1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * net/dccp/proto.c 4 * 5 * An implementation of the DCCP protocol 6 * Arnaldo Carvalho de Melo <acme@conectiva.com.br> 7 */ 8 9 #include <linux/dccp.h> 10 #include <linux/module.h> 11 #include <linux/types.h> 12 #include <linux/sched.h> 13 #include <linux/kernel.h> 14 #include <linux/skbuff.h> 15 #include <linux/netdevice.h> 16 #include <linux/in.h> 17 #include <linux/if_arp.h> 18 #include <linux/init.h> 19 #include <linux/random.h> 20 #include <linux/slab.h> 21 #include <net/checksum.h> 22 23 #include <net/inet_sock.h> 24 #include <net/inet_common.h> 25 #include <net/sock.h> 26 #include <net/xfrm.h> 27 28 #include <asm/ioctls.h> 29 #include <linux/spinlock.h> 30 #include <linux/timer.h> 31 #include <linux/delay.h> 32 #include <linux/poll.h> 33 34 #include "ccid.h" 35 #include "dccp.h" 36 #include "feat.h" 37 38 #define CREATE_TRACE_POINTS 39 #include "trace.h" 40 41 DEFINE_SNMP_STAT(struct dccp_mib, dccp_statistics) __read_mostly; 42 43 EXPORT_SYMBOL_GPL(dccp_statistics); 44 45 DEFINE_PER_CPU(unsigned int, dccp_orphan_count); 46 EXPORT_PER_CPU_SYMBOL_GPL(dccp_orphan_count); 47 48 struct inet_hashinfo dccp_hashinfo; 49 EXPORT_SYMBOL_GPL(dccp_hashinfo); 50 51 /* the maximum queue length for tx in packets. 0 is no limit */ 52 int sysctl_dccp_tx_qlen __read_mostly = 5; 53 54 #ifdef CONFIG_IP_DCCP_DEBUG 55 static const char *dccp_state_name(const int state) 56 { 57 static const char *const dccp_state_names[] = { 58 [DCCP_OPEN] = "OPEN", 59 [DCCP_REQUESTING] = "REQUESTING", 60 [DCCP_PARTOPEN] = "PARTOPEN", 61 [DCCP_LISTEN] = "LISTEN", 62 [DCCP_RESPOND] = "RESPOND", 63 [DCCP_CLOSING] = "CLOSING", 64 [DCCP_ACTIVE_CLOSEREQ] = "CLOSEREQ", 65 [DCCP_PASSIVE_CLOSE] = "PASSIVE_CLOSE", 66 [DCCP_PASSIVE_CLOSEREQ] = "PASSIVE_CLOSEREQ", 67 [DCCP_TIME_WAIT] = "TIME_WAIT", 68 [DCCP_CLOSED] = "CLOSED", 69 }; 70 71 if (state >= DCCP_MAX_STATES) 72 return "INVALID STATE!"; 73 else 74 return dccp_state_names[state]; 75 } 76 #endif 77 78 void dccp_set_state(struct sock *sk, const int state) 79 { 80 const int oldstate = sk->sk_state; 81 82 dccp_pr_debug("%s(%p) %s --> %s\n", dccp_role(sk), sk, 83 dccp_state_name(oldstate), dccp_state_name(state)); 84 WARN_ON(state == oldstate); 85 86 switch (state) { 87 case DCCP_OPEN: 88 if (oldstate != DCCP_OPEN) 89 DCCP_INC_STATS(DCCP_MIB_CURRESTAB); 90 /* Client retransmits all Confirm options until entering OPEN */ 91 if (oldstate == DCCP_PARTOPEN) 92 dccp_feat_list_purge(&dccp_sk(sk)->dccps_featneg); 93 break; 94 95 case DCCP_CLOSED: 96 if (oldstate == DCCP_OPEN || oldstate == DCCP_ACTIVE_CLOSEREQ || 97 oldstate == DCCP_CLOSING) 98 DCCP_INC_STATS(DCCP_MIB_ESTABRESETS); 99 100 sk->sk_prot->unhash(sk); 101 if (inet_csk(sk)->icsk_bind_hash != NULL && 102 !(sk->sk_userlocks & SOCK_BINDPORT_LOCK)) 103 inet_put_port(sk); 104 fallthrough; 105 default: 106 if (oldstate == DCCP_OPEN) 107 DCCP_DEC_STATS(DCCP_MIB_CURRESTAB); 108 } 109 110 /* Change state AFTER socket is unhashed to avoid closed 111 * socket sitting in hash tables. 112 */ 113 inet_sk_set_state(sk, state); 114 } 115 116 EXPORT_SYMBOL_GPL(dccp_set_state); 117 118 static void dccp_finish_passive_close(struct sock *sk) 119 { 120 switch (sk->sk_state) { 121 case DCCP_PASSIVE_CLOSE: 122 /* Node (client or server) has received Close packet. */ 123 dccp_send_reset(sk, DCCP_RESET_CODE_CLOSED); 124 dccp_set_state(sk, DCCP_CLOSED); 125 break; 126 case DCCP_PASSIVE_CLOSEREQ: 127 /* 128 * Client received CloseReq. We set the `active' flag so that 129 * dccp_send_close() retransmits the Close as per RFC 4340, 8.3. 130 */ 131 dccp_send_close(sk, 1); 132 dccp_set_state(sk, DCCP_CLOSING); 133 } 134 } 135 136 void dccp_done(struct sock *sk) 137 { 138 dccp_set_state(sk, DCCP_CLOSED); 139 dccp_clear_xmit_timers(sk); 140 141 sk->sk_shutdown = SHUTDOWN_MASK; 142 143 if (!sock_flag(sk, SOCK_DEAD)) 144 sk->sk_state_change(sk); 145 else 146 inet_csk_destroy_sock(sk); 147 } 148 149 EXPORT_SYMBOL_GPL(dccp_done); 150 151 const char *dccp_packet_name(const int type) 152 { 153 static const char *const dccp_packet_names[] = { 154 [DCCP_PKT_REQUEST] = "REQUEST", 155 [DCCP_PKT_RESPONSE] = "RESPONSE", 156 [DCCP_PKT_DATA] = "DATA", 157 [DCCP_PKT_ACK] = "ACK", 158 [DCCP_PKT_DATAACK] = "DATAACK", 159 [DCCP_PKT_CLOSEREQ] = "CLOSEREQ", 160 [DCCP_PKT_CLOSE] = "CLOSE", 161 [DCCP_PKT_RESET] = "RESET", 162 [DCCP_PKT_SYNC] = "SYNC", 163 [DCCP_PKT_SYNCACK] = "SYNCACK", 164 }; 165 166 if (type >= DCCP_NR_PKT_TYPES) 167 return "INVALID"; 168 else 169 return dccp_packet_names[type]; 170 } 171 172 EXPORT_SYMBOL_GPL(dccp_packet_name); 173 174 static void dccp_sk_destruct(struct sock *sk) 175 { 176 struct dccp_sock *dp = dccp_sk(sk); 177 178 ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk); 179 dp->dccps_hc_tx_ccid = NULL; 180 inet_sock_destruct(sk); 181 } 182 183 int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized) 184 { 185 struct dccp_sock *dp = dccp_sk(sk); 186 struct inet_connection_sock *icsk = inet_csk(sk); 187 188 icsk->icsk_rto = DCCP_TIMEOUT_INIT; 189 icsk->icsk_syn_retries = sysctl_dccp_request_retries; 190 sk->sk_state = DCCP_CLOSED; 191 sk->sk_write_space = dccp_write_space; 192 sk->sk_destruct = dccp_sk_destruct; 193 icsk->icsk_sync_mss = dccp_sync_mss; 194 dp->dccps_mss_cache = 536; 195 dp->dccps_rate_last = jiffies; 196 dp->dccps_role = DCCP_ROLE_UNDEFINED; 197 dp->dccps_service = DCCP_SERVICE_CODE_IS_ABSENT; 198 dp->dccps_tx_qlen = sysctl_dccp_tx_qlen; 199 200 dccp_init_xmit_timers(sk); 201 202 INIT_LIST_HEAD(&dp->dccps_featneg); 203 /* control socket doesn't need feat nego */ 204 if (likely(ctl_sock_initialized)) 205 return dccp_feat_init(sk); 206 return 0; 207 } 208 209 EXPORT_SYMBOL_GPL(dccp_init_sock); 210 211 void dccp_destroy_sock(struct sock *sk) 212 { 213 struct dccp_sock *dp = dccp_sk(sk); 214 215 __skb_queue_purge(&sk->sk_write_queue); 216 if (sk->sk_send_head != NULL) { 217 kfree_skb(sk->sk_send_head); 218 sk->sk_send_head = NULL; 219 } 220 221 /* Clean up a referenced DCCP bind bucket. */ 222 if (inet_csk(sk)->icsk_bind_hash != NULL) 223 inet_put_port(sk); 224 225 kfree(dp->dccps_service_list); 226 dp->dccps_service_list = NULL; 227 228 if (dp->dccps_hc_rx_ackvec != NULL) { 229 dccp_ackvec_free(dp->dccps_hc_rx_ackvec); 230 dp->dccps_hc_rx_ackvec = NULL; 231 } 232 ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk); 233 dp->dccps_hc_rx_ccid = NULL; 234 235 /* clean up feature negotiation state */ 236 dccp_feat_list_purge(&dp->dccps_featneg); 237 } 238 239 EXPORT_SYMBOL_GPL(dccp_destroy_sock); 240 241 static inline int dccp_need_reset(int state) 242 { 243 return state != DCCP_CLOSED && state != DCCP_LISTEN && 244 state != DCCP_REQUESTING; 245 } 246 247 int dccp_disconnect(struct sock *sk, int flags) 248 { 249 struct inet_connection_sock *icsk = inet_csk(sk); 250 struct inet_sock *inet = inet_sk(sk); 251 struct dccp_sock *dp = dccp_sk(sk); 252 const int old_state = sk->sk_state; 253 254 if (old_state != DCCP_CLOSED) 255 dccp_set_state(sk, DCCP_CLOSED); 256 257 /* 258 * This corresponds to the ABORT function of RFC793, sec. 3.8 259 * TCP uses a RST segment, DCCP a Reset packet with Code 2, "Aborted". 260 */ 261 if (old_state == DCCP_LISTEN) { 262 inet_csk_listen_stop(sk); 263 } else if (dccp_need_reset(old_state)) { 264 dccp_send_reset(sk, DCCP_RESET_CODE_ABORTED); 265 sk->sk_err = ECONNRESET; 266 } else if (old_state == DCCP_REQUESTING) 267 sk->sk_err = ECONNRESET; 268 269 dccp_clear_xmit_timers(sk); 270 ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk); 271 dp->dccps_hc_rx_ccid = NULL; 272 273 __skb_queue_purge(&sk->sk_receive_queue); 274 __skb_queue_purge(&sk->sk_write_queue); 275 if (sk->sk_send_head != NULL) { 276 __kfree_skb(sk->sk_send_head); 277 sk->sk_send_head = NULL; 278 } 279 280 inet->inet_dport = 0; 281 282 if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK)) 283 inet_reset_saddr(sk); 284 285 sk->sk_shutdown = 0; 286 sock_reset_flag(sk, SOCK_DONE); 287 288 icsk->icsk_backoff = 0; 289 inet_csk_delack_init(sk); 290 __sk_dst_reset(sk); 291 292 WARN_ON(inet->inet_num && !icsk->icsk_bind_hash); 293 294 sk_error_report(sk); 295 return 0; 296 } 297 298 EXPORT_SYMBOL_GPL(dccp_disconnect); 299 300 /* 301 * Wait for a DCCP event. 302 * 303 * Note that we don't need to lock the socket, as the upper poll layers 304 * take care of normal races (between the test and the event) and we don't 305 * go look at any of the socket buffers directly. 306 */ 307 __poll_t dccp_poll(struct file *file, struct socket *sock, 308 poll_table *wait) 309 { 310 __poll_t mask; 311 struct sock *sk = sock->sk; 312 313 sock_poll_wait(file, sock, wait); 314 if (sk->sk_state == DCCP_LISTEN) 315 return inet_csk_listen_poll(sk); 316 317 /* Socket is not locked. We are protected from async events 318 by poll logic and correct handling of state changes 319 made by another threads is impossible in any case. 320 */ 321 322 mask = 0; 323 if (sk->sk_err) 324 mask = EPOLLERR; 325 326 if (sk->sk_shutdown == SHUTDOWN_MASK || sk->sk_state == DCCP_CLOSED) 327 mask |= EPOLLHUP; 328 if (sk->sk_shutdown & RCV_SHUTDOWN) 329 mask |= EPOLLIN | EPOLLRDNORM | EPOLLRDHUP; 330 331 /* Connected? */ 332 if ((1 << sk->sk_state) & ~(DCCPF_REQUESTING | DCCPF_RESPOND)) { 333 if (atomic_read(&sk->sk_rmem_alloc) > 0) 334 mask |= EPOLLIN | EPOLLRDNORM; 335 336 if (!(sk->sk_shutdown & SEND_SHUTDOWN)) { 337 if (sk_stream_is_writeable(sk)) { 338 mask |= EPOLLOUT | EPOLLWRNORM; 339 } else { /* send SIGIO later */ 340 sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk); 341 set_bit(SOCK_NOSPACE, &sk->sk_socket->flags); 342 343 /* Race breaker. If space is freed after 344 * wspace test but before the flags are set, 345 * IO signal will be lost. 346 */ 347 if (sk_stream_is_writeable(sk)) 348 mask |= EPOLLOUT | EPOLLWRNORM; 349 } 350 } 351 } 352 return mask; 353 } 354 355 EXPORT_SYMBOL_GPL(dccp_poll); 356 357 int dccp_ioctl(struct sock *sk, int cmd, unsigned long arg) 358 { 359 int rc = -ENOTCONN; 360 361 lock_sock(sk); 362 363 if (sk->sk_state == DCCP_LISTEN) 364 goto out; 365 366 switch (cmd) { 367 case SIOCOUTQ: { 368 int amount = sk_wmem_alloc_get(sk); 369 /* Using sk_wmem_alloc here because sk_wmem_queued is not used by DCCP and 370 * always 0, comparably to UDP. 371 */ 372 373 rc = put_user(amount, (int __user *)arg); 374 } 375 break; 376 case SIOCINQ: { 377 struct sk_buff *skb; 378 unsigned long amount = 0; 379 380 skb = skb_peek(&sk->sk_receive_queue); 381 if (skb != NULL) { 382 /* 383 * We will only return the amount of this packet since 384 * that is all that will be read. 385 */ 386 amount = skb->len; 387 } 388 rc = put_user(amount, (int __user *)arg); 389 } 390 break; 391 default: 392 rc = -ENOIOCTLCMD; 393 break; 394 } 395 out: 396 release_sock(sk); 397 return rc; 398 } 399 400 EXPORT_SYMBOL_GPL(dccp_ioctl); 401 402 static int dccp_setsockopt_service(struct sock *sk, const __be32 service, 403 sockptr_t optval, unsigned int optlen) 404 { 405 struct dccp_sock *dp = dccp_sk(sk); 406 struct dccp_service_list *sl = NULL; 407 408 if (service == DCCP_SERVICE_INVALID_VALUE || 409 optlen > DCCP_SERVICE_LIST_MAX_LEN * sizeof(u32)) 410 return -EINVAL; 411 412 if (optlen > sizeof(service)) { 413 sl = kmalloc(optlen, GFP_KERNEL); 414 if (sl == NULL) 415 return -ENOMEM; 416 417 sl->dccpsl_nr = optlen / sizeof(u32) - 1; 418 if (copy_from_sockptr_offset(sl->dccpsl_list, optval, 419 sizeof(service), optlen - sizeof(service)) || 420 dccp_list_has_service(sl, DCCP_SERVICE_INVALID_VALUE)) { 421 kfree(sl); 422 return -EFAULT; 423 } 424 } 425 426 lock_sock(sk); 427 dp->dccps_service = service; 428 429 kfree(dp->dccps_service_list); 430 431 dp->dccps_service_list = sl; 432 release_sock(sk); 433 return 0; 434 } 435 436 static int dccp_setsockopt_cscov(struct sock *sk, int cscov, bool rx) 437 { 438 u8 *list, len; 439 int i, rc; 440 441 if (cscov < 0 || cscov > 15) 442 return -EINVAL; 443 /* 444 * Populate a list of permissible values, in the range cscov...15. This 445 * is necessary since feature negotiation of single values only works if 446 * both sides incidentally choose the same value. Since the list starts 447 * lowest-value first, negotiation will pick the smallest shared value. 448 */ 449 if (cscov == 0) 450 return 0; 451 len = 16 - cscov; 452 453 list = kmalloc(len, GFP_KERNEL); 454 if (list == NULL) 455 return -ENOBUFS; 456 457 for (i = 0; i < len; i++) 458 list[i] = cscov++; 459 460 rc = dccp_feat_register_sp(sk, DCCPF_MIN_CSUM_COVER, rx, list, len); 461 462 if (rc == 0) { 463 if (rx) 464 dccp_sk(sk)->dccps_pcrlen = cscov; 465 else 466 dccp_sk(sk)->dccps_pcslen = cscov; 467 } 468 kfree(list); 469 return rc; 470 } 471 472 static int dccp_setsockopt_ccid(struct sock *sk, int type, 473 sockptr_t optval, unsigned int optlen) 474 { 475 u8 *val; 476 int rc = 0; 477 478 if (optlen < 1 || optlen > DCCP_FEAT_MAX_SP_VALS) 479 return -EINVAL; 480 481 val = memdup_sockptr(optval, optlen); 482 if (IS_ERR(val)) 483 return PTR_ERR(val); 484 485 lock_sock(sk); 486 if (type == DCCP_SOCKOPT_TX_CCID || type == DCCP_SOCKOPT_CCID) 487 rc = dccp_feat_register_sp(sk, DCCPF_CCID, 1, val, optlen); 488 489 if (!rc && (type == DCCP_SOCKOPT_RX_CCID || type == DCCP_SOCKOPT_CCID)) 490 rc = dccp_feat_register_sp(sk, DCCPF_CCID, 0, val, optlen); 491 release_sock(sk); 492 493 kfree(val); 494 return rc; 495 } 496 497 static int do_dccp_setsockopt(struct sock *sk, int level, int optname, 498 sockptr_t optval, unsigned int optlen) 499 { 500 struct dccp_sock *dp = dccp_sk(sk); 501 int val, err = 0; 502 503 switch (optname) { 504 case DCCP_SOCKOPT_PACKET_SIZE: 505 DCCP_WARN("sockopt(PACKET_SIZE) is deprecated: fix your app\n"); 506 return 0; 507 case DCCP_SOCKOPT_CHANGE_L: 508 case DCCP_SOCKOPT_CHANGE_R: 509 DCCP_WARN("sockopt(CHANGE_L/R) is deprecated: fix your app\n"); 510 return 0; 511 case DCCP_SOCKOPT_CCID: 512 case DCCP_SOCKOPT_RX_CCID: 513 case DCCP_SOCKOPT_TX_CCID: 514 return dccp_setsockopt_ccid(sk, optname, optval, optlen); 515 } 516 517 if (optlen < (int)sizeof(int)) 518 return -EINVAL; 519 520 if (copy_from_sockptr(&val, optval, sizeof(int))) 521 return -EFAULT; 522 523 if (optname == DCCP_SOCKOPT_SERVICE) 524 return dccp_setsockopt_service(sk, val, optval, optlen); 525 526 lock_sock(sk); 527 switch (optname) { 528 case DCCP_SOCKOPT_SERVER_TIMEWAIT: 529 if (dp->dccps_role != DCCP_ROLE_SERVER) 530 err = -EOPNOTSUPP; 531 else 532 dp->dccps_server_timewait = (val != 0); 533 break; 534 case DCCP_SOCKOPT_SEND_CSCOV: 535 err = dccp_setsockopt_cscov(sk, val, false); 536 break; 537 case DCCP_SOCKOPT_RECV_CSCOV: 538 err = dccp_setsockopt_cscov(sk, val, true); 539 break; 540 case DCCP_SOCKOPT_QPOLICY_ID: 541 if (sk->sk_state != DCCP_CLOSED) 542 err = -EISCONN; 543 else if (val < 0 || val >= DCCPQ_POLICY_MAX) 544 err = -EINVAL; 545 else 546 dp->dccps_qpolicy = val; 547 break; 548 case DCCP_SOCKOPT_QPOLICY_TXQLEN: 549 if (val < 0) 550 err = -EINVAL; 551 else 552 dp->dccps_tx_qlen = val; 553 break; 554 default: 555 err = -ENOPROTOOPT; 556 break; 557 } 558 release_sock(sk); 559 560 return err; 561 } 562 563 int dccp_setsockopt(struct sock *sk, int level, int optname, sockptr_t optval, 564 unsigned int optlen) 565 { 566 if (level != SOL_DCCP) 567 return inet_csk(sk)->icsk_af_ops->setsockopt(sk, level, 568 optname, optval, 569 optlen); 570 return do_dccp_setsockopt(sk, level, optname, optval, optlen); 571 } 572 573 EXPORT_SYMBOL_GPL(dccp_setsockopt); 574 575 static int dccp_getsockopt_service(struct sock *sk, int len, 576 __be32 __user *optval, 577 int __user *optlen) 578 { 579 const struct dccp_sock *dp = dccp_sk(sk); 580 const struct dccp_service_list *sl; 581 int err = -ENOENT, slen = 0, total_len = sizeof(u32); 582 583 lock_sock(sk); 584 if ((sl = dp->dccps_service_list) != NULL) { 585 slen = sl->dccpsl_nr * sizeof(u32); 586 total_len += slen; 587 } 588 589 err = -EINVAL; 590 if (total_len > len) 591 goto out; 592 593 err = 0; 594 if (put_user(total_len, optlen) || 595 put_user(dp->dccps_service, optval) || 596 (sl != NULL && copy_to_user(optval + 1, sl->dccpsl_list, slen))) 597 err = -EFAULT; 598 out: 599 release_sock(sk); 600 return err; 601 } 602 603 static int do_dccp_getsockopt(struct sock *sk, int level, int optname, 604 char __user *optval, int __user *optlen) 605 { 606 struct dccp_sock *dp; 607 int val, len; 608 609 if (get_user(len, optlen)) 610 return -EFAULT; 611 612 if (len < (int)sizeof(int)) 613 return -EINVAL; 614 615 dp = dccp_sk(sk); 616 617 switch (optname) { 618 case DCCP_SOCKOPT_PACKET_SIZE: 619 DCCP_WARN("sockopt(PACKET_SIZE) is deprecated: fix your app\n"); 620 return 0; 621 case DCCP_SOCKOPT_SERVICE: 622 return dccp_getsockopt_service(sk, len, 623 (__be32 __user *)optval, optlen); 624 case DCCP_SOCKOPT_GET_CUR_MPS: 625 val = dp->dccps_mss_cache; 626 break; 627 case DCCP_SOCKOPT_AVAILABLE_CCIDS: 628 return ccid_getsockopt_builtin_ccids(sk, len, optval, optlen); 629 case DCCP_SOCKOPT_TX_CCID: 630 val = ccid_get_current_tx_ccid(dp); 631 if (val < 0) 632 return -ENOPROTOOPT; 633 break; 634 case DCCP_SOCKOPT_RX_CCID: 635 val = ccid_get_current_rx_ccid(dp); 636 if (val < 0) 637 return -ENOPROTOOPT; 638 break; 639 case DCCP_SOCKOPT_SERVER_TIMEWAIT: 640 val = dp->dccps_server_timewait; 641 break; 642 case DCCP_SOCKOPT_SEND_CSCOV: 643 val = dp->dccps_pcslen; 644 break; 645 case DCCP_SOCKOPT_RECV_CSCOV: 646 val = dp->dccps_pcrlen; 647 break; 648 case DCCP_SOCKOPT_QPOLICY_ID: 649 val = dp->dccps_qpolicy; 650 break; 651 case DCCP_SOCKOPT_QPOLICY_TXQLEN: 652 val = dp->dccps_tx_qlen; 653 break; 654 case 128 ... 191: 655 return ccid_hc_rx_getsockopt(dp->dccps_hc_rx_ccid, sk, optname, 656 len, (u32 __user *)optval, optlen); 657 case 192 ... 255: 658 return ccid_hc_tx_getsockopt(dp->dccps_hc_tx_ccid, sk, optname, 659 len, (u32 __user *)optval, optlen); 660 default: 661 return -ENOPROTOOPT; 662 } 663 664 len = sizeof(val); 665 if (put_user(len, optlen) || copy_to_user(optval, &val, len)) 666 return -EFAULT; 667 668 return 0; 669 } 670 671 int dccp_getsockopt(struct sock *sk, int level, int optname, 672 char __user *optval, int __user *optlen) 673 { 674 if (level != SOL_DCCP) 675 return inet_csk(sk)->icsk_af_ops->getsockopt(sk, level, 676 optname, optval, 677 optlen); 678 return do_dccp_getsockopt(sk, level, optname, optval, optlen); 679 } 680 681 EXPORT_SYMBOL_GPL(dccp_getsockopt); 682 683 static int dccp_msghdr_parse(struct msghdr *msg, struct sk_buff *skb) 684 { 685 struct cmsghdr *cmsg; 686 687 /* 688 * Assign an (opaque) qpolicy priority value to skb->priority. 689 * 690 * We are overloading this skb field for use with the qpolicy subystem. 691 * The skb->priority is normally used for the SO_PRIORITY option, which 692 * is initialised from sk_priority. Since the assignment of sk_priority 693 * to skb->priority happens later (on layer 3), we overload this field 694 * for use with queueing priorities as long as the skb is on layer 4. 695 * The default priority value (if nothing is set) is 0. 696 */ 697 skb->priority = 0; 698 699 for_each_cmsghdr(cmsg, msg) { 700 if (!CMSG_OK(msg, cmsg)) 701 return -EINVAL; 702 703 if (cmsg->cmsg_level != SOL_DCCP) 704 continue; 705 706 if (cmsg->cmsg_type <= DCCP_SCM_QPOLICY_MAX && 707 !dccp_qpolicy_param_ok(skb->sk, cmsg->cmsg_type)) 708 return -EINVAL; 709 710 switch (cmsg->cmsg_type) { 711 case DCCP_SCM_PRIORITY: 712 if (cmsg->cmsg_len != CMSG_LEN(sizeof(__u32))) 713 return -EINVAL; 714 skb->priority = *(__u32 *)CMSG_DATA(cmsg); 715 break; 716 default: 717 return -EINVAL; 718 } 719 } 720 return 0; 721 } 722 723 int dccp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) 724 { 725 const struct dccp_sock *dp = dccp_sk(sk); 726 const int flags = msg->msg_flags; 727 const int noblock = flags & MSG_DONTWAIT; 728 struct sk_buff *skb; 729 int rc, size; 730 long timeo; 731 732 trace_dccp_probe(sk, len); 733 734 if (len > dp->dccps_mss_cache) 735 return -EMSGSIZE; 736 737 lock_sock(sk); 738 739 if (dccp_qpolicy_full(sk)) { 740 rc = -EAGAIN; 741 goto out_release; 742 } 743 744 timeo = sock_sndtimeo(sk, noblock); 745 746 /* 747 * We have to use sk_stream_wait_connect here to set sk_write_pending, 748 * so that the trick in dccp_rcv_request_sent_state_process. 749 */ 750 /* Wait for a connection to finish. */ 751 if ((1 << sk->sk_state) & ~(DCCPF_OPEN | DCCPF_PARTOPEN)) 752 if ((rc = sk_stream_wait_connect(sk, &timeo)) != 0) 753 goto out_release; 754 755 size = sk->sk_prot->max_header + len; 756 release_sock(sk); 757 skb = sock_alloc_send_skb(sk, size, noblock, &rc); 758 lock_sock(sk); 759 if (skb == NULL) 760 goto out_release; 761 762 if (sk->sk_state == DCCP_CLOSED) { 763 rc = -ENOTCONN; 764 goto out_discard; 765 } 766 767 skb_reserve(skb, sk->sk_prot->max_header); 768 rc = memcpy_from_msg(skb_put(skb, len), msg, len); 769 if (rc != 0) 770 goto out_discard; 771 772 rc = dccp_msghdr_parse(msg, skb); 773 if (rc != 0) 774 goto out_discard; 775 776 dccp_qpolicy_push(sk, skb); 777 /* 778 * The xmit_timer is set if the TX CCID is rate-based and will expire 779 * when congestion control permits to release further packets into the 780 * network. Window-based CCIDs do not use this timer. 781 */ 782 if (!timer_pending(&dp->dccps_xmit_timer)) 783 dccp_write_xmit(sk); 784 out_release: 785 release_sock(sk); 786 return rc ? : len; 787 out_discard: 788 kfree_skb(skb); 789 goto out_release; 790 } 791 792 EXPORT_SYMBOL_GPL(dccp_sendmsg); 793 794 int dccp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock, 795 int flags, int *addr_len) 796 { 797 const struct dccp_hdr *dh; 798 long timeo; 799 800 lock_sock(sk); 801 802 if (sk->sk_state == DCCP_LISTEN) { 803 len = -ENOTCONN; 804 goto out; 805 } 806 807 timeo = sock_rcvtimeo(sk, nonblock); 808 809 do { 810 struct sk_buff *skb = skb_peek(&sk->sk_receive_queue); 811 812 if (skb == NULL) 813 goto verify_sock_status; 814 815 dh = dccp_hdr(skb); 816 817 switch (dh->dccph_type) { 818 case DCCP_PKT_DATA: 819 case DCCP_PKT_DATAACK: 820 goto found_ok_skb; 821 822 case DCCP_PKT_CLOSE: 823 case DCCP_PKT_CLOSEREQ: 824 if (!(flags & MSG_PEEK)) 825 dccp_finish_passive_close(sk); 826 fallthrough; 827 case DCCP_PKT_RESET: 828 dccp_pr_debug("found fin (%s) ok!\n", 829 dccp_packet_name(dh->dccph_type)); 830 len = 0; 831 goto found_fin_ok; 832 default: 833 dccp_pr_debug("packet_type=%s\n", 834 dccp_packet_name(dh->dccph_type)); 835 sk_eat_skb(sk, skb); 836 } 837 verify_sock_status: 838 if (sock_flag(sk, SOCK_DONE)) { 839 len = 0; 840 break; 841 } 842 843 if (sk->sk_err) { 844 len = sock_error(sk); 845 break; 846 } 847 848 if (sk->sk_shutdown & RCV_SHUTDOWN) { 849 len = 0; 850 break; 851 } 852 853 if (sk->sk_state == DCCP_CLOSED) { 854 if (!sock_flag(sk, SOCK_DONE)) { 855 /* This occurs when user tries to read 856 * from never connected socket. 857 */ 858 len = -ENOTCONN; 859 break; 860 } 861 len = 0; 862 break; 863 } 864 865 if (!timeo) { 866 len = -EAGAIN; 867 break; 868 } 869 870 if (signal_pending(current)) { 871 len = sock_intr_errno(timeo); 872 break; 873 } 874 875 sk_wait_data(sk, &timeo, NULL); 876 continue; 877 found_ok_skb: 878 if (len > skb->len) 879 len = skb->len; 880 else if (len < skb->len) 881 msg->msg_flags |= MSG_TRUNC; 882 883 if (skb_copy_datagram_msg(skb, 0, msg, len)) { 884 /* Exception. Bailout! */ 885 len = -EFAULT; 886 break; 887 } 888 if (flags & MSG_TRUNC) 889 len = skb->len; 890 found_fin_ok: 891 if (!(flags & MSG_PEEK)) 892 sk_eat_skb(sk, skb); 893 break; 894 } while (1); 895 out: 896 release_sock(sk); 897 return len; 898 } 899 900 EXPORT_SYMBOL_GPL(dccp_recvmsg); 901 902 int inet_dccp_listen(struct socket *sock, int backlog) 903 { 904 struct sock *sk = sock->sk; 905 unsigned char old_state; 906 int err; 907 908 lock_sock(sk); 909 910 err = -EINVAL; 911 if (sock->state != SS_UNCONNECTED || sock->type != SOCK_DCCP) 912 goto out; 913 914 old_state = sk->sk_state; 915 if (!((1 << old_state) & (DCCPF_CLOSED | DCCPF_LISTEN))) 916 goto out; 917 918 WRITE_ONCE(sk->sk_max_ack_backlog, backlog); 919 /* Really, if the socket is already in listen state 920 * we can only allow the backlog to be adjusted. 921 */ 922 if (old_state != DCCP_LISTEN) { 923 struct dccp_sock *dp = dccp_sk(sk); 924 925 dp->dccps_role = DCCP_ROLE_LISTEN; 926 927 /* do not start to listen if feature negotiation setup fails */ 928 if (dccp_feat_finalise_settings(dp)) { 929 err = -EPROTO; 930 goto out; 931 } 932 933 err = inet_csk_listen_start(sk); 934 if (err) 935 goto out; 936 } 937 err = 0; 938 939 out: 940 release_sock(sk); 941 return err; 942 } 943 944 EXPORT_SYMBOL_GPL(inet_dccp_listen); 945 946 static void dccp_terminate_connection(struct sock *sk) 947 { 948 u8 next_state = DCCP_CLOSED; 949 950 switch (sk->sk_state) { 951 case DCCP_PASSIVE_CLOSE: 952 case DCCP_PASSIVE_CLOSEREQ: 953 dccp_finish_passive_close(sk); 954 break; 955 case DCCP_PARTOPEN: 956 dccp_pr_debug("Stop PARTOPEN timer (%p)\n", sk); 957 inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK); 958 fallthrough; 959 case DCCP_OPEN: 960 dccp_send_close(sk, 1); 961 962 if (dccp_sk(sk)->dccps_role == DCCP_ROLE_SERVER && 963 !dccp_sk(sk)->dccps_server_timewait) 964 next_state = DCCP_ACTIVE_CLOSEREQ; 965 else 966 next_state = DCCP_CLOSING; 967 fallthrough; 968 default: 969 dccp_set_state(sk, next_state); 970 } 971 } 972 973 void dccp_close(struct sock *sk, long timeout) 974 { 975 struct dccp_sock *dp = dccp_sk(sk); 976 struct sk_buff *skb; 977 u32 data_was_unread = 0; 978 int state; 979 980 lock_sock(sk); 981 982 sk->sk_shutdown = SHUTDOWN_MASK; 983 984 if (sk->sk_state == DCCP_LISTEN) { 985 dccp_set_state(sk, DCCP_CLOSED); 986 987 /* Special case. */ 988 inet_csk_listen_stop(sk); 989 990 goto adjudge_to_death; 991 } 992 993 sk_stop_timer(sk, &dp->dccps_xmit_timer); 994 995 /* 996 * We need to flush the recv. buffs. We do this only on the 997 * descriptor close, not protocol-sourced closes, because the 998 *reader process may not have drained the data yet! 999 */ 1000 while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) { 1001 data_was_unread += skb->len; 1002 __kfree_skb(skb); 1003 } 1004 1005 /* If socket has been already reset kill it. */ 1006 if (sk->sk_state == DCCP_CLOSED) 1007 goto adjudge_to_death; 1008 1009 if (data_was_unread) { 1010 /* Unread data was tossed, send an appropriate Reset Code */ 1011 DCCP_WARN("ABORT with %u bytes unread\n", data_was_unread); 1012 dccp_send_reset(sk, DCCP_RESET_CODE_ABORTED); 1013 dccp_set_state(sk, DCCP_CLOSED); 1014 } else if (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime) { 1015 /* Check zero linger _after_ checking for unread data. */ 1016 sk->sk_prot->disconnect(sk, 0); 1017 } else if (sk->sk_state != DCCP_CLOSED) { 1018 /* 1019 * Normal connection termination. May need to wait if there are 1020 * still packets in the TX queue that are delayed by the CCID. 1021 */ 1022 dccp_flush_write_queue(sk, &timeout); 1023 dccp_terminate_connection(sk); 1024 } 1025 1026 /* 1027 * Flush write queue. This may be necessary in several cases: 1028 * - we have been closed by the peer but still have application data; 1029 * - abortive termination (unread data or zero linger time), 1030 * - normal termination but queue could not be flushed within time limit 1031 */ 1032 __skb_queue_purge(&sk->sk_write_queue); 1033 1034 sk_stream_wait_close(sk, timeout); 1035 1036 adjudge_to_death: 1037 state = sk->sk_state; 1038 sock_hold(sk); 1039 sock_orphan(sk); 1040 1041 /* 1042 * It is the last release_sock in its life. It will remove backlog. 1043 */ 1044 release_sock(sk); 1045 /* 1046 * Now socket is owned by kernel and we acquire BH lock 1047 * to finish close. No need to check for user refs. 1048 */ 1049 local_bh_disable(); 1050 bh_lock_sock(sk); 1051 WARN_ON(sock_owned_by_user(sk)); 1052 1053 this_cpu_inc(dccp_orphan_count); 1054 1055 /* Have we already been destroyed by a softirq or backlog? */ 1056 if (state != DCCP_CLOSED && sk->sk_state == DCCP_CLOSED) 1057 goto out; 1058 1059 if (sk->sk_state == DCCP_CLOSED) 1060 inet_csk_destroy_sock(sk); 1061 1062 /* Otherwise, socket is reprieved until protocol close. */ 1063 1064 out: 1065 bh_unlock_sock(sk); 1066 local_bh_enable(); 1067 sock_put(sk); 1068 } 1069 1070 EXPORT_SYMBOL_GPL(dccp_close); 1071 1072 void dccp_shutdown(struct sock *sk, int how) 1073 { 1074 dccp_pr_debug("called shutdown(%x)\n", how); 1075 } 1076 1077 EXPORT_SYMBOL_GPL(dccp_shutdown); 1078 1079 static inline int __init dccp_mib_init(void) 1080 { 1081 dccp_statistics = alloc_percpu(struct dccp_mib); 1082 if (!dccp_statistics) 1083 return -ENOMEM; 1084 return 0; 1085 } 1086 1087 static inline void dccp_mib_exit(void) 1088 { 1089 free_percpu(dccp_statistics); 1090 } 1091 1092 static int thash_entries; 1093 module_param(thash_entries, int, 0444); 1094 MODULE_PARM_DESC(thash_entries, "Number of ehash buckets"); 1095 1096 #ifdef CONFIG_IP_DCCP_DEBUG 1097 bool dccp_debug; 1098 module_param(dccp_debug, bool, 0644); 1099 MODULE_PARM_DESC(dccp_debug, "Enable debug messages"); 1100 1101 EXPORT_SYMBOL_GPL(dccp_debug); 1102 #endif 1103 1104 static int __init dccp_init(void) 1105 { 1106 unsigned long goal; 1107 unsigned long nr_pages = totalram_pages(); 1108 int ehash_order, bhash_order, i; 1109 int rc; 1110 1111 BUILD_BUG_ON(sizeof(struct dccp_skb_cb) > 1112 sizeof_field(struct sk_buff, cb)); 1113 inet_hashinfo_init(&dccp_hashinfo); 1114 rc = inet_hashinfo2_init_mod(&dccp_hashinfo); 1115 if (rc) 1116 goto out_fail; 1117 rc = -ENOBUFS; 1118 dccp_hashinfo.bind_bucket_cachep = 1119 kmem_cache_create("dccp_bind_bucket", 1120 sizeof(struct inet_bind_bucket), 0, 1121 SLAB_HWCACHE_ALIGN | SLAB_ACCOUNT, NULL); 1122 if (!dccp_hashinfo.bind_bucket_cachep) 1123 goto out_free_hashinfo2; 1124 1125 /* 1126 * Size and allocate the main established and bind bucket 1127 * hash tables. 1128 * 1129 * The methodology is similar to that of the buffer cache. 1130 */ 1131 if (nr_pages >= (128 * 1024)) 1132 goal = nr_pages >> (21 - PAGE_SHIFT); 1133 else 1134 goal = nr_pages >> (23 - PAGE_SHIFT); 1135 1136 if (thash_entries) 1137 goal = (thash_entries * 1138 sizeof(struct inet_ehash_bucket)) >> PAGE_SHIFT; 1139 for (ehash_order = 0; (1UL << ehash_order) < goal; ehash_order++) 1140 ; 1141 do { 1142 unsigned long hash_size = (1UL << ehash_order) * PAGE_SIZE / 1143 sizeof(struct inet_ehash_bucket); 1144 1145 while (hash_size & (hash_size - 1)) 1146 hash_size--; 1147 dccp_hashinfo.ehash_mask = hash_size - 1; 1148 dccp_hashinfo.ehash = (struct inet_ehash_bucket *) 1149 __get_free_pages(GFP_ATOMIC|__GFP_NOWARN, ehash_order); 1150 } while (!dccp_hashinfo.ehash && --ehash_order > 0); 1151 1152 if (!dccp_hashinfo.ehash) { 1153 DCCP_CRIT("Failed to allocate DCCP established hash table"); 1154 goto out_free_bind_bucket_cachep; 1155 } 1156 1157 for (i = 0; i <= dccp_hashinfo.ehash_mask; i++) 1158 INIT_HLIST_NULLS_HEAD(&dccp_hashinfo.ehash[i].chain, i); 1159 1160 if (inet_ehash_locks_alloc(&dccp_hashinfo)) 1161 goto out_free_dccp_ehash; 1162 1163 bhash_order = ehash_order; 1164 1165 do { 1166 dccp_hashinfo.bhash_size = (1UL << bhash_order) * PAGE_SIZE / 1167 sizeof(struct inet_bind_hashbucket); 1168 if ((dccp_hashinfo.bhash_size > (64 * 1024)) && 1169 bhash_order > 0) 1170 continue; 1171 dccp_hashinfo.bhash = (struct inet_bind_hashbucket *) 1172 __get_free_pages(GFP_ATOMIC|__GFP_NOWARN, bhash_order); 1173 } while (!dccp_hashinfo.bhash && --bhash_order >= 0); 1174 1175 if (!dccp_hashinfo.bhash) { 1176 DCCP_CRIT("Failed to allocate DCCP bind hash table"); 1177 goto out_free_dccp_locks; 1178 } 1179 1180 for (i = 0; i < dccp_hashinfo.bhash_size; i++) { 1181 spin_lock_init(&dccp_hashinfo.bhash[i].lock); 1182 INIT_HLIST_HEAD(&dccp_hashinfo.bhash[i].chain); 1183 } 1184 1185 rc = dccp_mib_init(); 1186 if (rc) 1187 goto out_free_dccp_bhash; 1188 1189 rc = dccp_ackvec_init(); 1190 if (rc) 1191 goto out_free_dccp_mib; 1192 1193 rc = dccp_sysctl_init(); 1194 if (rc) 1195 goto out_ackvec_exit; 1196 1197 rc = ccid_initialize_builtins(); 1198 if (rc) 1199 goto out_sysctl_exit; 1200 1201 dccp_timestamping_init(); 1202 1203 return 0; 1204 1205 out_sysctl_exit: 1206 dccp_sysctl_exit(); 1207 out_ackvec_exit: 1208 dccp_ackvec_exit(); 1209 out_free_dccp_mib: 1210 dccp_mib_exit(); 1211 out_free_dccp_bhash: 1212 free_pages((unsigned long)dccp_hashinfo.bhash, bhash_order); 1213 out_free_dccp_locks: 1214 inet_ehash_locks_free(&dccp_hashinfo); 1215 out_free_dccp_ehash: 1216 free_pages((unsigned long)dccp_hashinfo.ehash, ehash_order); 1217 out_free_bind_bucket_cachep: 1218 kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep); 1219 out_free_hashinfo2: 1220 inet_hashinfo2_free_mod(&dccp_hashinfo); 1221 out_fail: 1222 dccp_hashinfo.bhash = NULL; 1223 dccp_hashinfo.ehash = NULL; 1224 dccp_hashinfo.bind_bucket_cachep = NULL; 1225 return rc; 1226 } 1227 1228 static void __exit dccp_fini(void) 1229 { 1230 ccid_cleanup_builtins(); 1231 dccp_mib_exit(); 1232 free_pages((unsigned long)dccp_hashinfo.bhash, 1233 get_order(dccp_hashinfo.bhash_size * 1234 sizeof(struct inet_bind_hashbucket))); 1235 free_pages((unsigned long)dccp_hashinfo.ehash, 1236 get_order((dccp_hashinfo.ehash_mask + 1) * 1237 sizeof(struct inet_ehash_bucket))); 1238 inet_ehash_locks_free(&dccp_hashinfo); 1239 kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep); 1240 dccp_ackvec_exit(); 1241 dccp_sysctl_exit(); 1242 inet_hashinfo2_free_mod(&dccp_hashinfo); 1243 } 1244 1245 module_init(dccp_init); 1246 module_exit(dccp_fini); 1247 1248 MODULE_LICENSE("GPL"); 1249 MODULE_AUTHOR("Arnaldo Carvalho de Melo <acme@conectiva.com.br>"); 1250 MODULE_DESCRIPTION("DCCP - Datagram Congestion Controlled Protocol"); 1251