1 /* SCTP kernel implementation 2 * (C) Copyright IBM Corp. 2001, 2004 3 * Copyright (c) 1999 Cisco, Inc. 4 * Copyright (c) 1999-2001 Motorola, Inc. 5 * 6 * This file is part of the SCTP kernel implementation 7 * 8 * These functions work with the state functions in sctp_sm_statefuns.c 9 * to implement that state operations. These functions implement the 10 * steps which require modifying existing data structures. 11 * 12 * This SCTP implementation is free software; 13 * you can redistribute it and/or modify it under the terms of 14 * the GNU General Public License as published by 15 * the Free Software Foundation; either version 2, or (at your option) 16 * any later version. 17 * 18 * This SCTP implementation is distributed in the hope that it 19 * will be useful, but WITHOUT ANY WARRANTY; without even the implied 20 * ************************ 21 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 22 * See the GNU General Public License for more details. 23 * 24 * You should have received a copy of the GNU General Public License 25 * along with GNU CC; see the file COPYING. If not, write to 26 * the Free Software Foundation, 59 Temple Place - Suite 330, 27 * Boston, MA 02111-1307, USA. 28 * 29 * Please send any bug reports or fixes you make to the 30 * email address(es): 31 * lksctp developers <linux-sctp@vger.kernel.org> 32 * 33 * Written or modified by: 34 * La Monte H.P. Yarroll <piggy@acm.org> 35 * Karl Knutson <karl@athena.chicago.il.us> 36 * Jon Grimm <jgrimm@austin.ibm.com> 37 * Hui Huang <hui.huang@nokia.com> 38 * Dajiang Zhang <dajiang.zhang@nokia.com> 39 * Daisy Chang <daisyc@us.ibm.com> 40 * Sridhar Samudrala <sri@us.ibm.com> 41 * Ardelle Fan <ardelle.fan@intel.com> 42 */ 43 44 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 45 46 #include <linux/skbuff.h> 47 #include <linux/types.h> 48 #include <linux/socket.h> 49 #include <linux/ip.h> 50 #include <linux/gfp.h> 51 #include <net/sock.h> 52 #include <net/sctp/sctp.h> 53 #include <net/sctp/sm.h> 54 55 static int sctp_cmd_interpreter(sctp_event_t event_type, 56 sctp_subtype_t subtype, 57 sctp_state_t state, 58 struct sctp_endpoint *ep, 59 struct sctp_association *asoc, 60 void *event_arg, 61 sctp_disposition_t status, 62 sctp_cmd_seq_t *commands, 63 gfp_t gfp); 64 static int sctp_side_effects(sctp_event_t event_type, sctp_subtype_t subtype, 65 sctp_state_t state, 66 struct sctp_endpoint *ep, 67 struct sctp_association *asoc, 68 void *event_arg, 69 sctp_disposition_t status, 70 sctp_cmd_seq_t *commands, 71 gfp_t gfp); 72 73 static void sctp_cmd_hb_timer_update(sctp_cmd_seq_t *cmds, 74 struct sctp_transport *t); 75 /******************************************************************** 76 * Helper functions 77 ********************************************************************/ 78 79 /* A helper function for delayed processing of INET ECN CE bit. */ 80 static void sctp_do_ecn_ce_work(struct sctp_association *asoc, 81 __u32 lowest_tsn) 82 { 83 /* Save the TSN away for comparison when we receive CWR */ 84 85 asoc->last_ecne_tsn = lowest_tsn; 86 asoc->need_ecne = 1; 87 } 88 89 /* Helper function for delayed processing of SCTP ECNE chunk. */ 90 /* RFC 2960 Appendix A 91 * 92 * RFC 2481 details a specific bit for a sender to send in 93 * the header of its next outbound TCP segment to indicate to 94 * its peer that it has reduced its congestion window. This 95 * is termed the CWR bit. For SCTP the same indication is made 96 * by including the CWR chunk. This chunk contains one data 97 * element, i.e. the TSN number that was sent in the ECNE chunk. 98 * This element represents the lowest TSN number in the datagram 99 * that was originally marked with the CE bit. 100 */ 101 static struct sctp_chunk *sctp_do_ecn_ecne_work(struct sctp_association *asoc, 102 __u32 lowest_tsn, 103 struct sctp_chunk *chunk) 104 { 105 struct sctp_chunk *repl; 106 107 /* Our previously transmitted packet ran into some congestion 108 * so we should take action by reducing cwnd and ssthresh 109 * and then ACK our peer that we we've done so by 110 * sending a CWR. 111 */ 112 113 /* First, try to determine if we want to actually lower 114 * our cwnd variables. Only lower them if the ECNE looks more 115 * recent than the last response. 116 */ 117 if (TSN_lt(asoc->last_cwr_tsn, lowest_tsn)) { 118 struct sctp_transport *transport; 119 120 /* Find which transport's congestion variables 121 * need to be adjusted. 122 */ 123 transport = sctp_assoc_lookup_tsn(asoc, lowest_tsn); 124 125 /* Update the congestion variables. */ 126 if (transport) 127 sctp_transport_lower_cwnd(transport, 128 SCTP_LOWER_CWND_ECNE); 129 asoc->last_cwr_tsn = lowest_tsn; 130 } 131 132 /* Always try to quiet the other end. In case of lost CWR, 133 * resend last_cwr_tsn. 134 */ 135 repl = sctp_make_cwr(asoc, asoc->last_cwr_tsn, chunk); 136 137 /* If we run out of memory, it will look like a lost CWR. We'll 138 * get back in sync eventually. 139 */ 140 return repl; 141 } 142 143 /* Helper function to do delayed processing of ECN CWR chunk. */ 144 static void sctp_do_ecn_cwr_work(struct sctp_association *asoc, 145 __u32 lowest_tsn) 146 { 147 /* Turn off ECNE getting auto-prepended to every outgoing 148 * packet 149 */ 150 asoc->need_ecne = 0; 151 } 152 153 /* Generate SACK if necessary. We call this at the end of a packet. */ 154 static int sctp_gen_sack(struct sctp_association *asoc, int force, 155 sctp_cmd_seq_t *commands) 156 { 157 __u32 ctsn, max_tsn_seen; 158 struct sctp_chunk *sack; 159 struct sctp_transport *trans = asoc->peer.last_data_from; 160 int error = 0; 161 162 if (force || 163 (!trans && (asoc->param_flags & SPP_SACKDELAY_DISABLE)) || 164 (trans && (trans->param_flags & SPP_SACKDELAY_DISABLE))) 165 asoc->peer.sack_needed = 1; 166 167 ctsn = sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map); 168 max_tsn_seen = sctp_tsnmap_get_max_tsn_seen(&asoc->peer.tsn_map); 169 170 /* From 12.2 Parameters necessary per association (i.e. the TCB): 171 * 172 * Ack State : This flag indicates if the next received packet 173 * : is to be responded to with a SACK. ... 174 * : When DATA chunks are out of order, SACK's 175 * : are not delayed (see Section 6). 176 * 177 * [This is actually not mentioned in Section 6, but we 178 * implement it here anyway. --piggy] 179 */ 180 if (max_tsn_seen != ctsn) 181 asoc->peer.sack_needed = 1; 182 183 /* From 6.2 Acknowledgement on Reception of DATA Chunks: 184 * 185 * Section 4.2 of [RFC2581] SHOULD be followed. Specifically, 186 * an acknowledgement SHOULD be generated for at least every 187 * second packet (not every second DATA chunk) received, and 188 * SHOULD be generated within 200 ms of the arrival of any 189 * unacknowledged DATA chunk. ... 190 */ 191 if (!asoc->peer.sack_needed) { 192 asoc->peer.sack_cnt++; 193 194 /* Set the SACK delay timeout based on the 195 * SACK delay for the last transport 196 * data was received from, or the default 197 * for the association. 198 */ 199 if (trans) { 200 /* We will need a SACK for the next packet. */ 201 if (asoc->peer.sack_cnt >= trans->sackfreq - 1) 202 asoc->peer.sack_needed = 1; 203 204 asoc->timeouts[SCTP_EVENT_TIMEOUT_SACK] = 205 trans->sackdelay; 206 } else { 207 /* We will need a SACK for the next packet. */ 208 if (asoc->peer.sack_cnt >= asoc->sackfreq - 1) 209 asoc->peer.sack_needed = 1; 210 211 asoc->timeouts[SCTP_EVENT_TIMEOUT_SACK] = 212 asoc->sackdelay; 213 } 214 215 /* Restart the SACK timer. */ 216 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART, 217 SCTP_TO(SCTP_EVENT_TIMEOUT_SACK)); 218 } else { 219 asoc->a_rwnd = asoc->rwnd; 220 sack = sctp_make_sack(asoc); 221 if (!sack) 222 goto nomem; 223 224 asoc->peer.sack_needed = 0; 225 asoc->peer.sack_cnt = 0; 226 227 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(sack)); 228 229 /* Stop the SACK timer. */ 230 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, 231 SCTP_TO(SCTP_EVENT_TIMEOUT_SACK)); 232 } 233 234 return error; 235 nomem: 236 error = -ENOMEM; 237 return error; 238 } 239 240 /* When the T3-RTX timer expires, it calls this function to create the 241 * relevant state machine event. 242 */ 243 void sctp_generate_t3_rtx_event(unsigned long peer) 244 { 245 int error; 246 struct sctp_transport *transport = (struct sctp_transport *) peer; 247 struct sctp_association *asoc = transport->asoc; 248 struct net *net = sock_net(asoc->base.sk); 249 250 /* Check whether a task is in the sock. */ 251 252 sctp_bh_lock_sock(asoc->base.sk); 253 if (sock_owned_by_user(asoc->base.sk)) { 254 pr_debug("%s: sock is busy\n", __func__); 255 256 /* Try again later. */ 257 if (!mod_timer(&transport->T3_rtx_timer, jiffies + (HZ/20))) 258 sctp_transport_hold(transport); 259 goto out_unlock; 260 } 261 262 /* Is this transport really dead and just waiting around for 263 * the timer to let go of the reference? 264 */ 265 if (transport->dead) 266 goto out_unlock; 267 268 /* Run through the state machine. */ 269 error = sctp_do_sm(net, SCTP_EVENT_T_TIMEOUT, 270 SCTP_ST_TIMEOUT(SCTP_EVENT_TIMEOUT_T3_RTX), 271 asoc->state, 272 asoc->ep, asoc, 273 transport, GFP_ATOMIC); 274 275 if (error) 276 asoc->base.sk->sk_err = -error; 277 278 out_unlock: 279 sctp_bh_unlock_sock(asoc->base.sk); 280 sctp_transport_put(transport); 281 } 282 283 /* This is a sa interface for producing timeout events. It works 284 * for timeouts which use the association as their parameter. 285 */ 286 static void sctp_generate_timeout_event(struct sctp_association *asoc, 287 sctp_event_timeout_t timeout_type) 288 { 289 struct net *net = sock_net(asoc->base.sk); 290 int error = 0; 291 292 sctp_bh_lock_sock(asoc->base.sk); 293 if (sock_owned_by_user(asoc->base.sk)) { 294 pr_debug("%s: sock is busy: timer %d\n", __func__, 295 timeout_type); 296 297 /* Try again later. */ 298 if (!mod_timer(&asoc->timers[timeout_type], jiffies + (HZ/20))) 299 sctp_association_hold(asoc); 300 goto out_unlock; 301 } 302 303 /* Is this association really dead and just waiting around for 304 * the timer to let go of the reference? 305 */ 306 if (asoc->base.dead) 307 goto out_unlock; 308 309 /* Run through the state machine. */ 310 error = sctp_do_sm(net, SCTP_EVENT_T_TIMEOUT, 311 SCTP_ST_TIMEOUT(timeout_type), 312 asoc->state, asoc->ep, asoc, 313 (void *)timeout_type, GFP_ATOMIC); 314 315 if (error) 316 asoc->base.sk->sk_err = -error; 317 318 out_unlock: 319 sctp_bh_unlock_sock(asoc->base.sk); 320 sctp_association_put(asoc); 321 } 322 323 static void sctp_generate_t1_cookie_event(unsigned long data) 324 { 325 struct sctp_association *asoc = (struct sctp_association *) data; 326 sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_T1_COOKIE); 327 } 328 329 static void sctp_generate_t1_init_event(unsigned long data) 330 { 331 struct sctp_association *asoc = (struct sctp_association *) data; 332 sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_T1_INIT); 333 } 334 335 static void sctp_generate_t2_shutdown_event(unsigned long data) 336 { 337 struct sctp_association *asoc = (struct sctp_association *) data; 338 sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_T2_SHUTDOWN); 339 } 340 341 static void sctp_generate_t4_rto_event(unsigned long data) 342 { 343 struct sctp_association *asoc = (struct sctp_association *) data; 344 sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_T4_RTO); 345 } 346 347 static void sctp_generate_t5_shutdown_guard_event(unsigned long data) 348 { 349 struct sctp_association *asoc = (struct sctp_association *)data; 350 sctp_generate_timeout_event(asoc, 351 SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD); 352 353 } /* sctp_generate_t5_shutdown_guard_event() */ 354 355 static void sctp_generate_autoclose_event(unsigned long data) 356 { 357 struct sctp_association *asoc = (struct sctp_association *) data; 358 sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_AUTOCLOSE); 359 } 360 361 /* Generate a heart beat event. If the sock is busy, reschedule. Make 362 * sure that the transport is still valid. 363 */ 364 void sctp_generate_heartbeat_event(unsigned long data) 365 { 366 int error = 0; 367 struct sctp_transport *transport = (struct sctp_transport *) data; 368 struct sctp_association *asoc = transport->asoc; 369 struct net *net = sock_net(asoc->base.sk); 370 371 sctp_bh_lock_sock(asoc->base.sk); 372 if (sock_owned_by_user(asoc->base.sk)) { 373 pr_debug("%s: sock is busy\n", __func__); 374 375 /* Try again later. */ 376 if (!mod_timer(&transport->hb_timer, jiffies + (HZ/20))) 377 sctp_transport_hold(transport); 378 goto out_unlock; 379 } 380 381 /* Is this structure just waiting around for us to actually 382 * get destroyed? 383 */ 384 if (transport->dead) 385 goto out_unlock; 386 387 error = sctp_do_sm(net, SCTP_EVENT_T_TIMEOUT, 388 SCTP_ST_TIMEOUT(SCTP_EVENT_TIMEOUT_HEARTBEAT), 389 asoc->state, asoc->ep, asoc, 390 transport, GFP_ATOMIC); 391 392 if (error) 393 asoc->base.sk->sk_err = -error; 394 395 out_unlock: 396 sctp_bh_unlock_sock(asoc->base.sk); 397 sctp_transport_put(transport); 398 } 399 400 /* Handle the timeout of the ICMP protocol unreachable timer. Trigger 401 * the correct state machine transition that will close the association. 402 */ 403 void sctp_generate_proto_unreach_event(unsigned long data) 404 { 405 struct sctp_transport *transport = (struct sctp_transport *) data; 406 struct sctp_association *asoc = transport->asoc; 407 struct net *net = sock_net(asoc->base.sk); 408 409 sctp_bh_lock_sock(asoc->base.sk); 410 if (sock_owned_by_user(asoc->base.sk)) { 411 pr_debug("%s: sock is busy\n", __func__); 412 413 /* Try again later. */ 414 if (!mod_timer(&transport->proto_unreach_timer, 415 jiffies + (HZ/20))) 416 sctp_association_hold(asoc); 417 goto out_unlock; 418 } 419 420 /* Is this structure just waiting around for us to actually 421 * get destroyed? 422 */ 423 if (asoc->base.dead) 424 goto out_unlock; 425 426 sctp_do_sm(net, SCTP_EVENT_T_OTHER, 427 SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH), 428 asoc->state, asoc->ep, asoc, transport, GFP_ATOMIC); 429 430 out_unlock: 431 sctp_bh_unlock_sock(asoc->base.sk); 432 sctp_association_put(asoc); 433 } 434 435 436 /* Inject a SACK Timeout event into the state machine. */ 437 static void sctp_generate_sack_event(unsigned long data) 438 { 439 struct sctp_association *asoc = (struct sctp_association *) data; 440 sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_SACK); 441 } 442 443 sctp_timer_event_t *sctp_timer_events[SCTP_NUM_TIMEOUT_TYPES] = { 444 NULL, 445 sctp_generate_t1_cookie_event, 446 sctp_generate_t1_init_event, 447 sctp_generate_t2_shutdown_event, 448 NULL, 449 sctp_generate_t4_rto_event, 450 sctp_generate_t5_shutdown_guard_event, 451 NULL, 452 sctp_generate_sack_event, 453 sctp_generate_autoclose_event, 454 }; 455 456 457 /* RFC 2960 8.2 Path Failure Detection 458 * 459 * When its peer endpoint is multi-homed, an endpoint should keep a 460 * error counter for each of the destination transport addresses of the 461 * peer endpoint. 462 * 463 * Each time the T3-rtx timer expires on any address, or when a 464 * HEARTBEAT sent to an idle address is not acknowledged within a RTO, 465 * the error counter of that destination address will be incremented. 466 * When the value in the error counter exceeds the protocol parameter 467 * 'Path.Max.Retrans' of that destination address, the endpoint should 468 * mark the destination transport address as inactive, and a 469 * notification SHOULD be sent to the upper layer. 470 * 471 */ 472 static void sctp_do_8_2_transport_strike(sctp_cmd_seq_t *commands, 473 struct sctp_association *asoc, 474 struct sctp_transport *transport, 475 int is_hb) 476 { 477 /* The check for association's overall error counter exceeding the 478 * threshold is done in the state function. 479 */ 480 /* We are here due to a timer expiration. If the timer was 481 * not a HEARTBEAT, then normal error tracking is done. 482 * If the timer was a heartbeat, we only increment error counts 483 * when we already have an outstanding HEARTBEAT that has not 484 * been acknowledged. 485 * Additionally, some tranport states inhibit error increments. 486 */ 487 if (!is_hb) { 488 asoc->overall_error_count++; 489 if (transport->state != SCTP_INACTIVE) 490 transport->error_count++; 491 } else if (transport->hb_sent) { 492 if (transport->state != SCTP_UNCONFIRMED) 493 asoc->overall_error_count++; 494 if (transport->state != SCTP_INACTIVE) 495 transport->error_count++; 496 } 497 498 /* If the transport error count is greater than the pf_retrans 499 * threshold, and less than pathmaxrtx, then mark this transport 500 * as Partially Failed, ee SCTP Quick Failover Draft, secon 5.1, 501 * point 1 502 */ 503 if ((transport->state != SCTP_PF) && 504 (asoc->pf_retrans < transport->pathmaxrxt) && 505 (transport->error_count > asoc->pf_retrans)) { 506 507 sctp_assoc_control_transport(asoc, transport, 508 SCTP_TRANSPORT_PF, 509 0); 510 511 /* Update the hb timer to resend a heartbeat every rto */ 512 sctp_cmd_hb_timer_update(commands, transport); 513 } 514 515 if (transport->state != SCTP_INACTIVE && 516 (transport->error_count > transport->pathmaxrxt)) { 517 pr_debug("%s: association:%p transport addr:%pISpc failed\n", 518 __func__, asoc, &transport->ipaddr.sa); 519 520 sctp_assoc_control_transport(asoc, transport, 521 SCTP_TRANSPORT_DOWN, 522 SCTP_FAILED_THRESHOLD); 523 } 524 525 /* E2) For the destination address for which the timer 526 * expires, set RTO <- RTO * 2 ("back off the timer"). The 527 * maximum value discussed in rule C7 above (RTO.max) may be 528 * used to provide an upper bound to this doubling operation. 529 * 530 * Special Case: the first HB doesn't trigger exponential backoff. 531 * The first unacknowledged HB triggers it. We do this with a flag 532 * that indicates that we have an outstanding HB. 533 */ 534 if (!is_hb || transport->hb_sent) { 535 transport->rto = min((transport->rto * 2), transport->asoc->rto_max); 536 sctp_max_rto(asoc, transport); 537 } 538 } 539 540 /* Worker routine to handle INIT command failure. */ 541 static void sctp_cmd_init_failed(sctp_cmd_seq_t *commands, 542 struct sctp_association *asoc, 543 unsigned int error) 544 { 545 struct sctp_ulpevent *event; 546 547 event = sctp_ulpevent_make_assoc_change(asoc,0, SCTP_CANT_STR_ASSOC, 548 (__u16)error, 0, 0, NULL, 549 GFP_ATOMIC); 550 551 if (event) 552 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, 553 SCTP_ULPEVENT(event)); 554 555 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE, 556 SCTP_STATE(SCTP_STATE_CLOSED)); 557 558 /* SEND_FAILED sent later when cleaning up the association. */ 559 asoc->outqueue.error = error; 560 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL()); 561 } 562 563 /* Worker routine to handle SCTP_CMD_ASSOC_FAILED. */ 564 static void sctp_cmd_assoc_failed(sctp_cmd_seq_t *commands, 565 struct sctp_association *asoc, 566 sctp_event_t event_type, 567 sctp_subtype_t subtype, 568 struct sctp_chunk *chunk, 569 unsigned int error) 570 { 571 struct sctp_ulpevent *event; 572 struct sctp_chunk *abort; 573 /* Cancel any partial delivery in progress. */ 574 sctp_ulpq_abort_pd(&asoc->ulpq, GFP_ATOMIC); 575 576 if (event_type == SCTP_EVENT_T_CHUNK && subtype.chunk == SCTP_CID_ABORT) 577 event = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_COMM_LOST, 578 (__u16)error, 0, 0, chunk, 579 GFP_ATOMIC); 580 else 581 event = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_COMM_LOST, 582 (__u16)error, 0, 0, NULL, 583 GFP_ATOMIC); 584 if (event) 585 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, 586 SCTP_ULPEVENT(event)); 587 588 if (asoc->overall_error_count >= asoc->max_retrans) { 589 abort = sctp_make_violation_max_retrans(asoc, chunk); 590 if (abort) 591 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, 592 SCTP_CHUNK(abort)); 593 } 594 595 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE, 596 SCTP_STATE(SCTP_STATE_CLOSED)); 597 598 /* SEND_FAILED sent later when cleaning up the association. */ 599 asoc->outqueue.error = error; 600 sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL()); 601 } 602 603 /* Process an init chunk (may be real INIT/INIT-ACK or an embedded INIT 604 * inside the cookie. In reality, this is only used for INIT-ACK processing 605 * since all other cases use "temporary" associations and can do all 606 * their work in statefuns directly. 607 */ 608 static int sctp_cmd_process_init(sctp_cmd_seq_t *commands, 609 struct sctp_association *asoc, 610 struct sctp_chunk *chunk, 611 sctp_init_chunk_t *peer_init, 612 gfp_t gfp) 613 { 614 int error; 615 616 /* We only process the init as a sideeffect in a single 617 * case. This is when we process the INIT-ACK. If we 618 * fail during INIT processing (due to malloc problems), 619 * just return the error and stop processing the stack. 620 */ 621 if (!sctp_process_init(asoc, chunk, sctp_source(chunk), peer_init, gfp)) 622 error = -ENOMEM; 623 else 624 error = 0; 625 626 return error; 627 } 628 629 /* Helper function to break out starting up of heartbeat timers. */ 630 static void sctp_cmd_hb_timers_start(sctp_cmd_seq_t *cmds, 631 struct sctp_association *asoc) 632 { 633 struct sctp_transport *t; 634 635 /* Start a heartbeat timer for each transport on the association. 636 * hold a reference on the transport to make sure none of 637 * the needed data structures go away. 638 */ 639 list_for_each_entry(t, &asoc->peer.transport_addr_list, transports) { 640 641 if (!mod_timer(&t->hb_timer, sctp_transport_timeout(t))) 642 sctp_transport_hold(t); 643 } 644 } 645 646 static void sctp_cmd_hb_timers_stop(sctp_cmd_seq_t *cmds, 647 struct sctp_association *asoc) 648 { 649 struct sctp_transport *t; 650 651 /* Stop all heartbeat timers. */ 652 653 list_for_each_entry(t, &asoc->peer.transport_addr_list, 654 transports) { 655 if (del_timer(&t->hb_timer)) 656 sctp_transport_put(t); 657 } 658 } 659 660 /* Helper function to stop any pending T3-RTX timers */ 661 static void sctp_cmd_t3_rtx_timers_stop(sctp_cmd_seq_t *cmds, 662 struct sctp_association *asoc) 663 { 664 struct sctp_transport *t; 665 666 list_for_each_entry(t, &asoc->peer.transport_addr_list, 667 transports) { 668 if (del_timer(&t->T3_rtx_timer)) 669 sctp_transport_put(t); 670 } 671 } 672 673 674 /* Helper function to update the heartbeat timer. */ 675 static void sctp_cmd_hb_timer_update(sctp_cmd_seq_t *cmds, 676 struct sctp_transport *t) 677 { 678 /* Update the heartbeat timer. */ 679 if (!mod_timer(&t->hb_timer, sctp_transport_timeout(t))) 680 sctp_transport_hold(t); 681 } 682 683 /* Helper function to handle the reception of an HEARTBEAT ACK. */ 684 static void sctp_cmd_transport_on(sctp_cmd_seq_t *cmds, 685 struct sctp_association *asoc, 686 struct sctp_transport *t, 687 struct sctp_chunk *chunk) 688 { 689 sctp_sender_hb_info_t *hbinfo; 690 int was_unconfirmed = 0; 691 692 /* 8.3 Upon the receipt of the HEARTBEAT ACK, the sender of the 693 * HEARTBEAT should clear the error counter of the destination 694 * transport address to which the HEARTBEAT was sent. 695 */ 696 t->error_count = 0; 697 698 /* 699 * Although RFC4960 specifies that the overall error count must 700 * be cleared when a HEARTBEAT ACK is received, we make an 701 * exception while in SHUTDOWN PENDING. If the peer keeps its 702 * window shut forever, we may never be able to transmit our 703 * outstanding data and rely on the retransmission limit be reached 704 * to shutdown the association. 705 */ 706 if (t->asoc->state != SCTP_STATE_SHUTDOWN_PENDING) 707 t->asoc->overall_error_count = 0; 708 709 /* Clear the hb_sent flag to signal that we had a good 710 * acknowledgement. 711 */ 712 t->hb_sent = 0; 713 714 /* Mark the destination transport address as active if it is not so 715 * marked. 716 */ 717 if ((t->state == SCTP_INACTIVE) || (t->state == SCTP_UNCONFIRMED)) { 718 was_unconfirmed = 1; 719 sctp_assoc_control_transport(asoc, t, SCTP_TRANSPORT_UP, 720 SCTP_HEARTBEAT_SUCCESS); 721 } 722 723 if (t->state == SCTP_PF) 724 sctp_assoc_control_transport(asoc, t, SCTP_TRANSPORT_UP, 725 SCTP_HEARTBEAT_SUCCESS); 726 727 /* HB-ACK was received for a the proper HB. Consider this 728 * forward progress. 729 */ 730 if (t->dst) 731 dst_confirm(t->dst); 732 733 /* The receiver of the HEARTBEAT ACK should also perform an 734 * RTT measurement for that destination transport address 735 * using the time value carried in the HEARTBEAT ACK chunk. 736 * If the transport's rto_pending variable has been cleared, 737 * it was most likely due to a retransmit. However, we want 738 * to re-enable it to properly update the rto. 739 */ 740 if (t->rto_pending == 0) 741 t->rto_pending = 1; 742 743 hbinfo = (sctp_sender_hb_info_t *) chunk->skb->data; 744 sctp_transport_update_rto(t, (jiffies - hbinfo->sent_at)); 745 746 /* Update the heartbeat timer. */ 747 if (!mod_timer(&t->hb_timer, sctp_transport_timeout(t))) 748 sctp_transport_hold(t); 749 750 if (was_unconfirmed && asoc->peer.transport_count == 1) 751 sctp_transport_immediate_rtx(t); 752 } 753 754 755 /* Helper function to process the process SACK command. */ 756 static int sctp_cmd_process_sack(sctp_cmd_seq_t *cmds, 757 struct sctp_association *asoc, 758 struct sctp_chunk *chunk) 759 { 760 int err = 0; 761 762 if (sctp_outq_sack(&asoc->outqueue, chunk)) { 763 struct net *net = sock_net(asoc->base.sk); 764 765 /* There are no more TSNs awaiting SACK. */ 766 err = sctp_do_sm(net, SCTP_EVENT_T_OTHER, 767 SCTP_ST_OTHER(SCTP_EVENT_NO_PENDING_TSN), 768 asoc->state, asoc->ep, asoc, NULL, 769 GFP_ATOMIC); 770 } 771 772 return err; 773 } 774 775 /* Helper function to set the timeout value for T2-SHUTDOWN timer and to set 776 * the transport for a shutdown chunk. 777 */ 778 static void sctp_cmd_setup_t2(sctp_cmd_seq_t *cmds, 779 struct sctp_association *asoc, 780 struct sctp_chunk *chunk) 781 { 782 struct sctp_transport *t; 783 784 if (chunk->transport) 785 t = chunk->transport; 786 else { 787 t = sctp_assoc_choose_alter_transport(asoc, 788 asoc->shutdown_last_sent_to); 789 chunk->transport = t; 790 } 791 asoc->shutdown_last_sent_to = t; 792 asoc->timeouts[SCTP_EVENT_TIMEOUT_T2_SHUTDOWN] = t->rto; 793 } 794 795 /* Helper function to change the state of an association. */ 796 static void sctp_cmd_new_state(sctp_cmd_seq_t *cmds, 797 struct sctp_association *asoc, 798 sctp_state_t state) 799 { 800 struct sock *sk = asoc->base.sk; 801 802 asoc->state = state; 803 804 pr_debug("%s: asoc:%p[%s]\n", __func__, asoc, sctp_state_tbl[state]); 805 806 if (sctp_style(sk, TCP)) { 807 /* Change the sk->sk_state of a TCP-style socket that has 808 * successfully completed a connect() call. 809 */ 810 if (sctp_state(asoc, ESTABLISHED) && sctp_sstate(sk, CLOSED)) 811 sk->sk_state = SCTP_SS_ESTABLISHED; 812 813 /* Set the RCV_SHUTDOWN flag when a SHUTDOWN is received. */ 814 if (sctp_state(asoc, SHUTDOWN_RECEIVED) && 815 sctp_sstate(sk, ESTABLISHED)) 816 sk->sk_shutdown |= RCV_SHUTDOWN; 817 } 818 819 if (sctp_state(asoc, COOKIE_WAIT)) { 820 /* Reset init timeouts since they may have been 821 * increased due to timer expirations. 822 */ 823 asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_INIT] = 824 asoc->rto_initial; 825 asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_COOKIE] = 826 asoc->rto_initial; 827 } 828 829 if (sctp_state(asoc, ESTABLISHED) || 830 sctp_state(asoc, CLOSED) || 831 sctp_state(asoc, SHUTDOWN_RECEIVED)) { 832 /* Wake up any processes waiting in the asoc's wait queue in 833 * sctp_wait_for_connect() or sctp_wait_for_sndbuf(). 834 */ 835 if (waitqueue_active(&asoc->wait)) 836 wake_up_interruptible(&asoc->wait); 837 838 /* Wake up any processes waiting in the sk's sleep queue of 839 * a TCP-style or UDP-style peeled-off socket in 840 * sctp_wait_for_accept() or sctp_wait_for_packet(). 841 * For a UDP-style socket, the waiters are woken up by the 842 * notifications. 843 */ 844 if (!sctp_style(sk, UDP)) 845 sk->sk_state_change(sk); 846 } 847 } 848 849 /* Helper function to delete an association. */ 850 static void sctp_cmd_delete_tcb(sctp_cmd_seq_t *cmds, 851 struct sctp_association *asoc) 852 { 853 struct sock *sk = asoc->base.sk; 854 855 /* If it is a non-temporary association belonging to a TCP-style 856 * listening socket that is not closed, do not free it so that accept() 857 * can pick it up later. 858 */ 859 if (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING) && 860 (!asoc->temp) && (sk->sk_shutdown != SHUTDOWN_MASK)) 861 return; 862 863 BUG_ON(asoc->peer.primary_path == NULL); 864 sctp_unhash_established(asoc); 865 sctp_association_free(asoc); 866 } 867 868 /* 869 * ADDIP Section 4.1 ASCONF Chunk Procedures 870 * A4) Start a T-4 RTO timer, using the RTO value of the selected 871 * destination address (we use active path instead of primary path just 872 * because primary path may be inactive. 873 */ 874 static void sctp_cmd_setup_t4(sctp_cmd_seq_t *cmds, 875 struct sctp_association *asoc, 876 struct sctp_chunk *chunk) 877 { 878 struct sctp_transport *t; 879 880 t = sctp_assoc_choose_alter_transport(asoc, chunk->transport); 881 asoc->timeouts[SCTP_EVENT_TIMEOUT_T4_RTO] = t->rto; 882 chunk->transport = t; 883 } 884 885 /* Process an incoming Operation Error Chunk. */ 886 static void sctp_cmd_process_operr(sctp_cmd_seq_t *cmds, 887 struct sctp_association *asoc, 888 struct sctp_chunk *chunk) 889 { 890 struct sctp_errhdr *err_hdr; 891 struct sctp_ulpevent *ev; 892 893 while (chunk->chunk_end > chunk->skb->data) { 894 err_hdr = (struct sctp_errhdr *)(chunk->skb->data); 895 896 ev = sctp_ulpevent_make_remote_error(asoc, chunk, 0, 897 GFP_ATOMIC); 898 if (!ev) 899 return; 900 901 sctp_ulpq_tail_event(&asoc->ulpq, ev); 902 903 switch (err_hdr->cause) { 904 case SCTP_ERROR_UNKNOWN_CHUNK: 905 { 906 sctp_chunkhdr_t *unk_chunk_hdr; 907 908 unk_chunk_hdr = (sctp_chunkhdr_t *)err_hdr->variable; 909 switch (unk_chunk_hdr->type) { 910 /* ADDIP 4.1 A9) If the peer responds to an ASCONF with 911 * an ERROR chunk reporting that it did not recognized 912 * the ASCONF chunk type, the sender of the ASCONF MUST 913 * NOT send any further ASCONF chunks and MUST stop its 914 * T-4 timer. 915 */ 916 case SCTP_CID_ASCONF: 917 if (asoc->peer.asconf_capable == 0) 918 break; 919 920 asoc->peer.asconf_capable = 0; 921 sctp_add_cmd_sf(cmds, SCTP_CMD_TIMER_STOP, 922 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO)); 923 break; 924 default: 925 break; 926 } 927 break; 928 } 929 default: 930 break; 931 } 932 } 933 } 934 935 /* Process variable FWDTSN chunk information. */ 936 static void sctp_cmd_process_fwdtsn(struct sctp_ulpq *ulpq, 937 struct sctp_chunk *chunk) 938 { 939 struct sctp_fwdtsn_skip *skip; 940 /* Walk through all the skipped SSNs */ 941 sctp_walk_fwdtsn(skip, chunk) { 942 sctp_ulpq_skip(ulpq, ntohs(skip->stream), ntohs(skip->ssn)); 943 } 944 } 945 946 /* Helper function to remove the association non-primary peer 947 * transports. 948 */ 949 static void sctp_cmd_del_non_primary(struct sctp_association *asoc) 950 { 951 struct sctp_transport *t; 952 struct list_head *pos; 953 struct list_head *temp; 954 955 list_for_each_safe(pos, temp, &asoc->peer.transport_addr_list) { 956 t = list_entry(pos, struct sctp_transport, transports); 957 if (!sctp_cmp_addr_exact(&t->ipaddr, 958 &asoc->peer.primary_addr)) { 959 sctp_assoc_del_peer(asoc, &t->ipaddr); 960 } 961 } 962 } 963 964 /* Helper function to set sk_err on a 1-1 style socket. */ 965 static void sctp_cmd_set_sk_err(struct sctp_association *asoc, int error) 966 { 967 struct sock *sk = asoc->base.sk; 968 969 if (!sctp_style(sk, UDP)) 970 sk->sk_err = error; 971 } 972 973 /* Helper function to generate an association change event */ 974 static void sctp_cmd_assoc_change(sctp_cmd_seq_t *commands, 975 struct sctp_association *asoc, 976 u8 state) 977 { 978 struct sctp_ulpevent *ev; 979 980 ev = sctp_ulpevent_make_assoc_change(asoc, 0, state, 0, 981 asoc->c.sinit_num_ostreams, 982 asoc->c.sinit_max_instreams, 983 NULL, GFP_ATOMIC); 984 if (ev) 985 sctp_ulpq_tail_event(&asoc->ulpq, ev); 986 } 987 988 /* Helper function to generate an adaptation indication event */ 989 static void sctp_cmd_adaptation_ind(sctp_cmd_seq_t *commands, 990 struct sctp_association *asoc) 991 { 992 struct sctp_ulpevent *ev; 993 994 ev = sctp_ulpevent_make_adaptation_indication(asoc, GFP_ATOMIC); 995 996 if (ev) 997 sctp_ulpq_tail_event(&asoc->ulpq, ev); 998 } 999 1000 1001 static void sctp_cmd_t1_timer_update(struct sctp_association *asoc, 1002 sctp_event_timeout_t timer, 1003 char *name) 1004 { 1005 struct sctp_transport *t; 1006 1007 t = asoc->init_last_sent_to; 1008 asoc->init_err_counter++; 1009 1010 if (t->init_sent_count > (asoc->init_cycle + 1)) { 1011 asoc->timeouts[timer] *= 2; 1012 if (asoc->timeouts[timer] > asoc->max_init_timeo) { 1013 asoc->timeouts[timer] = asoc->max_init_timeo; 1014 } 1015 asoc->init_cycle++; 1016 1017 pr_debug("%s: T1[%s] timeout adjustment init_err_counter:%d" 1018 " cycle:%d timeout:%ld\n", __func__, name, 1019 asoc->init_err_counter, asoc->init_cycle, 1020 asoc->timeouts[timer]); 1021 } 1022 1023 } 1024 1025 /* Send the whole message, chunk by chunk, to the outqueue. 1026 * This way the whole message is queued up and bundling if 1027 * encouraged for small fragments. 1028 */ 1029 static int sctp_cmd_send_msg(struct sctp_association *asoc, 1030 struct sctp_datamsg *msg) 1031 { 1032 struct sctp_chunk *chunk; 1033 int error = 0; 1034 1035 list_for_each_entry(chunk, &msg->chunks, frag_list) { 1036 error = sctp_outq_tail(&asoc->outqueue, chunk); 1037 if (error) 1038 break; 1039 } 1040 1041 return error; 1042 } 1043 1044 1045 /* Sent the next ASCONF packet currently stored in the association. 1046 * This happens after the ASCONF_ACK was succeffully processed. 1047 */ 1048 static void sctp_cmd_send_asconf(struct sctp_association *asoc) 1049 { 1050 struct net *net = sock_net(asoc->base.sk); 1051 1052 /* Send the next asconf chunk from the addip chunk 1053 * queue. 1054 */ 1055 if (!list_empty(&asoc->addip_chunk_list)) { 1056 struct list_head *entry = asoc->addip_chunk_list.next; 1057 struct sctp_chunk *asconf = list_entry(entry, 1058 struct sctp_chunk, list); 1059 list_del_init(entry); 1060 1061 /* Hold the chunk until an ASCONF_ACK is received. */ 1062 sctp_chunk_hold(asconf); 1063 if (sctp_primitive_ASCONF(net, asoc, asconf)) 1064 sctp_chunk_free(asconf); 1065 else 1066 asoc->addip_last_asconf = asconf; 1067 } 1068 } 1069 1070 1071 /* These three macros allow us to pull the debugging code out of the 1072 * main flow of sctp_do_sm() to keep attention focused on the real 1073 * functionality there. 1074 */ 1075 #define debug_pre_sfn() \ 1076 pr_debug("%s[pre-fn]: ep:%p, %s, %s, asoc:%p[%s], %s\n", __func__, \ 1077 ep, sctp_evttype_tbl[event_type], (*debug_fn)(subtype), \ 1078 asoc, sctp_state_tbl[state], state_fn->name) 1079 1080 #define debug_post_sfn() \ 1081 pr_debug("%s[post-fn]: asoc:%p, status:%s\n", __func__, asoc, \ 1082 sctp_status_tbl[status]) 1083 1084 #define debug_post_sfx() \ 1085 pr_debug("%s[post-sfx]: error:%d, asoc:%p[%s]\n", __func__, error, \ 1086 asoc, sctp_state_tbl[(asoc && sctp_id2assoc(ep->base.sk, \ 1087 sctp_assoc2id(asoc))) ? asoc->state : SCTP_STATE_CLOSED]) 1088 1089 /* 1090 * This is the master state machine processing function. 1091 * 1092 * If you want to understand all of lksctp, this is a 1093 * good place to start. 1094 */ 1095 int sctp_do_sm(struct net *net, sctp_event_t event_type, sctp_subtype_t subtype, 1096 sctp_state_t state, 1097 struct sctp_endpoint *ep, 1098 struct sctp_association *asoc, 1099 void *event_arg, 1100 gfp_t gfp) 1101 { 1102 sctp_cmd_seq_t commands; 1103 const sctp_sm_table_entry_t *state_fn; 1104 sctp_disposition_t status; 1105 int error = 0; 1106 typedef const char *(printfn_t)(sctp_subtype_t); 1107 static printfn_t *table[] = { 1108 NULL, sctp_cname, sctp_tname, sctp_oname, sctp_pname, 1109 }; 1110 printfn_t *debug_fn __attribute__ ((unused)) = table[event_type]; 1111 1112 /* Look up the state function, run it, and then process the 1113 * side effects. These three steps are the heart of lksctp. 1114 */ 1115 state_fn = sctp_sm_lookup_event(net, event_type, state, subtype); 1116 1117 sctp_init_cmd_seq(&commands); 1118 1119 debug_pre_sfn(); 1120 status = (*state_fn->fn)(net, ep, asoc, subtype, event_arg, &commands); 1121 debug_post_sfn(); 1122 1123 error = sctp_side_effects(event_type, subtype, state, 1124 ep, asoc, event_arg, status, 1125 &commands, gfp); 1126 debug_post_sfx(); 1127 1128 return error; 1129 } 1130 1131 /***************************************************************** 1132 * This the master state function side effect processing function. 1133 *****************************************************************/ 1134 static int sctp_side_effects(sctp_event_t event_type, sctp_subtype_t subtype, 1135 sctp_state_t state, 1136 struct sctp_endpoint *ep, 1137 struct sctp_association *asoc, 1138 void *event_arg, 1139 sctp_disposition_t status, 1140 sctp_cmd_seq_t *commands, 1141 gfp_t gfp) 1142 { 1143 int error; 1144 1145 /* FIXME - Most of the dispositions left today would be categorized 1146 * as "exceptional" dispositions. For those dispositions, it 1147 * may not be proper to run through any of the commands at all. 1148 * For example, the command interpreter might be run only with 1149 * disposition SCTP_DISPOSITION_CONSUME. 1150 */ 1151 if (0 != (error = sctp_cmd_interpreter(event_type, subtype, state, 1152 ep, asoc, 1153 event_arg, status, 1154 commands, gfp))) 1155 goto bail; 1156 1157 switch (status) { 1158 case SCTP_DISPOSITION_DISCARD: 1159 pr_debug("%s: ignored sctp protocol event - state:%d, " 1160 "event_type:%d, event_id:%d\n", __func__, state, 1161 event_type, subtype.chunk); 1162 break; 1163 1164 case SCTP_DISPOSITION_NOMEM: 1165 /* We ran out of memory, so we need to discard this 1166 * packet. 1167 */ 1168 /* BUG--we should now recover some memory, probably by 1169 * reneging... 1170 */ 1171 error = -ENOMEM; 1172 break; 1173 1174 case SCTP_DISPOSITION_DELETE_TCB: 1175 /* This should now be a command. */ 1176 break; 1177 1178 case SCTP_DISPOSITION_CONSUME: 1179 case SCTP_DISPOSITION_ABORT: 1180 /* 1181 * We should no longer have much work to do here as the 1182 * real work has been done as explicit commands above. 1183 */ 1184 break; 1185 1186 case SCTP_DISPOSITION_VIOLATION: 1187 net_err_ratelimited("protocol violation state %d chunkid %d\n", 1188 state, subtype.chunk); 1189 break; 1190 1191 case SCTP_DISPOSITION_NOT_IMPL: 1192 pr_warn("unimplemented feature in state %d, event_type %d, event_id %d\n", 1193 state, event_type, subtype.chunk); 1194 break; 1195 1196 case SCTP_DISPOSITION_BUG: 1197 pr_err("bug in state %d, event_type %d, event_id %d\n", 1198 state, event_type, subtype.chunk); 1199 BUG(); 1200 break; 1201 1202 default: 1203 pr_err("impossible disposition %d in state %d, event_type %d, event_id %d\n", 1204 status, state, event_type, subtype.chunk); 1205 BUG(); 1206 break; 1207 } 1208 1209 bail: 1210 return error; 1211 } 1212 1213 /******************************************************************** 1214 * 2nd Level Abstractions 1215 ********************************************************************/ 1216 1217 /* This is the side-effect interpreter. */ 1218 static int sctp_cmd_interpreter(sctp_event_t event_type, 1219 sctp_subtype_t subtype, 1220 sctp_state_t state, 1221 struct sctp_endpoint *ep, 1222 struct sctp_association *asoc, 1223 void *event_arg, 1224 sctp_disposition_t status, 1225 sctp_cmd_seq_t *commands, 1226 gfp_t gfp) 1227 { 1228 int error = 0; 1229 int force; 1230 sctp_cmd_t *cmd; 1231 struct sctp_chunk *new_obj; 1232 struct sctp_chunk *chunk = NULL; 1233 struct sctp_packet *packet; 1234 struct timer_list *timer; 1235 unsigned long timeout; 1236 struct sctp_transport *t; 1237 struct sctp_sackhdr sackh; 1238 int local_cork = 0; 1239 1240 if (SCTP_EVENT_T_TIMEOUT != event_type) 1241 chunk = event_arg; 1242 1243 /* Note: This whole file is a huge candidate for rework. 1244 * For example, each command could either have its own handler, so 1245 * the loop would look like: 1246 * while (cmds) 1247 * cmd->handle(x, y, z) 1248 * --jgrimm 1249 */ 1250 while (NULL != (cmd = sctp_next_cmd(commands))) { 1251 switch (cmd->verb) { 1252 case SCTP_CMD_NOP: 1253 /* Do nothing. */ 1254 break; 1255 1256 case SCTP_CMD_NEW_ASOC: 1257 /* Register a new association. */ 1258 if (local_cork) { 1259 sctp_outq_uncork(&asoc->outqueue); 1260 local_cork = 0; 1261 } 1262 1263 /* Register with the endpoint. */ 1264 asoc = cmd->obj.asoc; 1265 BUG_ON(asoc->peer.primary_path == NULL); 1266 sctp_endpoint_add_asoc(ep, asoc); 1267 sctp_hash_established(asoc); 1268 break; 1269 1270 case SCTP_CMD_UPDATE_ASSOC: 1271 sctp_assoc_update(asoc, cmd->obj.asoc); 1272 break; 1273 1274 case SCTP_CMD_PURGE_OUTQUEUE: 1275 sctp_outq_teardown(&asoc->outqueue); 1276 break; 1277 1278 case SCTP_CMD_DELETE_TCB: 1279 if (local_cork) { 1280 sctp_outq_uncork(&asoc->outqueue); 1281 local_cork = 0; 1282 } 1283 /* Delete the current association. */ 1284 sctp_cmd_delete_tcb(commands, asoc); 1285 asoc = NULL; 1286 break; 1287 1288 case SCTP_CMD_NEW_STATE: 1289 /* Enter a new state. */ 1290 sctp_cmd_new_state(commands, asoc, cmd->obj.state); 1291 break; 1292 1293 case SCTP_CMD_REPORT_TSN: 1294 /* Record the arrival of a TSN. */ 1295 error = sctp_tsnmap_mark(&asoc->peer.tsn_map, 1296 cmd->obj.u32, NULL); 1297 break; 1298 1299 case SCTP_CMD_REPORT_FWDTSN: 1300 /* Move the Cumulattive TSN Ack ahead. */ 1301 sctp_tsnmap_skip(&asoc->peer.tsn_map, cmd->obj.u32); 1302 1303 /* purge the fragmentation queue */ 1304 sctp_ulpq_reasm_flushtsn(&asoc->ulpq, cmd->obj.u32); 1305 1306 /* Abort any in progress partial delivery. */ 1307 sctp_ulpq_abort_pd(&asoc->ulpq, GFP_ATOMIC); 1308 break; 1309 1310 case SCTP_CMD_PROCESS_FWDTSN: 1311 sctp_cmd_process_fwdtsn(&asoc->ulpq, cmd->obj.chunk); 1312 break; 1313 1314 case SCTP_CMD_GEN_SACK: 1315 /* Generate a Selective ACK. 1316 * The argument tells us whether to just count 1317 * the packet and MAYBE generate a SACK, or 1318 * force a SACK out. 1319 */ 1320 force = cmd->obj.i32; 1321 error = sctp_gen_sack(asoc, force, commands); 1322 break; 1323 1324 case SCTP_CMD_PROCESS_SACK: 1325 /* Process an inbound SACK. */ 1326 error = sctp_cmd_process_sack(commands, asoc, 1327 cmd->obj.chunk); 1328 break; 1329 1330 case SCTP_CMD_GEN_INIT_ACK: 1331 /* Generate an INIT ACK chunk. */ 1332 new_obj = sctp_make_init_ack(asoc, chunk, GFP_ATOMIC, 1333 0); 1334 if (!new_obj) 1335 goto nomem; 1336 1337 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, 1338 SCTP_CHUNK(new_obj)); 1339 break; 1340 1341 case SCTP_CMD_PEER_INIT: 1342 /* Process a unified INIT from the peer. 1343 * Note: Only used during INIT-ACK processing. If 1344 * there is an error just return to the outter 1345 * layer which will bail. 1346 */ 1347 error = sctp_cmd_process_init(commands, asoc, chunk, 1348 cmd->obj.init, gfp); 1349 break; 1350 1351 case SCTP_CMD_GEN_COOKIE_ECHO: 1352 /* Generate a COOKIE ECHO chunk. */ 1353 new_obj = sctp_make_cookie_echo(asoc, chunk); 1354 if (!new_obj) { 1355 if (cmd->obj.chunk) 1356 sctp_chunk_free(cmd->obj.chunk); 1357 goto nomem; 1358 } 1359 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, 1360 SCTP_CHUNK(new_obj)); 1361 1362 /* If there is an ERROR chunk to be sent along with 1363 * the COOKIE_ECHO, send it, too. 1364 */ 1365 if (cmd->obj.chunk) 1366 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, 1367 SCTP_CHUNK(cmd->obj.chunk)); 1368 1369 if (new_obj->transport) { 1370 new_obj->transport->init_sent_count++; 1371 asoc->init_last_sent_to = new_obj->transport; 1372 } 1373 1374 /* FIXME - Eventually come up with a cleaner way to 1375 * enabling COOKIE-ECHO + DATA bundling during 1376 * multihoming stale cookie scenarios, the following 1377 * command plays with asoc->peer.retran_path to 1378 * avoid the problem of sending the COOKIE-ECHO and 1379 * DATA in different paths, which could result 1380 * in the association being ABORTed if the DATA chunk 1381 * is processed first by the server. Checking the 1382 * init error counter simply causes this command 1383 * to be executed only during failed attempts of 1384 * association establishment. 1385 */ 1386 if ((asoc->peer.retran_path != 1387 asoc->peer.primary_path) && 1388 (asoc->init_err_counter > 0)) { 1389 sctp_add_cmd_sf(commands, 1390 SCTP_CMD_FORCE_PRIM_RETRAN, 1391 SCTP_NULL()); 1392 } 1393 1394 break; 1395 1396 case SCTP_CMD_GEN_SHUTDOWN: 1397 /* Generate SHUTDOWN when in SHUTDOWN_SENT state. 1398 * Reset error counts. 1399 */ 1400 asoc->overall_error_count = 0; 1401 1402 /* Generate a SHUTDOWN chunk. */ 1403 new_obj = sctp_make_shutdown(asoc, chunk); 1404 if (!new_obj) 1405 goto nomem; 1406 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, 1407 SCTP_CHUNK(new_obj)); 1408 break; 1409 1410 case SCTP_CMD_CHUNK_ULP: 1411 /* Send a chunk to the sockets layer. */ 1412 pr_debug("%s: sm_sideff: chunk_up:%p, ulpq:%p\n", 1413 __func__, cmd->obj.chunk, &asoc->ulpq); 1414 1415 sctp_ulpq_tail_data(&asoc->ulpq, cmd->obj.chunk, 1416 GFP_ATOMIC); 1417 break; 1418 1419 case SCTP_CMD_EVENT_ULP: 1420 /* Send a notification to the sockets layer. */ 1421 pr_debug("%s: sm_sideff: event_up:%p, ulpq:%p\n", 1422 __func__, cmd->obj.ulpevent, &asoc->ulpq); 1423 1424 sctp_ulpq_tail_event(&asoc->ulpq, cmd->obj.ulpevent); 1425 break; 1426 1427 case SCTP_CMD_REPLY: 1428 /* If an caller has not already corked, do cork. */ 1429 if (!asoc->outqueue.cork) { 1430 sctp_outq_cork(&asoc->outqueue); 1431 local_cork = 1; 1432 } 1433 /* Send a chunk to our peer. */ 1434 error = sctp_outq_tail(&asoc->outqueue, cmd->obj.chunk); 1435 break; 1436 1437 case SCTP_CMD_SEND_PKT: 1438 /* Send a full packet to our peer. */ 1439 packet = cmd->obj.packet; 1440 sctp_packet_transmit(packet); 1441 sctp_ootb_pkt_free(packet); 1442 break; 1443 1444 case SCTP_CMD_T1_RETRAN: 1445 /* Mark a transport for retransmission. */ 1446 sctp_retransmit(&asoc->outqueue, cmd->obj.transport, 1447 SCTP_RTXR_T1_RTX); 1448 break; 1449 1450 case SCTP_CMD_RETRAN: 1451 /* Mark a transport for retransmission. */ 1452 sctp_retransmit(&asoc->outqueue, cmd->obj.transport, 1453 SCTP_RTXR_T3_RTX); 1454 break; 1455 1456 case SCTP_CMD_ECN_CE: 1457 /* Do delayed CE processing. */ 1458 sctp_do_ecn_ce_work(asoc, cmd->obj.u32); 1459 break; 1460 1461 case SCTP_CMD_ECN_ECNE: 1462 /* Do delayed ECNE processing. */ 1463 new_obj = sctp_do_ecn_ecne_work(asoc, cmd->obj.u32, 1464 chunk); 1465 if (new_obj) 1466 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, 1467 SCTP_CHUNK(new_obj)); 1468 break; 1469 1470 case SCTP_CMD_ECN_CWR: 1471 /* Do delayed CWR processing. */ 1472 sctp_do_ecn_cwr_work(asoc, cmd->obj.u32); 1473 break; 1474 1475 case SCTP_CMD_SETUP_T2: 1476 sctp_cmd_setup_t2(commands, asoc, cmd->obj.chunk); 1477 break; 1478 1479 case SCTP_CMD_TIMER_START_ONCE: 1480 timer = &asoc->timers[cmd->obj.to]; 1481 1482 if (timer_pending(timer)) 1483 break; 1484 /* fall through */ 1485 1486 case SCTP_CMD_TIMER_START: 1487 timer = &asoc->timers[cmd->obj.to]; 1488 timeout = asoc->timeouts[cmd->obj.to]; 1489 BUG_ON(!timeout); 1490 1491 timer->expires = jiffies + timeout; 1492 sctp_association_hold(asoc); 1493 add_timer(timer); 1494 break; 1495 1496 case SCTP_CMD_TIMER_RESTART: 1497 timer = &asoc->timers[cmd->obj.to]; 1498 timeout = asoc->timeouts[cmd->obj.to]; 1499 if (!mod_timer(timer, jiffies + timeout)) 1500 sctp_association_hold(asoc); 1501 break; 1502 1503 case SCTP_CMD_TIMER_STOP: 1504 timer = &asoc->timers[cmd->obj.to]; 1505 if (del_timer(timer)) 1506 sctp_association_put(asoc); 1507 break; 1508 1509 case SCTP_CMD_INIT_CHOOSE_TRANSPORT: 1510 chunk = cmd->obj.chunk; 1511 t = sctp_assoc_choose_alter_transport(asoc, 1512 asoc->init_last_sent_to); 1513 asoc->init_last_sent_to = t; 1514 chunk->transport = t; 1515 t->init_sent_count++; 1516 /* Set the new transport as primary */ 1517 sctp_assoc_set_primary(asoc, t); 1518 break; 1519 1520 case SCTP_CMD_INIT_RESTART: 1521 /* Do the needed accounting and updates 1522 * associated with restarting an initialization 1523 * timer. Only multiply the timeout by two if 1524 * all transports have been tried at the current 1525 * timeout. 1526 */ 1527 sctp_cmd_t1_timer_update(asoc, 1528 SCTP_EVENT_TIMEOUT_T1_INIT, 1529 "INIT"); 1530 1531 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART, 1532 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT)); 1533 break; 1534 1535 case SCTP_CMD_COOKIEECHO_RESTART: 1536 /* Do the needed accounting and updates 1537 * associated with restarting an initialization 1538 * timer. Only multiply the timeout by two if 1539 * all transports have been tried at the current 1540 * timeout. 1541 */ 1542 sctp_cmd_t1_timer_update(asoc, 1543 SCTP_EVENT_TIMEOUT_T1_COOKIE, 1544 "COOKIE"); 1545 1546 /* If we've sent any data bundled with 1547 * COOKIE-ECHO we need to resend. 1548 */ 1549 list_for_each_entry(t, &asoc->peer.transport_addr_list, 1550 transports) { 1551 sctp_retransmit_mark(&asoc->outqueue, t, 1552 SCTP_RTXR_T1_RTX); 1553 } 1554 1555 sctp_add_cmd_sf(commands, 1556 SCTP_CMD_TIMER_RESTART, 1557 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE)); 1558 break; 1559 1560 case SCTP_CMD_INIT_FAILED: 1561 sctp_cmd_init_failed(commands, asoc, cmd->obj.err); 1562 break; 1563 1564 case SCTP_CMD_ASSOC_FAILED: 1565 sctp_cmd_assoc_failed(commands, asoc, event_type, 1566 subtype, chunk, cmd->obj.err); 1567 break; 1568 1569 case SCTP_CMD_INIT_COUNTER_INC: 1570 asoc->init_err_counter++; 1571 break; 1572 1573 case SCTP_CMD_INIT_COUNTER_RESET: 1574 asoc->init_err_counter = 0; 1575 asoc->init_cycle = 0; 1576 list_for_each_entry(t, &asoc->peer.transport_addr_list, 1577 transports) { 1578 t->init_sent_count = 0; 1579 } 1580 break; 1581 1582 case SCTP_CMD_REPORT_DUP: 1583 sctp_tsnmap_mark_dup(&asoc->peer.tsn_map, 1584 cmd->obj.u32); 1585 break; 1586 1587 case SCTP_CMD_REPORT_BAD_TAG: 1588 pr_debug("%s: vtag mismatch!\n", __func__); 1589 break; 1590 1591 case SCTP_CMD_STRIKE: 1592 /* Mark one strike against a transport. */ 1593 sctp_do_8_2_transport_strike(commands, asoc, 1594 cmd->obj.transport, 0); 1595 break; 1596 1597 case SCTP_CMD_TRANSPORT_IDLE: 1598 t = cmd->obj.transport; 1599 sctp_transport_lower_cwnd(t, SCTP_LOWER_CWND_INACTIVE); 1600 break; 1601 1602 case SCTP_CMD_TRANSPORT_HB_SENT: 1603 t = cmd->obj.transport; 1604 sctp_do_8_2_transport_strike(commands, asoc, 1605 t, 1); 1606 t->hb_sent = 1; 1607 break; 1608 1609 case SCTP_CMD_TRANSPORT_ON: 1610 t = cmd->obj.transport; 1611 sctp_cmd_transport_on(commands, asoc, t, chunk); 1612 break; 1613 1614 case SCTP_CMD_HB_TIMERS_START: 1615 sctp_cmd_hb_timers_start(commands, asoc); 1616 break; 1617 1618 case SCTP_CMD_HB_TIMER_UPDATE: 1619 t = cmd->obj.transport; 1620 sctp_cmd_hb_timer_update(commands, t); 1621 break; 1622 1623 case SCTP_CMD_HB_TIMERS_STOP: 1624 sctp_cmd_hb_timers_stop(commands, asoc); 1625 break; 1626 1627 case SCTP_CMD_REPORT_ERROR: 1628 error = cmd->obj.error; 1629 break; 1630 1631 case SCTP_CMD_PROCESS_CTSN: 1632 /* Dummy up a SACK for processing. */ 1633 sackh.cum_tsn_ack = cmd->obj.be32; 1634 sackh.a_rwnd = asoc->peer.rwnd + 1635 asoc->outqueue.outstanding_bytes; 1636 sackh.num_gap_ack_blocks = 0; 1637 sackh.num_dup_tsns = 0; 1638 chunk->subh.sack_hdr = &sackh; 1639 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_SACK, 1640 SCTP_CHUNK(chunk)); 1641 break; 1642 1643 case SCTP_CMD_DISCARD_PACKET: 1644 /* We need to discard the whole packet. 1645 * Uncork the queue since there might be 1646 * responses pending 1647 */ 1648 chunk->pdiscard = 1; 1649 if (asoc) { 1650 sctp_outq_uncork(&asoc->outqueue); 1651 local_cork = 0; 1652 } 1653 break; 1654 1655 case SCTP_CMD_RTO_PENDING: 1656 t = cmd->obj.transport; 1657 t->rto_pending = 1; 1658 break; 1659 1660 case SCTP_CMD_PART_DELIVER: 1661 sctp_ulpq_partial_delivery(&asoc->ulpq, GFP_ATOMIC); 1662 break; 1663 1664 case SCTP_CMD_RENEGE: 1665 sctp_ulpq_renege(&asoc->ulpq, cmd->obj.chunk, 1666 GFP_ATOMIC); 1667 break; 1668 1669 case SCTP_CMD_SETUP_T4: 1670 sctp_cmd_setup_t4(commands, asoc, cmd->obj.chunk); 1671 break; 1672 1673 case SCTP_CMD_PROCESS_OPERR: 1674 sctp_cmd_process_operr(commands, asoc, chunk); 1675 break; 1676 case SCTP_CMD_CLEAR_INIT_TAG: 1677 asoc->peer.i.init_tag = 0; 1678 break; 1679 case SCTP_CMD_DEL_NON_PRIMARY: 1680 sctp_cmd_del_non_primary(asoc); 1681 break; 1682 case SCTP_CMD_T3_RTX_TIMERS_STOP: 1683 sctp_cmd_t3_rtx_timers_stop(commands, asoc); 1684 break; 1685 case SCTP_CMD_FORCE_PRIM_RETRAN: 1686 t = asoc->peer.retran_path; 1687 asoc->peer.retran_path = asoc->peer.primary_path; 1688 error = sctp_outq_uncork(&asoc->outqueue); 1689 local_cork = 0; 1690 asoc->peer.retran_path = t; 1691 break; 1692 case SCTP_CMD_SET_SK_ERR: 1693 sctp_cmd_set_sk_err(asoc, cmd->obj.error); 1694 break; 1695 case SCTP_CMD_ASSOC_CHANGE: 1696 sctp_cmd_assoc_change(commands, asoc, 1697 cmd->obj.u8); 1698 break; 1699 case SCTP_CMD_ADAPTATION_IND: 1700 sctp_cmd_adaptation_ind(commands, asoc); 1701 break; 1702 1703 case SCTP_CMD_ASSOC_SHKEY: 1704 error = sctp_auth_asoc_init_active_key(asoc, 1705 GFP_ATOMIC); 1706 break; 1707 case SCTP_CMD_UPDATE_INITTAG: 1708 asoc->peer.i.init_tag = cmd->obj.u32; 1709 break; 1710 case SCTP_CMD_SEND_MSG: 1711 if (!asoc->outqueue.cork) { 1712 sctp_outq_cork(&asoc->outqueue); 1713 local_cork = 1; 1714 } 1715 error = sctp_cmd_send_msg(asoc, cmd->obj.msg); 1716 break; 1717 case SCTP_CMD_SEND_NEXT_ASCONF: 1718 sctp_cmd_send_asconf(asoc); 1719 break; 1720 case SCTP_CMD_PURGE_ASCONF_QUEUE: 1721 sctp_asconf_queue_teardown(asoc); 1722 break; 1723 1724 case SCTP_CMD_SET_ASOC: 1725 asoc = cmd->obj.asoc; 1726 break; 1727 1728 default: 1729 pr_warn("Impossible command: %u\n", 1730 cmd->verb); 1731 break; 1732 } 1733 1734 if (error) 1735 break; 1736 } 1737 1738 out: 1739 /* If this is in response to a received chunk, wait until 1740 * we are done with the packet to open the queue so that we don't 1741 * send multiple packets in response to a single request. 1742 */ 1743 if (asoc && SCTP_EVENT_T_CHUNK == event_type && chunk) { 1744 if (chunk->end_of_packet || chunk->singleton) 1745 error = sctp_outq_uncork(&asoc->outqueue); 1746 } else if (local_cork) 1747 error = sctp_outq_uncork(&asoc->outqueue); 1748 return error; 1749 nomem: 1750 error = -ENOMEM; 1751 goto out; 1752 } 1753 1754