xref: /openbmc/linux/net/sctp/sm_make_chunk.c (revision 2634682f)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* SCTP kernel implementation
3  * (C) Copyright IBM Corp. 2001, 2004
4  * Copyright (c) 1999-2000 Cisco, Inc.
5  * Copyright (c) 1999-2001 Motorola, Inc.
6  * Copyright (c) 2001-2002 Intel Corp.
7  *
8  * This file is part of the SCTP kernel implementation
9  *
10  * These functions work with the state functions in sctp_sm_statefuns.c
11  * to implement the state operations.  These functions implement the
12  * steps which require modifying existing data structures.
13  *
14  * Please send any bug reports or fixes you make to the
15  * email address(es):
16  *    lksctp developers <linux-sctp@vger.kernel.org>
17  *
18  * Written or modified by:
19  *    La Monte H.P. Yarroll <piggy@acm.org>
20  *    Karl Knutson          <karl@athena.chicago.il.us>
21  *    C. Robin              <chris@hundredacre.ac.uk>
22  *    Jon Grimm             <jgrimm@us.ibm.com>
23  *    Xingang Guo           <xingang.guo@intel.com>
24  *    Dajiang Zhang	    <dajiang.zhang@nokia.com>
25  *    Sridhar Samudrala	    <sri@us.ibm.com>
26  *    Daisy Chang	    <daisyc@us.ibm.com>
27  *    Ardelle Fan	    <ardelle.fan@intel.com>
28  *    Kevin Gao             <kevin.gao@intel.com>
29  */
30 
31 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
32 
33 #include <crypto/hash.h>
34 #include <linux/types.h>
35 #include <linux/kernel.h>
36 #include <linux/ip.h>
37 #include <linux/ipv6.h>
38 #include <linux/net.h>
39 #include <linux/inet.h>
40 #include <linux/scatterlist.h>
41 #include <linux/slab.h>
42 #include <net/sock.h>
43 
44 #include <linux/skbuff.h>
45 #include <linux/random.h>	/* for get_random_bytes */
46 #include <net/sctp/sctp.h>
47 #include <net/sctp/sm.h>
48 
49 static struct sctp_chunk *sctp_make_control(const struct sctp_association *asoc,
50 					    __u8 type, __u8 flags, int paylen,
51 					    gfp_t gfp);
52 static struct sctp_chunk *sctp_make_data(const struct sctp_association *asoc,
53 					 __u8 flags, int paylen, gfp_t gfp);
54 static struct sctp_chunk *_sctp_make_chunk(const struct sctp_association *asoc,
55 					   __u8 type, __u8 flags, int paylen,
56 					   gfp_t gfp);
57 static struct sctp_cookie_param *sctp_pack_cookie(
58 					const struct sctp_endpoint *ep,
59 					const struct sctp_association *asoc,
60 					const struct sctp_chunk *init_chunk,
61 					int *cookie_len,
62 					const __u8 *raw_addrs, int addrs_len);
63 static int sctp_process_param(struct sctp_association *asoc,
64 			      union sctp_params param,
65 			      const union sctp_addr *peer_addr,
66 			      gfp_t gfp);
67 static void *sctp_addto_param(struct sctp_chunk *chunk, int len,
68 			      const void *data);
69 
70 /* Control chunk destructor */
71 static void sctp_control_release_owner(struct sk_buff *skb)
72 {
73 	struct sctp_chunk *chunk = skb_shinfo(skb)->destructor_arg;
74 
75 	if (chunk->shkey) {
76 		struct sctp_shared_key *shkey = chunk->shkey;
77 		struct sctp_association *asoc = chunk->asoc;
78 
79 		/* refcnt == 2 and !list_empty mean after this release, it's
80 		 * not being used anywhere, and it's time to notify userland
81 		 * that this shkey can be freed if it's been deactivated.
82 		 */
83 		if (shkey->deactivated && !list_empty(&shkey->key_list) &&
84 		    refcount_read(&shkey->refcnt) == 2) {
85 			struct sctp_ulpevent *ev;
86 
87 			ev = sctp_ulpevent_make_authkey(asoc, shkey->key_id,
88 							SCTP_AUTH_FREE_KEY,
89 							GFP_KERNEL);
90 			if (ev)
91 				asoc->stream.si->enqueue_event(&asoc->ulpq, ev);
92 		}
93 		sctp_auth_shkey_release(chunk->shkey);
94 	}
95 }
96 
97 static void sctp_control_set_owner_w(struct sctp_chunk *chunk)
98 {
99 	struct sctp_association *asoc = chunk->asoc;
100 	struct sk_buff *skb = chunk->skb;
101 
102 	/* TODO: properly account for control chunks.
103 	 * To do it right we'll need:
104 	 *  1) endpoint if association isn't known.
105 	 *  2) proper memory accounting.
106 	 *
107 	 *  For now don't do anything for now.
108 	 */
109 	if (chunk->auth) {
110 		chunk->shkey = asoc->shkey;
111 		sctp_auth_shkey_hold(chunk->shkey);
112 	}
113 	skb->sk = asoc ? asoc->base.sk : NULL;
114 	skb_shinfo(skb)->destructor_arg = chunk;
115 	skb->destructor = sctp_control_release_owner;
116 }
117 
118 /* What was the inbound interface for this chunk? */
119 int sctp_chunk_iif(const struct sctp_chunk *chunk)
120 {
121 	struct sk_buff *skb = chunk->skb;
122 
123 	return SCTP_INPUT_CB(skb)->af->skb_iif(skb);
124 }
125 
126 /* RFC 2960 3.3.2 Initiation (INIT) (1)
127  *
128  * Note 2: The ECN capable field is reserved for future use of
129  * Explicit Congestion Notification.
130  */
131 static const struct sctp_paramhdr ecap_param = {
132 	SCTP_PARAM_ECN_CAPABLE,
133 	cpu_to_be16(sizeof(struct sctp_paramhdr)),
134 };
135 static const struct sctp_paramhdr prsctp_param = {
136 	SCTP_PARAM_FWD_TSN_SUPPORT,
137 	cpu_to_be16(sizeof(struct sctp_paramhdr)),
138 };
139 
140 /* A helper to initialize an op error inside a provided chunk, as most
141  * cause codes will be embedded inside an abort chunk.
142  */
143 int sctp_init_cause(struct sctp_chunk *chunk, __be16 cause_code,
144 		    size_t paylen)
145 {
146 	struct sctp_errhdr err;
147 	__u16 len;
148 
149 	/* Cause code constants are now defined in network order.  */
150 	err.cause = cause_code;
151 	len = sizeof(err) + paylen;
152 	err.length = htons(len);
153 
154 	if (skb_tailroom(chunk->skb) < len)
155 		return -ENOSPC;
156 
157 	chunk->subh.err_hdr = sctp_addto_chunk(chunk, sizeof(err), &err);
158 
159 	return 0;
160 }
161 
162 /* 3.3.2 Initiation (INIT) (1)
163  *
164  * This chunk is used to initiate a SCTP association between two
165  * endpoints. The format of the INIT chunk is shown below:
166  *
167  *     0                   1                   2                   3
168  *     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
169  *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
170  *    |   Type = 1    |  Chunk Flags  |      Chunk Length             |
171  *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
172  *    |                         Initiate Tag                          |
173  *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
174  *    |           Advertised Receiver Window Credit (a_rwnd)          |
175  *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
176  *    |  Number of Outbound Streams   |  Number of Inbound Streams    |
177  *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
178  *    |                          Initial TSN                          |
179  *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
180  *    \                                                               \
181  *    /              Optional/Variable-Length Parameters              /
182  *    \                                                               \
183  *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
184  *
185  *
186  * The INIT chunk contains the following parameters. Unless otherwise
187  * noted, each parameter MUST only be included once in the INIT chunk.
188  *
189  * Fixed Parameters                     Status
190  * ----------------------------------------------
191  * Initiate Tag                        Mandatory
192  * Advertised Receiver Window Credit   Mandatory
193  * Number of Outbound Streams          Mandatory
194  * Number of Inbound Streams           Mandatory
195  * Initial TSN                         Mandatory
196  *
197  * Variable Parameters                  Status     Type Value
198  * -------------------------------------------------------------
199  * IPv4 Address (Note 1)               Optional    5
200  * IPv6 Address (Note 1)               Optional    6
201  * Cookie Preservative                 Optional    9
202  * Reserved for ECN Capable (Note 2)   Optional    32768 (0x8000)
203  * Host Name Address (Note 3)          Optional    11
204  * Supported Address Types (Note 4)    Optional    12
205  */
206 struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
207 				  const struct sctp_bind_addr *bp,
208 				  gfp_t gfp, int vparam_len)
209 {
210 	struct sctp_supported_ext_param ext_param;
211 	struct sctp_adaptation_ind_param aiparam;
212 	struct sctp_paramhdr *auth_chunks = NULL;
213 	struct sctp_paramhdr *auth_hmacs = NULL;
214 	struct sctp_supported_addrs_param sat;
215 	struct sctp_endpoint *ep = asoc->ep;
216 	struct sctp_chunk *retval = NULL;
217 	int num_types, addrs_len = 0;
218 	struct sctp_inithdr init;
219 	union sctp_params addrs;
220 	struct sctp_sock *sp;
221 	__u8 extensions[5];
222 	size_t chunksize;
223 	__be16 types[2];
224 	int num_ext = 0;
225 
226 	/* RFC 2960 3.3.2 Initiation (INIT) (1)
227 	 *
228 	 * Note 1: The INIT chunks can contain multiple addresses that
229 	 * can be IPv4 and/or IPv6 in any combination.
230 	 */
231 
232 	/* Convert the provided bind address list to raw format. */
233 	addrs = sctp_bind_addrs_to_raw(bp, &addrs_len, gfp);
234 
235 	init.init_tag		   = htonl(asoc->c.my_vtag);
236 	init.a_rwnd		   = htonl(asoc->rwnd);
237 	init.num_outbound_streams  = htons(asoc->c.sinit_num_ostreams);
238 	init.num_inbound_streams   = htons(asoc->c.sinit_max_instreams);
239 	init.initial_tsn	   = htonl(asoc->c.initial_tsn);
240 
241 	/* How many address types are needed? */
242 	sp = sctp_sk(asoc->base.sk);
243 	num_types = sp->pf->supported_addrs(sp, types);
244 
245 	chunksize = sizeof(init) + addrs_len;
246 	chunksize += SCTP_PAD4(SCTP_SAT_LEN(num_types));
247 
248 	if (asoc->ep->ecn_enable)
249 		chunksize += sizeof(ecap_param);
250 
251 	if (asoc->ep->prsctp_enable)
252 		chunksize += sizeof(prsctp_param);
253 
254 	/* ADDIP: Section 4.2.7:
255 	 *  An implementation supporting this extension [ADDIP] MUST list
256 	 *  the ASCONF,the ASCONF-ACK, and the AUTH  chunks in its INIT and
257 	 *  INIT-ACK parameters.
258 	 */
259 	if (asoc->ep->asconf_enable) {
260 		extensions[num_ext] = SCTP_CID_ASCONF;
261 		extensions[num_ext+1] = SCTP_CID_ASCONF_ACK;
262 		num_ext += 2;
263 	}
264 
265 	if (asoc->ep->reconf_enable) {
266 		extensions[num_ext] = SCTP_CID_RECONF;
267 		num_ext += 1;
268 	}
269 
270 	if (sp->adaptation_ind)
271 		chunksize += sizeof(aiparam);
272 
273 	if (asoc->ep->intl_enable) {
274 		extensions[num_ext] = SCTP_CID_I_DATA;
275 		num_ext += 1;
276 	}
277 
278 	chunksize += vparam_len;
279 
280 	/* Account for AUTH related parameters */
281 	if (ep->auth_enable) {
282 		/* Add random parameter length*/
283 		chunksize += sizeof(asoc->c.auth_random);
284 
285 		/* Add HMACS parameter length if any were defined */
286 		auth_hmacs = (struct sctp_paramhdr *)asoc->c.auth_hmacs;
287 		if (auth_hmacs->length)
288 			chunksize += SCTP_PAD4(ntohs(auth_hmacs->length));
289 		else
290 			auth_hmacs = NULL;
291 
292 		/* Add CHUNKS parameter length */
293 		auth_chunks = (struct sctp_paramhdr *)asoc->c.auth_chunks;
294 		if (auth_chunks->length)
295 			chunksize += SCTP_PAD4(ntohs(auth_chunks->length));
296 		else
297 			auth_chunks = NULL;
298 
299 		extensions[num_ext] = SCTP_CID_AUTH;
300 		num_ext += 1;
301 	}
302 
303 	/* If we have any extensions to report, account for that */
304 	if (num_ext)
305 		chunksize += SCTP_PAD4(sizeof(ext_param) + num_ext);
306 
307 	/* RFC 2960 3.3.2 Initiation (INIT) (1)
308 	 *
309 	 * Note 3: An INIT chunk MUST NOT contain more than one Host
310 	 * Name address parameter. Moreover, the sender of the INIT
311 	 * MUST NOT combine any other address types with the Host Name
312 	 * address in the INIT. The receiver of INIT MUST ignore any
313 	 * other address types if the Host Name address parameter is
314 	 * present in the received INIT chunk.
315 	 *
316 	 * PLEASE DO NOT FIXME [This version does not support Host Name.]
317 	 */
318 
319 	retval = sctp_make_control(asoc, SCTP_CID_INIT, 0, chunksize, gfp);
320 	if (!retval)
321 		goto nodata;
322 
323 	retval->subh.init_hdr =
324 		sctp_addto_chunk(retval, sizeof(init), &init);
325 	retval->param_hdr.v =
326 		sctp_addto_chunk(retval, addrs_len, addrs.v);
327 
328 	/* RFC 2960 3.3.2 Initiation (INIT) (1)
329 	 *
330 	 * Note 4: This parameter, when present, specifies all the
331 	 * address types the sending endpoint can support. The absence
332 	 * of this parameter indicates that the sending endpoint can
333 	 * support any address type.
334 	 */
335 	sat.param_hdr.type = SCTP_PARAM_SUPPORTED_ADDRESS_TYPES;
336 	sat.param_hdr.length = htons(SCTP_SAT_LEN(num_types));
337 	sctp_addto_chunk(retval, sizeof(sat), &sat);
338 	sctp_addto_chunk(retval, num_types * sizeof(__u16), &types);
339 
340 	if (asoc->ep->ecn_enable)
341 		sctp_addto_chunk(retval, sizeof(ecap_param), &ecap_param);
342 
343 	/* Add the supported extensions parameter.  Be nice and add this
344 	 * fist before addiding the parameters for the extensions themselves
345 	 */
346 	if (num_ext) {
347 		ext_param.param_hdr.type = SCTP_PARAM_SUPPORTED_EXT;
348 		ext_param.param_hdr.length = htons(sizeof(ext_param) + num_ext);
349 		sctp_addto_chunk(retval, sizeof(ext_param), &ext_param);
350 		sctp_addto_param(retval, num_ext, extensions);
351 	}
352 
353 	if (asoc->ep->prsctp_enable)
354 		sctp_addto_chunk(retval, sizeof(prsctp_param), &prsctp_param);
355 
356 	if (sp->adaptation_ind) {
357 		aiparam.param_hdr.type = SCTP_PARAM_ADAPTATION_LAYER_IND;
358 		aiparam.param_hdr.length = htons(sizeof(aiparam));
359 		aiparam.adaptation_ind = htonl(sp->adaptation_ind);
360 		sctp_addto_chunk(retval, sizeof(aiparam), &aiparam);
361 	}
362 
363 	/* Add SCTP-AUTH chunks to the parameter list */
364 	if (ep->auth_enable) {
365 		sctp_addto_chunk(retval, sizeof(asoc->c.auth_random),
366 				 asoc->c.auth_random);
367 		if (auth_hmacs)
368 			sctp_addto_chunk(retval, ntohs(auth_hmacs->length),
369 					auth_hmacs);
370 		if (auth_chunks)
371 			sctp_addto_chunk(retval, ntohs(auth_chunks->length),
372 					auth_chunks);
373 	}
374 nodata:
375 	kfree(addrs.v);
376 	return retval;
377 }
378 
379 struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc,
380 				      const struct sctp_chunk *chunk,
381 				      gfp_t gfp, int unkparam_len)
382 {
383 	struct sctp_supported_ext_param ext_param;
384 	struct sctp_adaptation_ind_param aiparam;
385 	struct sctp_paramhdr *auth_chunks = NULL;
386 	struct sctp_paramhdr *auth_random = NULL;
387 	struct sctp_paramhdr *auth_hmacs = NULL;
388 	struct sctp_chunk *retval = NULL;
389 	struct sctp_cookie_param *cookie;
390 	struct sctp_inithdr initack;
391 	union sctp_params addrs;
392 	struct sctp_sock *sp;
393 	__u8 extensions[5];
394 	size_t chunksize;
395 	int num_ext = 0;
396 	int cookie_len;
397 	int addrs_len;
398 
399 	/* Note: there may be no addresses to embed. */
400 	addrs = sctp_bind_addrs_to_raw(&asoc->base.bind_addr, &addrs_len, gfp);
401 
402 	initack.init_tag	        = htonl(asoc->c.my_vtag);
403 	initack.a_rwnd			= htonl(asoc->rwnd);
404 	initack.num_outbound_streams	= htons(asoc->c.sinit_num_ostreams);
405 	initack.num_inbound_streams	= htons(asoc->c.sinit_max_instreams);
406 	initack.initial_tsn		= htonl(asoc->c.initial_tsn);
407 
408 	/* FIXME:  We really ought to build the cookie right
409 	 * into the packet instead of allocating more fresh memory.
410 	 */
411 	cookie = sctp_pack_cookie(asoc->ep, asoc, chunk, &cookie_len,
412 				  addrs.v, addrs_len);
413 	if (!cookie)
414 		goto nomem_cookie;
415 
416 	/* Calculate the total size of allocation, include the reserved
417 	 * space for reporting unknown parameters if it is specified.
418 	 */
419 	sp = sctp_sk(asoc->base.sk);
420 	chunksize = sizeof(initack) + addrs_len + cookie_len + unkparam_len;
421 
422 	/* Tell peer that we'll do ECN only if peer advertised such cap.  */
423 	if (asoc->peer.ecn_capable)
424 		chunksize += sizeof(ecap_param);
425 
426 	if (asoc->peer.prsctp_capable)
427 		chunksize += sizeof(prsctp_param);
428 
429 	if (asoc->peer.asconf_capable) {
430 		extensions[num_ext] = SCTP_CID_ASCONF;
431 		extensions[num_ext+1] = SCTP_CID_ASCONF_ACK;
432 		num_ext += 2;
433 	}
434 
435 	if (asoc->peer.reconf_capable) {
436 		extensions[num_ext] = SCTP_CID_RECONF;
437 		num_ext += 1;
438 	}
439 
440 	if (sp->adaptation_ind)
441 		chunksize += sizeof(aiparam);
442 
443 	if (asoc->peer.intl_capable) {
444 		extensions[num_ext] = SCTP_CID_I_DATA;
445 		num_ext += 1;
446 	}
447 
448 	if (asoc->peer.auth_capable) {
449 		auth_random = (struct sctp_paramhdr *)asoc->c.auth_random;
450 		chunksize += ntohs(auth_random->length);
451 
452 		auth_hmacs = (struct sctp_paramhdr *)asoc->c.auth_hmacs;
453 		if (auth_hmacs->length)
454 			chunksize += SCTP_PAD4(ntohs(auth_hmacs->length));
455 		else
456 			auth_hmacs = NULL;
457 
458 		auth_chunks = (struct sctp_paramhdr *)asoc->c.auth_chunks;
459 		if (auth_chunks->length)
460 			chunksize += SCTP_PAD4(ntohs(auth_chunks->length));
461 		else
462 			auth_chunks = NULL;
463 
464 		extensions[num_ext] = SCTP_CID_AUTH;
465 		num_ext += 1;
466 	}
467 
468 	if (num_ext)
469 		chunksize += SCTP_PAD4(sizeof(ext_param) + num_ext);
470 
471 	/* Now allocate and fill out the chunk.  */
472 	retval = sctp_make_control(asoc, SCTP_CID_INIT_ACK, 0, chunksize, gfp);
473 	if (!retval)
474 		goto nomem_chunk;
475 
476 	/* RFC 2960 6.4 Multi-homed SCTP Endpoints
477 	 *
478 	 * An endpoint SHOULD transmit reply chunks (e.g., SACK,
479 	 * HEARTBEAT ACK, * etc.) to the same destination transport
480 	 * address from which it received the DATA or control chunk
481 	 * to which it is replying.
482 	 *
483 	 * [INIT ACK back to where the INIT came from.]
484 	 */
485 	if (chunk->transport)
486 		retval->transport =
487 			sctp_assoc_lookup_paddr(asoc,
488 						&chunk->transport->ipaddr);
489 
490 	retval->subh.init_hdr =
491 		sctp_addto_chunk(retval, sizeof(initack), &initack);
492 	retval->param_hdr.v = sctp_addto_chunk(retval, addrs_len, addrs.v);
493 	sctp_addto_chunk(retval, cookie_len, cookie);
494 	if (asoc->peer.ecn_capable)
495 		sctp_addto_chunk(retval, sizeof(ecap_param), &ecap_param);
496 	if (num_ext) {
497 		ext_param.param_hdr.type = SCTP_PARAM_SUPPORTED_EXT;
498 		ext_param.param_hdr.length = htons(sizeof(ext_param) + num_ext);
499 		sctp_addto_chunk(retval, sizeof(ext_param), &ext_param);
500 		sctp_addto_param(retval, num_ext, extensions);
501 	}
502 	if (asoc->peer.prsctp_capable)
503 		sctp_addto_chunk(retval, sizeof(prsctp_param), &prsctp_param);
504 
505 	if (sp->adaptation_ind) {
506 		aiparam.param_hdr.type = SCTP_PARAM_ADAPTATION_LAYER_IND;
507 		aiparam.param_hdr.length = htons(sizeof(aiparam));
508 		aiparam.adaptation_ind = htonl(sp->adaptation_ind);
509 		sctp_addto_chunk(retval, sizeof(aiparam), &aiparam);
510 	}
511 
512 	if (asoc->peer.auth_capable) {
513 		sctp_addto_chunk(retval, ntohs(auth_random->length),
514 				 auth_random);
515 		if (auth_hmacs)
516 			sctp_addto_chunk(retval, ntohs(auth_hmacs->length),
517 					auth_hmacs);
518 		if (auth_chunks)
519 			sctp_addto_chunk(retval, ntohs(auth_chunks->length),
520 					auth_chunks);
521 	}
522 
523 	/* We need to remove the const qualifier at this point.  */
524 	retval->asoc = (struct sctp_association *) asoc;
525 
526 nomem_chunk:
527 	kfree(cookie);
528 nomem_cookie:
529 	kfree(addrs.v);
530 	return retval;
531 }
532 
533 /* 3.3.11 Cookie Echo (COOKIE ECHO) (10):
534  *
535  * This chunk is used only during the initialization of an association.
536  * It is sent by the initiator of an association to its peer to complete
537  * the initialization process. This chunk MUST precede any DATA chunk
538  * sent within the association, but MAY be bundled with one or more DATA
539  * chunks in the same packet.
540  *
541  *      0                   1                   2                   3
542  *      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
543  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
544  *     |   Type = 10   |Chunk  Flags   |         Length                |
545  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
546  *     /                     Cookie                                    /
547  *     \                                                               \
548  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
549  *
550  * Chunk Flags: 8 bit
551  *
552  *   Set to zero on transmit and ignored on receipt.
553  *
554  * Length: 16 bits (unsigned integer)
555  *
556  *   Set to the size of the chunk in bytes, including the 4 bytes of
557  *   the chunk header and the size of the Cookie.
558  *
559  * Cookie: variable size
560  *
561  *   This field must contain the exact cookie received in the
562  *   State Cookie parameter from the previous INIT ACK.
563  *
564  *   An implementation SHOULD make the cookie as small as possible
565  *   to insure interoperability.
566  */
567 struct sctp_chunk *sctp_make_cookie_echo(const struct sctp_association *asoc,
568 					 const struct sctp_chunk *chunk)
569 {
570 	struct sctp_chunk *retval;
571 	int cookie_len;
572 	void *cookie;
573 
574 	cookie = asoc->peer.cookie;
575 	cookie_len = asoc->peer.cookie_len;
576 
577 	/* Build a cookie echo chunk.  */
578 	retval = sctp_make_control(asoc, SCTP_CID_COOKIE_ECHO, 0,
579 				   cookie_len, GFP_ATOMIC);
580 	if (!retval)
581 		goto nodata;
582 	retval->subh.cookie_hdr =
583 		sctp_addto_chunk(retval, cookie_len, cookie);
584 
585 	/* RFC 2960 6.4 Multi-homed SCTP Endpoints
586 	 *
587 	 * An endpoint SHOULD transmit reply chunks (e.g., SACK,
588 	 * HEARTBEAT ACK, * etc.) to the same destination transport
589 	 * address from which it * received the DATA or control chunk
590 	 * to which it is replying.
591 	 *
592 	 * [COOKIE ECHO back to where the INIT ACK came from.]
593 	 */
594 	if (chunk)
595 		retval->transport = chunk->transport;
596 
597 nodata:
598 	return retval;
599 }
600 
601 /* 3.3.12 Cookie Acknowledgement (COOKIE ACK) (11):
602  *
603  * This chunk is used only during the initialization of an
604  * association.  It is used to acknowledge the receipt of a COOKIE
605  * ECHO chunk.  This chunk MUST precede any DATA or SACK chunk sent
606  * within the association, but MAY be bundled with one or more DATA
607  * chunks or SACK chunk in the same SCTP packet.
608  *
609  *      0                   1                   2                   3
610  *      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
611  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
612  *     |   Type = 11   |Chunk  Flags   |     Length = 4                |
613  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
614  *
615  * Chunk Flags: 8 bits
616  *
617  *   Set to zero on transmit and ignored on receipt.
618  */
619 struct sctp_chunk *sctp_make_cookie_ack(const struct sctp_association *asoc,
620 					const struct sctp_chunk *chunk)
621 {
622 	struct sctp_chunk *retval;
623 
624 	retval = sctp_make_control(asoc, SCTP_CID_COOKIE_ACK, 0, 0, GFP_ATOMIC);
625 
626 	/* RFC 2960 6.4 Multi-homed SCTP Endpoints
627 	 *
628 	 * An endpoint SHOULD transmit reply chunks (e.g., SACK,
629 	 * HEARTBEAT ACK, * etc.) to the same destination transport
630 	 * address from which it * received the DATA or control chunk
631 	 * to which it is replying.
632 	 *
633 	 * [COOKIE ACK back to where the COOKIE ECHO came from.]
634 	 */
635 	if (retval && chunk && chunk->transport)
636 		retval->transport =
637 			sctp_assoc_lookup_paddr(asoc,
638 						&chunk->transport->ipaddr);
639 
640 	return retval;
641 }
642 
643 /*
644  *  Appendix A: Explicit Congestion Notification:
645  *  CWR:
646  *
647  *  RFC 2481 details a specific bit for a sender to send in the header of
648  *  its next outbound TCP segment to indicate to its peer that it has
649  *  reduced its congestion window.  This is termed the CWR bit.  For
650  *  SCTP the same indication is made by including the CWR chunk.
651  *  This chunk contains one data element, i.e. the TSN number that
652  *  was sent in the ECNE chunk.  This element represents the lowest
653  *  TSN number in the datagram that was originally marked with the
654  *  CE bit.
655  *
656  *     0                   1                   2                   3
657  *     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
658  *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
659  *    | Chunk Type=13 | Flags=00000000|    Chunk Length = 8           |
660  *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
661  *    |                      Lowest TSN Number                        |
662  *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
663  *
664  *     Note: The CWR is considered a Control chunk.
665  */
666 struct sctp_chunk *sctp_make_cwr(const struct sctp_association *asoc,
667 				 const __u32 lowest_tsn,
668 				 const struct sctp_chunk *chunk)
669 {
670 	struct sctp_chunk *retval;
671 	struct sctp_cwrhdr cwr;
672 
673 	cwr.lowest_tsn = htonl(lowest_tsn);
674 	retval = sctp_make_control(asoc, SCTP_CID_ECN_CWR, 0,
675 				   sizeof(cwr), GFP_ATOMIC);
676 
677 	if (!retval)
678 		goto nodata;
679 
680 	retval->subh.ecn_cwr_hdr =
681 		sctp_addto_chunk(retval, sizeof(cwr), &cwr);
682 
683 	/* RFC 2960 6.4 Multi-homed SCTP Endpoints
684 	 *
685 	 * An endpoint SHOULD transmit reply chunks (e.g., SACK,
686 	 * HEARTBEAT ACK, * etc.) to the same destination transport
687 	 * address from which it * received the DATA or control chunk
688 	 * to which it is replying.
689 	 *
690 	 * [Report a reduced congestion window back to where the ECNE
691 	 * came from.]
692 	 */
693 	if (chunk)
694 		retval->transport = chunk->transport;
695 
696 nodata:
697 	return retval;
698 }
699 
700 /* Make an ECNE chunk.  This is a congestion experienced report.  */
701 struct sctp_chunk *sctp_make_ecne(const struct sctp_association *asoc,
702 				  const __u32 lowest_tsn)
703 {
704 	struct sctp_chunk *retval;
705 	struct sctp_ecnehdr ecne;
706 
707 	ecne.lowest_tsn = htonl(lowest_tsn);
708 	retval = sctp_make_control(asoc, SCTP_CID_ECN_ECNE, 0,
709 				   sizeof(ecne), GFP_ATOMIC);
710 	if (!retval)
711 		goto nodata;
712 	retval->subh.ecne_hdr =
713 		sctp_addto_chunk(retval, sizeof(ecne), &ecne);
714 
715 nodata:
716 	return retval;
717 }
718 
719 /* Make a DATA chunk for the given association from the provided
720  * parameters.  However, do not populate the data payload.
721  */
722 struct sctp_chunk *sctp_make_datafrag_empty(const struct sctp_association *asoc,
723 					    const struct sctp_sndrcvinfo *sinfo,
724 					    int len, __u8 flags, gfp_t gfp)
725 {
726 	struct sctp_chunk *retval;
727 	struct sctp_datahdr dp;
728 
729 	/* We assign the TSN as LATE as possible, not here when
730 	 * creating the chunk.
731 	 */
732 	memset(&dp, 0, sizeof(dp));
733 	dp.ppid = sinfo->sinfo_ppid;
734 	dp.stream = htons(sinfo->sinfo_stream);
735 
736 	/* Set the flags for an unordered send.  */
737 	if (sinfo->sinfo_flags & SCTP_UNORDERED)
738 		flags |= SCTP_DATA_UNORDERED;
739 
740 	retval = sctp_make_data(asoc, flags, sizeof(dp) + len, gfp);
741 	if (!retval)
742 		return NULL;
743 
744 	retval->subh.data_hdr = sctp_addto_chunk(retval, sizeof(dp), &dp);
745 	memcpy(&retval->sinfo, sinfo, sizeof(struct sctp_sndrcvinfo));
746 
747 	return retval;
748 }
749 
750 /* Create a selective ackowledgement (SACK) for the given
751  * association.  This reports on which TSN's we've seen to date,
752  * including duplicates and gaps.
753  */
754 struct sctp_chunk *sctp_make_sack(struct sctp_association *asoc)
755 {
756 	struct sctp_tsnmap *map = (struct sctp_tsnmap *)&asoc->peer.tsn_map;
757 	struct sctp_gap_ack_block gabs[SCTP_MAX_GABS];
758 	__u16 num_gabs, num_dup_tsns;
759 	struct sctp_transport *trans;
760 	struct sctp_chunk *retval;
761 	struct sctp_sackhdr sack;
762 	__u32 ctsn;
763 	int len;
764 
765 	memset(gabs, 0, sizeof(gabs));
766 	ctsn = sctp_tsnmap_get_ctsn(map);
767 
768 	pr_debug("%s: sackCTSNAck sent:0x%x\n", __func__, ctsn);
769 
770 	/* How much room is needed in the chunk? */
771 	num_gabs = sctp_tsnmap_num_gabs(map, gabs);
772 	num_dup_tsns = sctp_tsnmap_num_dups(map);
773 
774 	/* Initialize the SACK header.  */
775 	sack.cum_tsn_ack	    = htonl(ctsn);
776 	sack.a_rwnd 		    = htonl(asoc->a_rwnd);
777 	sack.num_gap_ack_blocks     = htons(num_gabs);
778 	sack.num_dup_tsns           = htons(num_dup_tsns);
779 
780 	len = sizeof(sack)
781 		+ sizeof(struct sctp_gap_ack_block) * num_gabs
782 		+ sizeof(__u32) * num_dup_tsns;
783 
784 	/* Create the chunk.  */
785 	retval = sctp_make_control(asoc, SCTP_CID_SACK, 0, len, GFP_ATOMIC);
786 	if (!retval)
787 		goto nodata;
788 
789 	/* RFC 2960 6.4 Multi-homed SCTP Endpoints
790 	 *
791 	 * An endpoint SHOULD transmit reply chunks (e.g., SACK,
792 	 * HEARTBEAT ACK, etc.) to the same destination transport
793 	 * address from which it received the DATA or control chunk to
794 	 * which it is replying.  This rule should also be followed if
795 	 * the endpoint is bundling DATA chunks together with the
796 	 * reply chunk.
797 	 *
798 	 * However, when acknowledging multiple DATA chunks received
799 	 * in packets from different source addresses in a single
800 	 * SACK, the SACK chunk may be transmitted to one of the
801 	 * destination transport addresses from which the DATA or
802 	 * control chunks being acknowledged were received.
803 	 *
804 	 * [BUG:  We do not implement the following paragraph.
805 	 * Perhaps we should remember the last transport we used for a
806 	 * SACK and avoid that (if possible) if we have seen any
807 	 * duplicates. --piggy]
808 	 *
809 	 * When a receiver of a duplicate DATA chunk sends a SACK to a
810 	 * multi- homed endpoint it MAY be beneficial to vary the
811 	 * destination address and not use the source address of the
812 	 * DATA chunk.  The reason being that receiving a duplicate
813 	 * from a multi-homed endpoint might indicate that the return
814 	 * path (as specified in the source address of the DATA chunk)
815 	 * for the SACK is broken.
816 	 *
817 	 * [Send to the address from which we last received a DATA chunk.]
818 	 */
819 	retval->transport = asoc->peer.last_data_from;
820 
821 	retval->subh.sack_hdr =
822 		sctp_addto_chunk(retval, sizeof(sack), &sack);
823 
824 	/* Add the gap ack block information.   */
825 	if (num_gabs)
826 		sctp_addto_chunk(retval, sizeof(__u32) * num_gabs,
827 				 gabs);
828 
829 	/* Add the duplicate TSN information.  */
830 	if (num_dup_tsns) {
831 		asoc->stats.idupchunks += num_dup_tsns;
832 		sctp_addto_chunk(retval, sizeof(__u32) * num_dup_tsns,
833 				 sctp_tsnmap_get_dups(map));
834 	}
835 	/* Once we have a sack generated, check to see what our sack
836 	 * generation is, if its 0, reset the transports to 0, and reset
837 	 * the association generation to 1
838 	 *
839 	 * The idea is that zero is never used as a valid generation for the
840 	 * association so no transport will match after a wrap event like this,
841 	 * Until the next sack
842 	 */
843 	if (++asoc->peer.sack_generation == 0) {
844 		list_for_each_entry(trans, &asoc->peer.transport_addr_list,
845 				    transports)
846 			trans->sack_generation = 0;
847 		asoc->peer.sack_generation = 1;
848 	}
849 nodata:
850 	return retval;
851 }
852 
853 /* Make a SHUTDOWN chunk. */
854 struct sctp_chunk *sctp_make_shutdown(const struct sctp_association *asoc,
855 				      const struct sctp_chunk *chunk)
856 {
857 	struct sctp_shutdownhdr shut;
858 	struct sctp_chunk *retval;
859 	__u32 ctsn;
860 
861 	if (chunk && chunk->asoc)
862 		ctsn = sctp_tsnmap_get_ctsn(&chunk->asoc->peer.tsn_map);
863 	else
864 		ctsn = sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map);
865 
866 	shut.cum_tsn_ack = htonl(ctsn);
867 
868 	retval = sctp_make_control(asoc, SCTP_CID_SHUTDOWN, 0,
869 				   sizeof(shut), GFP_ATOMIC);
870 	if (!retval)
871 		goto nodata;
872 
873 	retval->subh.shutdown_hdr =
874 		sctp_addto_chunk(retval, sizeof(shut), &shut);
875 
876 	if (chunk)
877 		retval->transport = chunk->transport;
878 nodata:
879 	return retval;
880 }
881 
882 struct sctp_chunk *sctp_make_shutdown_ack(const struct sctp_association *asoc,
883 					  const struct sctp_chunk *chunk)
884 {
885 	struct sctp_chunk *retval;
886 
887 	retval = sctp_make_control(asoc, SCTP_CID_SHUTDOWN_ACK, 0, 0,
888 				   GFP_ATOMIC);
889 
890 	/* RFC 2960 6.4 Multi-homed SCTP Endpoints
891 	 *
892 	 * An endpoint SHOULD transmit reply chunks (e.g., SACK,
893 	 * HEARTBEAT ACK, * etc.) to the same destination transport
894 	 * address from which it * received the DATA or control chunk
895 	 * to which it is replying.
896 	 *
897 	 * [ACK back to where the SHUTDOWN came from.]
898 	 */
899 	if (retval && chunk)
900 		retval->transport = chunk->transport;
901 
902 	return retval;
903 }
904 
905 struct sctp_chunk *sctp_make_shutdown_complete(
906 					const struct sctp_association *asoc,
907 					const struct sctp_chunk *chunk)
908 {
909 	struct sctp_chunk *retval;
910 	__u8 flags = 0;
911 
912 	/* Set the T-bit if we have no association (vtag will be
913 	 * reflected)
914 	 */
915 	flags |= asoc ? 0 : SCTP_CHUNK_FLAG_T;
916 
917 	retval = sctp_make_control(asoc, SCTP_CID_SHUTDOWN_COMPLETE, flags,
918 				   0, GFP_ATOMIC);
919 
920 	/* RFC 2960 6.4 Multi-homed SCTP Endpoints
921 	 *
922 	 * An endpoint SHOULD transmit reply chunks (e.g., SACK,
923 	 * HEARTBEAT ACK, * etc.) to the same destination transport
924 	 * address from which it * received the DATA or control chunk
925 	 * to which it is replying.
926 	 *
927 	 * [Report SHUTDOWN COMPLETE back to where the SHUTDOWN ACK
928 	 * came from.]
929 	 */
930 	if (retval && chunk)
931 		retval->transport = chunk->transport;
932 
933 	return retval;
934 }
935 
936 /* Create an ABORT.  Note that we set the T bit if we have no
937  * association, except when responding to an INIT (sctpimpguide 2.41).
938  */
939 struct sctp_chunk *sctp_make_abort(const struct sctp_association *asoc,
940 				   const struct sctp_chunk *chunk,
941 				   const size_t hint)
942 {
943 	struct sctp_chunk *retval;
944 	__u8 flags = 0;
945 
946 	/* Set the T-bit if we have no association and 'chunk' is not
947 	 * an INIT (vtag will be reflected).
948 	 */
949 	if (!asoc) {
950 		if (chunk && chunk->chunk_hdr &&
951 		    chunk->chunk_hdr->type == SCTP_CID_INIT)
952 			flags = 0;
953 		else
954 			flags = SCTP_CHUNK_FLAG_T;
955 	}
956 
957 	retval = sctp_make_control(asoc, SCTP_CID_ABORT, flags, hint,
958 				   GFP_ATOMIC);
959 
960 	/* RFC 2960 6.4 Multi-homed SCTP Endpoints
961 	 *
962 	 * An endpoint SHOULD transmit reply chunks (e.g., SACK,
963 	 * HEARTBEAT ACK, * etc.) to the same destination transport
964 	 * address from which it * received the DATA or control chunk
965 	 * to which it is replying.
966 	 *
967 	 * [ABORT back to where the offender came from.]
968 	 */
969 	if (retval && chunk)
970 		retval->transport = chunk->transport;
971 
972 	return retval;
973 }
974 
975 /* Helper to create ABORT with a NO_USER_DATA error.  */
976 struct sctp_chunk *sctp_make_abort_no_data(
977 					const struct sctp_association *asoc,
978 					const struct sctp_chunk *chunk,
979 					__u32 tsn)
980 {
981 	struct sctp_chunk *retval;
982 	__be32 payload;
983 
984 	retval = sctp_make_abort(asoc, chunk,
985 				 sizeof(struct sctp_errhdr) + sizeof(tsn));
986 
987 	if (!retval)
988 		goto no_mem;
989 
990 	/* Put the tsn back into network byte order.  */
991 	payload = htonl(tsn);
992 	sctp_init_cause(retval, SCTP_ERROR_NO_DATA, sizeof(payload));
993 	sctp_addto_chunk(retval, sizeof(payload), (const void *)&payload);
994 
995 	/* RFC 2960 6.4 Multi-homed SCTP Endpoints
996 	 *
997 	 * An endpoint SHOULD transmit reply chunks (e.g., SACK,
998 	 * HEARTBEAT ACK, * etc.) to the same destination transport
999 	 * address from which it * received the DATA or control chunk
1000 	 * to which it is replying.
1001 	 *
1002 	 * [ABORT back to where the offender came from.]
1003 	 */
1004 	if (chunk)
1005 		retval->transport = chunk->transport;
1006 
1007 no_mem:
1008 	return retval;
1009 }
1010 
1011 /* Helper to create ABORT with a SCTP_ERROR_USER_ABORT error.  */
1012 struct sctp_chunk *sctp_make_abort_user(const struct sctp_association *asoc,
1013 					struct msghdr *msg,
1014 					size_t paylen)
1015 {
1016 	struct sctp_chunk *retval;
1017 	void *payload = NULL;
1018 	int err;
1019 
1020 	retval = sctp_make_abort(asoc, NULL,
1021 				 sizeof(struct sctp_errhdr) + paylen);
1022 	if (!retval)
1023 		goto err_chunk;
1024 
1025 	if (paylen) {
1026 		/* Put the msg_iov together into payload.  */
1027 		payload = kmalloc(paylen, GFP_KERNEL);
1028 		if (!payload)
1029 			goto err_payload;
1030 
1031 		err = memcpy_from_msg(payload, msg, paylen);
1032 		if (err < 0)
1033 			goto err_copy;
1034 	}
1035 
1036 	sctp_init_cause(retval, SCTP_ERROR_USER_ABORT, paylen);
1037 	sctp_addto_chunk(retval, paylen, payload);
1038 
1039 	if (paylen)
1040 		kfree(payload);
1041 
1042 	return retval;
1043 
1044 err_copy:
1045 	kfree(payload);
1046 err_payload:
1047 	sctp_chunk_free(retval);
1048 	retval = NULL;
1049 err_chunk:
1050 	return retval;
1051 }
1052 
1053 /* Append bytes to the end of a parameter.  Will panic if chunk is not big
1054  * enough.
1055  */
1056 static void *sctp_addto_param(struct sctp_chunk *chunk, int len,
1057 			      const void *data)
1058 {
1059 	int chunklen = ntohs(chunk->chunk_hdr->length);
1060 	void *target;
1061 
1062 	target = skb_put(chunk->skb, len);
1063 
1064 	if (data)
1065 		memcpy(target, data, len);
1066 	else
1067 		memset(target, 0, len);
1068 
1069 	/* Adjust the chunk length field.  */
1070 	chunk->chunk_hdr->length = htons(chunklen + len);
1071 	chunk->chunk_end = skb_tail_pointer(chunk->skb);
1072 
1073 	return target;
1074 }
1075 
1076 /* Make an ABORT chunk with a PROTOCOL VIOLATION cause code. */
1077 struct sctp_chunk *sctp_make_abort_violation(
1078 					const struct sctp_association *asoc,
1079 					const struct sctp_chunk *chunk,
1080 					const __u8 *payload,
1081 					const size_t paylen)
1082 {
1083 	struct sctp_chunk  *retval;
1084 	struct sctp_paramhdr phdr;
1085 
1086 	retval = sctp_make_abort(asoc, chunk, sizeof(struct sctp_errhdr) +
1087 					      paylen + sizeof(phdr));
1088 	if (!retval)
1089 		goto end;
1090 
1091 	sctp_init_cause(retval, SCTP_ERROR_PROTO_VIOLATION, paylen +
1092 							    sizeof(phdr));
1093 
1094 	phdr.type = htons(chunk->chunk_hdr->type);
1095 	phdr.length = chunk->chunk_hdr->length;
1096 	sctp_addto_chunk(retval, paylen, payload);
1097 	sctp_addto_param(retval, sizeof(phdr), &phdr);
1098 
1099 end:
1100 	return retval;
1101 }
1102 
1103 struct sctp_chunk *sctp_make_violation_paramlen(
1104 					const struct sctp_association *asoc,
1105 					const struct sctp_chunk *chunk,
1106 					struct sctp_paramhdr *param)
1107 {
1108 	static const char error[] = "The following parameter had invalid length:";
1109 	size_t payload_len = sizeof(error) + sizeof(struct sctp_errhdr) +
1110 			     sizeof(*param);
1111 	struct sctp_chunk *retval;
1112 
1113 	retval = sctp_make_abort(asoc, chunk, payload_len);
1114 	if (!retval)
1115 		goto nodata;
1116 
1117 	sctp_init_cause(retval, SCTP_ERROR_PROTO_VIOLATION,
1118 			sizeof(error) + sizeof(*param));
1119 	sctp_addto_chunk(retval, sizeof(error), error);
1120 	sctp_addto_param(retval, sizeof(*param), param);
1121 
1122 nodata:
1123 	return retval;
1124 }
1125 
1126 struct sctp_chunk *sctp_make_violation_max_retrans(
1127 					const struct sctp_association *asoc,
1128 					const struct sctp_chunk *chunk)
1129 {
1130 	static const char error[] = "Association exceeded its max_retrans count";
1131 	size_t payload_len = sizeof(error) + sizeof(struct sctp_errhdr);
1132 	struct sctp_chunk *retval;
1133 
1134 	retval = sctp_make_abort(asoc, chunk, payload_len);
1135 	if (!retval)
1136 		goto nodata;
1137 
1138 	sctp_init_cause(retval, SCTP_ERROR_PROTO_VIOLATION, sizeof(error));
1139 	sctp_addto_chunk(retval, sizeof(error), error);
1140 
1141 nodata:
1142 	return retval;
1143 }
1144 
1145 /* Make a HEARTBEAT chunk.  */
1146 struct sctp_chunk *sctp_make_heartbeat(const struct sctp_association *asoc,
1147 				       const struct sctp_transport *transport)
1148 {
1149 	struct sctp_sender_hb_info hbinfo;
1150 	struct sctp_chunk *retval;
1151 
1152 	retval = sctp_make_control(asoc, SCTP_CID_HEARTBEAT, 0,
1153 				   sizeof(hbinfo), GFP_ATOMIC);
1154 
1155 	if (!retval)
1156 		goto nodata;
1157 
1158 	hbinfo.param_hdr.type = SCTP_PARAM_HEARTBEAT_INFO;
1159 	hbinfo.param_hdr.length = htons(sizeof(hbinfo));
1160 	hbinfo.daddr = transport->ipaddr;
1161 	hbinfo.sent_at = jiffies;
1162 	hbinfo.hb_nonce = transport->hb_nonce;
1163 
1164 	/* Cast away the 'const', as this is just telling the chunk
1165 	 * what transport it belongs to.
1166 	 */
1167 	retval->transport = (struct sctp_transport *) transport;
1168 	retval->subh.hbs_hdr = sctp_addto_chunk(retval, sizeof(hbinfo),
1169 						&hbinfo);
1170 
1171 nodata:
1172 	return retval;
1173 }
1174 
1175 struct sctp_chunk *sctp_make_heartbeat_ack(const struct sctp_association *asoc,
1176 					   const struct sctp_chunk *chunk,
1177 					   const void *payload,
1178 					   const size_t paylen)
1179 {
1180 	struct sctp_chunk *retval;
1181 
1182 	retval  = sctp_make_control(asoc, SCTP_CID_HEARTBEAT_ACK, 0, paylen,
1183 				    GFP_ATOMIC);
1184 	if (!retval)
1185 		goto nodata;
1186 
1187 	retval->subh.hbs_hdr = sctp_addto_chunk(retval, paylen, payload);
1188 
1189 	/* RFC 2960 6.4 Multi-homed SCTP Endpoints
1190 	 *
1191 	 * An endpoint SHOULD transmit reply chunks (e.g., SACK,
1192 	 * HEARTBEAT ACK, * etc.) to the same destination transport
1193 	 * address from which it * received the DATA or control chunk
1194 	 * to which it is replying.
1195 	 *
1196 	 * [HBACK back to where the HEARTBEAT came from.]
1197 	 */
1198 	if (chunk)
1199 		retval->transport = chunk->transport;
1200 
1201 nodata:
1202 	return retval;
1203 }
1204 
1205 /* Create an Operation Error chunk with the specified space reserved.
1206  * This routine can be used for containing multiple causes in the chunk.
1207  */
1208 static struct sctp_chunk *sctp_make_op_error_space(
1209 					const struct sctp_association *asoc,
1210 					const struct sctp_chunk *chunk,
1211 					size_t size)
1212 {
1213 	struct sctp_chunk *retval;
1214 
1215 	retval = sctp_make_control(asoc, SCTP_CID_ERROR, 0,
1216 				   sizeof(struct sctp_errhdr) + size,
1217 				   GFP_ATOMIC);
1218 	if (!retval)
1219 		goto nodata;
1220 
1221 	/* RFC 2960 6.4 Multi-homed SCTP Endpoints
1222 	 *
1223 	 * An endpoint SHOULD transmit reply chunks (e.g., SACK,
1224 	 * HEARTBEAT ACK, etc.) to the same destination transport
1225 	 * address from which it received the DATA or control chunk
1226 	 * to which it is replying.
1227 	 *
1228 	 */
1229 	if (chunk)
1230 		retval->transport = chunk->transport;
1231 
1232 nodata:
1233 	return retval;
1234 }
1235 
1236 /* Create an Operation Error chunk of a fixed size, specifically,
1237  * min(asoc->pathmtu, SCTP_DEFAULT_MAXSEGMENT) - overheads.
1238  * This is a helper function to allocate an error chunk for for those
1239  * invalid parameter codes in which we may not want to report all the
1240  * errors, if the incoming chunk is large. If it can't fit in a single
1241  * packet, we ignore it.
1242  */
1243 static inline struct sctp_chunk *sctp_make_op_error_limited(
1244 					const struct sctp_association *asoc,
1245 					const struct sctp_chunk *chunk)
1246 {
1247 	size_t size = SCTP_DEFAULT_MAXSEGMENT;
1248 	struct sctp_sock *sp = NULL;
1249 
1250 	if (asoc) {
1251 		size = min_t(size_t, size, asoc->pathmtu);
1252 		sp = sctp_sk(asoc->base.sk);
1253 	}
1254 
1255 	size = sctp_mtu_payload(sp, size, sizeof(struct sctp_errhdr));
1256 
1257 	return sctp_make_op_error_space(asoc, chunk, size);
1258 }
1259 
1260 /* Create an Operation Error chunk.  */
1261 struct sctp_chunk *sctp_make_op_error(const struct sctp_association *asoc,
1262 				      const struct sctp_chunk *chunk,
1263 				      __be16 cause_code, const void *payload,
1264 				      size_t paylen, size_t reserve_tail)
1265 {
1266 	struct sctp_chunk *retval;
1267 
1268 	retval = sctp_make_op_error_space(asoc, chunk, paylen + reserve_tail);
1269 	if (!retval)
1270 		goto nodata;
1271 
1272 	sctp_init_cause(retval, cause_code, paylen + reserve_tail);
1273 	sctp_addto_chunk(retval, paylen, payload);
1274 	if (reserve_tail)
1275 		sctp_addto_param(retval, reserve_tail, NULL);
1276 
1277 nodata:
1278 	return retval;
1279 }
1280 
1281 struct sctp_chunk *sctp_make_auth(const struct sctp_association *asoc,
1282 				  __u16 key_id)
1283 {
1284 	struct sctp_authhdr auth_hdr;
1285 	struct sctp_hmac *hmac_desc;
1286 	struct sctp_chunk *retval;
1287 
1288 	/* Get the first hmac that the peer told us to use */
1289 	hmac_desc = sctp_auth_asoc_get_hmac(asoc);
1290 	if (unlikely(!hmac_desc))
1291 		return NULL;
1292 
1293 	retval = sctp_make_control(asoc, SCTP_CID_AUTH, 0,
1294 				   hmac_desc->hmac_len + sizeof(auth_hdr),
1295 				   GFP_ATOMIC);
1296 	if (!retval)
1297 		return NULL;
1298 
1299 	auth_hdr.hmac_id = htons(hmac_desc->hmac_id);
1300 	auth_hdr.shkey_id = htons(key_id);
1301 
1302 	retval->subh.auth_hdr = sctp_addto_chunk(retval, sizeof(auth_hdr),
1303 						 &auth_hdr);
1304 
1305 	skb_put_zero(retval->skb, hmac_desc->hmac_len);
1306 
1307 	/* Adjust the chunk header to include the empty MAC */
1308 	retval->chunk_hdr->length =
1309 		htons(ntohs(retval->chunk_hdr->length) + hmac_desc->hmac_len);
1310 	retval->chunk_end = skb_tail_pointer(retval->skb);
1311 
1312 	return retval;
1313 }
1314 
1315 
1316 /********************************************************************
1317  * 2nd Level Abstractions
1318  ********************************************************************/
1319 
1320 /* Turn an skb into a chunk.
1321  * FIXME: Eventually move the structure directly inside the skb->cb[].
1322  *
1323  * sctpimpguide-05.txt Section 2.8.2
1324  * M1) Each time a new DATA chunk is transmitted
1325  * set the 'TSN.Missing.Report' count for that TSN to 0. The
1326  * 'TSN.Missing.Report' count will be used to determine missing chunks
1327  * and when to fast retransmit.
1328  *
1329  */
1330 struct sctp_chunk *sctp_chunkify(struct sk_buff *skb,
1331 				 const struct sctp_association *asoc,
1332 				 struct sock *sk, gfp_t gfp)
1333 {
1334 	struct sctp_chunk *retval;
1335 
1336 	retval = kmem_cache_zalloc(sctp_chunk_cachep, gfp);
1337 
1338 	if (!retval)
1339 		goto nodata;
1340 	if (!sk)
1341 		pr_debug("%s: chunkifying skb:%p w/o an sk\n", __func__, skb);
1342 
1343 	INIT_LIST_HEAD(&retval->list);
1344 	retval->skb		= skb;
1345 	retval->asoc		= (struct sctp_association *)asoc;
1346 	retval->singleton	= 1;
1347 
1348 	retval->fast_retransmit = SCTP_CAN_FRTX;
1349 
1350 	/* Polish the bead hole.  */
1351 	INIT_LIST_HEAD(&retval->transmitted_list);
1352 	INIT_LIST_HEAD(&retval->frag_list);
1353 	SCTP_DBG_OBJCNT_INC(chunk);
1354 	refcount_set(&retval->refcnt, 1);
1355 
1356 nodata:
1357 	return retval;
1358 }
1359 
1360 /* Set chunk->source and dest based on the IP header in chunk->skb.  */
1361 void sctp_init_addrs(struct sctp_chunk *chunk, union sctp_addr *src,
1362 		     union sctp_addr *dest)
1363 {
1364 	memcpy(&chunk->source, src, sizeof(union sctp_addr));
1365 	memcpy(&chunk->dest, dest, sizeof(union sctp_addr));
1366 }
1367 
1368 /* Extract the source address from a chunk.  */
1369 const union sctp_addr *sctp_source(const struct sctp_chunk *chunk)
1370 {
1371 	/* If we have a known transport, use that.  */
1372 	if (chunk->transport) {
1373 		return &chunk->transport->ipaddr;
1374 	} else {
1375 		/* Otherwise, extract it from the IP header.  */
1376 		return &chunk->source;
1377 	}
1378 }
1379 
1380 /* Create a new chunk, setting the type and flags headers from the
1381  * arguments, reserving enough space for a 'paylen' byte payload.
1382  */
1383 static struct sctp_chunk *_sctp_make_chunk(const struct sctp_association *asoc,
1384 					   __u8 type, __u8 flags, int paylen,
1385 					   gfp_t gfp)
1386 {
1387 	struct sctp_chunkhdr *chunk_hdr;
1388 	struct sctp_chunk *retval;
1389 	struct sk_buff *skb;
1390 	struct sock *sk;
1391 	int chunklen;
1392 
1393 	chunklen = SCTP_PAD4(sizeof(*chunk_hdr) + paylen);
1394 	if (chunklen > SCTP_MAX_CHUNK_LEN)
1395 		goto nodata;
1396 
1397 	/* No need to allocate LL here, as this is only a chunk. */
1398 	skb = alloc_skb(chunklen, gfp);
1399 	if (!skb)
1400 		goto nodata;
1401 
1402 	/* Make room for the chunk header.  */
1403 	chunk_hdr = (struct sctp_chunkhdr *)skb_put(skb, sizeof(*chunk_hdr));
1404 	chunk_hdr->type	  = type;
1405 	chunk_hdr->flags  = flags;
1406 	chunk_hdr->length = htons(sizeof(*chunk_hdr));
1407 
1408 	sk = asoc ? asoc->base.sk : NULL;
1409 	retval = sctp_chunkify(skb, asoc, sk, gfp);
1410 	if (!retval) {
1411 		kfree_skb(skb);
1412 		goto nodata;
1413 	}
1414 
1415 	retval->chunk_hdr = chunk_hdr;
1416 	retval->chunk_end = ((__u8 *)chunk_hdr) + sizeof(*chunk_hdr);
1417 
1418 	/* Determine if the chunk needs to be authenticated */
1419 	if (sctp_auth_send_cid(type, asoc))
1420 		retval->auth = 1;
1421 
1422 	return retval;
1423 nodata:
1424 	return NULL;
1425 }
1426 
1427 static struct sctp_chunk *sctp_make_data(const struct sctp_association *asoc,
1428 					 __u8 flags, int paylen, gfp_t gfp)
1429 {
1430 	return _sctp_make_chunk(asoc, SCTP_CID_DATA, flags, paylen, gfp);
1431 }
1432 
1433 struct sctp_chunk *sctp_make_idata(const struct sctp_association *asoc,
1434 				   __u8 flags, int paylen, gfp_t gfp)
1435 {
1436 	return _sctp_make_chunk(asoc, SCTP_CID_I_DATA, flags, paylen, gfp);
1437 }
1438 
1439 static struct sctp_chunk *sctp_make_control(const struct sctp_association *asoc,
1440 					    __u8 type, __u8 flags, int paylen,
1441 					    gfp_t gfp)
1442 {
1443 	struct sctp_chunk *chunk;
1444 
1445 	chunk = _sctp_make_chunk(asoc, type, flags, paylen, gfp);
1446 	if (chunk)
1447 		sctp_control_set_owner_w(chunk);
1448 
1449 	return chunk;
1450 }
1451 
1452 /* Release the memory occupied by a chunk.  */
1453 static void sctp_chunk_destroy(struct sctp_chunk *chunk)
1454 {
1455 	BUG_ON(!list_empty(&chunk->list));
1456 	list_del_init(&chunk->transmitted_list);
1457 
1458 	consume_skb(chunk->skb);
1459 	consume_skb(chunk->auth_chunk);
1460 
1461 	SCTP_DBG_OBJCNT_DEC(chunk);
1462 	kmem_cache_free(sctp_chunk_cachep, chunk);
1463 }
1464 
1465 /* Possibly, free the chunk.  */
1466 void sctp_chunk_free(struct sctp_chunk *chunk)
1467 {
1468 	/* Release our reference on the message tracker. */
1469 	if (chunk->msg)
1470 		sctp_datamsg_put(chunk->msg);
1471 
1472 	sctp_chunk_put(chunk);
1473 }
1474 
1475 /* Grab a reference to the chunk. */
1476 void sctp_chunk_hold(struct sctp_chunk *ch)
1477 {
1478 	refcount_inc(&ch->refcnt);
1479 }
1480 
1481 /* Release a reference to the chunk. */
1482 void sctp_chunk_put(struct sctp_chunk *ch)
1483 {
1484 	if (refcount_dec_and_test(&ch->refcnt))
1485 		sctp_chunk_destroy(ch);
1486 }
1487 
1488 /* Append bytes to the end of a chunk.  Will panic if chunk is not big
1489  * enough.
1490  */
1491 void *sctp_addto_chunk(struct sctp_chunk *chunk, int len, const void *data)
1492 {
1493 	int chunklen = ntohs(chunk->chunk_hdr->length);
1494 	int padlen = SCTP_PAD4(chunklen) - chunklen;
1495 	void *target;
1496 
1497 	skb_put_zero(chunk->skb, padlen);
1498 	target = skb_put_data(chunk->skb, data, len);
1499 
1500 	/* Adjust the chunk length field.  */
1501 	chunk->chunk_hdr->length = htons(chunklen + padlen + len);
1502 	chunk->chunk_end = skb_tail_pointer(chunk->skb);
1503 
1504 	return target;
1505 }
1506 
1507 /* Append bytes from user space to the end of a chunk.  Will panic if
1508  * chunk is not big enough.
1509  * Returns a kernel err value.
1510  */
1511 int sctp_user_addto_chunk(struct sctp_chunk *chunk, int len,
1512 			  struct iov_iter *from)
1513 {
1514 	void *target;
1515 
1516 	/* Make room in chunk for data.  */
1517 	target = skb_put(chunk->skb, len);
1518 
1519 	/* Copy data (whole iovec) into chunk */
1520 	if (!copy_from_iter_full(target, len, from))
1521 		return -EFAULT;
1522 
1523 	/* Adjust the chunk length field.  */
1524 	chunk->chunk_hdr->length =
1525 		htons(ntohs(chunk->chunk_hdr->length) + len);
1526 	chunk->chunk_end = skb_tail_pointer(chunk->skb);
1527 
1528 	return 0;
1529 }
1530 
1531 /* Helper function to assign a TSN if needed.  This assumes that both
1532  * the data_hdr and association have already been assigned.
1533  */
1534 void sctp_chunk_assign_ssn(struct sctp_chunk *chunk)
1535 {
1536 	struct sctp_stream *stream;
1537 	struct sctp_chunk *lchunk;
1538 	struct sctp_datamsg *msg;
1539 	__u16 ssn, sid;
1540 
1541 	if (chunk->has_ssn)
1542 		return;
1543 
1544 	/* All fragments will be on the same stream */
1545 	sid = ntohs(chunk->subh.data_hdr->stream);
1546 	stream = &chunk->asoc->stream;
1547 
1548 	/* Now assign the sequence number to the entire message.
1549 	 * All fragments must have the same stream sequence number.
1550 	 */
1551 	msg = chunk->msg;
1552 	list_for_each_entry(lchunk, &msg->chunks, frag_list) {
1553 		if (lchunk->chunk_hdr->flags & SCTP_DATA_UNORDERED) {
1554 			ssn = 0;
1555 		} else {
1556 			if (lchunk->chunk_hdr->flags & SCTP_DATA_LAST_FRAG)
1557 				ssn = sctp_ssn_next(stream, out, sid);
1558 			else
1559 				ssn = sctp_ssn_peek(stream, out, sid);
1560 		}
1561 
1562 		lchunk->subh.data_hdr->ssn = htons(ssn);
1563 		lchunk->has_ssn = 1;
1564 	}
1565 }
1566 
1567 /* Helper function to assign a TSN if needed.  This assumes that both
1568  * the data_hdr and association have already been assigned.
1569  */
1570 void sctp_chunk_assign_tsn(struct sctp_chunk *chunk)
1571 {
1572 	if (!chunk->has_tsn) {
1573 		/* This is the last possible instant to
1574 		 * assign a TSN.
1575 		 */
1576 		chunk->subh.data_hdr->tsn =
1577 			htonl(sctp_association_get_next_tsn(chunk->asoc));
1578 		chunk->has_tsn = 1;
1579 	}
1580 }
1581 
1582 /* Create a CLOSED association to use with an incoming packet.  */
1583 struct sctp_association *sctp_make_temp_asoc(const struct sctp_endpoint *ep,
1584 					     struct sctp_chunk *chunk,
1585 					     gfp_t gfp)
1586 {
1587 	struct sctp_association *asoc;
1588 	enum sctp_scope scope;
1589 	struct sk_buff *skb;
1590 
1591 	/* Create the bare association.  */
1592 	scope = sctp_scope(sctp_source(chunk));
1593 	asoc = sctp_association_new(ep, ep->base.sk, scope, gfp);
1594 	if (!asoc)
1595 		goto nodata;
1596 	asoc->temp = 1;
1597 	skb = chunk->skb;
1598 	/* Create an entry for the source address of the packet.  */
1599 	SCTP_INPUT_CB(skb)->af->from_skb(&asoc->c.peer_addr, skb, 1);
1600 
1601 nodata:
1602 	return asoc;
1603 }
1604 
1605 /* Build a cookie representing asoc.
1606  * This INCLUDES the param header needed to put the cookie in the INIT ACK.
1607  */
1608 static struct sctp_cookie_param *sctp_pack_cookie(
1609 					const struct sctp_endpoint *ep,
1610 					const struct sctp_association *asoc,
1611 					const struct sctp_chunk *init_chunk,
1612 					int *cookie_len, const __u8 *raw_addrs,
1613 					int addrs_len)
1614 {
1615 	struct sctp_signed_cookie *cookie;
1616 	struct sctp_cookie_param *retval;
1617 	int headersize, bodysize;
1618 
1619 	/* Header size is static data prior to the actual cookie, including
1620 	 * any padding.
1621 	 */
1622 	headersize = sizeof(struct sctp_paramhdr) +
1623 		     (sizeof(struct sctp_signed_cookie) -
1624 		      sizeof(struct sctp_cookie));
1625 	bodysize = sizeof(struct sctp_cookie)
1626 		+ ntohs(init_chunk->chunk_hdr->length) + addrs_len;
1627 
1628 	/* Pad out the cookie to a multiple to make the signature
1629 	 * functions simpler to write.
1630 	 */
1631 	if (bodysize % SCTP_COOKIE_MULTIPLE)
1632 		bodysize += SCTP_COOKIE_MULTIPLE
1633 			- (bodysize % SCTP_COOKIE_MULTIPLE);
1634 	*cookie_len = headersize + bodysize;
1635 
1636 	/* Clear this memory since we are sending this data structure
1637 	 * out on the network.
1638 	 */
1639 	retval = kzalloc(*cookie_len, GFP_ATOMIC);
1640 	if (!retval)
1641 		goto nodata;
1642 
1643 	cookie = (struct sctp_signed_cookie *) retval->body;
1644 
1645 	/* Set up the parameter header.  */
1646 	retval->p.type = SCTP_PARAM_STATE_COOKIE;
1647 	retval->p.length = htons(*cookie_len);
1648 
1649 	/* Copy the cookie part of the association itself.  */
1650 	cookie->c = asoc->c;
1651 	/* Save the raw address list length in the cookie. */
1652 	cookie->c.raw_addr_list_len = addrs_len;
1653 
1654 	/* Remember PR-SCTP capability. */
1655 	cookie->c.prsctp_capable = asoc->peer.prsctp_capable;
1656 
1657 	/* Save adaptation indication in the cookie. */
1658 	cookie->c.adaptation_ind = asoc->peer.adaptation_ind;
1659 
1660 	/* Set an expiration time for the cookie.  */
1661 	cookie->c.expiration = ktime_add(asoc->cookie_life,
1662 					 ktime_get_real());
1663 
1664 	/* Copy the peer's init packet.  */
1665 	memcpy(&cookie->c.peer_init[0], init_chunk->chunk_hdr,
1666 	       ntohs(init_chunk->chunk_hdr->length));
1667 
1668 	/* Copy the raw local address list of the association. */
1669 	memcpy((__u8 *)&cookie->c.peer_init[0] +
1670 	       ntohs(init_chunk->chunk_hdr->length), raw_addrs, addrs_len);
1671 
1672 	if (sctp_sk(ep->base.sk)->hmac) {
1673 		struct crypto_shash *tfm = sctp_sk(ep->base.sk)->hmac;
1674 		int err;
1675 
1676 		/* Sign the message.  */
1677 		err = crypto_shash_setkey(tfm, ep->secret_key,
1678 					  sizeof(ep->secret_key)) ?:
1679 		      crypto_shash_tfm_digest(tfm, (u8 *)&cookie->c, bodysize,
1680 					      cookie->signature);
1681 		if (err)
1682 			goto free_cookie;
1683 	}
1684 
1685 	return retval;
1686 
1687 free_cookie:
1688 	kfree(retval);
1689 nodata:
1690 	*cookie_len = 0;
1691 	return NULL;
1692 }
1693 
1694 /* Unpack the cookie from COOKIE ECHO chunk, recreating the association.  */
1695 struct sctp_association *sctp_unpack_cookie(
1696 					const struct sctp_endpoint *ep,
1697 					const struct sctp_association *asoc,
1698 					struct sctp_chunk *chunk, gfp_t gfp,
1699 					int *error, struct sctp_chunk **errp)
1700 {
1701 	struct sctp_association *retval = NULL;
1702 	int headersize, bodysize, fixed_size;
1703 	struct sctp_signed_cookie *cookie;
1704 	struct sk_buff *skb = chunk->skb;
1705 	struct sctp_cookie *bear_cookie;
1706 	__u8 *digest = ep->digest;
1707 	enum sctp_scope scope;
1708 	unsigned int len;
1709 	ktime_t kt;
1710 
1711 	/* Header size is static data prior to the actual cookie, including
1712 	 * any padding.
1713 	 */
1714 	headersize = sizeof(struct sctp_chunkhdr) +
1715 		     (sizeof(struct sctp_signed_cookie) -
1716 		      sizeof(struct sctp_cookie));
1717 	bodysize = ntohs(chunk->chunk_hdr->length) - headersize;
1718 	fixed_size = headersize + sizeof(struct sctp_cookie);
1719 
1720 	/* Verify that the chunk looks like it even has a cookie.
1721 	 * There must be enough room for our cookie and our peer's
1722 	 * INIT chunk.
1723 	 */
1724 	len = ntohs(chunk->chunk_hdr->length);
1725 	if (len < fixed_size + sizeof(struct sctp_chunkhdr))
1726 		goto malformed;
1727 
1728 	/* Verify that the cookie has been padded out. */
1729 	if (bodysize % SCTP_COOKIE_MULTIPLE)
1730 		goto malformed;
1731 
1732 	/* Process the cookie.  */
1733 	cookie = chunk->subh.cookie_hdr;
1734 	bear_cookie = &cookie->c;
1735 
1736 	if (!sctp_sk(ep->base.sk)->hmac)
1737 		goto no_hmac;
1738 
1739 	/* Check the signature.  */
1740 	{
1741 		struct crypto_shash *tfm = sctp_sk(ep->base.sk)->hmac;
1742 		int err;
1743 
1744 		err = crypto_shash_setkey(tfm, ep->secret_key,
1745 					  sizeof(ep->secret_key)) ?:
1746 		      crypto_shash_tfm_digest(tfm, (u8 *)bear_cookie, bodysize,
1747 					      digest);
1748 		if (err) {
1749 			*error = -SCTP_IERROR_NOMEM;
1750 			goto fail;
1751 		}
1752 	}
1753 
1754 	if (memcmp(digest, cookie->signature, SCTP_SIGNATURE_SIZE)) {
1755 		*error = -SCTP_IERROR_BAD_SIG;
1756 		goto fail;
1757 	}
1758 
1759 no_hmac:
1760 	/* IG Section 2.35.2:
1761 	 *  3) Compare the port numbers and the verification tag contained
1762 	 *     within the COOKIE ECHO chunk to the actual port numbers and the
1763 	 *     verification tag within the SCTP common header of the received
1764 	 *     packet. If these values do not match the packet MUST be silently
1765 	 *     discarded,
1766 	 */
1767 	if (ntohl(chunk->sctp_hdr->vtag) != bear_cookie->my_vtag) {
1768 		*error = -SCTP_IERROR_BAD_TAG;
1769 		goto fail;
1770 	}
1771 
1772 	if (chunk->sctp_hdr->source != bear_cookie->peer_addr.v4.sin_port ||
1773 	    ntohs(chunk->sctp_hdr->dest) != bear_cookie->my_port) {
1774 		*error = -SCTP_IERROR_BAD_PORTS;
1775 		goto fail;
1776 	}
1777 
1778 	/* Check to see if the cookie is stale.  If there is already
1779 	 * an association, there is no need to check cookie's expiration
1780 	 * for init collision case of lost COOKIE ACK.
1781 	 * If skb has been timestamped, then use the stamp, otherwise
1782 	 * use current time.  This introduces a small possibility that
1783 	 * that a cookie may be considered expired, but his would only slow
1784 	 * down the new association establishment instead of every packet.
1785 	 */
1786 	if (sock_flag(ep->base.sk, SOCK_TIMESTAMP))
1787 		kt = skb_get_ktime(skb);
1788 	else
1789 		kt = ktime_get_real();
1790 
1791 	if (!asoc && ktime_before(bear_cookie->expiration, kt)) {
1792 		suseconds_t usecs = ktime_to_us(ktime_sub(kt, bear_cookie->expiration));
1793 		__be32 n = htonl(usecs);
1794 
1795 		/*
1796 		 * Section 3.3.10.3 Stale Cookie Error (3)
1797 		 *
1798 		 * Cause of error
1799 		 * ---------------
1800 		 * Stale Cookie Error:  Indicates the receipt of a valid State
1801 		 * Cookie that has expired.
1802 		 */
1803 		*errp = sctp_make_op_error(asoc, chunk,
1804 					   SCTP_ERROR_STALE_COOKIE, &n,
1805 					   sizeof(n), 0);
1806 		if (*errp)
1807 			*error = -SCTP_IERROR_STALE_COOKIE;
1808 		else
1809 			*error = -SCTP_IERROR_NOMEM;
1810 
1811 		goto fail;
1812 	}
1813 
1814 	/* Make a new base association.  */
1815 	scope = sctp_scope(sctp_source(chunk));
1816 	retval = sctp_association_new(ep, ep->base.sk, scope, gfp);
1817 	if (!retval) {
1818 		*error = -SCTP_IERROR_NOMEM;
1819 		goto fail;
1820 	}
1821 
1822 	/* Set up our peer's port number.  */
1823 	retval->peer.port = ntohs(chunk->sctp_hdr->source);
1824 
1825 	/* Populate the association from the cookie.  */
1826 	memcpy(&retval->c, bear_cookie, sizeof(*bear_cookie));
1827 
1828 	if (sctp_assoc_set_bind_addr_from_cookie(retval, bear_cookie,
1829 						 GFP_ATOMIC) < 0) {
1830 		*error = -SCTP_IERROR_NOMEM;
1831 		goto fail;
1832 	}
1833 
1834 	/* Also, add the destination address. */
1835 	if (list_empty(&retval->base.bind_addr.address_list)) {
1836 		sctp_add_bind_addr(&retval->base.bind_addr, &chunk->dest,
1837 				   sizeof(chunk->dest), SCTP_ADDR_SRC,
1838 				   GFP_ATOMIC);
1839 	}
1840 
1841 	retval->next_tsn = retval->c.initial_tsn;
1842 	retval->ctsn_ack_point = retval->next_tsn - 1;
1843 	retval->addip_serial = retval->c.initial_tsn;
1844 	retval->strreset_outseq = retval->c.initial_tsn;
1845 	retval->adv_peer_ack_point = retval->ctsn_ack_point;
1846 	retval->peer.prsctp_capable = retval->c.prsctp_capable;
1847 	retval->peer.adaptation_ind = retval->c.adaptation_ind;
1848 
1849 	/* The INIT stuff will be done by the side effects.  */
1850 	return retval;
1851 
1852 fail:
1853 	if (retval)
1854 		sctp_association_free(retval);
1855 
1856 	return NULL;
1857 
1858 malformed:
1859 	/* Yikes!  The packet is either corrupt or deliberately
1860 	 * malformed.
1861 	 */
1862 	*error = -SCTP_IERROR_MALFORMED;
1863 	goto fail;
1864 }
1865 
1866 /********************************************************************
1867  * 3rd Level Abstractions
1868  ********************************************************************/
1869 
1870 struct __sctp_missing {
1871 	__be32 num_missing;
1872 	__be16 type;
1873 }  __packed;
1874 
1875 /*
1876  * Report a missing mandatory parameter.
1877  */
1878 static int sctp_process_missing_param(const struct sctp_association *asoc,
1879 				      enum sctp_param paramtype,
1880 				      struct sctp_chunk *chunk,
1881 				      struct sctp_chunk **errp)
1882 {
1883 	struct __sctp_missing report;
1884 	__u16 len;
1885 
1886 	len = SCTP_PAD4(sizeof(report));
1887 
1888 	/* Make an ERROR chunk, preparing enough room for
1889 	 * returning multiple unknown parameters.
1890 	 */
1891 	if (!*errp)
1892 		*errp = sctp_make_op_error_space(asoc, chunk, len);
1893 
1894 	if (*errp) {
1895 		report.num_missing = htonl(1);
1896 		report.type = paramtype;
1897 		sctp_init_cause(*errp, SCTP_ERROR_MISS_PARAM,
1898 				sizeof(report));
1899 		sctp_addto_chunk(*errp, sizeof(report), &report);
1900 	}
1901 
1902 	/* Stop processing this chunk. */
1903 	return 0;
1904 }
1905 
1906 /* Report an Invalid Mandatory Parameter.  */
1907 static int sctp_process_inv_mandatory(const struct sctp_association *asoc,
1908 				      struct sctp_chunk *chunk,
1909 				      struct sctp_chunk **errp)
1910 {
1911 	/* Invalid Mandatory Parameter Error has no payload. */
1912 
1913 	if (!*errp)
1914 		*errp = sctp_make_op_error_space(asoc, chunk, 0);
1915 
1916 	if (*errp)
1917 		sctp_init_cause(*errp, SCTP_ERROR_INV_PARAM, 0);
1918 
1919 	/* Stop processing this chunk. */
1920 	return 0;
1921 }
1922 
1923 static int sctp_process_inv_paramlength(const struct sctp_association *asoc,
1924 					struct sctp_paramhdr *param,
1925 					const struct sctp_chunk *chunk,
1926 					struct sctp_chunk **errp)
1927 {
1928 	/* This is a fatal error.  Any accumulated non-fatal errors are
1929 	 * not reported.
1930 	 */
1931 	if (*errp)
1932 		sctp_chunk_free(*errp);
1933 
1934 	/* Create an error chunk and fill it in with our payload. */
1935 	*errp = sctp_make_violation_paramlen(asoc, chunk, param);
1936 
1937 	return 0;
1938 }
1939 
1940 
1941 /* Do not attempt to handle the HOST_NAME parm.  However, do
1942  * send back an indicator to the peer.
1943  */
1944 static int sctp_process_hn_param(const struct sctp_association *asoc,
1945 				 union sctp_params param,
1946 				 struct sctp_chunk *chunk,
1947 				 struct sctp_chunk **errp)
1948 {
1949 	__u16 len = ntohs(param.p->length);
1950 
1951 	/* Processing of the HOST_NAME parameter will generate an
1952 	 * ABORT.  If we've accumulated any non-fatal errors, they
1953 	 * would be unrecognized parameters and we should not include
1954 	 * them in the ABORT.
1955 	 */
1956 	if (*errp)
1957 		sctp_chunk_free(*errp);
1958 
1959 	*errp = sctp_make_op_error(asoc, chunk, SCTP_ERROR_DNS_FAILED,
1960 				   param.v, len, 0);
1961 
1962 	/* Stop processing this chunk. */
1963 	return 0;
1964 }
1965 
1966 static int sctp_verify_ext_param(struct net *net,
1967 				 const struct sctp_endpoint *ep,
1968 				 union sctp_params param)
1969 {
1970 	__u16 num_ext = ntohs(param.p->length) - sizeof(struct sctp_paramhdr);
1971 	int have_asconf = 0;
1972 	int have_auth = 0;
1973 	int i;
1974 
1975 	for (i = 0; i < num_ext; i++) {
1976 		switch (param.ext->chunks[i]) {
1977 		case SCTP_CID_AUTH:
1978 			have_auth = 1;
1979 			break;
1980 		case SCTP_CID_ASCONF:
1981 		case SCTP_CID_ASCONF_ACK:
1982 			have_asconf = 1;
1983 			break;
1984 		}
1985 	}
1986 
1987 	/* ADD-IP Security: The draft requires us to ABORT or ignore the
1988 	 * INIT/INIT-ACK if ADD-IP is listed, but AUTH is not.  Do this
1989 	 * only if ADD-IP is turned on and we are not backward-compatible
1990 	 * mode.
1991 	 */
1992 	if (net->sctp.addip_noauth)
1993 		return 1;
1994 
1995 	if (ep->asconf_enable && !have_auth && have_asconf)
1996 		return 0;
1997 
1998 	return 1;
1999 }
2000 
2001 static void sctp_process_ext_param(struct sctp_association *asoc,
2002 				   union sctp_params param)
2003 {
2004 	__u16 num_ext = ntohs(param.p->length) - sizeof(struct sctp_paramhdr);
2005 	int i;
2006 
2007 	for (i = 0; i < num_ext; i++) {
2008 		switch (param.ext->chunks[i]) {
2009 		case SCTP_CID_RECONF:
2010 			if (asoc->ep->reconf_enable)
2011 				asoc->peer.reconf_capable = 1;
2012 			break;
2013 		case SCTP_CID_FWD_TSN:
2014 			if (asoc->ep->prsctp_enable)
2015 				asoc->peer.prsctp_capable = 1;
2016 			break;
2017 		case SCTP_CID_AUTH:
2018 			/* if the peer reports AUTH, assume that he
2019 			 * supports AUTH.
2020 			 */
2021 			if (asoc->ep->auth_enable)
2022 				asoc->peer.auth_capable = 1;
2023 			break;
2024 		case SCTP_CID_ASCONF:
2025 		case SCTP_CID_ASCONF_ACK:
2026 			if (asoc->ep->asconf_enable)
2027 				asoc->peer.asconf_capable = 1;
2028 			break;
2029 		case SCTP_CID_I_DATA:
2030 			if (asoc->ep->intl_enable)
2031 				asoc->peer.intl_capable = 1;
2032 			break;
2033 		default:
2034 			break;
2035 		}
2036 	}
2037 }
2038 
2039 /* RFC 3.2.1 & the Implementers Guide 2.2.
2040  *
2041  * The Parameter Types are encoded such that the
2042  * highest-order two bits specify the action that must be
2043  * taken if the processing endpoint does not recognize the
2044  * Parameter Type.
2045  *
2046  * 00 - Stop processing this parameter; do not process any further
2047  * 	parameters within this chunk
2048  *
2049  * 01 - Stop processing this parameter, do not process any further
2050  *	parameters within this chunk, and report the unrecognized
2051  *	parameter in an 'Unrecognized Parameter' ERROR chunk.
2052  *
2053  * 10 - Skip this parameter and continue processing.
2054  *
2055  * 11 - Skip this parameter and continue processing but
2056  *	report the unrecognized parameter in an
2057  *	'Unrecognized Parameter' ERROR chunk.
2058  *
2059  * Return value:
2060  * 	SCTP_IERROR_NO_ERROR - continue with the chunk
2061  * 	SCTP_IERROR_ERROR    - stop and report an error.
2062  * 	SCTP_IERROR_NOMEME   - out of memory.
2063  */
2064 static enum sctp_ierror sctp_process_unk_param(
2065 					const struct sctp_association *asoc,
2066 					union sctp_params param,
2067 					struct sctp_chunk *chunk,
2068 					struct sctp_chunk **errp)
2069 {
2070 	int retval = SCTP_IERROR_NO_ERROR;
2071 
2072 	switch (param.p->type & SCTP_PARAM_ACTION_MASK) {
2073 	case SCTP_PARAM_ACTION_DISCARD:
2074 		retval =  SCTP_IERROR_ERROR;
2075 		break;
2076 	case SCTP_PARAM_ACTION_SKIP:
2077 		break;
2078 	case SCTP_PARAM_ACTION_DISCARD_ERR:
2079 		retval =  SCTP_IERROR_ERROR;
2080 		fallthrough;
2081 	case SCTP_PARAM_ACTION_SKIP_ERR:
2082 		/* Make an ERROR chunk, preparing enough room for
2083 		 * returning multiple unknown parameters.
2084 		 */
2085 		if (!*errp) {
2086 			*errp = sctp_make_op_error_limited(asoc, chunk);
2087 			if (!*errp) {
2088 				/* If there is no memory for generating the
2089 				 * ERROR report as specified, an ABORT will be
2090 				 * triggered to the peer and the association
2091 				 * won't be established.
2092 				 */
2093 				retval = SCTP_IERROR_NOMEM;
2094 				break;
2095 			}
2096 		}
2097 
2098 		if (!sctp_init_cause(*errp, SCTP_ERROR_UNKNOWN_PARAM,
2099 				     ntohs(param.p->length)))
2100 			sctp_addto_chunk(*errp, ntohs(param.p->length),
2101 					 param.v);
2102 		break;
2103 	default:
2104 		break;
2105 	}
2106 
2107 	return retval;
2108 }
2109 
2110 /* Verify variable length parameters
2111  * Return values:
2112  * 	SCTP_IERROR_ABORT - trigger an ABORT
2113  * 	SCTP_IERROR_NOMEM - out of memory (abort)
2114  *	SCTP_IERROR_ERROR - stop processing, trigger an ERROR
2115  * 	SCTP_IERROR_NO_ERROR - continue with the chunk
2116  */
2117 static enum sctp_ierror sctp_verify_param(struct net *net,
2118 					  const struct sctp_endpoint *ep,
2119 					  const struct sctp_association *asoc,
2120 					  union sctp_params param,
2121 					  enum sctp_cid cid,
2122 					  struct sctp_chunk *chunk,
2123 					  struct sctp_chunk **err_chunk)
2124 {
2125 	struct sctp_hmac_algo_param *hmacs;
2126 	int retval = SCTP_IERROR_NO_ERROR;
2127 	__u16 n_elt, id = 0;
2128 	int i;
2129 
2130 	/* FIXME - This routine is not looking at each parameter per the
2131 	 * chunk type, i.e., unrecognized parameters should be further
2132 	 * identified based on the chunk id.
2133 	 */
2134 
2135 	switch (param.p->type) {
2136 	case SCTP_PARAM_IPV4_ADDRESS:
2137 	case SCTP_PARAM_IPV6_ADDRESS:
2138 	case SCTP_PARAM_COOKIE_PRESERVATIVE:
2139 	case SCTP_PARAM_SUPPORTED_ADDRESS_TYPES:
2140 	case SCTP_PARAM_STATE_COOKIE:
2141 	case SCTP_PARAM_HEARTBEAT_INFO:
2142 	case SCTP_PARAM_UNRECOGNIZED_PARAMETERS:
2143 	case SCTP_PARAM_ECN_CAPABLE:
2144 	case SCTP_PARAM_ADAPTATION_LAYER_IND:
2145 		break;
2146 
2147 	case SCTP_PARAM_SUPPORTED_EXT:
2148 		if (!sctp_verify_ext_param(net, ep, param))
2149 			return SCTP_IERROR_ABORT;
2150 		break;
2151 
2152 	case SCTP_PARAM_SET_PRIMARY:
2153 		if (ep->asconf_enable)
2154 			break;
2155 		goto unhandled;
2156 
2157 	case SCTP_PARAM_HOST_NAME_ADDRESS:
2158 		/* Tell the peer, we won't support this param.  */
2159 		sctp_process_hn_param(asoc, param, chunk, err_chunk);
2160 		retval = SCTP_IERROR_ABORT;
2161 		break;
2162 
2163 	case SCTP_PARAM_FWD_TSN_SUPPORT:
2164 		if (ep->prsctp_enable)
2165 			break;
2166 		goto unhandled;
2167 
2168 	case SCTP_PARAM_RANDOM:
2169 		if (!ep->auth_enable)
2170 			goto unhandled;
2171 
2172 		/* SCTP-AUTH: Secion 6.1
2173 		 * If the random number is not 32 byte long the association
2174 		 * MUST be aborted.  The ABORT chunk SHOULD contain the error
2175 		 * cause 'Protocol Violation'.
2176 		 */
2177 		if (SCTP_AUTH_RANDOM_LENGTH != ntohs(param.p->length) -
2178 					       sizeof(struct sctp_paramhdr)) {
2179 			sctp_process_inv_paramlength(asoc, param.p,
2180 						     chunk, err_chunk);
2181 			retval = SCTP_IERROR_ABORT;
2182 		}
2183 		break;
2184 
2185 	case SCTP_PARAM_CHUNKS:
2186 		if (!ep->auth_enable)
2187 			goto unhandled;
2188 
2189 		/* SCTP-AUTH: Section 3.2
2190 		 * The CHUNKS parameter MUST be included once in the INIT or
2191 		 *  INIT-ACK chunk if the sender wants to receive authenticated
2192 		 *  chunks.  Its maximum length is 260 bytes.
2193 		 */
2194 		if (260 < ntohs(param.p->length)) {
2195 			sctp_process_inv_paramlength(asoc, param.p,
2196 						     chunk, err_chunk);
2197 			retval = SCTP_IERROR_ABORT;
2198 		}
2199 		break;
2200 
2201 	case SCTP_PARAM_HMAC_ALGO:
2202 		if (!ep->auth_enable)
2203 			goto unhandled;
2204 
2205 		hmacs = (struct sctp_hmac_algo_param *)param.p;
2206 		n_elt = (ntohs(param.p->length) -
2207 			 sizeof(struct sctp_paramhdr)) >> 1;
2208 
2209 		/* SCTP-AUTH: Section 6.1
2210 		 * The HMAC algorithm based on SHA-1 MUST be supported and
2211 		 * included in the HMAC-ALGO parameter.
2212 		 */
2213 		for (i = 0; i < n_elt; i++) {
2214 			id = ntohs(hmacs->hmac_ids[i]);
2215 
2216 			if (id == SCTP_AUTH_HMAC_ID_SHA1)
2217 				break;
2218 		}
2219 
2220 		if (id != SCTP_AUTH_HMAC_ID_SHA1) {
2221 			sctp_process_inv_paramlength(asoc, param.p, chunk,
2222 						     err_chunk);
2223 			retval = SCTP_IERROR_ABORT;
2224 		}
2225 		break;
2226 unhandled:
2227 	default:
2228 		pr_debug("%s: unrecognized param:%d for chunk:%d\n",
2229 			 __func__, ntohs(param.p->type), cid);
2230 
2231 		retval = sctp_process_unk_param(asoc, param, chunk, err_chunk);
2232 		break;
2233 	}
2234 	return retval;
2235 }
2236 
2237 /* Verify the INIT packet before we process it.  */
2238 int sctp_verify_init(struct net *net, const struct sctp_endpoint *ep,
2239 		     const struct sctp_association *asoc, enum sctp_cid cid,
2240 		     struct sctp_init_chunk *peer_init,
2241 		     struct sctp_chunk *chunk, struct sctp_chunk **errp)
2242 {
2243 	union sctp_params param;
2244 	bool has_cookie = false;
2245 	int result;
2246 
2247 	/* Check for missing mandatory parameters. Note: Initial TSN is
2248 	 * also mandatory, but is not checked here since the valid range
2249 	 * is 0..2**32-1. RFC4960, section 3.3.3.
2250 	 */
2251 	if (peer_init->init_hdr.num_outbound_streams == 0 ||
2252 	    peer_init->init_hdr.num_inbound_streams == 0 ||
2253 	    peer_init->init_hdr.init_tag == 0 ||
2254 	    ntohl(peer_init->init_hdr.a_rwnd) < SCTP_DEFAULT_MINWINDOW)
2255 		return sctp_process_inv_mandatory(asoc, chunk, errp);
2256 
2257 	sctp_walk_params(param, peer_init, init_hdr.params) {
2258 		if (param.p->type == SCTP_PARAM_STATE_COOKIE)
2259 			has_cookie = true;
2260 	}
2261 
2262 	/* There is a possibility that a parameter length was bad and
2263 	 * in that case we would have stoped walking the parameters.
2264 	 * The current param.p would point at the bad one.
2265 	 * Current consensus on the mailing list is to generate a PROTOCOL
2266 	 * VIOLATION error.  We build the ERROR chunk here and let the normal
2267 	 * error handling code build and send the packet.
2268 	 */
2269 	if (param.v != (void *)chunk->chunk_end)
2270 		return sctp_process_inv_paramlength(asoc, param.p, chunk, errp);
2271 
2272 	/* The only missing mandatory param possible today is
2273 	 * the state cookie for an INIT-ACK chunk.
2274 	 */
2275 	if ((SCTP_CID_INIT_ACK == cid) && !has_cookie)
2276 		return sctp_process_missing_param(asoc, SCTP_PARAM_STATE_COOKIE,
2277 						  chunk, errp);
2278 
2279 	/* Verify all the variable length parameters */
2280 	sctp_walk_params(param, peer_init, init_hdr.params) {
2281 		result = sctp_verify_param(net, ep, asoc, param, cid,
2282 					   chunk, errp);
2283 		switch (result) {
2284 		case SCTP_IERROR_ABORT:
2285 		case SCTP_IERROR_NOMEM:
2286 			return 0;
2287 		case SCTP_IERROR_ERROR:
2288 			return 1;
2289 		case SCTP_IERROR_NO_ERROR:
2290 		default:
2291 			break;
2292 		}
2293 
2294 	} /* for (loop through all parameters) */
2295 
2296 	return 1;
2297 }
2298 
2299 /* Unpack the parameters in an INIT packet into an association.
2300  * Returns 0 on failure, else success.
2301  * FIXME:  This is an association method.
2302  */
2303 int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk,
2304 		      const union sctp_addr *peer_addr,
2305 		      struct sctp_init_chunk *peer_init, gfp_t gfp)
2306 {
2307 	struct sctp_transport *transport;
2308 	struct list_head *pos, *temp;
2309 	union sctp_params param;
2310 	union sctp_addr addr;
2311 	struct sctp_af *af;
2312 	int src_match = 0;
2313 
2314 	/* We must include the address that the INIT packet came from.
2315 	 * This is the only address that matters for an INIT packet.
2316 	 * When processing a COOKIE ECHO, we retrieve the from address
2317 	 * of the INIT from the cookie.
2318 	 */
2319 
2320 	/* This implementation defaults to making the first transport
2321 	 * added as the primary transport.  The source address seems to
2322 	 * be a a better choice than any of the embedded addresses.
2323 	 */
2324 	if (!sctp_assoc_add_peer(asoc, peer_addr, gfp, SCTP_ACTIVE))
2325 		goto nomem;
2326 
2327 	if (sctp_cmp_addr_exact(sctp_source(chunk), peer_addr))
2328 		src_match = 1;
2329 
2330 	/* Process the initialization parameters.  */
2331 	sctp_walk_params(param, peer_init, init_hdr.params) {
2332 		if (!src_match && (param.p->type == SCTP_PARAM_IPV4_ADDRESS ||
2333 		    param.p->type == SCTP_PARAM_IPV6_ADDRESS)) {
2334 			af = sctp_get_af_specific(param_type2af(param.p->type));
2335 			af->from_addr_param(&addr, param.addr,
2336 					    chunk->sctp_hdr->source, 0);
2337 			if (sctp_cmp_addr_exact(sctp_source(chunk), &addr))
2338 				src_match = 1;
2339 		}
2340 
2341 		if (!sctp_process_param(asoc, param, peer_addr, gfp))
2342 			goto clean_up;
2343 	}
2344 
2345 	/* source address of chunk may not match any valid address */
2346 	if (!src_match)
2347 		goto clean_up;
2348 
2349 	/* AUTH: After processing the parameters, make sure that we
2350 	 * have all the required info to potentially do authentications.
2351 	 */
2352 	if (asoc->peer.auth_capable && (!asoc->peer.peer_random ||
2353 					!asoc->peer.peer_hmacs))
2354 		asoc->peer.auth_capable = 0;
2355 
2356 	/* In a non-backward compatible mode, if the peer claims
2357 	 * support for ADD-IP but not AUTH,  the ADD-IP spec states
2358 	 * that we MUST ABORT the association. Section 6.  The section
2359 	 * also give us an option to silently ignore the packet, which
2360 	 * is what we'll do here.
2361 	 */
2362 	if (!asoc->base.net->sctp.addip_noauth &&
2363 	    (asoc->peer.asconf_capable && !asoc->peer.auth_capable)) {
2364 		asoc->peer.addip_disabled_mask |= (SCTP_PARAM_ADD_IP |
2365 						  SCTP_PARAM_DEL_IP |
2366 						  SCTP_PARAM_SET_PRIMARY);
2367 		asoc->peer.asconf_capable = 0;
2368 		goto clean_up;
2369 	}
2370 
2371 	/* Walk list of transports, removing transports in the UNKNOWN state. */
2372 	list_for_each_safe(pos, temp, &asoc->peer.transport_addr_list) {
2373 		transport = list_entry(pos, struct sctp_transport, transports);
2374 		if (transport->state == SCTP_UNKNOWN) {
2375 			sctp_assoc_rm_peer(asoc, transport);
2376 		}
2377 	}
2378 
2379 	/* The fixed INIT headers are always in network byte
2380 	 * order.
2381 	 */
2382 	asoc->peer.i.init_tag =
2383 		ntohl(peer_init->init_hdr.init_tag);
2384 	asoc->peer.i.a_rwnd =
2385 		ntohl(peer_init->init_hdr.a_rwnd);
2386 	asoc->peer.i.num_outbound_streams =
2387 		ntohs(peer_init->init_hdr.num_outbound_streams);
2388 	asoc->peer.i.num_inbound_streams =
2389 		ntohs(peer_init->init_hdr.num_inbound_streams);
2390 	asoc->peer.i.initial_tsn =
2391 		ntohl(peer_init->init_hdr.initial_tsn);
2392 
2393 	asoc->strreset_inseq = asoc->peer.i.initial_tsn;
2394 
2395 	/* Apply the upper bounds for output streams based on peer's
2396 	 * number of inbound streams.
2397 	 */
2398 	if (asoc->c.sinit_num_ostreams  >
2399 	    ntohs(peer_init->init_hdr.num_inbound_streams)) {
2400 		asoc->c.sinit_num_ostreams =
2401 			ntohs(peer_init->init_hdr.num_inbound_streams);
2402 	}
2403 
2404 	if (asoc->c.sinit_max_instreams >
2405 	    ntohs(peer_init->init_hdr.num_outbound_streams)) {
2406 		asoc->c.sinit_max_instreams =
2407 			ntohs(peer_init->init_hdr.num_outbound_streams);
2408 	}
2409 
2410 	/* Copy Initiation tag from INIT to VT_peer in cookie.   */
2411 	asoc->c.peer_vtag = asoc->peer.i.init_tag;
2412 
2413 	/* Peer Rwnd   : Current calculated value of the peer's rwnd.  */
2414 	asoc->peer.rwnd = asoc->peer.i.a_rwnd;
2415 
2416 	/* RFC 2960 7.2.1 The initial value of ssthresh MAY be arbitrarily
2417 	 * high (for example, implementations MAY use the size of the receiver
2418 	 * advertised window).
2419 	 */
2420 	list_for_each_entry(transport, &asoc->peer.transport_addr_list,
2421 			transports) {
2422 		transport->ssthresh = asoc->peer.i.a_rwnd;
2423 	}
2424 
2425 	/* Set up the TSN tracking pieces.  */
2426 	if (!sctp_tsnmap_init(&asoc->peer.tsn_map, SCTP_TSN_MAP_INITIAL,
2427 				asoc->peer.i.initial_tsn, gfp))
2428 		goto clean_up;
2429 
2430 	/* RFC 2960 6.5 Stream Identifier and Stream Sequence Number
2431 	 *
2432 	 * The stream sequence number in all the streams shall start
2433 	 * from 0 when the association is established.  Also, when the
2434 	 * stream sequence number reaches the value 65535 the next
2435 	 * stream sequence number shall be set to 0.
2436 	 */
2437 
2438 	if (sctp_stream_init(&asoc->stream, asoc->c.sinit_num_ostreams,
2439 			     asoc->c.sinit_max_instreams, gfp))
2440 		goto clean_up;
2441 
2442 	/* Update frag_point when stream_interleave may get changed. */
2443 	sctp_assoc_update_frag_point(asoc);
2444 
2445 	if (!asoc->temp && sctp_assoc_set_id(asoc, gfp))
2446 		goto clean_up;
2447 
2448 	/* ADDIP Section 4.1 ASCONF Chunk Procedures
2449 	 *
2450 	 * When an endpoint has an ASCONF signaled change to be sent to the
2451 	 * remote endpoint it should do the following:
2452 	 * ...
2453 	 * A2) A serial number should be assigned to the Chunk. The serial
2454 	 * number should be a monotonically increasing number. All serial
2455 	 * numbers are defined to be initialized at the start of the
2456 	 * association to the same value as the Initial TSN.
2457 	 */
2458 	asoc->peer.addip_serial = asoc->peer.i.initial_tsn - 1;
2459 	return 1;
2460 
2461 clean_up:
2462 	/* Release the transport structures. */
2463 	list_for_each_safe(pos, temp, &asoc->peer.transport_addr_list) {
2464 		transport = list_entry(pos, struct sctp_transport, transports);
2465 		if (transport->state != SCTP_ACTIVE)
2466 			sctp_assoc_rm_peer(asoc, transport);
2467 	}
2468 
2469 nomem:
2470 	return 0;
2471 }
2472 
2473 
2474 /* Update asoc with the option described in param.
2475  *
2476  * RFC2960 3.3.2.1 Optional/Variable Length Parameters in INIT
2477  *
2478  * asoc is the association to update.
2479  * param is the variable length parameter to use for update.
2480  * cid tells us if this is an INIT, INIT ACK or COOKIE ECHO.
2481  * If the current packet is an INIT we want to minimize the amount of
2482  * work we do.  In particular, we should not build transport
2483  * structures for the addresses.
2484  */
2485 static int sctp_process_param(struct sctp_association *asoc,
2486 			      union sctp_params param,
2487 			      const union sctp_addr *peer_addr,
2488 			      gfp_t gfp)
2489 {
2490 	struct sctp_endpoint *ep = asoc->ep;
2491 	union sctp_addr_param *addr_param;
2492 	struct net *net = asoc->base.net;
2493 	struct sctp_transport *t;
2494 	enum sctp_scope scope;
2495 	union sctp_addr addr;
2496 	struct sctp_af *af;
2497 	int retval = 1, i;
2498 	u32 stale;
2499 	__u16 sat;
2500 
2501 	/* We maintain all INIT parameters in network byte order all the
2502 	 * time.  This allows us to not worry about whether the parameters
2503 	 * came from a fresh INIT, and INIT ACK, or were stored in a cookie.
2504 	 */
2505 	switch (param.p->type) {
2506 	case SCTP_PARAM_IPV6_ADDRESS:
2507 		if (PF_INET6 != asoc->base.sk->sk_family)
2508 			break;
2509 		goto do_addr_param;
2510 
2511 	case SCTP_PARAM_IPV4_ADDRESS:
2512 		/* v4 addresses are not allowed on v6-only socket */
2513 		if (ipv6_only_sock(asoc->base.sk))
2514 			break;
2515 do_addr_param:
2516 		af = sctp_get_af_specific(param_type2af(param.p->type));
2517 		af->from_addr_param(&addr, param.addr, htons(asoc->peer.port), 0);
2518 		scope = sctp_scope(peer_addr);
2519 		if (sctp_in_scope(net, &addr, scope))
2520 			if (!sctp_assoc_add_peer(asoc, &addr, gfp, SCTP_UNCONFIRMED))
2521 				return 0;
2522 		break;
2523 
2524 	case SCTP_PARAM_COOKIE_PRESERVATIVE:
2525 		if (!net->sctp.cookie_preserve_enable)
2526 			break;
2527 
2528 		stale = ntohl(param.life->lifespan_increment);
2529 
2530 		/* Suggested Cookie Life span increment's unit is msec,
2531 		 * (1/1000sec).
2532 		 */
2533 		asoc->cookie_life = ktime_add_ms(asoc->cookie_life, stale);
2534 		break;
2535 
2536 	case SCTP_PARAM_HOST_NAME_ADDRESS:
2537 		pr_debug("%s: unimplemented SCTP_HOST_NAME_ADDRESS\n", __func__);
2538 		break;
2539 
2540 	case SCTP_PARAM_SUPPORTED_ADDRESS_TYPES:
2541 		/* Turn off the default values first so we'll know which
2542 		 * ones are really set by the peer.
2543 		 */
2544 		asoc->peer.ipv4_address = 0;
2545 		asoc->peer.ipv6_address = 0;
2546 
2547 		/* Assume that peer supports the address family
2548 		 * by which it sends a packet.
2549 		 */
2550 		if (peer_addr->sa.sa_family == AF_INET6)
2551 			asoc->peer.ipv6_address = 1;
2552 		else if (peer_addr->sa.sa_family == AF_INET)
2553 			asoc->peer.ipv4_address = 1;
2554 
2555 		/* Cycle through address types; avoid divide by 0. */
2556 		sat = ntohs(param.p->length) - sizeof(struct sctp_paramhdr);
2557 		if (sat)
2558 			sat /= sizeof(__u16);
2559 
2560 		for (i = 0; i < sat; ++i) {
2561 			switch (param.sat->types[i]) {
2562 			case SCTP_PARAM_IPV4_ADDRESS:
2563 				asoc->peer.ipv4_address = 1;
2564 				break;
2565 
2566 			case SCTP_PARAM_IPV6_ADDRESS:
2567 				if (PF_INET6 == asoc->base.sk->sk_family)
2568 					asoc->peer.ipv6_address = 1;
2569 				break;
2570 
2571 			case SCTP_PARAM_HOST_NAME_ADDRESS:
2572 				asoc->peer.hostname_address = 1;
2573 				break;
2574 
2575 			default: /* Just ignore anything else.  */
2576 				break;
2577 			}
2578 		}
2579 		break;
2580 
2581 	case SCTP_PARAM_STATE_COOKIE:
2582 		asoc->peer.cookie_len =
2583 			ntohs(param.p->length) - sizeof(struct sctp_paramhdr);
2584 		kfree(asoc->peer.cookie);
2585 		asoc->peer.cookie = kmemdup(param.cookie->body, asoc->peer.cookie_len, gfp);
2586 		if (!asoc->peer.cookie)
2587 			retval = 0;
2588 		break;
2589 
2590 	case SCTP_PARAM_HEARTBEAT_INFO:
2591 		/* Would be odd to receive, but it causes no problems. */
2592 		break;
2593 
2594 	case SCTP_PARAM_UNRECOGNIZED_PARAMETERS:
2595 		/* Rejected during verify stage. */
2596 		break;
2597 
2598 	case SCTP_PARAM_ECN_CAPABLE:
2599 		if (asoc->ep->ecn_enable) {
2600 			asoc->peer.ecn_capable = 1;
2601 			break;
2602 		}
2603 		/* Fall Through */
2604 		goto fall_through;
2605 
2606 
2607 	case SCTP_PARAM_ADAPTATION_LAYER_IND:
2608 		asoc->peer.adaptation_ind = ntohl(param.aind->adaptation_ind);
2609 		break;
2610 
2611 	case SCTP_PARAM_SET_PRIMARY:
2612 		if (!ep->asconf_enable)
2613 			goto fall_through;
2614 
2615 		addr_param = param.v + sizeof(struct sctp_addip_param);
2616 
2617 		af = sctp_get_af_specific(param_type2af(addr_param->p.type));
2618 		if (af == NULL)
2619 			break;
2620 
2621 		af->from_addr_param(&addr, addr_param,
2622 				    htons(asoc->peer.port), 0);
2623 
2624 		/* if the address is invalid, we can't process it.
2625 		 * XXX: see spec for what to do.
2626 		 */
2627 		if (!af->addr_valid(&addr, NULL, NULL))
2628 			break;
2629 
2630 		t = sctp_assoc_lookup_paddr(asoc, &addr);
2631 		if (!t)
2632 			break;
2633 
2634 		sctp_assoc_set_primary(asoc, t);
2635 		break;
2636 
2637 	case SCTP_PARAM_SUPPORTED_EXT:
2638 		sctp_process_ext_param(asoc, param);
2639 		break;
2640 
2641 	case SCTP_PARAM_FWD_TSN_SUPPORT:
2642 		if (asoc->ep->prsctp_enable) {
2643 			asoc->peer.prsctp_capable = 1;
2644 			break;
2645 		}
2646 		/* Fall Through */
2647 		goto fall_through;
2648 
2649 	case SCTP_PARAM_RANDOM:
2650 		if (!ep->auth_enable)
2651 			goto fall_through;
2652 
2653 		/* Save peer's random parameter */
2654 		kfree(asoc->peer.peer_random);
2655 		asoc->peer.peer_random = kmemdup(param.p,
2656 					    ntohs(param.p->length), gfp);
2657 		if (!asoc->peer.peer_random) {
2658 			retval = 0;
2659 			break;
2660 		}
2661 		break;
2662 
2663 	case SCTP_PARAM_HMAC_ALGO:
2664 		if (!ep->auth_enable)
2665 			goto fall_through;
2666 
2667 		/* Save peer's HMAC list */
2668 		kfree(asoc->peer.peer_hmacs);
2669 		asoc->peer.peer_hmacs = kmemdup(param.p,
2670 					    ntohs(param.p->length), gfp);
2671 		if (!asoc->peer.peer_hmacs) {
2672 			retval = 0;
2673 			break;
2674 		}
2675 
2676 		/* Set the default HMAC the peer requested*/
2677 		sctp_auth_asoc_set_default_hmac(asoc, param.hmac_algo);
2678 		break;
2679 
2680 	case SCTP_PARAM_CHUNKS:
2681 		if (!ep->auth_enable)
2682 			goto fall_through;
2683 
2684 		kfree(asoc->peer.peer_chunks);
2685 		asoc->peer.peer_chunks = kmemdup(param.p,
2686 					    ntohs(param.p->length), gfp);
2687 		if (!asoc->peer.peer_chunks)
2688 			retval = 0;
2689 		break;
2690 fall_through:
2691 	default:
2692 		/* Any unrecognized parameters should have been caught
2693 		 * and handled by sctp_verify_param() which should be
2694 		 * called prior to this routine.  Simply log the error
2695 		 * here.
2696 		 */
2697 		pr_debug("%s: ignoring param:%d for association:%p.\n",
2698 			 __func__, ntohs(param.p->type), asoc);
2699 		break;
2700 	}
2701 
2702 	return retval;
2703 }
2704 
2705 /* Select a new verification tag.  */
2706 __u32 sctp_generate_tag(const struct sctp_endpoint *ep)
2707 {
2708 	/* I believe that this random number generator complies with RFC1750.
2709 	 * A tag of 0 is reserved for special cases (e.g. INIT).
2710 	 */
2711 	__u32 x;
2712 
2713 	do {
2714 		get_random_bytes(&x, sizeof(__u32));
2715 	} while (x == 0);
2716 
2717 	return x;
2718 }
2719 
2720 /* Select an initial TSN to send during startup.  */
2721 __u32 sctp_generate_tsn(const struct sctp_endpoint *ep)
2722 {
2723 	__u32 retval;
2724 
2725 	get_random_bytes(&retval, sizeof(__u32));
2726 	return retval;
2727 }
2728 
2729 /*
2730  * ADDIP 3.1.1 Address Configuration Change Chunk (ASCONF)
2731  *      0                   1                   2                   3
2732  *      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
2733  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2734  *     | Type = 0xC1   |  Chunk Flags  |      Chunk Length             |
2735  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2736  *     |                       Serial Number                           |
2737  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2738  *     |                    Address Parameter                          |
2739  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2740  *     |                     ASCONF Parameter #1                       |
2741  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2742  *     \                                                               \
2743  *     /                             ....                              /
2744  *     \                                                               \
2745  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2746  *     |                     ASCONF Parameter #N                       |
2747  *      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2748  *
2749  * Address Parameter and other parameter will not be wrapped in this function
2750  */
2751 static struct sctp_chunk *sctp_make_asconf(struct sctp_association *asoc,
2752 					   union sctp_addr *addr,
2753 					   int vparam_len)
2754 {
2755 	struct sctp_addiphdr asconf;
2756 	struct sctp_chunk *retval;
2757 	int length = sizeof(asconf) + vparam_len;
2758 	union sctp_addr_param addrparam;
2759 	int addrlen;
2760 	struct sctp_af *af = sctp_get_af_specific(addr->v4.sin_family);
2761 
2762 	addrlen = af->to_addr_param(addr, &addrparam);
2763 	if (!addrlen)
2764 		return NULL;
2765 	length += addrlen;
2766 
2767 	/* Create the chunk.  */
2768 	retval = sctp_make_control(asoc, SCTP_CID_ASCONF, 0, length,
2769 				   GFP_ATOMIC);
2770 	if (!retval)
2771 		return NULL;
2772 
2773 	asconf.serial = htonl(asoc->addip_serial++);
2774 
2775 	retval->subh.addip_hdr =
2776 		sctp_addto_chunk(retval, sizeof(asconf), &asconf);
2777 	retval->param_hdr.v =
2778 		sctp_addto_chunk(retval, addrlen, &addrparam);
2779 
2780 	return retval;
2781 }
2782 
2783 /* ADDIP
2784  * 3.2.1 Add IP Address
2785  * 	0                   1                   2                   3
2786  * 	0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
2787  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2788  *     |        Type = 0xC001          |    Length = Variable          |
2789  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2790  *     |               ASCONF-Request Correlation ID                   |
2791  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2792  *     |                       Address Parameter                       |
2793  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2794  *
2795  * 3.2.2 Delete IP Address
2796  * 	0                   1                   2                   3
2797  * 	0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
2798  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2799  *     |        Type = 0xC002          |    Length = Variable          |
2800  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2801  *     |               ASCONF-Request Correlation ID                   |
2802  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2803  *     |                       Address Parameter                       |
2804  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2805  *
2806  */
2807 struct sctp_chunk *sctp_make_asconf_update_ip(struct sctp_association *asoc,
2808 					      union sctp_addr *laddr,
2809 					      struct sockaddr *addrs,
2810 					      int addrcnt, __be16 flags)
2811 {
2812 	union sctp_addr_param addr_param;
2813 	struct sctp_addip_param	param;
2814 	int paramlen = sizeof(param);
2815 	struct sctp_chunk *retval;
2816 	int addr_param_len = 0;
2817 	union sctp_addr *addr;
2818 	int totallen = 0, i;
2819 	int del_pickup = 0;
2820 	struct sctp_af *af;
2821 	void *addr_buf;
2822 
2823 	/* Get total length of all the address parameters. */
2824 	addr_buf = addrs;
2825 	for (i = 0; i < addrcnt; i++) {
2826 		addr = addr_buf;
2827 		af = sctp_get_af_specific(addr->v4.sin_family);
2828 		addr_param_len = af->to_addr_param(addr, &addr_param);
2829 
2830 		totallen += paramlen;
2831 		totallen += addr_param_len;
2832 
2833 		addr_buf += af->sockaddr_len;
2834 		if (asoc->asconf_addr_del_pending && !del_pickup) {
2835 			/* reuse the parameter length from the same scope one */
2836 			totallen += paramlen;
2837 			totallen += addr_param_len;
2838 			del_pickup = 1;
2839 
2840 			pr_debug("%s: picked same-scope del_pending addr, "
2841 				 "totallen for all addresses is %d\n",
2842 				 __func__, totallen);
2843 		}
2844 	}
2845 
2846 	/* Create an asconf chunk with the required length. */
2847 	retval = sctp_make_asconf(asoc, laddr, totallen);
2848 	if (!retval)
2849 		return NULL;
2850 
2851 	/* Add the address parameters to the asconf chunk. */
2852 	addr_buf = addrs;
2853 	for (i = 0; i < addrcnt; i++) {
2854 		addr = addr_buf;
2855 		af = sctp_get_af_specific(addr->v4.sin_family);
2856 		addr_param_len = af->to_addr_param(addr, &addr_param);
2857 		param.param_hdr.type = flags;
2858 		param.param_hdr.length = htons(paramlen + addr_param_len);
2859 		param.crr_id = htonl(i);
2860 
2861 		sctp_addto_chunk(retval, paramlen, &param);
2862 		sctp_addto_chunk(retval, addr_param_len, &addr_param);
2863 
2864 		addr_buf += af->sockaddr_len;
2865 	}
2866 	if (flags == SCTP_PARAM_ADD_IP && del_pickup) {
2867 		addr = asoc->asconf_addr_del_pending;
2868 		af = sctp_get_af_specific(addr->v4.sin_family);
2869 		addr_param_len = af->to_addr_param(addr, &addr_param);
2870 		param.param_hdr.type = SCTP_PARAM_DEL_IP;
2871 		param.param_hdr.length = htons(paramlen + addr_param_len);
2872 		param.crr_id = htonl(i);
2873 
2874 		sctp_addto_chunk(retval, paramlen, &param);
2875 		sctp_addto_chunk(retval, addr_param_len, &addr_param);
2876 	}
2877 	return retval;
2878 }
2879 
2880 /* ADDIP
2881  * 3.2.4 Set Primary IP Address
2882  *	0                   1                   2                   3
2883  *	0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
2884  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2885  *     |        Type =0xC004           |    Length = Variable          |
2886  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2887  *     |               ASCONF-Request Correlation ID                   |
2888  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2889  *     |                       Address Parameter                       |
2890  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2891  *
2892  * Create an ASCONF chunk with Set Primary IP address parameter.
2893  */
2894 struct sctp_chunk *sctp_make_asconf_set_prim(struct sctp_association *asoc,
2895 					     union sctp_addr *addr)
2896 {
2897 	struct sctp_af *af = sctp_get_af_specific(addr->v4.sin_family);
2898 	union sctp_addr_param addrparam;
2899 	struct sctp_addip_param	param;
2900 	struct sctp_chunk *retval;
2901 	int len = sizeof(param);
2902 	int addrlen;
2903 
2904 	addrlen = af->to_addr_param(addr, &addrparam);
2905 	if (!addrlen)
2906 		return NULL;
2907 	len += addrlen;
2908 
2909 	/* Create the chunk and make asconf header. */
2910 	retval = sctp_make_asconf(asoc, addr, len);
2911 	if (!retval)
2912 		return NULL;
2913 
2914 	param.param_hdr.type = SCTP_PARAM_SET_PRIMARY;
2915 	param.param_hdr.length = htons(len);
2916 	param.crr_id = 0;
2917 
2918 	sctp_addto_chunk(retval, sizeof(param), &param);
2919 	sctp_addto_chunk(retval, addrlen, &addrparam);
2920 
2921 	return retval;
2922 }
2923 
2924 /* ADDIP 3.1.2 Address Configuration Acknowledgement Chunk (ASCONF-ACK)
2925  *      0                   1                   2                   3
2926  *      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
2927  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2928  *     | Type = 0x80   |  Chunk Flags  |      Chunk Length             |
2929  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2930  *     |                       Serial Number                           |
2931  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2932  *     |                 ASCONF Parameter Response#1                   |
2933  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2934  *     \                                                               \
2935  *     /                             ....                              /
2936  *     \                                                               \
2937  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2938  *     |                 ASCONF Parameter Response#N                   |
2939  *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2940  *
2941  * Create an ASCONF_ACK chunk with enough space for the parameter responses.
2942  */
2943 static struct sctp_chunk *sctp_make_asconf_ack(const struct sctp_association *asoc,
2944 					       __u32 serial, int vparam_len)
2945 {
2946 	struct sctp_addiphdr asconf;
2947 	struct sctp_chunk *retval;
2948 	int length = sizeof(asconf) + vparam_len;
2949 
2950 	/* Create the chunk.  */
2951 	retval = sctp_make_control(asoc, SCTP_CID_ASCONF_ACK, 0, length,
2952 				   GFP_ATOMIC);
2953 	if (!retval)
2954 		return NULL;
2955 
2956 	asconf.serial = htonl(serial);
2957 
2958 	retval->subh.addip_hdr =
2959 		sctp_addto_chunk(retval, sizeof(asconf), &asconf);
2960 
2961 	return retval;
2962 }
2963 
2964 /* Add response parameters to an ASCONF_ACK chunk. */
2965 static void sctp_add_asconf_response(struct sctp_chunk *chunk, __be32 crr_id,
2966 				     __be16 err_code,
2967 				     struct sctp_addip_param *asconf_param)
2968 {
2969 	struct sctp_addip_param ack_param;
2970 	struct sctp_errhdr err_param;
2971 	int asconf_param_len = 0;
2972 	int err_param_len = 0;
2973 	__be16 response_type;
2974 
2975 	if (SCTP_ERROR_NO_ERROR == err_code) {
2976 		response_type = SCTP_PARAM_SUCCESS_REPORT;
2977 	} else {
2978 		response_type = SCTP_PARAM_ERR_CAUSE;
2979 		err_param_len = sizeof(err_param);
2980 		if (asconf_param)
2981 			asconf_param_len =
2982 				 ntohs(asconf_param->param_hdr.length);
2983 	}
2984 
2985 	/* Add Success Indication or Error Cause Indication parameter. */
2986 	ack_param.param_hdr.type = response_type;
2987 	ack_param.param_hdr.length = htons(sizeof(ack_param) +
2988 					   err_param_len +
2989 					   asconf_param_len);
2990 	ack_param.crr_id = crr_id;
2991 	sctp_addto_chunk(chunk, sizeof(ack_param), &ack_param);
2992 
2993 	if (SCTP_ERROR_NO_ERROR == err_code)
2994 		return;
2995 
2996 	/* Add Error Cause parameter. */
2997 	err_param.cause = err_code;
2998 	err_param.length = htons(err_param_len + asconf_param_len);
2999 	sctp_addto_chunk(chunk, err_param_len, &err_param);
3000 
3001 	/* Add the failed TLV copied from ASCONF chunk. */
3002 	if (asconf_param)
3003 		sctp_addto_chunk(chunk, asconf_param_len, asconf_param);
3004 }
3005 
3006 /* Process a asconf parameter. */
3007 static __be16 sctp_process_asconf_param(struct sctp_association *asoc,
3008 					struct sctp_chunk *asconf,
3009 					struct sctp_addip_param *asconf_param)
3010 {
3011 	union sctp_addr_param *addr_param;
3012 	struct sctp_transport *peer;
3013 	union sctp_addr	addr;
3014 	struct sctp_af *af;
3015 
3016 	addr_param = (void *)asconf_param + sizeof(*asconf_param);
3017 
3018 	if (asconf_param->param_hdr.type != SCTP_PARAM_ADD_IP &&
3019 	    asconf_param->param_hdr.type != SCTP_PARAM_DEL_IP &&
3020 	    asconf_param->param_hdr.type != SCTP_PARAM_SET_PRIMARY)
3021 		return SCTP_ERROR_UNKNOWN_PARAM;
3022 
3023 	switch (addr_param->p.type) {
3024 	case SCTP_PARAM_IPV6_ADDRESS:
3025 		if (!asoc->peer.ipv6_address)
3026 			return SCTP_ERROR_DNS_FAILED;
3027 		break;
3028 	case SCTP_PARAM_IPV4_ADDRESS:
3029 		if (!asoc->peer.ipv4_address)
3030 			return SCTP_ERROR_DNS_FAILED;
3031 		break;
3032 	default:
3033 		return SCTP_ERROR_DNS_FAILED;
3034 	}
3035 
3036 	af = sctp_get_af_specific(param_type2af(addr_param->p.type));
3037 	if (unlikely(!af))
3038 		return SCTP_ERROR_DNS_FAILED;
3039 
3040 	af->from_addr_param(&addr, addr_param, htons(asoc->peer.port), 0);
3041 
3042 	/* ADDIP 4.2.1  This parameter MUST NOT contain a broadcast
3043 	 * or multicast address.
3044 	 * (note: wildcard is permitted and requires special handling so
3045 	 *  make sure we check for that)
3046 	 */
3047 	if (!af->is_any(&addr) && !af->addr_valid(&addr, NULL, asconf->skb))
3048 		return SCTP_ERROR_DNS_FAILED;
3049 
3050 	switch (asconf_param->param_hdr.type) {
3051 	case SCTP_PARAM_ADD_IP:
3052 		/* Section 4.2.1:
3053 		 * If the address 0.0.0.0 or ::0 is provided, the source
3054 		 * address of the packet MUST be added.
3055 		 */
3056 		if (af->is_any(&addr))
3057 			memcpy(&addr, &asconf->source, sizeof(addr));
3058 
3059 		if (security_sctp_bind_connect(asoc->ep->base.sk,
3060 					       SCTP_PARAM_ADD_IP,
3061 					       (struct sockaddr *)&addr,
3062 					       af->sockaddr_len))
3063 			return SCTP_ERROR_REQ_REFUSED;
3064 
3065 		/* ADDIP 4.3 D9) If an endpoint receives an ADD IP address
3066 		 * request and does not have the local resources to add this
3067 		 * new address to the association, it MUST return an Error
3068 		 * Cause TLV set to the new error code 'Operation Refused
3069 		 * Due to Resource Shortage'.
3070 		 */
3071 
3072 		peer = sctp_assoc_add_peer(asoc, &addr, GFP_ATOMIC, SCTP_UNCONFIRMED);
3073 		if (!peer)
3074 			return SCTP_ERROR_RSRC_LOW;
3075 
3076 		/* Start the heartbeat timer. */
3077 		sctp_transport_reset_hb_timer(peer);
3078 		asoc->new_transport = peer;
3079 		break;
3080 	case SCTP_PARAM_DEL_IP:
3081 		/* ADDIP 4.3 D7) If a request is received to delete the
3082 		 * last remaining IP address of a peer endpoint, the receiver
3083 		 * MUST send an Error Cause TLV with the error cause set to the
3084 		 * new error code 'Request to Delete Last Remaining IP Address'.
3085 		 */
3086 		if (asoc->peer.transport_count == 1)
3087 			return SCTP_ERROR_DEL_LAST_IP;
3088 
3089 		/* ADDIP 4.3 D8) If a request is received to delete an IP
3090 		 * address which is also the source address of the IP packet
3091 		 * which contained the ASCONF chunk, the receiver MUST reject
3092 		 * this request. To reject the request the receiver MUST send
3093 		 * an Error Cause TLV set to the new error code 'Request to
3094 		 * Delete Source IP Address'
3095 		 */
3096 		if (sctp_cmp_addr_exact(&asconf->source, &addr))
3097 			return SCTP_ERROR_DEL_SRC_IP;
3098 
3099 		/* Section 4.2.2
3100 		 * If the address 0.0.0.0 or ::0 is provided, all
3101 		 * addresses of the peer except	the source address of the
3102 		 * packet MUST be deleted.
3103 		 */
3104 		if (af->is_any(&addr)) {
3105 			sctp_assoc_set_primary(asoc, asconf->transport);
3106 			sctp_assoc_del_nonprimary_peers(asoc,
3107 							asconf->transport);
3108 			return SCTP_ERROR_NO_ERROR;
3109 		}
3110 
3111 		/* If the address is not part of the association, the
3112 		 * ASCONF-ACK with Error Cause Indication Parameter
3113 		 * which including cause of Unresolvable Address should
3114 		 * be sent.
3115 		 */
3116 		peer = sctp_assoc_lookup_paddr(asoc, &addr);
3117 		if (!peer)
3118 			return SCTP_ERROR_DNS_FAILED;
3119 
3120 		sctp_assoc_rm_peer(asoc, peer);
3121 		break;
3122 	case SCTP_PARAM_SET_PRIMARY:
3123 		/* ADDIP Section 4.2.4
3124 		 * If the address 0.0.0.0 or ::0 is provided, the receiver
3125 		 * MAY mark the source address of the packet as its
3126 		 * primary.
3127 		 */
3128 		if (af->is_any(&addr))
3129 			memcpy(&addr.v4, sctp_source(asconf), sizeof(addr));
3130 
3131 		if (security_sctp_bind_connect(asoc->ep->base.sk,
3132 					       SCTP_PARAM_SET_PRIMARY,
3133 					       (struct sockaddr *)&addr,
3134 					       af->sockaddr_len))
3135 			return SCTP_ERROR_REQ_REFUSED;
3136 
3137 		peer = sctp_assoc_lookup_paddr(asoc, &addr);
3138 		if (!peer)
3139 			return SCTP_ERROR_DNS_FAILED;
3140 
3141 		sctp_assoc_set_primary(asoc, peer);
3142 		break;
3143 	}
3144 
3145 	return SCTP_ERROR_NO_ERROR;
3146 }
3147 
3148 /* Verify the ASCONF packet before we process it. */
3149 bool sctp_verify_asconf(const struct sctp_association *asoc,
3150 			struct sctp_chunk *chunk, bool addr_param_needed,
3151 			struct sctp_paramhdr **errp)
3152 {
3153 	struct sctp_addip_chunk *addip;
3154 	bool addr_param_seen = false;
3155 	union sctp_params param;
3156 
3157 	addip = (struct sctp_addip_chunk *)chunk->chunk_hdr;
3158 	sctp_walk_params(param, addip, addip_hdr.params) {
3159 		size_t length = ntohs(param.p->length);
3160 
3161 		*errp = param.p;
3162 		switch (param.p->type) {
3163 		case SCTP_PARAM_ERR_CAUSE:
3164 			break;
3165 		case SCTP_PARAM_IPV4_ADDRESS:
3166 			if (length != sizeof(struct sctp_ipv4addr_param))
3167 				return false;
3168 			/* ensure there is only one addr param and it's in the
3169 			 * beginning of addip_hdr params, or we reject it.
3170 			 */
3171 			if (param.v != addip->addip_hdr.params)
3172 				return false;
3173 			addr_param_seen = true;
3174 			break;
3175 		case SCTP_PARAM_IPV6_ADDRESS:
3176 			if (length != sizeof(struct sctp_ipv6addr_param))
3177 				return false;
3178 			if (param.v != addip->addip_hdr.params)
3179 				return false;
3180 			addr_param_seen = true;
3181 			break;
3182 		case SCTP_PARAM_ADD_IP:
3183 		case SCTP_PARAM_DEL_IP:
3184 		case SCTP_PARAM_SET_PRIMARY:
3185 			/* In ASCONF chunks, these need to be first. */
3186 			if (addr_param_needed && !addr_param_seen)
3187 				return false;
3188 			length = ntohs(param.addip->param_hdr.length);
3189 			if (length < sizeof(struct sctp_addip_param) +
3190 				     sizeof(**errp))
3191 				return false;
3192 			break;
3193 		case SCTP_PARAM_SUCCESS_REPORT:
3194 		case SCTP_PARAM_ADAPTATION_LAYER_IND:
3195 			if (length != sizeof(struct sctp_addip_param))
3196 				return false;
3197 			break;
3198 		default:
3199 			/* This is unkown to us, reject! */
3200 			return false;
3201 		}
3202 	}
3203 
3204 	/* Remaining sanity checks. */
3205 	if (addr_param_needed && !addr_param_seen)
3206 		return false;
3207 	if (!addr_param_needed && addr_param_seen)
3208 		return false;
3209 	if (param.v != chunk->chunk_end)
3210 		return false;
3211 
3212 	return true;
3213 }
3214 
3215 /* Process an incoming ASCONF chunk with the next expected serial no. and
3216  * return an ASCONF_ACK chunk to be sent in response.
3217  */
3218 struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc,
3219 				       struct sctp_chunk *asconf)
3220 {
3221 	union sctp_addr_param *addr_param;
3222 	struct sctp_addip_chunk *addip;
3223 	struct sctp_chunk *asconf_ack;
3224 	bool all_param_pass = true;
3225 	struct sctp_addiphdr *hdr;
3226 	int length = 0, chunk_len;
3227 	union sctp_params param;
3228 	__be16 err_code;
3229 	__u32 serial;
3230 
3231 	addip = (struct sctp_addip_chunk *)asconf->chunk_hdr;
3232 	chunk_len = ntohs(asconf->chunk_hdr->length) -
3233 		    sizeof(struct sctp_chunkhdr);
3234 	hdr = (struct sctp_addiphdr *)asconf->skb->data;
3235 	serial = ntohl(hdr->serial);
3236 
3237 	/* Skip the addiphdr and store a pointer to address parameter.  */
3238 	length = sizeof(*hdr);
3239 	addr_param = (union sctp_addr_param *)(asconf->skb->data + length);
3240 	chunk_len -= length;
3241 
3242 	/* Skip the address parameter and store a pointer to the first
3243 	 * asconf parameter.
3244 	 */
3245 	length = ntohs(addr_param->p.length);
3246 	chunk_len -= length;
3247 
3248 	/* create an ASCONF_ACK chunk.
3249 	 * Based on the definitions of parameters, we know that the size of
3250 	 * ASCONF_ACK parameters are less than or equal to the fourfold of ASCONF
3251 	 * parameters.
3252 	 */
3253 	asconf_ack = sctp_make_asconf_ack(asoc, serial, chunk_len * 4);
3254 	if (!asconf_ack)
3255 		goto done;
3256 
3257 	/* Process the TLVs contained within the ASCONF chunk. */
3258 	sctp_walk_params(param, addip, addip_hdr.params) {
3259 		/* Skip preceeding address parameters. */
3260 		if (param.p->type == SCTP_PARAM_IPV4_ADDRESS ||
3261 		    param.p->type == SCTP_PARAM_IPV6_ADDRESS)
3262 			continue;
3263 
3264 		err_code = sctp_process_asconf_param(asoc, asconf,
3265 						     param.addip);
3266 		/* ADDIP 4.1 A7)
3267 		 * If an error response is received for a TLV parameter,
3268 		 * all TLVs with no response before the failed TLV are
3269 		 * considered successful if not reported.  All TLVs after
3270 		 * the failed response are considered unsuccessful unless
3271 		 * a specific success indication is present for the parameter.
3272 		 */
3273 		if (err_code != SCTP_ERROR_NO_ERROR)
3274 			all_param_pass = false;
3275 		if (!all_param_pass)
3276 			sctp_add_asconf_response(asconf_ack, param.addip->crr_id,
3277 						 err_code, param.addip);
3278 
3279 		/* ADDIP 4.3 D11) When an endpoint receiving an ASCONF to add
3280 		 * an IP address sends an 'Out of Resource' in its response, it
3281 		 * MUST also fail any subsequent add or delete requests bundled
3282 		 * in the ASCONF.
3283 		 */
3284 		if (err_code == SCTP_ERROR_RSRC_LOW)
3285 			goto done;
3286 	}
3287 done:
3288 	asoc->peer.addip_serial++;
3289 
3290 	/* If we are sending a new ASCONF_ACK hold a reference to it in assoc
3291 	 * after freeing the reference to old asconf ack if any.
3292 	 */
3293 	if (asconf_ack) {
3294 		sctp_chunk_hold(asconf_ack);
3295 		list_add_tail(&asconf_ack->transmitted_list,
3296 			      &asoc->asconf_ack_list);
3297 	}
3298 
3299 	return asconf_ack;
3300 }
3301 
3302 /* Process a asconf parameter that is successfully acked. */
3303 static void sctp_asconf_param_success(struct sctp_association *asoc,
3304 				      struct sctp_addip_param *asconf_param)
3305 {
3306 	struct sctp_bind_addr *bp = &asoc->base.bind_addr;
3307 	union sctp_addr_param *addr_param;
3308 	struct sctp_sockaddr_entry *saddr;
3309 	struct sctp_transport *transport;
3310 	union sctp_addr	addr;
3311 	struct sctp_af *af;
3312 
3313 	addr_param = (void *)asconf_param + sizeof(*asconf_param);
3314 
3315 	/* We have checked the packet before, so we do not check again.	*/
3316 	af = sctp_get_af_specific(param_type2af(addr_param->p.type));
3317 	af->from_addr_param(&addr, addr_param, htons(bp->port), 0);
3318 
3319 	switch (asconf_param->param_hdr.type) {
3320 	case SCTP_PARAM_ADD_IP:
3321 		/* This is always done in BH context with a socket lock
3322 		 * held, so the list can not change.
3323 		 */
3324 		local_bh_disable();
3325 		list_for_each_entry(saddr, &bp->address_list, list) {
3326 			if (sctp_cmp_addr_exact(&saddr->a, &addr))
3327 				saddr->state = SCTP_ADDR_SRC;
3328 		}
3329 		local_bh_enable();
3330 		list_for_each_entry(transport, &asoc->peer.transport_addr_list,
3331 				transports) {
3332 			sctp_transport_dst_release(transport);
3333 		}
3334 		break;
3335 	case SCTP_PARAM_DEL_IP:
3336 		local_bh_disable();
3337 		sctp_del_bind_addr(bp, &addr);
3338 		if (asoc->asconf_addr_del_pending != NULL &&
3339 		    sctp_cmp_addr_exact(asoc->asconf_addr_del_pending, &addr)) {
3340 			kfree(asoc->asconf_addr_del_pending);
3341 			asoc->asconf_addr_del_pending = NULL;
3342 		}
3343 		local_bh_enable();
3344 		list_for_each_entry(transport, &asoc->peer.transport_addr_list,
3345 				transports) {
3346 			sctp_transport_dst_release(transport);
3347 		}
3348 		break;
3349 	default:
3350 		break;
3351 	}
3352 }
3353 
3354 /* Get the corresponding ASCONF response error code from the ASCONF_ACK chunk
3355  * for the given asconf parameter.  If there is no response for this parameter,
3356  * return the error code based on the third argument 'no_err'.
3357  * ADDIP 4.1
3358  * A7) If an error response is received for a TLV parameter, all TLVs with no
3359  * response before the failed TLV are considered successful if not reported.
3360  * All TLVs after the failed response are considered unsuccessful unless a
3361  * specific success indication is present for the parameter.
3362  */
3363 static __be16 sctp_get_asconf_response(struct sctp_chunk *asconf_ack,
3364 				       struct sctp_addip_param *asconf_param,
3365 				       int no_err)
3366 {
3367 	struct sctp_addip_param	*asconf_ack_param;
3368 	struct sctp_errhdr *err_param;
3369 	int asconf_ack_len;
3370 	__be16 err_code;
3371 	int length;
3372 
3373 	if (no_err)
3374 		err_code = SCTP_ERROR_NO_ERROR;
3375 	else
3376 		err_code = SCTP_ERROR_REQ_REFUSED;
3377 
3378 	asconf_ack_len = ntohs(asconf_ack->chunk_hdr->length) -
3379 			 sizeof(struct sctp_chunkhdr);
3380 
3381 	/* Skip the addiphdr from the asconf_ack chunk and store a pointer to
3382 	 * the first asconf_ack parameter.
3383 	 */
3384 	length = sizeof(struct sctp_addiphdr);
3385 	asconf_ack_param = (struct sctp_addip_param *)(asconf_ack->skb->data +
3386 						       length);
3387 	asconf_ack_len -= length;
3388 
3389 	while (asconf_ack_len > 0) {
3390 		if (asconf_ack_param->crr_id == asconf_param->crr_id) {
3391 			switch (asconf_ack_param->param_hdr.type) {
3392 			case SCTP_PARAM_SUCCESS_REPORT:
3393 				return SCTP_ERROR_NO_ERROR;
3394 			case SCTP_PARAM_ERR_CAUSE:
3395 				length = sizeof(*asconf_ack_param);
3396 				err_param = (void *)asconf_ack_param + length;
3397 				asconf_ack_len -= length;
3398 				if (asconf_ack_len > 0)
3399 					return err_param->cause;
3400 				else
3401 					return SCTP_ERROR_INV_PARAM;
3402 				break;
3403 			default:
3404 				return SCTP_ERROR_INV_PARAM;
3405 			}
3406 		}
3407 
3408 		length = ntohs(asconf_ack_param->param_hdr.length);
3409 		asconf_ack_param = (void *)asconf_ack_param + length;
3410 		asconf_ack_len -= length;
3411 	}
3412 
3413 	return err_code;
3414 }
3415 
3416 /* Process an incoming ASCONF_ACK chunk against the cached last ASCONF chunk. */
3417 int sctp_process_asconf_ack(struct sctp_association *asoc,
3418 			    struct sctp_chunk *asconf_ack)
3419 {
3420 	struct sctp_chunk *asconf = asoc->addip_last_asconf;
3421 	struct sctp_addip_param *asconf_param;
3422 	__be16 err_code = SCTP_ERROR_NO_ERROR;
3423 	union sctp_addr_param *addr_param;
3424 	int asconf_len = asconf->skb->len;
3425 	int all_param_pass = 0;
3426 	int length = 0;
3427 	int no_err = 1;
3428 	int retval = 0;
3429 
3430 	/* Skip the chunkhdr and addiphdr from the last asconf sent and store
3431 	 * a pointer to address parameter.
3432 	 */
3433 	length = sizeof(struct sctp_addip_chunk);
3434 	addr_param = (union sctp_addr_param *)(asconf->skb->data + length);
3435 	asconf_len -= length;
3436 
3437 	/* Skip the address parameter in the last asconf sent and store a
3438 	 * pointer to the first asconf parameter.
3439 	 */
3440 	length = ntohs(addr_param->p.length);
3441 	asconf_param = (void *)addr_param + length;
3442 	asconf_len -= length;
3443 
3444 	/* ADDIP 4.1
3445 	 * A8) If there is no response(s) to specific TLV parameter(s), and no
3446 	 * failures are indicated, then all request(s) are considered
3447 	 * successful.
3448 	 */
3449 	if (asconf_ack->skb->len == sizeof(struct sctp_addiphdr))
3450 		all_param_pass = 1;
3451 
3452 	/* Process the TLVs contained in the last sent ASCONF chunk. */
3453 	while (asconf_len > 0) {
3454 		if (all_param_pass)
3455 			err_code = SCTP_ERROR_NO_ERROR;
3456 		else {
3457 			err_code = sctp_get_asconf_response(asconf_ack,
3458 							    asconf_param,
3459 							    no_err);
3460 			if (no_err && (SCTP_ERROR_NO_ERROR != err_code))
3461 				no_err = 0;
3462 		}
3463 
3464 		switch (err_code) {
3465 		case SCTP_ERROR_NO_ERROR:
3466 			sctp_asconf_param_success(asoc, asconf_param);
3467 			break;
3468 
3469 		case SCTP_ERROR_RSRC_LOW:
3470 			retval = 1;
3471 			break;
3472 
3473 		case SCTP_ERROR_UNKNOWN_PARAM:
3474 			/* Disable sending this type of asconf parameter in
3475 			 * future.
3476 			 */
3477 			asoc->peer.addip_disabled_mask |=
3478 				asconf_param->param_hdr.type;
3479 			break;
3480 
3481 		case SCTP_ERROR_REQ_REFUSED:
3482 		case SCTP_ERROR_DEL_LAST_IP:
3483 		case SCTP_ERROR_DEL_SRC_IP:
3484 		default:
3485 			 break;
3486 		}
3487 
3488 		/* Skip the processed asconf parameter and move to the next
3489 		 * one.
3490 		 */
3491 		length = ntohs(asconf_param->param_hdr.length);
3492 		asconf_param = (void *)asconf_param + length;
3493 		asconf_len -= length;
3494 	}
3495 
3496 	if (no_err && asoc->src_out_of_asoc_ok) {
3497 		asoc->src_out_of_asoc_ok = 0;
3498 		sctp_transport_immediate_rtx(asoc->peer.primary_path);
3499 	}
3500 
3501 	/* Free the cached last sent asconf chunk. */
3502 	list_del_init(&asconf->transmitted_list);
3503 	sctp_chunk_free(asconf);
3504 	asoc->addip_last_asconf = NULL;
3505 
3506 	return retval;
3507 }
3508 
3509 /* Make a FWD TSN chunk. */
3510 struct sctp_chunk *sctp_make_fwdtsn(const struct sctp_association *asoc,
3511 				    __u32 new_cum_tsn, size_t nstreams,
3512 				    struct sctp_fwdtsn_skip *skiplist)
3513 {
3514 	struct sctp_chunk *retval = NULL;
3515 	struct sctp_fwdtsn_hdr ftsn_hdr;
3516 	struct sctp_fwdtsn_skip skip;
3517 	size_t hint;
3518 	int i;
3519 
3520 	hint = (nstreams + 1) * sizeof(__u32);
3521 
3522 	retval = sctp_make_control(asoc, SCTP_CID_FWD_TSN, 0, hint, GFP_ATOMIC);
3523 
3524 	if (!retval)
3525 		return NULL;
3526 
3527 	ftsn_hdr.new_cum_tsn = htonl(new_cum_tsn);
3528 	retval->subh.fwdtsn_hdr =
3529 		sctp_addto_chunk(retval, sizeof(ftsn_hdr), &ftsn_hdr);
3530 
3531 	for (i = 0; i < nstreams; i++) {
3532 		skip.stream = skiplist[i].stream;
3533 		skip.ssn = skiplist[i].ssn;
3534 		sctp_addto_chunk(retval, sizeof(skip), &skip);
3535 	}
3536 
3537 	return retval;
3538 }
3539 
3540 struct sctp_chunk *sctp_make_ifwdtsn(const struct sctp_association *asoc,
3541 				     __u32 new_cum_tsn, size_t nstreams,
3542 				     struct sctp_ifwdtsn_skip *skiplist)
3543 {
3544 	struct sctp_chunk *retval = NULL;
3545 	struct sctp_ifwdtsn_hdr ftsn_hdr;
3546 	size_t hint;
3547 
3548 	hint = (nstreams + 1) * sizeof(__u32);
3549 
3550 	retval = sctp_make_control(asoc, SCTP_CID_I_FWD_TSN, 0, hint,
3551 				   GFP_ATOMIC);
3552 	if (!retval)
3553 		return NULL;
3554 
3555 	ftsn_hdr.new_cum_tsn = htonl(new_cum_tsn);
3556 	retval->subh.ifwdtsn_hdr =
3557 		sctp_addto_chunk(retval, sizeof(ftsn_hdr), &ftsn_hdr);
3558 
3559 	sctp_addto_chunk(retval, nstreams * sizeof(skiplist[0]), skiplist);
3560 
3561 	return retval;
3562 }
3563 
3564 /* RE-CONFIG 3.1 (RE-CONFIG chunk)
3565  *   0                   1                   2                   3
3566  *   0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
3567  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3568  *  | Type = 130    |  Chunk Flags  |      Chunk Length             |
3569  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3570  *  \                                                               \
3571  *  /                  Re-configuration Parameter                   /
3572  *  \                                                               \
3573  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3574  *  \                                                               \
3575  *  /             Re-configuration Parameter (optional)             /
3576  *  \                                                               \
3577  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3578  */
3579 static struct sctp_chunk *sctp_make_reconf(const struct sctp_association *asoc,
3580 					   int length)
3581 {
3582 	struct sctp_reconf_chunk *reconf;
3583 	struct sctp_chunk *retval;
3584 
3585 	retval = sctp_make_control(asoc, SCTP_CID_RECONF, 0, length,
3586 				   GFP_ATOMIC);
3587 	if (!retval)
3588 		return NULL;
3589 
3590 	reconf = (struct sctp_reconf_chunk *)retval->chunk_hdr;
3591 	retval->param_hdr.v = reconf->params;
3592 
3593 	return retval;
3594 }
3595 
3596 /* RE-CONFIG 4.1 (STREAM OUT RESET)
3597  *   0                   1                   2                   3
3598  *   0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
3599  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3600  *  |     Parameter Type = 13       | Parameter Length = 16 + 2 * N |
3601  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3602  *  |           Re-configuration Request Sequence Number            |
3603  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3604  *  |           Re-configuration Response Sequence Number           |
3605  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3606  *  |                Sender's Last Assigned TSN                     |
3607  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3608  *  |  Stream Number 1 (optional)   |    Stream Number 2 (optional) |
3609  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3610  *  /                            ......                             /
3611  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3612  *  |  Stream Number N-1 (optional) |    Stream Number N (optional) |
3613  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3614  *
3615  * RE-CONFIG 4.2 (STREAM IN RESET)
3616  *   0                   1                   2                   3
3617  *   0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
3618  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3619  *  |     Parameter Type = 14       |  Parameter Length = 8 + 2 * N |
3620  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3621  *  |          Re-configuration Request Sequence Number             |
3622  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3623  *  |  Stream Number 1 (optional)   |    Stream Number 2 (optional) |
3624  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3625  *  /                            ......                             /
3626  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3627  *  |  Stream Number N-1 (optional) |    Stream Number N (optional) |
3628  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3629  */
3630 struct sctp_chunk *sctp_make_strreset_req(
3631 					const struct sctp_association *asoc,
3632 					__u16 stream_num, __be16 *stream_list,
3633 					bool out, bool in)
3634 {
3635 	__u16 stream_len = stream_num * sizeof(__u16);
3636 	struct sctp_strreset_outreq outreq;
3637 	struct sctp_strreset_inreq inreq;
3638 	struct sctp_chunk *retval;
3639 	__u16 outlen, inlen;
3640 
3641 	outlen = (sizeof(outreq) + stream_len) * out;
3642 	inlen = (sizeof(inreq) + stream_len) * in;
3643 
3644 	retval = sctp_make_reconf(asoc, outlen + inlen);
3645 	if (!retval)
3646 		return NULL;
3647 
3648 	if (outlen) {
3649 		outreq.param_hdr.type = SCTP_PARAM_RESET_OUT_REQUEST;
3650 		outreq.param_hdr.length = htons(outlen);
3651 		outreq.request_seq = htonl(asoc->strreset_outseq);
3652 		outreq.response_seq = htonl(asoc->strreset_inseq - 1);
3653 		outreq.send_reset_at_tsn = htonl(asoc->next_tsn - 1);
3654 
3655 		sctp_addto_chunk(retval, sizeof(outreq), &outreq);
3656 
3657 		if (stream_len)
3658 			sctp_addto_chunk(retval, stream_len, stream_list);
3659 	}
3660 
3661 	if (inlen) {
3662 		inreq.param_hdr.type = SCTP_PARAM_RESET_IN_REQUEST;
3663 		inreq.param_hdr.length = htons(inlen);
3664 		inreq.request_seq = htonl(asoc->strreset_outseq + out);
3665 
3666 		sctp_addto_chunk(retval, sizeof(inreq), &inreq);
3667 
3668 		if (stream_len)
3669 			sctp_addto_chunk(retval, stream_len, stream_list);
3670 	}
3671 
3672 	return retval;
3673 }
3674 
3675 /* RE-CONFIG 4.3 (SSN/TSN RESET ALL)
3676  *   0                   1                   2                   3
3677  *   0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
3678  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3679  *  |     Parameter Type = 15       |      Parameter Length = 8     |
3680  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3681  *  |         Re-configuration Request Sequence Number              |
3682  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3683  */
3684 struct sctp_chunk *sctp_make_strreset_tsnreq(
3685 					const struct sctp_association *asoc)
3686 {
3687 	struct sctp_strreset_tsnreq tsnreq;
3688 	__u16 length = sizeof(tsnreq);
3689 	struct sctp_chunk *retval;
3690 
3691 	retval = sctp_make_reconf(asoc, length);
3692 	if (!retval)
3693 		return NULL;
3694 
3695 	tsnreq.param_hdr.type = SCTP_PARAM_RESET_TSN_REQUEST;
3696 	tsnreq.param_hdr.length = htons(length);
3697 	tsnreq.request_seq = htonl(asoc->strreset_outseq);
3698 
3699 	sctp_addto_chunk(retval, sizeof(tsnreq), &tsnreq);
3700 
3701 	return retval;
3702 }
3703 
3704 /* RE-CONFIG 4.5/4.6 (ADD STREAM)
3705  *   0                   1                   2                   3
3706  *   0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
3707  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3708  *  |     Parameter Type = 17       |      Parameter Length = 12    |
3709  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3710  *  |          Re-configuration Request Sequence Number             |
3711  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3712  *  |      Number of new streams    |         Reserved              |
3713  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3714  */
3715 struct sctp_chunk *sctp_make_strreset_addstrm(
3716 					const struct sctp_association *asoc,
3717 					__u16 out, __u16 in)
3718 {
3719 	struct sctp_strreset_addstrm addstrm;
3720 	__u16 size = sizeof(addstrm);
3721 	struct sctp_chunk *retval;
3722 
3723 	retval = sctp_make_reconf(asoc, (!!out + !!in) * size);
3724 	if (!retval)
3725 		return NULL;
3726 
3727 	if (out) {
3728 		addstrm.param_hdr.type = SCTP_PARAM_RESET_ADD_OUT_STREAMS;
3729 		addstrm.param_hdr.length = htons(size);
3730 		addstrm.number_of_streams = htons(out);
3731 		addstrm.request_seq = htonl(asoc->strreset_outseq);
3732 		addstrm.reserved = 0;
3733 
3734 		sctp_addto_chunk(retval, size, &addstrm);
3735 	}
3736 
3737 	if (in) {
3738 		addstrm.param_hdr.type = SCTP_PARAM_RESET_ADD_IN_STREAMS;
3739 		addstrm.param_hdr.length = htons(size);
3740 		addstrm.number_of_streams = htons(in);
3741 		addstrm.request_seq = htonl(asoc->strreset_outseq + !!out);
3742 		addstrm.reserved = 0;
3743 
3744 		sctp_addto_chunk(retval, size, &addstrm);
3745 	}
3746 
3747 	return retval;
3748 }
3749 
3750 /* RE-CONFIG 4.4 (RESP)
3751  *   0                   1                   2                   3
3752  *   0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
3753  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3754  *  |     Parameter Type = 16       |      Parameter Length         |
3755  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3756  *  |         Re-configuration Response Sequence Number             |
3757  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3758  *  |                            Result                             |
3759  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3760  */
3761 struct sctp_chunk *sctp_make_strreset_resp(const struct sctp_association *asoc,
3762 					   __u32 result, __u32 sn)
3763 {
3764 	struct sctp_strreset_resp resp;
3765 	__u16 length = sizeof(resp);
3766 	struct sctp_chunk *retval;
3767 
3768 	retval = sctp_make_reconf(asoc, length);
3769 	if (!retval)
3770 		return NULL;
3771 
3772 	resp.param_hdr.type = SCTP_PARAM_RESET_RESPONSE;
3773 	resp.param_hdr.length = htons(length);
3774 	resp.response_seq = htonl(sn);
3775 	resp.result = htonl(result);
3776 
3777 	sctp_addto_chunk(retval, sizeof(resp), &resp);
3778 
3779 	return retval;
3780 }
3781 
3782 /* RE-CONFIG 4.4 OPTIONAL (TSNRESP)
3783  *   0                   1                   2                   3
3784  *   0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
3785  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3786  *  |     Parameter Type = 16       |      Parameter Length         |
3787  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3788  *  |         Re-configuration Response Sequence Number             |
3789  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3790  *  |                            Result                             |
3791  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3792  *  |                   Sender's Next TSN (optional)                |
3793  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3794  *  |                  Receiver's Next TSN (optional)               |
3795  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
3796  */
3797 struct sctp_chunk *sctp_make_strreset_tsnresp(struct sctp_association *asoc,
3798 					      __u32 result, __u32 sn,
3799 					      __u32 sender_tsn,
3800 					      __u32 receiver_tsn)
3801 {
3802 	struct sctp_strreset_resptsn tsnresp;
3803 	__u16 length = sizeof(tsnresp);
3804 	struct sctp_chunk *retval;
3805 
3806 	retval = sctp_make_reconf(asoc, length);
3807 	if (!retval)
3808 		return NULL;
3809 
3810 	tsnresp.param_hdr.type = SCTP_PARAM_RESET_RESPONSE;
3811 	tsnresp.param_hdr.length = htons(length);
3812 
3813 	tsnresp.response_seq = htonl(sn);
3814 	tsnresp.result = htonl(result);
3815 	tsnresp.senders_next_tsn = htonl(sender_tsn);
3816 	tsnresp.receivers_next_tsn = htonl(receiver_tsn);
3817 
3818 	sctp_addto_chunk(retval, sizeof(tsnresp), &tsnresp);
3819 
3820 	return retval;
3821 }
3822 
3823 bool sctp_verify_reconf(const struct sctp_association *asoc,
3824 			struct sctp_chunk *chunk,
3825 			struct sctp_paramhdr **errp)
3826 {
3827 	struct sctp_reconf_chunk *hdr;
3828 	union sctp_params param;
3829 	__be16 last = 0;
3830 	__u16 cnt = 0;
3831 
3832 	hdr = (struct sctp_reconf_chunk *)chunk->chunk_hdr;
3833 	sctp_walk_params(param, hdr, params) {
3834 		__u16 length = ntohs(param.p->length);
3835 
3836 		*errp = param.p;
3837 		if (cnt++ > 2)
3838 			return false;
3839 		switch (param.p->type) {
3840 		case SCTP_PARAM_RESET_OUT_REQUEST:
3841 			if (length < sizeof(struct sctp_strreset_outreq) ||
3842 			    (last && last != SCTP_PARAM_RESET_RESPONSE &&
3843 			     last != SCTP_PARAM_RESET_IN_REQUEST))
3844 				return false;
3845 			break;
3846 		case SCTP_PARAM_RESET_IN_REQUEST:
3847 			if (length < sizeof(struct sctp_strreset_inreq) ||
3848 			    (last && last != SCTP_PARAM_RESET_OUT_REQUEST))
3849 				return false;
3850 			break;
3851 		case SCTP_PARAM_RESET_RESPONSE:
3852 			if ((length != sizeof(struct sctp_strreset_resp) &&
3853 			     length != sizeof(struct sctp_strreset_resptsn)) ||
3854 			    (last && last != SCTP_PARAM_RESET_RESPONSE &&
3855 			     last != SCTP_PARAM_RESET_OUT_REQUEST))
3856 				return false;
3857 			break;
3858 		case SCTP_PARAM_RESET_TSN_REQUEST:
3859 			if (length !=
3860 			    sizeof(struct sctp_strreset_tsnreq) || last)
3861 				return false;
3862 			break;
3863 		case SCTP_PARAM_RESET_ADD_IN_STREAMS:
3864 			if (length != sizeof(struct sctp_strreset_addstrm) ||
3865 			    (last && last != SCTP_PARAM_RESET_ADD_OUT_STREAMS))
3866 				return false;
3867 			break;
3868 		case SCTP_PARAM_RESET_ADD_OUT_STREAMS:
3869 			if (length != sizeof(struct sctp_strreset_addstrm) ||
3870 			    (last && last != SCTP_PARAM_RESET_ADD_IN_STREAMS))
3871 				return false;
3872 			break;
3873 		default:
3874 			return false;
3875 		}
3876 
3877 		last = param.p->type;
3878 	}
3879 
3880 	return true;
3881 }
3882