483 if (DCCP_SKB_CB(skb)->dccpd_opt_len >= DCCP_MAX_OPT_LEN) 484 return -1; 485 486 DCCP_SKB_CB(skb)->dccpd_opt_len++; 487 *skb_push(skb, 1) = DCCPO_MANDATORY; 488 return 0; 489 } 490 491 /** 492 * dccp_insert_fn_opt - Insert single Feature-Negotiation option into @skb 493 * @type: %DCCPO_CHANGE_L, %DCCPO_CHANGE_R, %DCCPO_CONFIRM_L, %DCCPO_CONFIRM_R 494 * @feat: one out of %dccp_feature_numbers 495 * @val: NN value or SP array (preferred element first) to copy 496 * @len: true length of @val in bytes (excluding first element repetition) 497 * @repeat_first: whether to copy the first element of @val twice 498 * 499 * The last argument is used to construct Confirm options, where the preferred 500 * value and the preference list appear separately (RFC 4340, 6.3.1). Preference 501 * lists are kept such that the preferred entry is always first, so we only need 502 * to copy twice, and avoid the overhead of cloning into a bigger array. 503 */ 504 int dccp_insert_fn_opt(struct sk_buff *skb, u8 type, u8 feat, 505 u8 *val, u8 len, bool repeat_first) 506 { 507 u8 tot_len, *to; 508 509 /* take the `Feature' field and possible repetition into account */ 510 if (len > (DCCP_SINGLE_OPT_MAXLEN - 2)) { 511 DCCP_WARN("length %u for feature %u too large\n", len, feat); 512 return -1; 513 } 514 515 if (unlikely(val == NULL || len == 0)) 516 len = repeat_first = false; 517 tot_len = 3 + repeat_first + len; 518 519 if (DCCP_SKB_CB(skb)->dccpd_opt_len + tot_len > DCCP_MAX_OPT_LEN) { 520 DCCP_WARN("packet too small for feature %d option!\n", feat); 521 return -1; 522 } 523 DCCP_SKB_CB(skb)->dccpd_opt_len += tot_len; 524 525 to = skb_push(skb, tot_len); 526 *to++ = type; 527 *to++ = tot_len; 528 *to++ = feat; 529 530 if (repeat_first) 531 *to++ = *val; 532 if (len) 533 memcpy(to, val, len); 534 return 0; 535 } 536 537 /* The length of all options needs to be a multiple of 4 (5.8) */ 538 static void dccp_insert_option_padding(struct sk_buff *skb) 539 { 540 int padding = DCCP_SKB_CB(skb)->dccpd_opt_len % 4; 541 542 if (padding != 0) { 543 padding = 4 - padding; 544 memset(skb_push(skb, padding), 0, padding); 545 DCCP_SKB_CB(skb)->dccpd_opt_len += padding; 546 } 547 } 548 549 int dccp_insert_options(struct sock *sk, struct sk_buff *skb) 550 { 551 struct dccp_sock *dp = dccp_sk(sk); 552 553 DCCP_SKB_CB(skb)->dccpd_opt_len = 0; 554 555 if (dp->dccps_send_ndp_count && dccp_insert_option_ndp(sk, skb)) 556 return -1; 557 558 if (DCCP_SKB_CB(skb)->dccpd_type != DCCP_PKT_DATA) { 559 560 /* Feature Negotiation */ 561 if (dccp_feat_insert_opts(dp, NULL, skb)) 562 return -1; 563 564 if (DCCP_SKB_CB(skb)->dccpd_type == DCCP_PKT_REQUEST) { 565 /* 566 * Obtain RTT sample from Request/Response exchange. 567 * This is currently used for TFRC initialisation. 568 */ 569 if (dccp_insert_option_timestamp(skb)) 570 return -1; 571 572 } else if (dccp_ackvec_pending(sk) && 573 dccp_insert_option_ackvec(sk, skb)) { 574 return -1; 575 } 576 } 577 578 if (dp->dccps_hc_rx_insert_options) { 579 if (ccid_hc_rx_insert_options(dp->dccps_hc_rx_ccid, sk, skb)) 580 return -1; 581 dp->dccps_hc_rx_insert_options = 0; 582 } 583 584 if (dp->dccps_timestamp_echo != 0 && 585 dccp_insert_option_timestamp_echo(dp, NULL, skb)) 586 return -1; 587 588 dccp_insert_option_padding(skb); 589 return 0; 590 } 591 592 int dccp_insert_options_rsk(struct dccp_request_sock *dreq, struct sk_buff *skb) 593 { 594 DCCP_SKB_CB(skb)->dccpd_opt_len = 0; 595 596 if (dccp_feat_insert_opts(NULL, dreq, skb)) 597 return -1; 598 599 /* Obtain RTT sample from Response/Ack exchange (used by TFRC). */ 600 if (dccp_insert_option_timestamp(skb)) 601 return -1; 602 603 if (dreq->dreq_timestamp_echo != 0 && 604 dccp_insert_option_timestamp_echo(NULL, dreq, skb)) 605 return -1; 606 607 dccp_insert_option_padding(skb); 608 return 0; 609 } 610