1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* SCTP kernel implementation
3  * Copyright (c) 1999-2000 Cisco, Inc.
4  * Copyright (c) 1999-2001 Motorola, Inc.
5  * Copyright (c) 2001-2003 International Business Machines, Corp.
6  * Copyright (c) 2001 Intel Corp.
7  * Copyright (c) 2001 Nokia, Inc.
8  * Copyright (c) 2001 La Monte H.P. Yarroll
9  *
10  * This file is part of the SCTP kernel implementation
11  *
12  * These functions handle all input from the IP layer into SCTP.
13  *
14  * Please send any bug reports or fixes you make to the
15  * email address(es):
16  *    lksctp developers <linux-sctp@vger.kernel.org>
17  *
18  * Written or modified by:
19  *    La Monte H.P. Yarroll <piggy@acm.org>
20  *    Karl Knutson <karl@athena.chicago.il.us>
21  *    Xingang Guo <xingang.guo@intel.com>
22  *    Jon Grimm <jgrimm@us.ibm.com>
23  *    Hui Huang <hui.huang@nokia.com>
24  *    Daisy Chang <daisyc@us.ibm.com>
25  *    Sridhar Samudrala <sri@us.ibm.com>
26  *    Ardelle Fan <ardelle.fan@intel.com>
27  */
28 
29 #include <linux/types.h>
30 #include <linux/list.h> /* For struct list_head */
31 #include <linux/socket.h>
32 #include <linux/ip.h>
33 #include <linux/time.h> /* For struct timeval */
34 #include <linux/slab.h>
35 #include <net/ip.h>
36 #include <net/icmp.h>
37 #include <net/snmp.h>
38 #include <net/sock.h>
39 #include <net/xfrm.h>
40 #include <net/sctp/sctp.h>
41 #include <net/sctp/sm.h>
42 #include <net/sctp/checksum.h>
43 #include <net/net_namespace.h>
44 #include <linux/rhashtable.h>
45 #include <net/sock_reuseport.h>
46 
47 /* Forward declarations for internal helpers. */
48 static int sctp_rcv_ootb(struct sk_buff *);
49 static struct sctp_association *__sctp_rcv_lookup(struct net *net,
50 				      struct sk_buff *skb,
51 				      const union sctp_addr *paddr,
52 				      const union sctp_addr *laddr,
53 				      struct sctp_transport **transportp);
54 static struct sctp_endpoint *__sctp_rcv_lookup_endpoint(
55 					struct net *net, struct sk_buff *skb,
56 					const union sctp_addr *laddr,
57 					const union sctp_addr *daddr);
58 static struct sctp_association *__sctp_lookup_association(
59 					struct net *net,
60 					const union sctp_addr *local,
61 					const union sctp_addr *peer,
62 					struct sctp_transport **pt);
63 
64 static int sctp_add_backlog(struct sock *sk, struct sk_buff *skb);
65 
66 
67 /* Calculate the SCTP checksum of an SCTP packet.  */
sctp_rcv_checksum(struct net * net,struct sk_buff * skb)68 static inline int sctp_rcv_checksum(struct net *net, struct sk_buff *skb)
69 {
70 	struct sctphdr *sh = sctp_hdr(skb);
71 	__le32 cmp = sh->checksum;
72 	__le32 val = sctp_compute_cksum(skb, 0);
73 
74 	if (val != cmp) {
75 		/* CRC failure, dump it. */
76 		__SCTP_INC_STATS(net, SCTP_MIB_CHECKSUMERRORS);
77 		return -1;
78 	}
79 	return 0;
80 }
81 
82 /*
83  * This is the routine which IP calls when receiving an SCTP packet.
84  */
sctp_rcv(struct sk_buff * skb)85 int sctp_rcv(struct sk_buff *skb)
86 {
87 	struct sock *sk;
88 	struct sctp_association *asoc;
89 	struct sctp_endpoint *ep = NULL;
90 	struct sctp_ep_common *rcvr;
91 	struct sctp_transport *transport = NULL;
92 	struct sctp_chunk *chunk;
93 	union sctp_addr src;
94 	union sctp_addr dest;
95 	int bound_dev_if;
96 	int family;
97 	struct sctp_af *af;
98 	struct net *net = dev_net(skb->dev);
99 	bool is_gso = skb_is_gso(skb) && skb_is_gso_sctp(skb);
100 
101 	if (skb->pkt_type != PACKET_HOST)
102 		goto discard_it;
103 
104 	__SCTP_INC_STATS(net, SCTP_MIB_INSCTPPACKS);
105 
106 	/* If packet is too small to contain a single chunk, let's not
107 	 * waste time on it anymore.
108 	 */
109 	if (skb->len < sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr) +
110 		       skb_transport_offset(skb))
111 		goto discard_it;
112 
113 	/* If the packet is fragmented and we need to do crc checking,
114 	 * it's better to just linearize it otherwise crc computing
115 	 * takes longer.
116 	 */
117 	if ((!is_gso && skb_linearize(skb)) ||
118 	    !pskb_may_pull(skb, sizeof(struct sctphdr)))
119 		goto discard_it;
120 
121 	/* Pull up the IP header. */
122 	__skb_pull(skb, skb_transport_offset(skb));
123 
124 	skb->csum_valid = 0; /* Previous value not applicable */
125 	if (skb_csum_unnecessary(skb))
126 		__skb_decr_checksum_unnecessary(skb);
127 	else if (!sctp_checksum_disable &&
128 		 !is_gso &&
129 		 sctp_rcv_checksum(net, skb) < 0)
130 		goto discard_it;
131 	skb->csum_valid = 1;
132 
133 	__skb_pull(skb, sizeof(struct sctphdr));
134 
135 	family = ipver2af(ip_hdr(skb)->version);
136 	af = sctp_get_af_specific(family);
137 	if (unlikely(!af))
138 		goto discard_it;
139 	SCTP_INPUT_CB(skb)->af = af;
140 
141 	/* Initialize local addresses for lookups. */
142 	af->from_skb(&src, skb, 1);
143 	af->from_skb(&dest, skb, 0);
144 
145 	/* If the packet is to or from a non-unicast address,
146 	 * silently discard the packet.
147 	 *
148 	 * This is not clearly defined in the RFC except in section
149 	 * 8.4 - OOTB handling.  However, based on the book "Stream Control
150 	 * Transmission Protocol" 2.1, "It is important to note that the
151 	 * IP address of an SCTP transport address must be a routable
152 	 * unicast address.  In other words, IP multicast addresses and
153 	 * IP broadcast addresses cannot be used in an SCTP transport
154 	 * address."
155 	 */
156 	if (!af->addr_valid(&src, NULL, skb) ||
157 	    !af->addr_valid(&dest, NULL, skb))
158 		goto discard_it;
159 
160 	asoc = __sctp_rcv_lookup(net, skb, &src, &dest, &transport);
161 
162 	if (!asoc)
163 		ep = __sctp_rcv_lookup_endpoint(net, skb, &dest, &src);
164 
165 	/* Retrieve the common input handling substructure. */
166 	rcvr = asoc ? &asoc->base : &ep->base;
167 	sk = rcvr->sk;
168 
169 	/*
170 	 * If a frame arrives on an interface and the receiving socket is
171 	 * bound to another interface, via SO_BINDTODEVICE, treat it as OOTB
172 	 */
173 	bound_dev_if = READ_ONCE(sk->sk_bound_dev_if);
174 	if (bound_dev_if && (bound_dev_if != af->skb_iif(skb))) {
175 		if (transport) {
176 			sctp_transport_put(transport);
177 			asoc = NULL;
178 			transport = NULL;
179 		} else {
180 			sctp_endpoint_put(ep);
181 			ep = NULL;
182 		}
183 		sk = net->sctp.ctl_sock;
184 		ep = sctp_sk(sk)->ep;
185 		sctp_endpoint_hold(ep);
186 		rcvr = &ep->base;
187 	}
188 
189 	/*
190 	 * RFC 2960, 8.4 - Handle "Out of the blue" Packets.
191 	 * An SCTP packet is called an "out of the blue" (OOTB)
192 	 * packet if it is correctly formed, i.e., passed the
193 	 * receiver's checksum check, but the receiver is not
194 	 * able to identify the association to which this
195 	 * packet belongs.
196 	 */
197 	if (!asoc) {
198 		if (sctp_rcv_ootb(skb)) {
199 			__SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
200 			goto discard_release;
201 		}
202 	}
203 
204 	if (!xfrm_policy_check(sk, XFRM_POLICY_IN, skb, family))
205 		goto discard_release;
206 	nf_reset_ct(skb);
207 
208 	if (sk_filter(sk, skb))
209 		goto discard_release;
210 
211 	/* Create an SCTP packet structure. */
212 	chunk = sctp_chunkify(skb, asoc, sk, GFP_ATOMIC);
213 	if (!chunk)
214 		goto discard_release;
215 	SCTP_INPUT_CB(skb)->chunk = chunk;
216 
217 	/* Remember what endpoint is to handle this packet. */
218 	chunk->rcvr = rcvr;
219 
220 	/* Remember the SCTP header. */
221 	chunk->sctp_hdr = sctp_hdr(skb);
222 
223 	/* Set the source and destination addresses of the incoming chunk.  */
224 	sctp_init_addrs(chunk, &src, &dest);
225 
226 	/* Remember where we came from.  */
227 	chunk->transport = transport;
228 
229 	/* Acquire access to the sock lock. Note: We are safe from other
230 	 * bottom halves on this lock, but a user may be in the lock too,
231 	 * so check if it is busy.
232 	 */
233 	bh_lock_sock(sk);
234 
235 	if (sk != rcvr->sk) {
236 		/* Our cached sk is different from the rcvr->sk.  This is
237 		 * because migrate()/accept() may have moved the association
238 		 * to a new socket and released all the sockets.  So now we
239 		 * are holding a lock on the old socket while the user may
240 		 * be doing something with the new socket.  Switch our veiw
241 		 * of the current sk.
242 		 */
243 		bh_unlock_sock(sk);
244 		sk = rcvr->sk;
245 		bh_lock_sock(sk);
246 	}
247 
248 	if (sock_owned_by_user(sk) || !sctp_newsk_ready(sk)) {
249 		if (sctp_add_backlog(sk, skb)) {
250 			bh_unlock_sock(sk);
251 			sctp_chunk_free(chunk);
252 			skb = NULL; /* sctp_chunk_free already freed the skb */
253 			goto discard_release;
254 		}
255 		__SCTP_INC_STATS(net, SCTP_MIB_IN_PKT_BACKLOG);
256 	} else {
257 		__SCTP_INC_STATS(net, SCTP_MIB_IN_PKT_SOFTIRQ);
258 		sctp_inq_push(&chunk->rcvr->inqueue, chunk);
259 	}
260 
261 	bh_unlock_sock(sk);
262 
263 	/* Release the asoc/ep ref we took in the lookup calls. */
264 	if (transport)
265 		sctp_transport_put(transport);
266 	else
267 		sctp_endpoint_put(ep);
268 
269 	return 0;
270 
271 discard_it:
272 	__SCTP_INC_STATS(net, SCTP_MIB_IN_PKT_DISCARDS);
273 	kfree_skb(skb);
274 	return 0;
275 
276 discard_release:
277 	/* Release the asoc/ep ref we took in the lookup calls. */
278 	if (transport)
279 		sctp_transport_put(transport);
280 	else
281 		sctp_endpoint_put(ep);
282 
283 	goto discard_it;
284 }
285 
286 /* Process the backlog queue of the socket.  Every skb on
287  * the backlog holds a ref on an association or endpoint.
288  * We hold this ref throughout the state machine to make
289  * sure that the structure we need is still around.
290  */
sctp_backlog_rcv(struct sock * sk,struct sk_buff * skb)291 int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
292 {
293 	struct sctp_chunk *chunk = SCTP_INPUT_CB(skb)->chunk;
294 	struct sctp_inq *inqueue = &chunk->rcvr->inqueue;
295 	struct sctp_transport *t = chunk->transport;
296 	struct sctp_ep_common *rcvr = NULL;
297 	int backloged = 0;
298 
299 	rcvr = chunk->rcvr;
300 
301 	/* If the rcvr is dead then the association or endpoint
302 	 * has been deleted and we can safely drop the chunk
303 	 * and refs that we are holding.
304 	 */
305 	if (rcvr->dead) {
306 		sctp_chunk_free(chunk);
307 		goto done;
308 	}
309 
310 	if (unlikely(rcvr->sk != sk)) {
311 		/* In this case, the association moved from one socket to
312 		 * another.  We are currently sitting on the backlog of the
313 		 * old socket, so we need to move.
314 		 * However, since we are here in the process context we
315 		 * need to take make sure that the user doesn't own
316 		 * the new socket when we process the packet.
317 		 * If the new socket is user-owned, queue the chunk to the
318 		 * backlog of the new socket without dropping any refs.
319 		 * Otherwise, we can safely push the chunk on the inqueue.
320 		 */
321 
322 		sk = rcvr->sk;
323 		local_bh_disable();
324 		bh_lock_sock(sk);
325 
326 		if (sock_owned_by_user(sk) || !sctp_newsk_ready(sk)) {
327 			if (sk_add_backlog(sk, skb, READ_ONCE(sk->sk_rcvbuf)))
328 				sctp_chunk_free(chunk);
329 			else
330 				backloged = 1;
331 		} else
332 			sctp_inq_push(inqueue, chunk);
333 
334 		bh_unlock_sock(sk);
335 		local_bh_enable();
336 
337 		/* If the chunk was backloged again, don't drop refs */
338 		if (backloged)
339 			return 0;
340 	} else {
341 		if (!sctp_newsk_ready(sk)) {
342 			if (!sk_add_backlog(sk, skb, READ_ONCE(sk->sk_rcvbuf)))
343 				return 0;
344 			sctp_chunk_free(chunk);
345 		} else {
346 			sctp_inq_push(inqueue, chunk);
347 		}
348 	}
349 
350 done:
351 	/* Release the refs we took in sctp_add_backlog */
352 	if (SCTP_EP_TYPE_ASSOCIATION == rcvr->type)
353 		sctp_transport_put(t);
354 	else if (SCTP_EP_TYPE_SOCKET == rcvr->type)
355 		sctp_endpoint_put(sctp_ep(rcvr));
356 	else
357 		BUG();
358 
359 	return 0;
360 }
361 
sctp_add_backlog(struct sock * sk,struct sk_buff * skb)362 static int sctp_add_backlog(struct sock *sk, struct sk_buff *skb)
363 {
364 	struct sctp_chunk *chunk = SCTP_INPUT_CB(skb)->chunk;
365 	struct sctp_transport *t = chunk->transport;
366 	struct sctp_ep_common *rcvr = chunk->rcvr;
367 	int ret;
368 
369 	ret = sk_add_backlog(sk, skb, READ_ONCE(sk->sk_rcvbuf));
370 	if (!ret) {
371 		/* Hold the assoc/ep while hanging on the backlog queue.
372 		 * This way, we know structures we need will not disappear
373 		 * from us
374 		 */
375 		if (SCTP_EP_TYPE_ASSOCIATION == rcvr->type)
376 			sctp_transport_hold(t);
377 		else if (SCTP_EP_TYPE_SOCKET == rcvr->type)
378 			sctp_endpoint_hold(sctp_ep(rcvr));
379 		else
380 			BUG();
381 	}
382 	return ret;
383 
384 }
385 
386 /* Handle icmp frag needed error. */
sctp_icmp_frag_needed(struct sock * sk,struct sctp_association * asoc,struct sctp_transport * t,__u32 pmtu)387 void sctp_icmp_frag_needed(struct sock *sk, struct sctp_association *asoc,
388 			   struct sctp_transport *t, __u32 pmtu)
389 {
390 	if (!t ||
391 	    (t->pathmtu <= pmtu &&
392 	     t->pl.probe_size + sctp_transport_pl_hlen(t) <= pmtu))
393 		return;
394 
395 	if (sock_owned_by_user(sk)) {
396 		atomic_set(&t->mtu_info, pmtu);
397 		asoc->pmtu_pending = 1;
398 		t->pmtu_pending = 1;
399 		return;
400 	}
401 
402 	if (!(t->param_flags & SPP_PMTUD_ENABLE))
403 		/* We can't allow retransmitting in such case, as the
404 		 * retransmission would be sized just as before, and thus we
405 		 * would get another icmp, and retransmit again.
406 		 */
407 		return;
408 
409 	/* Update transports view of the MTU. Return if no update was needed.
410 	 * If an update wasn't needed/possible, it also doesn't make sense to
411 	 * try to retransmit now.
412 	 */
413 	if (!sctp_transport_update_pmtu(t, pmtu))
414 		return;
415 
416 	/* Update association pmtu. */
417 	sctp_assoc_sync_pmtu(asoc);
418 
419 	/* Retransmit with the new pmtu setting. */
420 	sctp_retransmit(&asoc->outqueue, t, SCTP_RTXR_PMTUD);
421 }
422 
sctp_icmp_redirect(struct sock * sk,struct sctp_transport * t,struct sk_buff * skb)423 void sctp_icmp_redirect(struct sock *sk, struct sctp_transport *t,
424 			struct sk_buff *skb)
425 {
426 	struct dst_entry *dst;
427 
428 	if (sock_owned_by_user(sk) || !t)
429 		return;
430 	dst = sctp_transport_dst_check(t);
431 	if (dst)
432 		dst->ops->redirect(dst, sk, skb);
433 }
434 
435 /*
436  * SCTP Implementer's Guide, 2.37 ICMP handling procedures
437  *
438  * ICMP8) If the ICMP code is a "Unrecognized next header type encountered"
439  *        or a "Protocol Unreachable" treat this message as an abort
440  *        with the T bit set.
441  *
442  * This function sends an event to the state machine, which will abort the
443  * association.
444  *
445  */
sctp_icmp_proto_unreachable(struct sock * sk,struct sctp_association * asoc,struct sctp_transport * t)446 void sctp_icmp_proto_unreachable(struct sock *sk,
447 			   struct sctp_association *asoc,
448 			   struct sctp_transport *t)
449 {
450 	if (sock_owned_by_user(sk)) {
451 		if (timer_pending(&t->proto_unreach_timer))
452 			return;
453 		else {
454 			if (!mod_timer(&t->proto_unreach_timer,
455 						jiffies + (HZ/20)))
456 				sctp_transport_hold(t);
457 		}
458 	} else {
459 		struct net *net = sock_net(sk);
460 
461 		pr_debug("%s: unrecognized next header type "
462 			 "encountered!\n", __func__);
463 
464 		if (del_timer(&t->proto_unreach_timer))
465 			sctp_transport_put(t);
466 
467 		sctp_do_sm(net, SCTP_EVENT_T_OTHER,
468 			   SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
469 			   asoc->state, asoc->ep, asoc, t,
470 			   GFP_ATOMIC);
471 	}
472 }
473 
474 /* Common lookup code for icmp/icmpv6 error handler. */
sctp_err_lookup(struct net * net,int family,struct sk_buff * skb,struct sctphdr * sctphdr,struct sctp_association ** app,struct sctp_transport ** tpp)475 struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb,
476 			     struct sctphdr *sctphdr,
477 			     struct sctp_association **app,
478 			     struct sctp_transport **tpp)
479 {
480 	struct sctp_init_chunk *chunkhdr, _chunkhdr;
481 	union sctp_addr saddr;
482 	union sctp_addr daddr;
483 	struct sctp_af *af;
484 	struct sock *sk = NULL;
485 	struct sctp_association *asoc;
486 	struct sctp_transport *transport = NULL;
487 	__u32 vtag = ntohl(sctphdr->vtag);
488 
489 	*app = NULL; *tpp = NULL;
490 
491 	af = sctp_get_af_specific(family);
492 	if (unlikely(!af)) {
493 		return NULL;
494 	}
495 
496 	/* Initialize local addresses for lookups. */
497 	af->from_skb(&saddr, skb, 1);
498 	af->from_skb(&daddr, skb, 0);
499 
500 	/* Look for an association that matches the incoming ICMP error
501 	 * packet.
502 	 */
503 	asoc = __sctp_lookup_association(net, &saddr, &daddr, &transport);
504 	if (!asoc)
505 		return NULL;
506 
507 	sk = asoc->base.sk;
508 
509 	/* RFC 4960, Appendix C. ICMP Handling
510 	 *
511 	 * ICMP6) An implementation MUST validate that the Verification Tag
512 	 * contained in the ICMP message matches the Verification Tag of
513 	 * the peer.  If the Verification Tag is not 0 and does NOT
514 	 * match, discard the ICMP message.  If it is 0 and the ICMP
515 	 * message contains enough bytes to verify that the chunk type is
516 	 * an INIT chunk and that the Initiate Tag matches the tag of the
517 	 * peer, continue with ICMP7.  If the ICMP message is too short
518 	 * or the chunk type or the Initiate Tag does not match, silently
519 	 * discard the packet.
520 	 */
521 	if (vtag == 0) {
522 		/* chunk header + first 4 octects of init header */
523 		chunkhdr = skb_header_pointer(skb, skb_transport_offset(skb) +
524 					      sizeof(struct sctphdr),
525 					      sizeof(struct sctp_chunkhdr) +
526 					      sizeof(__be32), &_chunkhdr);
527 		if (!chunkhdr ||
528 		    chunkhdr->chunk_hdr.type != SCTP_CID_INIT ||
529 		    ntohl(chunkhdr->init_hdr.init_tag) != asoc->c.my_vtag)
530 			goto out;
531 
532 	} else if (vtag != asoc->c.peer_vtag) {
533 		goto out;
534 	}
535 
536 	bh_lock_sock(sk);
537 
538 	/* If too many ICMPs get dropped on busy
539 	 * servers this needs to be solved differently.
540 	 */
541 	if (sock_owned_by_user(sk))
542 		__NET_INC_STATS(net, LINUX_MIB_LOCKDROPPEDICMPS);
543 
544 	*app = asoc;
545 	*tpp = transport;
546 	return sk;
547 
548 out:
549 	sctp_transport_put(transport);
550 	return NULL;
551 }
552 
553 /* Common cleanup code for icmp/icmpv6 error handler. */
sctp_err_finish(struct sock * sk,struct sctp_transport * t)554 void sctp_err_finish(struct sock *sk, struct sctp_transport *t)
555 	__releases(&((__sk)->sk_lock.slock))
556 {
557 	bh_unlock_sock(sk);
558 	sctp_transport_put(t);
559 }
560 
sctp_v4_err_handle(struct sctp_transport * t,struct sk_buff * skb,__u8 type,__u8 code,__u32 info)561 static void sctp_v4_err_handle(struct sctp_transport *t, struct sk_buff *skb,
562 			       __u8 type, __u8 code, __u32 info)
563 {
564 	struct sctp_association *asoc = t->asoc;
565 	struct sock *sk = asoc->base.sk;
566 	int err = 0;
567 
568 	switch (type) {
569 	case ICMP_PARAMETERPROB:
570 		err = EPROTO;
571 		break;
572 	case ICMP_DEST_UNREACH:
573 		if (code > NR_ICMP_UNREACH)
574 			return;
575 		if (code == ICMP_FRAG_NEEDED) {
576 			sctp_icmp_frag_needed(sk, asoc, t, SCTP_TRUNC4(info));
577 			return;
578 		}
579 		if (code == ICMP_PROT_UNREACH) {
580 			sctp_icmp_proto_unreachable(sk, asoc, t);
581 			return;
582 		}
583 		err = icmp_err_convert[code].errno;
584 		break;
585 	case ICMP_TIME_EXCEEDED:
586 		if (code == ICMP_EXC_FRAGTIME)
587 			return;
588 
589 		err = EHOSTUNREACH;
590 		break;
591 	case ICMP_REDIRECT:
592 		sctp_icmp_redirect(sk, t, skb);
593 		return;
594 	default:
595 		return;
596 	}
597 	if (!sock_owned_by_user(sk) && inet_sk(sk)->recverr) {
598 		sk->sk_err = err;
599 		sk_error_report(sk);
600 	} else {  /* Only an error on timeout */
601 		sk->sk_err_soft = err;
602 	}
603 }
604 
605 /*
606  * This routine is called by the ICMP module when it gets some
607  * sort of error condition.  If err < 0 then the socket should
608  * be closed and the error returned to the user.  If err > 0
609  * it's just the icmp type << 8 | icmp code.  After adjustment
610  * header points to the first 8 bytes of the sctp header.  We need
611  * to find the appropriate port.
612  *
613  * The locking strategy used here is very "optimistic". When
614  * someone else accesses the socket the ICMP is just dropped
615  * and for some paths there is no check at all.
616  * A more general error queue to queue errors for later handling
617  * is probably better.
618  *
619  */
sctp_v4_err(struct sk_buff * skb,__u32 info)620 int sctp_v4_err(struct sk_buff *skb, __u32 info)
621 {
622 	const struct iphdr *iph = (const struct iphdr *)skb->data;
623 	const int type = icmp_hdr(skb)->type;
624 	const int code = icmp_hdr(skb)->code;
625 	struct net *net = dev_net(skb->dev);
626 	struct sctp_transport *transport;
627 	struct sctp_association *asoc;
628 	__u16 saveip, savesctp;
629 	struct sock *sk;
630 
631 	/* Fix up skb to look at the embedded net header. */
632 	saveip = skb->network_header;
633 	savesctp = skb->transport_header;
634 	skb_reset_network_header(skb);
635 	skb_set_transport_header(skb, iph->ihl * 4);
636 	sk = sctp_err_lookup(net, AF_INET, skb, sctp_hdr(skb), &asoc, &transport);
637 	/* Put back, the original values. */
638 	skb->network_header = saveip;
639 	skb->transport_header = savesctp;
640 	if (!sk) {
641 		__ICMP_INC_STATS(net, ICMP_MIB_INERRORS);
642 		return -ENOENT;
643 	}
644 
645 	sctp_v4_err_handle(transport, skb, type, code, info);
646 	sctp_err_finish(sk, transport);
647 
648 	return 0;
649 }
650 
sctp_udp_v4_err(struct sock * sk,struct sk_buff * skb)651 int sctp_udp_v4_err(struct sock *sk, struct sk_buff *skb)
652 {
653 	struct net *net = dev_net(skb->dev);
654 	struct sctp_association *asoc;
655 	struct sctp_transport *t;
656 	struct icmphdr *hdr;
657 	__u32 info = 0;
658 
659 	skb->transport_header += sizeof(struct udphdr);
660 	sk = sctp_err_lookup(net, AF_INET, skb, sctp_hdr(skb), &asoc, &t);
661 	if (!sk) {
662 		__ICMP_INC_STATS(net, ICMP_MIB_INERRORS);
663 		return -ENOENT;
664 	}
665 
666 	skb->transport_header -= sizeof(struct udphdr);
667 	hdr = (struct icmphdr *)(skb_network_header(skb) - sizeof(struct icmphdr));
668 	if (hdr->type == ICMP_REDIRECT) {
669 		/* can't be handled without outer iphdr known, leave it to udp_err */
670 		sctp_err_finish(sk, t);
671 		return 0;
672 	}
673 	if (hdr->type == ICMP_DEST_UNREACH && hdr->code == ICMP_FRAG_NEEDED)
674 		info = ntohs(hdr->un.frag.mtu);
675 	sctp_v4_err_handle(t, skb, hdr->type, hdr->code, info);
676 
677 	sctp_err_finish(sk, t);
678 	return 1;
679 }
680 
681 /*
682  * RFC 2960, 8.4 - Handle "Out of the blue" Packets.
683  *
684  * This function scans all the chunks in the OOTB packet to determine if
685  * the packet should be discarded right away.  If a response might be needed
686  * for this packet, or, if further processing is possible, the packet will
687  * be queued to a proper inqueue for the next phase of handling.
688  *
689  * Output:
690  * Return 0 - If further processing is needed.
691  * Return 1 - If the packet can be discarded right away.
692  */
sctp_rcv_ootb(struct sk_buff * skb)693 static int sctp_rcv_ootb(struct sk_buff *skb)
694 {
695 	struct sctp_chunkhdr *ch, _ch;
696 	int ch_end, offset = 0;
697 
698 	/* Scan through all the chunks in the packet.  */
699 	do {
700 		/* Make sure we have at least the header there */
701 		if (offset + sizeof(_ch) > skb->len)
702 			break;
703 
704 		ch = skb_header_pointer(skb, offset, sizeof(*ch), &_ch);
705 
706 		/* Break out if chunk length is less then minimal. */
707 		if (!ch || ntohs(ch->length) < sizeof(_ch))
708 			break;
709 
710 		ch_end = offset + SCTP_PAD4(ntohs(ch->length));
711 		if (ch_end > skb->len)
712 			break;
713 
714 		/* RFC 8.4, 2) If the OOTB packet contains an ABORT chunk, the
715 		 * receiver MUST silently discard the OOTB packet and take no
716 		 * further action.
717 		 */
718 		if (SCTP_CID_ABORT == ch->type)
719 			goto discard;
720 
721 		/* RFC 8.4, 6) If the packet contains a SHUTDOWN COMPLETE
722 		 * chunk, the receiver should silently discard the packet
723 		 * and take no further action.
724 		 */
725 		if (SCTP_CID_SHUTDOWN_COMPLETE == ch->type)
726 			goto discard;
727 
728 		/* RFC 4460, 2.11.2
729 		 * This will discard packets with INIT chunk bundled as
730 		 * subsequent chunks in the packet.  When INIT is first,
731 		 * the normal INIT processing will discard the chunk.
732 		 */
733 		if (SCTP_CID_INIT == ch->type && (void *)ch != skb->data)
734 			goto discard;
735 
736 		offset = ch_end;
737 	} while (ch_end < skb->len);
738 
739 	return 0;
740 
741 discard:
742 	return 1;
743 }
744 
745 /* Insert endpoint into the hash table.  */
__sctp_hash_endpoint(struct sctp_endpoint * ep)746 static int __sctp_hash_endpoint(struct sctp_endpoint *ep)
747 {
748 	struct sock *sk = ep->base.sk;
749 	struct net *net = sock_net(sk);
750 	struct sctp_hashbucket *head;
751 
752 	ep->hashent = sctp_ep_hashfn(net, ep->base.bind_addr.port);
753 	head = &sctp_ep_hashtable[ep->hashent];
754 
755 	if (sk->sk_reuseport) {
756 		bool any = sctp_is_ep_boundall(sk);
757 		struct sctp_endpoint *ep2;
758 		struct list_head *list;
759 		int cnt = 0, err = 1;
760 
761 		list_for_each(list, &ep->base.bind_addr.address_list)
762 			cnt++;
763 
764 		sctp_for_each_hentry(ep2, &head->chain) {
765 			struct sock *sk2 = ep2->base.sk;
766 
767 			if (!net_eq(sock_net(sk2), net) || sk2 == sk ||
768 			    !uid_eq(sock_i_uid(sk2), sock_i_uid(sk)) ||
769 			    !sk2->sk_reuseport)
770 				continue;
771 
772 			err = sctp_bind_addrs_check(sctp_sk(sk2),
773 						    sctp_sk(sk), cnt);
774 			if (!err) {
775 				err = reuseport_add_sock(sk, sk2, any);
776 				if (err)
777 					return err;
778 				break;
779 			} else if (err < 0) {
780 				return err;
781 			}
782 		}
783 
784 		if (err) {
785 			err = reuseport_alloc(sk, any);
786 			if (err)
787 				return err;
788 		}
789 	}
790 
791 	write_lock(&head->lock);
792 	hlist_add_head(&ep->node, &head->chain);
793 	write_unlock(&head->lock);
794 	return 0;
795 }
796 
797 /* Add an endpoint to the hash. Local BH-safe. */
sctp_hash_endpoint(struct sctp_endpoint * ep)798 int sctp_hash_endpoint(struct sctp_endpoint *ep)
799 {
800 	int err;
801 
802 	local_bh_disable();
803 	err = __sctp_hash_endpoint(ep);
804 	local_bh_enable();
805 
806 	return err;
807 }
808 
809 /* Remove endpoint from the hash table.  */
__sctp_unhash_endpoint(struct sctp_endpoint * ep)810 static void __sctp_unhash_endpoint(struct sctp_endpoint *ep)
811 {
812 	struct sock *sk = ep->base.sk;
813 	struct sctp_hashbucket *head;
814 
815 	ep->hashent = sctp_ep_hashfn(sock_net(sk), ep->base.bind_addr.port);
816 
817 	head = &sctp_ep_hashtable[ep->hashent];
818 
819 	if (rcu_access_pointer(sk->sk_reuseport_cb))
820 		reuseport_detach_sock(sk);
821 
822 	write_lock(&head->lock);
823 	hlist_del_init(&ep->node);
824 	write_unlock(&head->lock);
825 }
826 
827 /* Remove endpoint from the hash.  Local BH-safe. */
sctp_unhash_endpoint(struct sctp_endpoint * ep)828 void sctp_unhash_endpoint(struct sctp_endpoint *ep)
829 {
830 	local_bh_disable();
831 	__sctp_unhash_endpoint(ep);
832 	local_bh_enable();
833 }
834 
sctp_hashfn(const struct net * net,__be16 lport,const union sctp_addr * paddr,__u32 seed)835 static inline __u32 sctp_hashfn(const struct net *net, __be16 lport,
836 				const union sctp_addr *paddr, __u32 seed)
837 {
838 	__u32 addr;
839 
840 	if (paddr->sa.sa_family == AF_INET6)
841 		addr = jhash(&paddr->v6.sin6_addr, 16, seed);
842 	else
843 		addr = (__force __u32)paddr->v4.sin_addr.s_addr;
844 
845 	return  jhash_3words(addr, ((__force __u32)paddr->v4.sin_port) << 16 |
846 			     (__force __u32)lport, net_hash_mix(net), seed);
847 }
848 
849 /* Look up an endpoint. */
__sctp_rcv_lookup_endpoint(struct net * net,struct sk_buff * skb,const union sctp_addr * laddr,const union sctp_addr * paddr)850 static struct sctp_endpoint *__sctp_rcv_lookup_endpoint(
851 					struct net *net, struct sk_buff *skb,
852 					const union sctp_addr *laddr,
853 					const union sctp_addr *paddr)
854 {
855 	struct sctp_hashbucket *head;
856 	struct sctp_endpoint *ep;
857 	struct sock *sk;
858 	__be16 lport;
859 	int hash;
860 
861 	lport = laddr->v4.sin_port;
862 	hash = sctp_ep_hashfn(net, ntohs(lport));
863 	head = &sctp_ep_hashtable[hash];
864 	read_lock(&head->lock);
865 	sctp_for_each_hentry(ep, &head->chain) {
866 		if (sctp_endpoint_is_match(ep, net, laddr))
867 			goto hit;
868 	}
869 
870 	ep = sctp_sk(net->sctp.ctl_sock)->ep;
871 
872 hit:
873 	sk = ep->base.sk;
874 	if (sk->sk_reuseport) {
875 		__u32 phash = sctp_hashfn(net, lport, paddr, 0);
876 
877 		sk = reuseport_select_sock(sk, phash, skb,
878 					   sizeof(struct sctphdr));
879 		if (sk)
880 			ep = sctp_sk(sk)->ep;
881 	}
882 	sctp_endpoint_hold(ep);
883 	read_unlock(&head->lock);
884 	return ep;
885 }
886 
887 /* rhashtable for transport */
888 struct sctp_hash_cmp_arg {
889 	const union sctp_addr	*paddr;
890 	const struct net	*net;
891 	__be16			lport;
892 };
893 
sctp_hash_cmp(struct rhashtable_compare_arg * arg,const void * ptr)894 static inline int sctp_hash_cmp(struct rhashtable_compare_arg *arg,
895 				const void *ptr)
896 {
897 	struct sctp_transport *t = (struct sctp_transport *)ptr;
898 	const struct sctp_hash_cmp_arg *x = arg->key;
899 	int err = 1;
900 
901 	if (!sctp_cmp_addr_exact(&t->ipaddr, x->paddr))
902 		return err;
903 	if (!sctp_transport_hold(t))
904 		return err;
905 
906 	if (!net_eq(t->asoc->base.net, x->net))
907 		goto out;
908 	if (x->lport != htons(t->asoc->base.bind_addr.port))
909 		goto out;
910 
911 	err = 0;
912 out:
913 	sctp_transport_put(t);
914 	return err;
915 }
916 
sctp_hash_obj(const void * data,u32 len,u32 seed)917 static inline __u32 sctp_hash_obj(const void *data, u32 len, u32 seed)
918 {
919 	const struct sctp_transport *t = data;
920 
921 	return sctp_hashfn(t->asoc->base.net,
922 			   htons(t->asoc->base.bind_addr.port),
923 			   &t->ipaddr, seed);
924 }
925 
sctp_hash_key(const void * data,u32 len,u32 seed)926 static inline __u32 sctp_hash_key(const void *data, u32 len, u32 seed)
927 {
928 	const struct sctp_hash_cmp_arg *x = data;
929 
930 	return sctp_hashfn(x->net, x->lport, x->paddr, seed);
931 }
932 
933 static const struct rhashtable_params sctp_hash_params = {
934 	.head_offset		= offsetof(struct sctp_transport, node),
935 	.hashfn			= sctp_hash_key,
936 	.obj_hashfn		= sctp_hash_obj,
937 	.obj_cmpfn		= sctp_hash_cmp,
938 	.automatic_shrinking	= true,
939 };
940 
sctp_transport_hashtable_init(void)941 int sctp_transport_hashtable_init(void)
942 {
943 	return rhltable_init(&sctp_transport_hashtable, &sctp_hash_params);
944 }
945 
sctp_transport_hashtable_destroy(void)946 void sctp_transport_hashtable_destroy(void)
947 {
948 	rhltable_destroy(&sctp_transport_hashtable);
949 }
950 
sctp_hash_transport(struct sctp_transport * t)951 int sctp_hash_transport(struct sctp_transport *t)
952 {
953 	struct sctp_transport *transport;
954 	struct rhlist_head *tmp, *list;
955 	struct sctp_hash_cmp_arg arg;
956 	int err;
957 
958 	if (t->asoc->temp)
959 		return 0;
960 
961 	arg.net   = t->asoc->base.net;
962 	arg.paddr = &t->ipaddr;
963 	arg.lport = htons(t->asoc->base.bind_addr.port);
964 
965 	rcu_read_lock();
966 	list = rhltable_lookup(&sctp_transport_hashtable, &arg,
967 			       sctp_hash_params);
968 
969 	rhl_for_each_entry_rcu(transport, tmp, list, node)
970 		if (transport->asoc->ep == t->asoc->ep) {
971 			rcu_read_unlock();
972 			return -EEXIST;
973 		}
974 	rcu_read_unlock();
975 
976 	err = rhltable_insert_key(&sctp_transport_hashtable, &arg,
977 				  &t->node, sctp_hash_params);
978 	if (err)
979 		pr_err_once("insert transport fail, errno %d\n", err);
980 
981 	return err;
982 }
983 
sctp_unhash_transport(struct sctp_transport * t)984 void sctp_unhash_transport(struct sctp_transport *t)
985 {
986 	if (t->asoc->temp)
987 		return;
988 
989 	rhltable_remove(&sctp_transport_hashtable, &t->node,
990 			sctp_hash_params);
991 }
992 
993 /* return a transport with holding it */
sctp_addrs_lookup_transport(struct net * net,const union sctp_addr * laddr,const union sctp_addr * paddr)994 struct sctp_transport *sctp_addrs_lookup_transport(
995 				struct net *net,
996 				const union sctp_addr *laddr,
997 				const union sctp_addr *paddr)
998 {
999 	struct rhlist_head *tmp, *list;
1000 	struct sctp_transport *t;
1001 	struct sctp_hash_cmp_arg arg = {
1002 		.paddr = paddr,
1003 		.net   = net,
1004 		.lport = laddr->v4.sin_port,
1005 	};
1006 
1007 	list = rhltable_lookup(&sctp_transport_hashtable, &arg,
1008 			       sctp_hash_params);
1009 
1010 	rhl_for_each_entry_rcu(t, tmp, list, node) {
1011 		if (!sctp_transport_hold(t))
1012 			continue;
1013 
1014 		if (sctp_bind_addr_match(&t->asoc->base.bind_addr,
1015 					 laddr, sctp_sk(t->asoc->base.sk)))
1016 			return t;
1017 		sctp_transport_put(t);
1018 	}
1019 
1020 	return NULL;
1021 }
1022 
1023 /* return a transport without holding it, as it's only used under sock lock */
sctp_epaddr_lookup_transport(const struct sctp_endpoint * ep,const union sctp_addr * paddr)1024 struct sctp_transport *sctp_epaddr_lookup_transport(
1025 				const struct sctp_endpoint *ep,
1026 				const union sctp_addr *paddr)
1027 {
1028 	struct rhlist_head *tmp, *list;
1029 	struct sctp_transport *t;
1030 	struct sctp_hash_cmp_arg arg = {
1031 		.paddr = paddr,
1032 		.net   = ep->base.net,
1033 		.lport = htons(ep->base.bind_addr.port),
1034 	};
1035 
1036 	list = rhltable_lookup(&sctp_transport_hashtable, &arg,
1037 			       sctp_hash_params);
1038 
1039 	rhl_for_each_entry_rcu(t, tmp, list, node)
1040 		if (ep == t->asoc->ep)
1041 			return t;
1042 
1043 	return NULL;
1044 }
1045 
1046 /* Look up an association. */
__sctp_lookup_association(struct net * net,const union sctp_addr * local,const union sctp_addr * peer,struct sctp_transport ** pt)1047 static struct sctp_association *__sctp_lookup_association(
1048 					struct net *net,
1049 					const union sctp_addr *local,
1050 					const union sctp_addr *peer,
1051 					struct sctp_transport **pt)
1052 {
1053 	struct sctp_transport *t;
1054 	struct sctp_association *asoc = NULL;
1055 
1056 	t = sctp_addrs_lookup_transport(net, local, peer);
1057 	if (!t)
1058 		goto out;
1059 
1060 	asoc = t->asoc;
1061 	*pt = t;
1062 
1063 out:
1064 	return asoc;
1065 }
1066 
1067 /* Look up an association. protected by RCU read lock */
1068 static
sctp_lookup_association(struct net * net,const union sctp_addr * laddr,const union sctp_addr * paddr,struct sctp_transport ** transportp)1069 struct sctp_association *sctp_lookup_association(struct net *net,
1070 						 const union sctp_addr *laddr,
1071 						 const union sctp_addr *paddr,
1072 						 struct sctp_transport **transportp)
1073 {
1074 	struct sctp_association *asoc;
1075 
1076 	rcu_read_lock();
1077 	asoc = __sctp_lookup_association(net, laddr, paddr, transportp);
1078 	rcu_read_unlock();
1079 
1080 	return asoc;
1081 }
1082 
1083 /* Is there an association matching the given local and peer addresses? */
sctp_has_association(struct net * net,const union sctp_addr * laddr,const union sctp_addr * paddr)1084 bool sctp_has_association(struct net *net,
1085 			  const union sctp_addr *laddr,
1086 			  const union sctp_addr *paddr)
1087 {
1088 	struct sctp_transport *transport;
1089 
1090 	if (sctp_lookup_association(net, laddr, paddr, &transport)) {
1091 		sctp_transport_put(transport);
1092 		return true;
1093 	}
1094 
1095 	return false;
1096 }
1097 
1098 /*
1099  * SCTP Implementors Guide, 2.18 Handling of address
1100  * parameters within the INIT or INIT-ACK.
1101  *
1102  * D) When searching for a matching TCB upon reception of an INIT
1103  *    or INIT-ACK chunk the receiver SHOULD use not only the
1104  *    source address of the packet (containing the INIT or
1105  *    INIT-ACK) but the receiver SHOULD also use all valid
1106  *    address parameters contained within the chunk.
1107  *
1108  * 2.18.3 Solution description
1109  *
1110  * This new text clearly specifies to an implementor the need
1111  * to look within the INIT or INIT-ACK. Any implementation that
1112  * does not do this, may not be able to establish associations
1113  * in certain circumstances.
1114  *
1115  */
__sctp_rcv_init_lookup(struct net * net,struct sk_buff * skb,const union sctp_addr * laddr,struct sctp_transport ** transportp)1116 static struct sctp_association *__sctp_rcv_init_lookup(struct net *net,
1117 	struct sk_buff *skb,
1118 	const union sctp_addr *laddr, struct sctp_transport **transportp)
1119 {
1120 	struct sctp_association *asoc;
1121 	union sctp_addr addr;
1122 	union sctp_addr *paddr = &addr;
1123 	struct sctphdr *sh = sctp_hdr(skb);
1124 	union sctp_params params;
1125 	struct sctp_init_chunk *init;
1126 	struct sctp_af *af;
1127 
1128 	/*
1129 	 * This code will NOT touch anything inside the chunk--it is
1130 	 * strictly READ-ONLY.
1131 	 *
1132 	 * RFC 2960 3  SCTP packet Format
1133 	 *
1134 	 * Multiple chunks can be bundled into one SCTP packet up to
1135 	 * the MTU size, except for the INIT, INIT ACK, and SHUTDOWN
1136 	 * COMPLETE chunks.  These chunks MUST NOT be bundled with any
1137 	 * other chunk in a packet.  See Section 6.10 for more details
1138 	 * on chunk bundling.
1139 	 */
1140 
1141 	/* Find the start of the TLVs and the end of the chunk.  This is
1142 	 * the region we search for address parameters.
1143 	 */
1144 	init = (struct sctp_init_chunk *)skb->data;
1145 
1146 	/* Walk the parameters looking for embedded addresses. */
1147 	sctp_walk_params(params, init, init_hdr.params) {
1148 
1149 		/* Note: Ignoring hostname addresses. */
1150 		af = sctp_get_af_specific(param_type2af(params.p->type));
1151 		if (!af)
1152 			continue;
1153 
1154 		if (!af->from_addr_param(paddr, params.addr, sh->source, 0))
1155 			continue;
1156 
1157 		asoc = __sctp_lookup_association(net, laddr, paddr, transportp);
1158 		if (asoc)
1159 			return asoc;
1160 	}
1161 
1162 	return NULL;
1163 }
1164 
1165 /* ADD-IP, Section 5.2
1166  * When an endpoint receives an ASCONF Chunk from the remote peer
1167  * special procedures may be needed to identify the association the
1168  * ASCONF Chunk is associated with. To properly find the association
1169  * the following procedures SHOULD be followed:
1170  *
1171  * D2) If the association is not found, use the address found in the
1172  * Address Parameter TLV combined with the port number found in the
1173  * SCTP common header. If found proceed to rule D4.
1174  *
1175  * D2-ext) If more than one ASCONF Chunks are packed together, use the
1176  * address found in the ASCONF Address Parameter TLV of each of the
1177  * subsequent ASCONF Chunks. If found, proceed to rule D4.
1178  */
__sctp_rcv_asconf_lookup(struct net * net,struct sctp_chunkhdr * ch,const union sctp_addr * laddr,__be16 peer_port,struct sctp_transport ** transportp)1179 static struct sctp_association *__sctp_rcv_asconf_lookup(
1180 					struct net *net,
1181 					struct sctp_chunkhdr *ch,
1182 					const union sctp_addr *laddr,
1183 					__be16 peer_port,
1184 					struct sctp_transport **transportp)
1185 {
1186 	struct sctp_addip_chunk *asconf = (struct sctp_addip_chunk *)ch;
1187 	struct sctp_af *af;
1188 	union sctp_addr_param *param;
1189 	union sctp_addr paddr;
1190 
1191 	if (ntohs(ch->length) < sizeof(*asconf) + sizeof(struct sctp_paramhdr))
1192 		return NULL;
1193 
1194 	/* Skip over the ADDIP header and find the Address parameter */
1195 	param = (union sctp_addr_param *)(asconf + 1);
1196 
1197 	af = sctp_get_af_specific(param_type2af(param->p.type));
1198 	if (unlikely(!af))
1199 		return NULL;
1200 
1201 	if (!af->from_addr_param(&paddr, param, peer_port, 0))
1202 		return NULL;
1203 
1204 	return __sctp_lookup_association(net, laddr, &paddr, transportp);
1205 }
1206 
1207 
1208 /* SCTP-AUTH, Section 6.3:
1209 *    If the receiver does not find a STCB for a packet containing an AUTH
1210 *    chunk as the first chunk and not a COOKIE-ECHO chunk as the second
1211 *    chunk, it MUST use the chunks after the AUTH chunk to look up an existing
1212 *    association.
1213 *
1214 * This means that any chunks that can help us identify the association need
1215 * to be looked at to find this association.
1216 */
__sctp_rcv_walk_lookup(struct net * net,struct sk_buff * skb,const union sctp_addr * laddr,struct sctp_transport ** transportp)1217 static struct sctp_association *__sctp_rcv_walk_lookup(struct net *net,
1218 				      struct sk_buff *skb,
1219 				      const union sctp_addr *laddr,
1220 				      struct sctp_transport **transportp)
1221 {
1222 	struct sctp_association *asoc = NULL;
1223 	struct sctp_chunkhdr *ch;
1224 	int have_auth = 0;
1225 	unsigned int chunk_num = 1;
1226 	__u8 *ch_end;
1227 
1228 	/* Walk through the chunks looking for AUTH or ASCONF chunks
1229 	 * to help us find the association.
1230 	 */
1231 	ch = (struct sctp_chunkhdr *)skb->data;
1232 	do {
1233 		/* Break out if chunk length is less then minimal. */
1234 		if (ntohs(ch->length) < sizeof(*ch))
1235 			break;
1236 
1237 		ch_end = ((__u8 *)ch) + SCTP_PAD4(ntohs(ch->length));
1238 		if (ch_end > skb_tail_pointer(skb))
1239 			break;
1240 
1241 		switch (ch->type) {
1242 		case SCTP_CID_AUTH:
1243 			have_auth = chunk_num;
1244 			break;
1245 
1246 		case SCTP_CID_COOKIE_ECHO:
1247 			/* If a packet arrives containing an AUTH chunk as
1248 			 * a first chunk, a COOKIE-ECHO chunk as the second
1249 			 * chunk, and possibly more chunks after them, and
1250 			 * the receiver does not have an STCB for that
1251 			 * packet, then authentication is based on
1252 			 * the contents of the COOKIE- ECHO chunk.
1253 			 */
1254 			if (have_auth == 1 && chunk_num == 2)
1255 				return NULL;
1256 			break;
1257 
1258 		case SCTP_CID_ASCONF:
1259 			if (have_auth || net->sctp.addip_noauth)
1260 				asoc = __sctp_rcv_asconf_lookup(
1261 						net, ch, laddr,
1262 						sctp_hdr(skb)->source,
1263 						transportp);
1264 			break;
1265 		default:
1266 			break;
1267 		}
1268 
1269 		if (asoc)
1270 			break;
1271 
1272 		ch = (struct sctp_chunkhdr *)ch_end;
1273 		chunk_num++;
1274 	} while (ch_end + sizeof(*ch) < skb_tail_pointer(skb));
1275 
1276 	return asoc;
1277 }
1278 
1279 /*
1280  * There are circumstances when we need to look inside the SCTP packet
1281  * for information to help us find the association.   Examples
1282  * include looking inside of INIT/INIT-ACK chunks or after the AUTH
1283  * chunks.
1284  */
__sctp_rcv_lookup_harder(struct net * net,struct sk_buff * skb,const union sctp_addr * laddr,struct sctp_transport ** transportp)1285 static struct sctp_association *__sctp_rcv_lookup_harder(struct net *net,
1286 				      struct sk_buff *skb,
1287 				      const union sctp_addr *laddr,
1288 				      struct sctp_transport **transportp)
1289 {
1290 	struct sctp_chunkhdr *ch;
1291 
1292 	/* We do not allow GSO frames here as we need to linearize and
1293 	 * then cannot guarantee frame boundaries. This shouldn't be an
1294 	 * issue as packets hitting this are mostly INIT or INIT-ACK and
1295 	 * those cannot be on GSO-style anyway.
1296 	 */
1297 	if (skb_is_gso(skb) && skb_is_gso_sctp(skb))
1298 		return NULL;
1299 
1300 	ch = (struct sctp_chunkhdr *)skb->data;
1301 
1302 	/* The code below will attempt to walk the chunk and extract
1303 	 * parameter information.  Before we do that, we need to verify
1304 	 * that the chunk length doesn't cause overflow.  Otherwise, we'll
1305 	 * walk off the end.
1306 	 */
1307 	if (SCTP_PAD4(ntohs(ch->length)) > skb->len)
1308 		return NULL;
1309 
1310 	/* If this is INIT/INIT-ACK look inside the chunk too. */
1311 	if (ch->type == SCTP_CID_INIT || ch->type == SCTP_CID_INIT_ACK)
1312 		return __sctp_rcv_init_lookup(net, skb, laddr, transportp);
1313 
1314 	return __sctp_rcv_walk_lookup(net, skb, laddr, transportp);
1315 }
1316 
1317 /* Lookup an association for an inbound skb. */
__sctp_rcv_lookup(struct net * net,struct sk_buff * skb,const union sctp_addr * paddr,const union sctp_addr * laddr,struct sctp_transport ** transportp)1318 static struct sctp_association *__sctp_rcv_lookup(struct net *net,
1319 				      struct sk_buff *skb,
1320 				      const union sctp_addr *paddr,
1321 				      const union sctp_addr *laddr,
1322 				      struct sctp_transport **transportp)
1323 {
1324 	struct sctp_association *asoc;
1325 
1326 	asoc = __sctp_lookup_association(net, laddr, paddr, transportp);
1327 	if (asoc)
1328 		goto out;
1329 
1330 	/* Further lookup for INIT/INIT-ACK packets.
1331 	 * SCTP Implementors Guide, 2.18 Handling of address
1332 	 * parameters within the INIT or INIT-ACK.
1333 	 */
1334 	asoc = __sctp_rcv_lookup_harder(net, skb, laddr, transportp);
1335 	if (asoc)
1336 		goto out;
1337 
1338 	if (paddr->sa.sa_family == AF_INET)
1339 		pr_debug("sctp: asoc not found for src:%pI4:%d dst:%pI4:%d\n",
1340 			 &laddr->v4.sin_addr, ntohs(laddr->v4.sin_port),
1341 			 &paddr->v4.sin_addr, ntohs(paddr->v4.sin_port));
1342 	else
1343 		pr_debug("sctp: asoc not found for src:%pI6:%d dst:%pI6:%d\n",
1344 			 &laddr->v6.sin6_addr, ntohs(laddr->v6.sin6_port),
1345 			 &paddr->v6.sin6_addr, ntohs(paddr->v6.sin6_port));
1346 
1347 out:
1348 	return asoc;
1349 }
1350