1// SPDX-License-Identifier: GPL-2.0-or-later 2/* SCTP kernel implementation 3 * Copyright (c) 1999-2000 Cisco, Inc. 4 * Copyright (c) 1999-2001 Motorola, Inc. 5 * Copyright (c) 2001-2003 International Business Machines, Corp. 6 * Copyright (c) 2001 Intel Corp. 7 * Copyright (c) 2001 Nokia, Inc. 8 * Copyright (c) 2001 La Monte H.P. Yarroll 9 * 10 * This file is part of the SCTP kernel implementation 11 * 12 * These functions handle all input from the IP layer into SCTP. 13 * 14 * Please send any bug reports or fixes you make to the 15 * email address(es): 16 * lksctp developers <linux-sctp@vger.kernel.org> 17 * 18 * Written or modified by: 19 * La Monte H.P. Yarroll <piggy@acm.org> 20 * Karl Knutson <karl@athena.chicago.il.us> 21 * Xingang Guo <xingang.guo@intel.com> 22 * Jon Grimm <jgrimm@us.ibm.com> 23 * Hui Huang <hui.huang@nokia.com> 24 * Daisy Chang <daisyc@us.ibm.com> 25 * Sridhar Samudrala <sri@us.ibm.com> 26 * Ardelle Fan <ardelle.fan@intel.com> 27 */ 28 29#include <linux/types.h> 30#include <linux/list.h> /* For struct list_head */ 31#include <linux/socket.h> 32#include <linux/ip.h> 33#include <linux/time.h> /* For struct timeval */ 34#include <linux/slab.h> 35#include <net/ip.h> 36#include <net/icmp.h> 37#include <net/snmp.h> 38#include <net/sock.h> 39#include <net/xfrm.h> 40#include <net/sctp/sctp.h> 41#include <net/sctp/sm.h> 42#include <net/sctp/checksum.h> 43#include <net/net_namespace.h> 44#include <linux/rhashtable.h> 45#include <net/sock_reuseport.h> 46 47/* Forward declarations for internal helpers. */ 48static int sctp_rcv_ootb(struct sk_buff *); 49static struct sctp_association *__sctp_rcv_lookup(struct net *net, 50 struct sk_buff *skb, 51 const union sctp_addr *paddr, 52 const union sctp_addr *laddr, 53 struct sctp_transport **transportp); 54static struct sctp_endpoint *__sctp_rcv_lookup_endpoint( 55 struct net *net, struct sk_buff *skb, 56 const union sctp_addr *laddr, 57 const union sctp_addr *daddr); 58static struct sctp_association *__sctp_lookup_association( 59 struct net *net, 60 const union sctp_addr *local, 61 const union sctp_addr *peer, 62 struct sctp_transport **pt); 63 64static int sctp_add_backlog(struct sock *sk, struct sk_buff *skb); 65 66 67/* Calculate the SCTP checksum of an SCTP packet. */ 68static inline int sctp_rcv_checksum(struct net *net, struct sk_buff *skb) 69{ 70 struct sctphdr *sh = sctp_hdr(skb); 71 __le32 cmp = sh->checksum; 72 __le32 val = sctp_compute_cksum(skb, 0); 73 74 if (val != cmp) { 75 /* CRC failure, dump it. */ 76 __SCTP_INC_STATS(net, SCTP_MIB_CHECKSUMERRORS); 77 return -1; 78 } 79 return 0; 80} 81 82/* 83 * This is the routine which IP calls when receiving an SCTP packet. 84 */ 85int sctp_rcv(struct sk_buff *skb) 86{ 87 struct sock *sk; 88 struct sctp_association *asoc; 89 struct sctp_endpoint *ep = NULL; 90 struct sctp_ep_common *rcvr; 91 struct sctp_transport *transport = NULL; 92 struct sctp_chunk *chunk; 93 union sctp_addr src; 94 union sctp_addr dest; 95 int bound_dev_if; 96 int family; 97 struct sctp_af *af; 98 struct net *net = dev_net(skb->dev); 99 bool is_gso = skb_is_gso(skb) && skb_is_gso_sctp(skb); 100 101 if (skb->pkt_type != PACKET_HOST) 102 goto discard_it; 103 104 __SCTP_INC_STATS(net, SCTP_MIB_INSCTPPACKS); 105 106 /* If packet is too small to contain a single chunk, let's not 107 * waste time on it anymore. 108 */ 109 if (skb->len < sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr) + 110 skb_transport_offset(skb)) 111 goto discard_it; 112 113 /* If the packet is fragmented and we need to do crc checking, 114 * it's better to just linearize it otherwise crc computing 115 * takes longer. 116 */ 117 if ((!is_gso && skb_linearize(skb)) || 118 !pskb_may_pull(skb, sizeof(struct sctphdr))) 119 goto discard_it; 120 121 /* Pull up the IP header. */ 122 __skb_pull(skb, skb_transport_offset(skb)); 123 124 skb->csum_valid = 0; /* Previous value not applicable */ 125 if (skb_csum_unnecessary(skb)) 126 __skb_decr_checksum_unnecessary(skb); 127 else if (!sctp_checksum_disable && 128 !is_gso && 129 sctp_rcv_checksum(net, skb) < 0) 130 goto discard_it; 131 skb->csum_valid = 1; 132 133 __skb_pull(skb, sizeof(struct sctphdr)); 134 135 family = ipver2af(ip_hdr(skb)->version); 136 af = sctp_get_af_specific(family); 137 if (unlikely(!af)) 138 goto discard_it; 139 SCTP_INPUT_CB(skb)->af = af; 140 141 /* Initialize local addresses for lookups. */ 142 af->from_skb(&src, skb, 1); 143 af->from_skb(&dest, skb, 0); 144 145 /* If the packet is to or from a non-unicast address, 146 * silently discard the packet. 147 * 148 * This is not clearly defined in the RFC except in section 149 * 8.4 - OOTB handling. However, based on the book "Stream Control 150 * Transmission Protocol" 2.1, "It is important to note that the 151 * IP address of an SCTP transport address must be a routable 152 * unicast address. In other words, IP multicast addresses and 153 * IP broadcast addresses cannot be used in an SCTP transport 154 * address." 155 */ 156 if (!af->addr_valid(&src, NULL, skb) || 157 !af->addr_valid(&dest, NULL, skb)) 158 goto discard_it; 159 160 asoc = __sctp_rcv_lookup(net, skb, &src, &dest, &transport); 161 162 if (!asoc) 163 ep = __sctp_rcv_lookup_endpoint(net, skb, &dest, &src); 164 165 /* Retrieve the common input handling substructure. */ 166 rcvr = asoc ? &asoc->base : &ep->base; 167 sk = rcvr->sk; 168 169 /* 170 * If a frame arrives on an interface and the receiving socket is 171 * bound to another interface, via SO_BINDTODEVICE, treat it as OOTB 172 */ 173 bound_dev_if = READ_ONCE(sk->sk_bound_dev_if); 174 if (bound_dev_if && (bound_dev_if != af->skb_iif(skb))) { 175 if (transport) { 176 sctp_transport_put(transport); 177 asoc = NULL; 178 transport = NULL; 179 } else { 180 sctp_endpoint_put(ep); 181 ep = NULL; 182 } 183 sk = net->sctp.ctl_sock; 184 ep = sctp_sk(sk)->ep; 185 sctp_endpoint_hold(ep); 186 rcvr = &ep->base; 187 } 188 189 /* 190 * RFC 2960, 8.4 - Handle "Out of the blue" Packets. 191 * An SCTP packet is called an "out of the blue" (OOTB) 192 * packet if it is correctly formed, i.e., passed the 193 * receiver's checksum check, but the receiver is not 194 * able to identify the association to which this 195 * packet belongs. 196 */ 197 if (!asoc) { 198 if (sctp_rcv_ootb(skb)) { 199 __SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES); 200 goto discard_release; 201 } 202 } 203 204 if (!xfrm_policy_check(sk, XFRM_POLICY_IN, skb, family)) 205 goto discard_release; 206 nf_reset_ct(skb); 207 208 if (sk_filter(sk, skb)) 209 goto discard_release; 210 211 /* Create an SCTP packet structure. */ 212 chunk = sctp_chunkify(skb, asoc, sk, GFP_ATOMIC); 213 if (!chunk) 214 goto discard_release; 215 SCTP_INPUT_CB(skb)->chunk = chunk; 216 217 /* Remember what endpoint is to handle this packet. */ 218 chunk->rcvr = rcvr; 219 220 /* Remember the SCTP header. */ 221 chunk->sctp_hdr = sctp_hdr(skb); 222 223 /* Set the source and destination addresses of the incoming chunk. */ 224 sctp_init_addrs(chunk, &src, &dest); 225 226 /* Remember where we came from. */ 227 chunk->transport = transport; 228 229 /* Acquire access to the sock lock. Note: We are safe from other 230 * bottom halves on this lock, but a user may be in the lock too, 231 * so check if it is busy. 232 */ 233 bh_lock_sock(sk); 234 235 if (sk != rcvr->sk) { 236 /* Our cached sk is different from the rcvr->sk. This is 237 * because migrate()/accept() may have moved the association 238 * to a new socket and released all the sockets. So now we 239 * are holding a lock on the old socket while the user may 240 * be doing something with the new socket. Switch our veiw 241 * of the current sk. 242 */ 243 bh_unlock_sock(sk); 244 sk = rcvr->sk; 245 bh_lock_sock(sk); 246 } 247 248 if (sock_owned_by_user(sk) || !sctp_newsk_ready(sk)) { 249 if (sctp_add_backlog(sk, skb)) { 250 bh_unlock_sock(sk); 251 sctp_chunk_free(chunk); 252 skb = NULL; /* sctp_chunk_free already freed the skb */ 253 goto discard_release; 254 } 255 __SCTP_INC_STATS(net, SCTP_MIB_IN_PKT_BACKLOG); 256 } else { 257 __SCTP_INC_STATS(net, SCTP_MIB_IN_PKT_SOFTIRQ); 258 sctp_inq_push(&chunk->rcvr->inqueue, chunk); 259 } 260 261 bh_unlock_sock(sk); 262 263 /* Release the asoc/ep ref we took in the lookup calls. */ 264 if (transport) 265 sctp_transport_put(transport); 266 else 267 sctp_endpoint_put(ep); 268 269 return 0; 270 271discard_it: 272 __SCTP_INC_STATS(net, SCTP_MIB_IN_PKT_DISCARDS); 273 kfree_skb(skb); 274 return 0; 275 276discard_release: 277 /* Release the asoc/ep ref we took in the lookup calls. */ 278 if (transport) 279 sctp_transport_put(transport); 280 else 281 sctp_endpoint_put(ep); 282 283 goto discard_it; 284} 285 286/* Process the backlog queue of the socket. Every skb on 287 * the backlog holds a ref on an association or endpoint. 288 * We hold this ref throughout the state machine to make 289 * sure that the structure we need is still around. 290 */ 291int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb) 292{ 293 struct sctp_chunk *chunk = SCTP_INPUT_CB(skb)->chunk; 294 struct sctp_inq *inqueue = &chunk->rcvr->inqueue; 295 struct sctp_transport *t = chunk->transport; 296 struct sctp_ep_common *rcvr = NULL; 297 int backloged = 0; 298 299 rcvr = chunk->rcvr; 300 301 /* If the rcvr is dead then the association or endpoint 302 * has been deleted and we can safely drop the chunk 303 * and refs that we are holding. 304 */ 305 if (rcvr->dead) { 306 sctp_chunk_free(chunk); 307 goto done; 308 } 309 310 if (unlikely(rcvr->sk != sk)) { 311 /* In this case, the association moved from one socket to 312 * another. We are currently sitting on the backlog of the 313 * old socket, so we need to move. 314 * However, since we are here in the process context we 315 * need to take make sure that the user doesn't own 316 * the new socket when we process the packet. 317 * If the new socket is user-owned, queue the chunk to the 318 * backlog of the new socket without dropping any refs. 319 * Otherwise, we can safely push the chunk on the inqueue. 320 */ 321 322 sk = rcvr->sk; 323 local_bh_disable(); 324 bh_lock_sock(sk); 325 326 if (sock_owned_by_user(sk) || !sctp_newsk_ready(sk)) { 327 if (sk_add_backlog(sk, skb, READ_ONCE(sk->sk_rcvbuf))) 328 sctp_chunk_free(chunk); 329 else 330 backloged = 1; 331 } else 332 sctp_inq_push(inqueue, chunk); 333 334 bh_unlock_sock(sk); 335 local_bh_enable(); 336 337 /* If the chunk was backloged again, don't drop refs */ 338 if (backloged) 339 return 0; 340 } else { 341 if (!sctp_newsk_ready(sk)) { 342 if (!sk_add_backlog(sk, skb, READ_ONCE(sk->sk_rcvbuf))) 343 return 0; 344 sctp_chunk_free(chunk); 345 } else { 346 sctp_inq_push(inqueue, chunk); 347 } 348 } 349 350done: 351 /* Release the refs we took in sctp_add_backlog */ 352 if (SCTP_EP_TYPE_ASSOCIATION == rcvr->type) 353 sctp_transport_put(t); 354 else if (SCTP_EP_TYPE_SOCKET == rcvr->type) 355 sctp_endpoint_put(sctp_ep(rcvr)); 356 else 357 BUG(); 358 359 return 0; 360} 361 362static int sctp_add_backlog(struct sock *sk, struct sk_buff *skb) 363{ 364 struct sctp_chunk *chunk = SCTP_INPUT_CB(skb)->chunk; 365 struct sctp_transport *t = chunk->transport; 366 struct sctp_ep_common *rcvr = chunk->rcvr; 367 int ret; 368 369 ret = sk_add_backlog(sk, skb, READ_ONCE(sk->sk_rcvbuf)); 370 if (!ret) { 371 /* Hold the assoc/ep while hanging on the backlog queue. 372 * This way, we know structures we need will not disappear 373 * from us 374 */ 375 if (SCTP_EP_TYPE_ASSOCIATION == rcvr->type) 376 sctp_transport_hold(t); 377 else if (SCTP_EP_TYPE_SOCKET == rcvr->type) 378 sctp_endpoint_hold(sctp_ep(rcvr)); 379 else 380 BUG(); 381 } 382 return ret; 383 384} 385 386/* Handle icmp frag needed error. */ 387void sctp_icmp_frag_needed(struct sock *sk, struct sctp_association *asoc, 388 struct sctp_transport *t, __u32 pmtu) 389{ 390 if (!t || (t->pathmtu <= pmtu)) 391 return; 392 393 if (sock_owned_by_user(sk)) { 394 atomic_set(&t->mtu_info, pmtu); 395 asoc->pmtu_pending = 1; 396 t->pmtu_pending = 1; 397 return; 398 } 399 400 if (!(t->param_flags & SPP_PMTUD_ENABLE)) 401 /* We can't allow retransmitting in such case, as the 402 * retransmission would be sized just as before, and thus we 403 * would get another icmp, and retransmit again. 404 */ 405 return; 406 407 /* Update transports view of the MTU. Return if no update was needed. 408 * If an update wasn't needed/possible, it also doesn't make sense to 409 * try to retransmit now. 410 */ 411 if (!sctp_transport_update_pmtu(t, pmtu)) 412 return; 413 414 /* Update association pmtu. */ 415 sctp_assoc_sync_pmtu(asoc); 416 417 /* Retransmit with the new pmtu setting. */ 418 sctp_retransmit(&asoc->outqueue, t, SCTP_RTXR_PMTUD); 419} 420 421void sctp_icmp_redirect(struct sock *sk, struct sctp_transport *t, 422 struct sk_buff *skb) 423{ 424 struct dst_entry *dst; 425 426 if (sock_owned_by_user(sk) || !t) 427 return; 428 dst = sctp_transport_dst_check(t); 429 if (dst) 430 dst->ops->redirect(dst, sk, skb); 431} 432 433/* 434 * SCTP Implementer's Guide, 2.37 ICMP handling procedures 435 * 436 * ICMP8) If the ICMP code is a "Unrecognized next header type encountered" 437 * or a "Protocol Unreachable" treat this message as an abort 438 * with the T bit set. 439 * 440 * This function sends an event to the state machine, which will abort the 441 * association. 442 * 443 */ 444void sctp_icmp_proto_unreachable(struct sock *sk, 445 struct sctp_association *asoc, 446 struct sctp_transport *t) 447{ 448 if (sock_owned_by_user(sk)) { 449 if (timer_pending(&t->proto_unreach_timer)) 450 return; 451 else { 452 if (!mod_timer(&t->proto_unreach_timer, 453 jiffies + (HZ/20))) 454 sctp_transport_hold(t); 455 } 456 } else { 457 struct net *net = sock_net(sk); 458 459 pr_debug("%s: unrecognized next header type " 460 "encountered!\n", __func__); 461 462 if (del_timer(&t->proto_unreach_timer)) 463 sctp_transport_put(t); 464 465 sctp_do_sm(net, SCTP_EVENT_T_OTHER, 466 SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH), 467 asoc->state, asoc->ep, asoc, t, 468 GFP_ATOMIC); 469 } 470} 471 472/* Common lookup code for icmp/icmpv6 error handler. */ 473struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb, 474 struct sctphdr *sctphdr, 475 struct sctp_association **app, 476 struct sctp_transport **tpp) 477{ 478 struct sctp_init_chunk *chunkhdr, _chunkhdr; 479 union sctp_addr saddr; 480 union sctp_addr daddr; 481 struct sctp_af *af; 482 struct sock *sk = NULL; 483 struct sctp_association *asoc; 484 struct sctp_transport *transport = NULL; 485 __u32 vtag = ntohl(sctphdr->vtag); 486 487 *app = NULL; *tpp = NULL; 488 489 af = sctp_get_af_specific(family); 490 if (unlikely(!af)) { 491 return NULL; 492 } 493 494 /* Initialize local addresses for lookups. */ 495 af->from_skb(&saddr, skb, 1); 496 af->from_skb(&daddr, skb, 0); 497 498 /* Look for an association that matches the incoming ICMP error 499 * packet. 500 */ 501 asoc = __sctp_lookup_association(net, &saddr, &daddr, &transport); 502 if (!asoc) 503 return NULL; 504 505 sk = asoc->base.sk; 506 507 /* RFC 4960, Appendix C. ICMP Handling 508 * 509 * ICMP6) An implementation MUST validate that the Verification Tag 510 * contained in the ICMP message matches the Verification Tag of 511 * the peer. If the Verification Tag is not 0 and does NOT 512 * match, discard the ICMP message. If it is 0 and the ICMP 513 * message contains enough bytes to verify that the chunk type is 514 * an INIT chunk and that the Initiate Tag matches the tag of the 515 * peer, continue with ICMP7. If the ICMP message is too short 516 * or the chunk type or the Initiate Tag does not match, silently 517 * discard the packet. 518 */ 519 if (vtag == 0) { 520 /* chunk header + first 4 octects of init header */ 521 chunkhdr = skb_header_pointer(skb, skb_transport_offset(skb) + 522 sizeof(struct sctphdr), 523 sizeof(struct sctp_chunkhdr) + 524 sizeof(__be32), &_chunkhdr); 525 if (!chunkhdr || 526 chunkhdr->chunk_hdr.type != SCTP_CID_INIT || 527 ntohl(chunkhdr->init_hdr.init_tag) != asoc->c.my_vtag) 528 goto out; 529 530 } else if (vtag != asoc->c.peer_vtag) { 531 goto out; 532 } 533 534 bh_lock_sock(sk); 535 536 /* If too many ICMPs get dropped on busy 537 * servers this needs to be solved differently. 538 */ 539 if (sock_owned_by_user(sk)) 540 __NET_INC_STATS(net, LINUX_MIB_LOCKDROPPEDICMPS); 541 542 *app = asoc; 543 *tpp = transport; 544 return sk; 545 546out: 547 sctp_transport_put(transport); 548 return NULL; 549} 550 551/* Common cleanup code for icmp/icmpv6 error handler. */ 552void sctp_err_finish(struct sock *sk, struct sctp_transport *t) 553 __releases(&((__sk)->sk_lock.slock)) 554{ 555 bh_unlock_sock(sk); 556 sctp_transport_put(t); 557} 558 559/* 560 * This routine is called by the ICMP module when it gets some 561 * sort of error condition. If err < 0 then the socket should 562 * be closed and the error returned to the user. If err > 0 563 * it's just the icmp type << 8 | icmp code. After adjustment 564 * header points to the first 8 bytes of the sctp header. We need 565 * to find the appropriate port. 566 * 567 * The locking strategy used here is very "optimistic". When 568 * someone else accesses the socket the ICMP is just dropped 569 * and for some paths there is no check at all. 570 * A more general error queue to queue errors for later handling 571 * is probably better. 572 * 573 */ 574int sctp_v4_err(struct sk_buff *skb, __u32 info) 575{ 576 const struct iphdr *iph = (const struct iphdr *)skb->data; 577 const int ihlen = iph->ihl * 4; 578 const int type = icmp_hdr(skb)->type; 579 const int code = icmp_hdr(skb)->code; 580 struct sock *sk; 581 struct sctp_association *asoc = NULL; 582 struct sctp_transport *transport; 583 struct inet_sock *inet; 584 __u16 saveip, savesctp; 585 int err; 586 struct net *net = dev_net(skb->dev); 587 588 /* Fix up skb to look at the embedded net header. */ 589 saveip = skb->network_header; 590 savesctp = skb->transport_header; 591 skb_reset_network_header(skb); 592 skb_set_transport_header(skb, ihlen); 593 sk = sctp_err_lookup(net, AF_INET, skb, sctp_hdr(skb), &asoc, &transport); 594 /* Put back, the original values. */ 595 skb->network_header = saveip; 596 skb->transport_header = savesctp; 597 if (!sk) { 598 __ICMP_INC_STATS(net, ICMP_MIB_INERRORS); 599 return -ENOENT; 600 } 601 /* Warning: The sock lock is held. Remember to call 602 * sctp_err_finish! 603 */ 604 605 switch (type) { 606 case ICMP_PARAMETERPROB: 607 err = EPROTO; 608 break; 609 case ICMP_DEST_UNREACH: 610 if (code > NR_ICMP_UNREACH) 611 goto out_unlock; 612 613 /* PMTU discovery (RFC1191) */ 614 if (ICMP_FRAG_NEEDED == code) { 615 sctp_icmp_frag_needed(sk, asoc, transport, 616 SCTP_TRUNC4(info)); 617 goto out_unlock; 618 } else { 619 if (ICMP_PROT_UNREACH == code) { 620 sctp_icmp_proto_unreachable(sk, asoc, 621 transport); 622 goto out_unlock; 623 } 624 } 625 err = icmp_err_convert[code].errno; 626 break; 627 case ICMP_TIME_EXCEEDED: 628 /* Ignore any time exceeded errors due to fragment reassembly 629 * timeouts. 630 */ 631 if (ICMP_EXC_FRAGTIME == code) 632 goto out_unlock; 633 634 err = EHOSTUNREACH; 635 break; 636 case ICMP_REDIRECT: 637 sctp_icmp_redirect(sk, transport, skb); 638 /* Fall through to out_unlock. */ 639 default: 640 goto out_unlock; 641 } 642 643 inet = inet_sk(sk); 644 if (!sock_owned_by_user(sk) && inet->recverr) { 645 sk->sk_err = err; 646 sk->sk_error_report(sk); 647 } else { /* Only an error on timeout */ 648 sk->sk_err_soft = err; 649 } 650 651out_unlock: 652 sctp_err_finish(sk, transport); 653 return 0; 654} 655 656/* 657 * RFC 2960, 8.4 - Handle "Out of the blue" Packets. 658 * 659 * This function scans all the chunks in the OOTB packet to determine if 660 * the packet should be discarded right away. If a response might be needed 661 * for this packet, or, if further processing is possible, the packet will 662 * be queued to a proper inqueue for the next phase of handling. 663 * 664 * Output: 665 * Return 0 - If further processing is needed. 666 * Return 1 - If the packet can be discarded right away. 667 */ 668static int sctp_rcv_ootb(struct sk_buff *skb) 669{ 670 struct sctp_chunkhdr *ch, _ch; 671 int ch_end, offset = 0; 672 673 /* Scan through all the chunks in the packet. */ 674 do { 675 /* Make sure we have at least the header there */ 676 if (offset + sizeof(_ch) > skb->len) 677 break; 678 679 ch = skb_header_pointer(skb, offset, sizeof(*ch), &_ch); 680 681 /* Break out if chunk length is less then minimal. */ 682 if (!ch || ntohs(ch->length) < sizeof(_ch)) 683 break; 684 685 ch_end = offset + SCTP_PAD4(ntohs(ch->length)); 686 if (ch_end > skb->len) 687 break; 688 689 /* RFC 8.4, 2) If the OOTB packet contains an ABORT chunk, the 690 * receiver MUST silently discard the OOTB packet and take no 691 * further action. 692 */ 693 if (SCTP_CID_ABORT == ch->type) 694 goto discard; 695 696 /* RFC 8.4, 6) If the packet contains a SHUTDOWN COMPLETE 697 * chunk, the receiver should silently discard the packet 698 * and take no further action. 699 */ 700 if (SCTP_CID_SHUTDOWN_COMPLETE == ch->type) 701 goto discard; 702 703 /* RFC 4460, 2.11.2 704 * This will discard packets with INIT chunk bundled as 705 * subsequent chunks in the packet. When INIT is first, 706 * the normal INIT processing will discard the chunk. 707 */ 708 if (SCTP_CID_INIT == ch->type && (void *)ch != skb->data) 709 goto discard; 710 711 offset = ch_end; 712 } while (ch_end < skb->len); 713 714 return 0; 715 716discard: 717 return 1; 718} 719 720/* Insert endpoint into the hash table. */ 721static int __sctp_hash_endpoint(struct sctp_endpoint *ep) 722{ 723 struct sock *sk = ep->base.sk; 724 struct net *net = sock_net(sk); 725 struct sctp_hashbucket *head; 726 struct sctp_ep_common *epb; 727 728 epb = &ep->base; 729 epb->hashent = sctp_ep_hashfn(net, epb->bind_addr.port); 730 head = &sctp_ep_hashtable[epb->hashent]; 731 732 if (sk->sk_reuseport) { 733 bool any = sctp_is_ep_boundall(sk); 734 struct sctp_ep_common *epb2; 735 struct list_head *list; 736 int cnt = 0, err = 1; 737 738 list_for_each(list, &ep->base.bind_addr.address_list) 739 cnt++; 740 741 sctp_for_each_hentry(epb2, &head->chain) { 742 struct sock *sk2 = epb2->sk; 743 744 if (!net_eq(sock_net(sk2), net) || sk2 == sk || 745 !uid_eq(sock_i_uid(sk2), sock_i_uid(sk)) || 746 !sk2->sk_reuseport) 747 continue; 748 749 err = sctp_bind_addrs_check(sctp_sk(sk2), 750 sctp_sk(sk), cnt); 751 if (!err) { 752 err = reuseport_add_sock(sk, sk2, any); 753 if (err) 754 return err; 755 break; 756 } else if (err < 0) { 757 return err; 758 } 759 } 760 761 if (err) { 762 err = reuseport_alloc(sk, any); 763 if (err) 764 return err; 765 } 766 } 767 768 write_lock(&head->lock); 769 hlist_add_head(&epb->node, &head->chain); 770 write_unlock(&head->lock); 771 return 0; 772} 773 774/* Add an endpoint to the hash. Local BH-safe. */ 775int sctp_hash_endpoint(struct sctp_endpoint *ep) 776{ 777 int err; 778 779 local_bh_disable(); 780 err = __sctp_hash_endpoint(ep); 781 local_bh_enable(); 782 783 return err; 784} 785 786/* Remove endpoint from the hash table. */ 787static void __sctp_unhash_endpoint(struct sctp_endpoint *ep) 788{ 789 struct sock *sk = ep->base.sk; 790 struct sctp_hashbucket *head; 791 struct sctp_ep_common *epb; 792 793 epb = &ep->base; 794 795 epb->hashent = sctp_ep_hashfn(sock_net(sk), epb->bind_addr.port); 796 797 head = &sctp_ep_hashtable[epb->hashent]; 798 799 if (rcu_access_pointer(sk->sk_reuseport_cb)) 800 reuseport_detach_sock(sk); 801 802 write_lock(&head->lock); 803 hlist_del_init(&epb->node); 804 write_unlock(&head->lock); 805} 806 807/* Remove endpoint from the hash. Local BH-safe. */ 808void sctp_unhash_endpoint(struct sctp_endpoint *ep) 809{ 810 local_bh_disable(); 811 __sctp_unhash_endpoint(ep); 812 local_bh_enable(); 813} 814 815static inline __u32 sctp_hashfn(const struct net *net, __be16 lport, 816 const union sctp_addr *paddr, __u32 seed) 817{ 818 __u32 addr; 819 820 if (paddr->sa.sa_family == AF_INET6) 821 addr = jhash(&paddr->v6.sin6_addr, 16, seed); 822 else 823 addr = (__force __u32)paddr->v4.sin_addr.s_addr; 824 825 return jhash_3words(addr, ((__force __u32)paddr->v4.sin_port) << 16 | 826 (__force __u32)lport, net_hash_mix(net), seed); 827} 828 829/* Look up an endpoint. */ 830static struct sctp_endpoint *__sctp_rcv_lookup_endpoint( 831 struct net *net, struct sk_buff *skb, 832 const union sctp_addr *laddr, 833 const union sctp_addr *paddr) 834{ 835 struct sctp_hashbucket *head; 836 struct sctp_ep_common *epb; 837 struct sctp_endpoint *ep; 838 struct sock *sk; 839 __be16 lport; 840 int hash; 841 842 lport = laddr->v4.sin_port; 843 hash = sctp_ep_hashfn(net, ntohs(lport)); 844 head = &sctp_ep_hashtable[hash]; 845 read_lock(&head->lock); 846 sctp_for_each_hentry(epb, &head->chain) { 847 ep = sctp_ep(epb); 848 if (sctp_endpoint_is_match(ep, net, laddr)) 849 goto hit; 850 } 851 852 ep = sctp_sk(net->sctp.ctl_sock)->ep; 853 854hit: 855 sk = ep->base.sk; 856 if (sk->sk_reuseport) { 857 __u32 phash = sctp_hashfn(net, lport, paddr, 0); 858 859 sk = reuseport_select_sock(sk, phash, skb, 860 sizeof(struct sctphdr)); 861 if (sk) 862 ep = sctp_sk(sk)->ep; 863 } 864 sctp_endpoint_hold(ep); 865 read_unlock(&head->lock); 866 return ep; 867} 868 869/* rhashtable for transport */ 870struct sctp_hash_cmp_arg { 871 const union sctp_addr *paddr; 872 const struct net *net; 873 __be16 lport; 874}; 875 876static inline int sctp_hash_cmp(struct rhashtable_compare_arg *arg, 877 const void *ptr) 878{ 879 struct sctp_transport *t = (struct sctp_transport *)ptr; 880 const struct sctp_hash_cmp_arg *x = arg->key; 881 int err = 1; 882 883 if (!sctp_cmp_addr_exact(&t->ipaddr, x->paddr)) 884 return err; 885 if (!sctp_transport_hold(t)) 886 return err; 887 888 if (!net_eq(t->asoc->base.net, x->net)) 889 goto out; 890 if (x->lport != htons(t->asoc->base.bind_addr.port)) 891 goto out; 892 893 err = 0; 894out: 895 sctp_transport_put(t); 896 return err; 897} 898 899static inline __u32 sctp_hash_obj(const void *data, u32 len, u32 seed) 900{ 901 const struct sctp_transport *t = data; 902 903 return sctp_hashfn(t->asoc->base.net, 904 htons(t->asoc->base.bind_addr.port), 905 &t->ipaddr, seed); 906} 907 908static inline __u32 sctp_hash_key(const void *data, u32 len, u32 seed) 909{ 910 const struct sctp_hash_cmp_arg *x = data; 911 912 return sctp_hashfn(x->net, x->lport, x->paddr, seed); 913} 914 915static const struct rhashtable_params sctp_hash_params = { 916 .head_offset = offsetof(struct sctp_transport, node), 917 .hashfn = sctp_hash_key, 918 .obj_hashfn = sctp_hash_obj, 919 .obj_cmpfn = sctp_hash_cmp, 920 .automatic_shrinking = true, 921}; 922 923int sctp_transport_hashtable_init(void) 924{ 925 return rhltable_init(&sctp_transport_hashtable, &sctp_hash_params); 926} 927 928void sctp_transport_hashtable_destroy(void) 929{ 930 rhltable_destroy(&sctp_transport_hashtable); 931} 932 933int sctp_hash_transport(struct sctp_transport *t) 934{ 935 struct sctp_transport *transport; 936 struct rhlist_head *tmp, *list; 937 struct sctp_hash_cmp_arg arg; 938 int err; 939 940 if (t->asoc->temp) 941 return 0; 942 943 arg.net = t->asoc->base.net; 944 arg.paddr = &t->ipaddr; 945 arg.lport = htons(t->asoc->base.bind_addr.port); 946 947 rcu_read_lock(); 948 list = rhltable_lookup(&sctp_transport_hashtable, &arg, 949 sctp_hash_params); 950 951 rhl_for_each_entry_rcu(transport, tmp, list, node) 952 if (transport->asoc->ep == t->asoc->ep) { 953 rcu_read_unlock(); 954 return -EEXIST; 955 } 956 rcu_read_unlock(); 957 958 err = rhltable_insert_key(&sctp_transport_hashtable, &arg, 959 &t->node, sctp_hash_params); 960 if (err) 961 pr_err_once("insert transport fail, errno %d\n", err); 962 963 return err; 964} 965 966void sctp_unhash_transport(struct sctp_transport *t) 967{ 968 if (t->asoc->temp) 969 return; 970 971 rhltable_remove(&sctp_transport_hashtable, &t->node, 972 sctp_hash_params); 973} 974 975/* return a transport with holding it */ 976struct sctp_transport *sctp_addrs_lookup_transport( 977 struct net *net, 978 const union sctp_addr *laddr, 979 const union sctp_addr *paddr) 980{ 981 struct rhlist_head *tmp, *list; 982 struct sctp_transport *t; 983 struct sctp_hash_cmp_arg arg = { 984 .paddr = paddr, 985 .net = net, 986 .lport = laddr->v4.sin_port, 987 }; 988 989 list = rhltable_lookup(&sctp_transport_hashtable, &arg, 990 sctp_hash_params); 991 992 rhl_for_each_entry_rcu(t, tmp, list, node) { 993 if (!sctp_transport_hold(t)) 994 continue; 995 996 if (sctp_bind_addr_match(&t->asoc->base.bind_addr, 997 laddr, sctp_sk(t->asoc->base.sk))) 998 return t; 999 sctp_transport_put(t); 1000 } 1001 1002 return NULL; 1003} 1004 1005/* return a transport without holding it, as it's only used under sock lock */ 1006struct sctp_transport *sctp_epaddr_lookup_transport( 1007 const struct sctp_endpoint *ep, 1008 const union sctp_addr *paddr) 1009{ 1010 struct rhlist_head *tmp, *list; 1011 struct sctp_transport *t; 1012 struct sctp_hash_cmp_arg arg = { 1013 .paddr = paddr, 1014 .net = ep->base.net, 1015 .lport = htons(ep->base.bind_addr.port), 1016 }; 1017 1018 list = rhltable_lookup(&sctp_transport_hashtable, &arg, 1019 sctp_hash_params); 1020 1021 rhl_for_each_entry_rcu(t, tmp, list, node) 1022 if (ep == t->asoc->ep) 1023 return t; 1024 1025 return NULL; 1026} 1027 1028/* Look up an association. */ 1029static struct sctp_association *__sctp_lookup_association( 1030 struct net *net, 1031 const union sctp_addr *local, 1032 const union sctp_addr *peer, 1033 struct sctp_transport **pt) 1034{ 1035 struct sctp_transport *t; 1036 struct sctp_association *asoc = NULL; 1037 1038 t = sctp_addrs_lookup_transport(net, local, peer); 1039 if (!t) 1040 goto out; 1041 1042 asoc = t->asoc; 1043 *pt = t; 1044 1045out: 1046 return asoc; 1047} 1048 1049/* Look up an association. protected by RCU read lock */ 1050static 1051struct sctp_association *sctp_lookup_association(struct net *net, 1052 const union sctp_addr *laddr, 1053 const union sctp_addr *paddr, 1054 struct sctp_transport **transportp) 1055{ 1056 struct sctp_association *asoc; 1057 1058 rcu_read_lock(); 1059 asoc = __sctp_lookup_association(net, laddr, paddr, transportp); 1060 rcu_read_unlock(); 1061 1062 return asoc; 1063} 1064 1065/* Is there an association matching the given local and peer addresses? */ 1066bool sctp_has_association(struct net *net, 1067 const union sctp_addr *laddr, 1068 const union sctp_addr *paddr) 1069{ 1070 struct sctp_transport *transport; 1071 1072 if (sctp_lookup_association(net, laddr, paddr, &transport)) { 1073 sctp_transport_put(transport); 1074 return true; 1075 } 1076 1077 return false; 1078} 1079 1080/* 1081 * SCTP Implementors Guide, 2.18 Handling of address 1082 * parameters within the INIT or INIT-ACK. 1083 * 1084 * D) When searching for a matching TCB upon reception of an INIT 1085 * or INIT-ACK chunk the receiver SHOULD use not only the 1086 * source address of the packet (containing the INIT or 1087 * INIT-ACK) but the receiver SHOULD also use all valid 1088 * address parameters contained within the chunk. 1089 * 1090 * 2.18.3 Solution description 1091 * 1092 * This new text clearly specifies to an implementor the need 1093 * to look within the INIT or INIT-ACK. Any implementation that 1094 * does not do this, may not be able to establish associations 1095 * in certain circumstances. 1096 * 1097 */ 1098static struct sctp_association *__sctp_rcv_init_lookup(struct net *net, 1099 struct sk_buff *skb, 1100 const union sctp_addr *laddr, struct sctp_transport **transportp) 1101{ 1102 struct sctp_association *asoc; 1103 union sctp_addr addr; 1104 union sctp_addr *paddr = &addr; 1105 struct sctphdr *sh = sctp_hdr(skb); 1106 union sctp_params params; 1107 struct sctp_init_chunk *init; 1108 struct sctp_af *af; 1109 1110 /* 1111 * This code will NOT touch anything inside the chunk--it is 1112 * strictly READ-ONLY. 1113 * 1114 * RFC 2960 3 SCTP packet Format 1115 * 1116 * Multiple chunks can be bundled into one SCTP packet up to 1117 * the MTU size, except for the INIT, INIT ACK, and SHUTDOWN 1118 * COMPLETE chunks. These chunks MUST NOT be bundled with any 1119 * other chunk in a packet. See Section 6.10 for more details 1120 * on chunk bundling. 1121 */ 1122 1123 /* Find the start of the TLVs and the end of the chunk. This is 1124 * the region we search for address parameters. 1125 */ 1126 init = (struct sctp_init_chunk *)skb->data; 1127 1128 /* Walk the parameters looking for embedded addresses. */ 1129 sctp_walk_params(params, init, init_hdr.params) { 1130 1131 /* Note: Ignoring hostname addresses. */ 1132 af = sctp_get_af_specific(param_type2af(params.p->type)); 1133 if (!af) 1134 continue; 1135 1136 if (!af->from_addr_param(paddr, params.addr, sh->source, 0)) 1137 continue; 1138 1139 asoc = __sctp_lookup_association(net, laddr, paddr, transportp); 1140 if (asoc) 1141 return asoc; 1142 } 1143 1144 return NULL; 1145} 1146 1147/* ADD-IP, Section 5.2 1148 * When an endpoint receives an ASCONF Chunk from the remote peer 1149 * special procedures may be needed to identify the association the 1150 * ASCONF Chunk is associated with. To properly find the association 1151 * the following procedures SHOULD be followed: 1152 * 1153 * D2) If the association is not found, use the address found in the 1154 * Address Parameter TLV combined with the port number found in the 1155 * SCTP common header. If found proceed to rule D4. 1156 * 1157 * D2-ext) If more than one ASCONF Chunks are packed together, use the 1158 * address found in the ASCONF Address Parameter TLV of each of the 1159 * subsequent ASCONF Chunks. If found, proceed to rule D4. 1160 */ 1161static struct sctp_association *__sctp_rcv_asconf_lookup( 1162 struct net *net, 1163 struct sctp_chunkhdr *ch, 1164 const union sctp_addr *laddr, 1165 __be16 peer_port, 1166 struct sctp_transport **transportp) 1167{ 1168 struct sctp_addip_chunk *asconf = (struct sctp_addip_chunk *)ch; 1169 struct sctp_af *af; 1170 union sctp_addr_param *param; 1171 union sctp_addr paddr; 1172 1173 if (ntohs(ch->length) < sizeof(*asconf) + sizeof(struct sctp_paramhdr)) 1174 return NULL; 1175 1176 /* Skip over the ADDIP header and find the Address parameter */ 1177 param = (union sctp_addr_param *)(asconf + 1); 1178 1179 af = sctp_get_af_specific(param_type2af(param->p.type)); 1180 if (unlikely(!af)) 1181 return NULL; 1182 1183 if (!af->from_addr_param(&paddr, param, peer_port, 0)) 1184 return NULL; 1185 1186 return __sctp_lookup_association(net, laddr, &paddr, transportp); 1187} 1188 1189 1190/* SCTP-AUTH, Section 6.3: 1191* If the receiver does not find a STCB for a packet containing an AUTH 1192* chunk as the first chunk and not a COOKIE-ECHO chunk as the second 1193* chunk, it MUST use the chunks after the AUTH chunk to look up an existing 1194* association. 1195* 1196* This means that any chunks that can help us identify the association need 1197* to be looked at to find this association. 1198*/ 1199static struct sctp_association *__sctp_rcv_walk_lookup(struct net *net, 1200 struct sk_buff *skb, 1201 const union sctp_addr *laddr, 1202 struct sctp_transport **transportp) 1203{ 1204 struct sctp_association *asoc = NULL; 1205 struct sctp_chunkhdr *ch; 1206 int have_auth = 0; 1207 unsigned int chunk_num = 1; 1208 __u8 *ch_end; 1209 1210 /* Walk through the chunks looking for AUTH or ASCONF chunks 1211 * to help us find the association. 1212 */ 1213 ch = (struct sctp_chunkhdr *)skb->data; 1214 do { 1215 /* Break out if chunk length is less then minimal. */ 1216 if (ntohs(ch->length) < sizeof(*ch)) 1217 break; 1218 1219 ch_end = ((__u8 *)ch) + SCTP_PAD4(ntohs(ch->length)); 1220 if (ch_end > skb_tail_pointer(skb)) 1221 break; 1222 1223 switch (ch->type) { 1224 case SCTP_CID_AUTH: 1225 have_auth = chunk_num; 1226 break; 1227 1228 case SCTP_CID_COOKIE_ECHO: 1229 /* If a packet arrives containing an AUTH chunk as 1230 * a first chunk, a COOKIE-ECHO chunk as the second 1231 * chunk, and possibly more chunks after them, and 1232 * the receiver does not have an STCB for that 1233 * packet, then authentication is based on 1234 * the contents of the COOKIE- ECHO chunk. 1235 */ 1236 if (have_auth == 1 && chunk_num == 2) 1237 return NULL; 1238 break; 1239 1240 case SCTP_CID_ASCONF: 1241 if (have_auth || net->sctp.addip_noauth) 1242 asoc = __sctp_rcv_asconf_lookup( 1243 net, ch, laddr, 1244 sctp_hdr(skb)->source, 1245 transportp); 1246 default: 1247 break; 1248 } 1249 1250 if (asoc) 1251 break; 1252 1253 ch = (struct sctp_chunkhdr *)ch_end; 1254 chunk_num++; 1255 } while (ch_end + sizeof(*ch) < skb_tail_pointer(skb)); 1256 1257 return asoc; 1258} 1259 1260/* 1261 * There are circumstances when we need to look inside the SCTP packet 1262 * for information to help us find the association. Examples 1263 * include looking inside of INIT/INIT-ACK chunks or after the AUTH 1264 * chunks. 1265 */ 1266static struct sctp_association *__sctp_rcv_lookup_harder(struct net *net, 1267 struct sk_buff *skb, 1268 const union sctp_addr *laddr, 1269 struct sctp_transport **transportp) 1270{ 1271 struct sctp_chunkhdr *ch; 1272 1273 /* We do not allow GSO frames here as we need to linearize and 1274 * then cannot guarantee frame boundaries. This shouldn't be an 1275 * issue as packets hitting this are mostly INIT or INIT-ACK and 1276 * those cannot be on GSO-style anyway. 1277 */ 1278 if (skb_is_gso(skb) && skb_is_gso_sctp(skb)) 1279 return NULL; 1280 1281 ch = (struct sctp_chunkhdr *)skb->data; 1282 1283 /* The code below will attempt to walk the chunk and extract 1284 * parameter information. Before we do that, we need to verify 1285 * that the chunk length doesn't cause overflow. Otherwise, we'll 1286 * walk off the end. 1287 */ 1288 if (SCTP_PAD4(ntohs(ch->length)) > skb->len) 1289 return NULL; 1290 1291 /* If this is INIT/INIT-ACK look inside the chunk too. */ 1292 if (ch->type == SCTP_CID_INIT || ch->type == SCTP_CID_INIT_ACK) 1293 return __sctp_rcv_init_lookup(net, skb, laddr, transportp); 1294 1295 return __sctp_rcv_walk_lookup(net, skb, laddr, transportp); 1296} 1297 1298/* Lookup an association for an inbound skb. */ 1299static struct sctp_association *__sctp_rcv_lookup(struct net *net, 1300 struct sk_buff *skb, 1301 const union sctp_addr *paddr, 1302 const union sctp_addr *laddr, 1303 struct sctp_transport **transportp) 1304{ 1305 struct sctp_association *asoc; 1306 1307 asoc = __sctp_lookup_association(net, laddr, paddr, transportp); 1308 if (asoc) 1309 goto out; 1310 1311 /* Further lookup for INIT/INIT-ACK packets. 1312 * SCTP Implementors Guide, 2.18 Handling of address 1313 * parameters within the INIT or INIT-ACK. 1314 */ 1315 asoc = __sctp_rcv_lookup_harder(net, skb, laddr, transportp); 1316 if (asoc) 1317 goto out; 1318 1319 if (paddr->sa.sa_family == AF_INET) 1320 pr_debug("sctp: asoc not found for src:%pI4:%d dst:%pI4:%d\n", 1321 &laddr->v4.sin_addr, ntohs(laddr->v4.sin_port), 1322 &paddr->v4.sin_addr, ntohs(paddr->v4.sin_port)); 1323 else 1324 pr_debug("sctp: asoc not found for src:%pI6:%d dst:%pI6:%d\n", 1325 &laddr->v6.sin6_addr, ntohs(laddr->v6.sin6_port), 1326 &paddr->v6.sin6_addr, ntohs(paddr->v6.sin6_port)); 1327 1328out: 1329 return asoc; 1330} 1331