1/* 2 * net/dccp/ipv4.c 3 * 4 * An implementation of the DCCP protocol 5 * Arnaldo Carvalho de Melo <acme@conectiva.com.br> 6 * 7 * This program is free software; you can redistribute it and/or 8 * modify it under the terms of the GNU General Public License 9 * as published by the Free Software Foundation; either version 10 * 2 of the License, or (at your option) any later version. 11 */ 12 13#include <linux/dccp.h> 14#include <linux/icmp.h> 15#include <linux/module.h> 16#include <linux/skbuff.h> 17#include <linux/random.h> 18 19#include <net/icmp.h> 20#include <net/inet_common.h> 21#include <net/inet_hashtables.h> 22#include <net/inet_sock.h> 23#include <net/protocol.h> 24#include <net/sock.h> 25#include <net/timewait_sock.h> 26#include <net/tcp_states.h> 27#include <net/xfrm.h> 28 29#include "ackvec.h" 30#include "ccid.h" 31#include "dccp.h" 32#include "feat.h" 33 34/* 35 * This is the global socket data structure used for responding to 36 * the Out-of-the-blue (OOTB) packets. A control sock will be created 37 * for this socket at the initialization time. 38 */ 39static struct socket *dccp_v4_ctl_socket; 40 41static int dccp_v4_get_port(struct sock *sk, const unsigned short snum) 42{ 43 return inet_csk_get_port(&dccp_hashinfo, sk, snum, 44 inet_csk_bind_conflict); 45} 46 47int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) 48{ 49 struct inet_sock *inet = inet_sk(sk); 50 struct dccp_sock *dp = dccp_sk(sk); 51 const struct sockaddr_in *usin = (struct sockaddr_in *)uaddr; 52 struct rtable *rt; 53 __be32 daddr, nexthop; 54 int tmp; 55 int err; 56 57 dp->dccps_role = DCCP_ROLE_CLIENT; 58 59 if (addr_len < sizeof(struct sockaddr_in)) 60 return -EINVAL; 61 62 if (usin->sin_family != AF_INET) 63 return -EAFNOSUPPORT; 64 65 nexthop = daddr = usin->sin_addr.s_addr; 66 if (inet->opt != NULL && inet->opt->srr) { 67 if (daddr == 0) 68 return -EINVAL; 69 nexthop = inet->opt->faddr; 70 } 71 72 tmp = ip_route_connect(&rt, nexthop, inet->saddr, 73 RT_CONN_FLAGS(sk), sk->sk_bound_dev_if, 74 IPPROTO_DCCP, 75 inet->sport, usin->sin_port, sk, 1); 76 if (tmp < 0) 77 return tmp; 78 79 if (rt->rt_flags & (RTCF_MULTICAST | RTCF_BROADCAST)) { 80 ip_rt_put(rt); 81 return -ENETUNREACH; 82 } 83 84 if (inet->opt == NULL || !inet->opt->srr) 85 daddr = rt->rt_dst; 86 87 if (inet->saddr == 0) 88 inet->saddr = rt->rt_src; 89 inet->rcv_saddr = inet->saddr; 90 91 inet->dport = usin->sin_port; 92 inet->daddr = daddr; 93 94 inet_csk(sk)->icsk_ext_hdr_len = 0; 95 if (inet->opt != NULL) 96 inet_csk(sk)->icsk_ext_hdr_len = inet->opt->optlen; 97 /* 98 * Socket identity is still unknown (sport may be zero). 99 * However we set state to DCCP_REQUESTING and not releasing socket 100 * lock select source port, enter ourselves into the hash tables and 101 * complete initialization after this. 102 */ 103 dccp_set_state(sk, DCCP_REQUESTING); 104 err = inet_hash_connect(&dccp_death_row, sk); 105 if (err != 0) 106 goto failure; 107 108 err = ip_route_newports(&rt, IPPROTO_DCCP, inet->sport, inet->dport, 109 sk); 110 if (err != 0) 111 goto failure; 112 113 /* OK, now commit destination to socket. */ 114 sk_setup_caps(sk, &rt->u.dst); 115 116 dp->dccps_iss = secure_dccp_sequence_number(inet->saddr, inet->daddr, 117 inet->sport, inet->dport); 118 inet->id = dp->dccps_iss ^ jiffies; 119 120 err = dccp_connect(sk); 121 rt = NULL; 122 if (err != 0) 123 goto failure; 124out: 125 return err; 126failure: 127 /* 128 * This unhashes the socket and releases the local port, if necessary. 129 */ 130 dccp_set_state(sk, DCCP_CLOSED); 131 ip_rt_put(rt); 132 sk->sk_route_caps = 0; 133 inet->dport = 0; 134 goto out; 135} 136 137EXPORT_SYMBOL_GPL(dccp_v4_connect); 138 139/* 140 * This routine does path mtu discovery as defined in RFC1191. 141 */ 142static inline void dccp_do_pmtu_discovery(struct sock *sk, 143 const struct iphdr *iph, 144 u32 mtu) 145{ 146 struct dst_entry *dst; 147 const struct inet_sock *inet = inet_sk(sk); 148 const struct dccp_sock *dp = dccp_sk(sk); 149 150 /* We are not interested in DCCP_LISTEN and request_socks (RESPONSEs 151 * send out by Linux are always < 576bytes so they should go through 152 * unfragmented). 153 */ 154 if (sk->sk_state == DCCP_LISTEN) 155 return; 156 157 /* We don't check in the destentry if pmtu discovery is forbidden 158 * on this route. We just assume that no packet_to_big packets 159 * are send back when pmtu discovery is not active. 160 * There is a small race when the user changes this flag in the 161 * route, but I think that's acceptable. 162 */ 163 if ((dst = __sk_dst_check(sk, 0)) == NULL) 164 return; 165 166 dst->ops->update_pmtu(dst, mtu); 167 168 /* Something is about to be wrong... Remember soft error 169 * for the case, if this connection will not able to recover. 170 */ 171 if (mtu < dst_mtu(dst) && ip_dont_fragment(sk, dst)) 172 sk->sk_err_soft = EMSGSIZE; 173 174 mtu = dst_mtu(dst); 175 176 if (inet->pmtudisc != IP_PMTUDISC_DONT && 177 inet_csk(sk)->icsk_pmtu_cookie > mtu) { 178 dccp_sync_mss(sk, mtu); 179 180 /* 181 * From RFC 4340, sec. 14.1: 182 * 183 * DCCP-Sync packets are the best choice for upward 184 * probing, since DCCP-Sync probes do not risk application 185 * data loss. 186 */ 187 dccp_send_sync(sk, dp->dccps_gsr, DCCP_PKT_SYNC); 188 } /* else let the usual retransmit timer handle it */ 189} 190 191/* 192 * This routine is called by the ICMP module when it gets some sort of error 193 * condition. If err < 0 then the socket should be closed and the error 194 * returned to the user. If err > 0 it's just the icmp type << 8 | icmp code. 195 * After adjustment header points to the first 8 bytes of the tcp header. We 196 * need to find the appropriate port. 197 * 198 * The locking strategy used here is very "optimistic". When someone else 199 * accesses the socket the ICMP is just dropped and for some paths there is no 200 * check at all. A more general error queue to queue errors for later handling 201 * is probably better. 202 */ 203static void dccp_v4_err(struct sk_buff *skb, u32 info) 204{ 205 const struct iphdr *iph = (struct iphdr *)skb->data; 206 const struct dccp_hdr *dh = (struct dccp_hdr *)(skb->data + 207 (iph->ihl << 2)); 208 struct dccp_sock *dp; 209 struct inet_sock *inet; 210 const int type = icmp_hdr(skb)->type; 211 const int code = icmp_hdr(skb)->code; 212 struct sock *sk; 213 __u64 seq; 214 int err; 215 216 if (skb->len < (iph->ihl << 2) + 8) { 217 ICMP_INC_STATS_BH(ICMP_MIB_INERRORS); 218 return; 219 } 220 221 sk = inet_lookup(&dccp_hashinfo, iph->daddr, dh->dccph_dport, 222 iph->saddr, dh->dccph_sport, inet_iif(skb)); 223 if (sk == NULL) { 224 ICMP_INC_STATS_BH(ICMP_MIB_INERRORS); 225 return; 226 } 227 228 if (sk->sk_state == DCCP_TIME_WAIT) { 229 inet_twsk_put(inet_twsk(sk)); 230 return; 231 } 232 233 bh_lock_sock(sk); 234 /* If too many ICMPs get dropped on busy 235 * servers this needs to be solved differently. 236 */ 237 if (sock_owned_by_user(sk)) 238 NET_INC_STATS_BH(LINUX_MIB_LOCKDROPPEDICMPS); 239 240 if (sk->sk_state == DCCP_CLOSED) 241 goto out; 242 243 dp = dccp_sk(sk); 244 seq = dccp_hdr_seq(skb); 245 if (sk->sk_state != DCCP_LISTEN && 246 !between48(seq, dp->dccps_swl, dp->dccps_swh)) { 247 NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS); 248 goto out; 249 } 250 251 switch (type) { 252 case ICMP_SOURCE_QUENCH: 253 /* Just silently ignore these. */ 254 goto out; 255 case ICMP_PARAMETERPROB: 256 err = EPROTO; 257 break; 258 case ICMP_DEST_UNREACH: 259 if (code > NR_ICMP_UNREACH) 260 goto out; 261 262 if (code == ICMP_FRAG_NEEDED) { /* PMTU discovery (RFC1191) */ 263 if (!sock_owned_by_user(sk)) 264 dccp_do_pmtu_discovery(sk, iph, info); 265 goto out; 266 } 267 268 err = icmp_err_convert[code].errno; 269 break; 270 case ICMP_TIME_EXCEEDED: 271 err = EHOSTUNREACH; 272 break; 273 default: 274 goto out; 275 } 276 277 switch (sk->sk_state) { 278 struct request_sock *req , **prev; 279 case DCCP_LISTEN: 280 if (sock_owned_by_user(sk)) 281 goto out; 282 req = inet_csk_search_req(sk, &prev, dh->dccph_dport, 283 iph->daddr, iph->saddr); 284 if (!req) 285 goto out; 286 287 /* 288 * ICMPs are not backlogged, hence we cannot get an established 289 * socket here. 290 */ 291 BUG_TRAP(!req->sk); 292 293 if (seq != dccp_rsk(req)->dreq_iss) { 294 NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS); 295 goto out; 296 } 297 /* 298 * Still in RESPOND, just remove it silently. 299 * There is no good way to pass the error to the newly 300 * created socket, and POSIX does not want network 301 * errors returned from accept(). 302 */ 303 inet_csk_reqsk_queue_drop(sk, req, prev); 304 goto out; 305 306 case DCCP_REQUESTING: 307 case DCCP_RESPOND: 308 if (!sock_owned_by_user(sk)) { 309 DCCP_INC_STATS_BH(DCCP_MIB_ATTEMPTFAILS); 310 sk->sk_err = err; 311 312 sk->sk_error_report(sk); 313 314 dccp_done(sk); 315 } else 316 sk->sk_err_soft = err; 317 goto out; 318 } 319 320 /* If we've already connected we will keep trying 321 * until we time out, or the user gives up. 322 * 323 * rfc1122 4.2.3.9 allows to consider as hard errors 324 * only PROTO_UNREACH and PORT_UNREACH (well, FRAG_FAILED too, 325 * but it is obsoleted by pmtu discovery). 326 * 327 * Note, that in modern internet, where routing is unreliable 328 * and in each dark corner broken firewalls sit, sending random 329 * errors ordered by their masters even this two messages finally lose 330 * their original sense (even Linux sends invalid PORT_UNREACHs) 331 * 332 * Now we are in compliance with RFCs. 333 * --ANK (980905) 334 */ 335 336 inet = inet_sk(sk); 337 if (!sock_owned_by_user(sk) && inet->recverr) { 338 sk->sk_err = err; 339 sk->sk_error_report(sk); 340 } else /* Only an error on timeout */ 341 sk->sk_err_soft = err; 342out: 343 bh_unlock_sock(sk); 344 sock_put(sk); 345} 346 347static inline __sum16 dccp_v4_csum_finish(struct sk_buff *skb, 348 __be32 src, __be32 dst) 349{ 350 return csum_tcpudp_magic(src, dst, skb->len, IPPROTO_DCCP, skb->csum); 351} 352 353void dccp_v4_send_check(struct sock *sk, int unused, struct sk_buff *skb) 354{ 355 const struct inet_sock *inet = inet_sk(sk); 356 struct dccp_hdr *dh = dccp_hdr(skb); 357 358 dccp_csum_outgoing(skb); 359 dh->dccph_checksum = dccp_v4_csum_finish(skb, inet->saddr, inet->daddr); 360} 361 362EXPORT_SYMBOL_GPL(dccp_v4_send_check); 363 364static inline u64 dccp_v4_init_sequence(const struct sk_buff *skb) 365{ 366 return secure_dccp_sequence_number(ip_hdr(skb)->daddr, 367 ip_hdr(skb)->saddr, 368 dccp_hdr(skb)->dccph_dport, 369 dccp_hdr(skb)->dccph_sport); 370} 371 372/* 373 * The three way handshake has completed - we got a valid ACK or DATAACK - 374 * now create the new socket. 375 * 376 * This is the equivalent of TCP's tcp_v4_syn_recv_sock 377 */ 378struct sock *dccp_v4_request_recv_sock(struct sock *sk, struct sk_buff *skb, 379 struct request_sock *req, 380 struct dst_entry *dst) 381{ 382 struct inet_request_sock *ireq; 383 struct inet_sock *newinet; 384 struct dccp_sock *newdp; 385 struct sock *newsk; 386 387 if (sk_acceptq_is_full(sk)) 388 goto exit_overflow; 389 390 if (dst == NULL && (dst = inet_csk_route_req(sk, req)) == NULL) 391 goto exit; 392 393 newsk = dccp_create_openreq_child(sk, req, skb); 394 if (newsk == NULL) 395 goto exit; 396 397 sk_setup_caps(newsk, dst); 398 399 newdp = dccp_sk(newsk); 400 newinet = inet_sk(newsk); 401 ireq = inet_rsk(req); 402 newinet->daddr = ireq->rmt_addr; 403 newinet->rcv_saddr = ireq->loc_addr; 404 newinet->saddr = ireq->loc_addr; 405 newinet->opt = ireq->opt; 406 ireq->opt = NULL; 407 newinet->mc_index = inet_iif(skb); 408 newinet->mc_ttl = ip_hdr(skb)->ttl; 409 newinet->id = jiffies; 410 411 dccp_sync_mss(newsk, dst_mtu(dst)); 412 413 __inet_hash(&dccp_hashinfo, newsk, 0); 414 __inet_inherit_port(&dccp_hashinfo, sk, newsk); 415 416 return newsk; 417 418exit_overflow: 419 NET_INC_STATS_BH(LINUX_MIB_LISTENOVERFLOWS); 420exit: 421 NET_INC_STATS_BH(LINUX_MIB_LISTENDROPS); 422 dst_release(dst); 423 return NULL; 424} 425 426EXPORT_SYMBOL_GPL(dccp_v4_request_recv_sock); 427 428static struct sock *dccp_v4_hnd_req(struct sock *sk, struct sk_buff *skb) 429{ 430 const struct dccp_hdr *dh = dccp_hdr(skb); 431 const struct iphdr *iph = ip_hdr(skb); 432 struct sock *nsk; 433 struct request_sock **prev; 434 /* Find possible connection requests. */ 435 struct request_sock *req = inet_csk_search_req(sk, &prev, 436 dh->dccph_sport, 437 iph->saddr, iph->daddr); 438 if (req != NULL) 439 return dccp_check_req(sk, skb, req, prev); 440 441 nsk = inet_lookup_established(&dccp_hashinfo, 442 iph->saddr, dh->dccph_sport, 443 iph->daddr, dh->dccph_dport, 444 inet_iif(skb)); 445 if (nsk != NULL) { 446 if (nsk->sk_state != DCCP_TIME_WAIT) { 447 bh_lock_sock(nsk); 448 return nsk; 449 } 450 inet_twsk_put(inet_twsk(nsk)); 451 return NULL; 452 } 453 454 return sk; 455} 456 457static struct dst_entry* dccp_v4_route_skb(struct sock *sk, 458 struct sk_buff *skb) 459{ 460 struct rtable *rt; 461 struct flowi fl = { .oif = ((struct rtable *)skb->dst)->rt_iif, 462 .nl_u = { .ip4_u = 463 { .daddr = ip_hdr(skb)->saddr, 464 .saddr = ip_hdr(skb)->daddr, 465 .tos = RT_CONN_FLAGS(sk) } }, 466 .proto = sk->sk_protocol, 467 .uli_u = { .ports = 468 { .sport = dccp_hdr(skb)->dccph_dport, 469 .dport = dccp_hdr(skb)->dccph_sport } 470 } 471 }; 472 473 security_skb_classify_flow(skb, &fl); 474 if (ip_route_output_flow(&rt, &fl, sk, 0)) { 475 IP_INC_STATS_BH(IPSTATS_MIB_OUTNOROUTES); 476 return NULL; 477 } 478 479 return &rt->u.dst; 480} 481 482static int dccp_v4_send_response(struct sock *sk, struct request_sock *req, 483 struct dst_entry *dst) 484{ 485 int err = -1; 486 struct sk_buff *skb; 487 488 /* First, grab a route. */ 489 490 if (dst == NULL && (dst = inet_csk_route_req(sk, req)) == NULL) 491 goto out; 492 493 skb = dccp_make_response(sk, dst, req); 494 if (skb != NULL) { 495 const struct inet_request_sock *ireq = inet_rsk(req); 496 struct dccp_hdr *dh = dccp_hdr(skb); 497 498 dh->dccph_checksum = dccp_v4_csum_finish(skb, ireq->loc_addr, 499 ireq->rmt_addr); 500 memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt)); 501 err = ip_build_and_send_pkt(skb, sk, ireq->loc_addr, 502 ireq->rmt_addr, 503 ireq->opt); 504 err = net_xmit_eval(err); 505 } 506 507out: 508 dst_release(dst); 509 return err; 510} 511 512static void dccp_v4_ctl_send_reset(struct sock *sk, struct sk_buff *rxskb) 513{ 514 int err; 515 struct dccp_hdr *rxdh = dccp_hdr(rxskb), *dh; 516 const struct iphdr *rxiph; 517 const int dccp_hdr_reset_len = sizeof(struct dccp_hdr) + 518 sizeof(struct dccp_hdr_ext) + 519 sizeof(struct dccp_hdr_reset); 520 struct sk_buff *skb; 521 struct dst_entry *dst; 522 u64 seqno = 0; 523 524 /* Never send a reset in response to a reset. */ 525 if (rxdh->dccph_type == DCCP_PKT_RESET) 526 return; 527 528 if (((struct rtable *)rxskb->dst)->rt_type != RTN_LOCAL) 529 return; 530 531 dst = dccp_v4_route_skb(dccp_v4_ctl_socket->sk, rxskb); 532 if (dst == NULL) 533 return; 534 535 skb = alloc_skb(dccp_v4_ctl_socket->sk->sk_prot->max_header, 536 GFP_ATOMIC); 537 if (skb == NULL) 538 goto out; 539 540 /* Reserve space for headers. */ 541 skb_reserve(skb, dccp_v4_ctl_socket->sk->sk_prot->max_header); 542 skb->dst = dst_clone(dst); 543 544 dh = dccp_zeroed_hdr(skb, dccp_hdr_reset_len); 545 546 /* Build DCCP header and checksum it. */ 547 dh->dccph_type = DCCP_PKT_RESET; 548 dh->dccph_sport = rxdh->dccph_dport; 549 dh->dccph_dport = rxdh->dccph_sport; 550 dh->dccph_doff = dccp_hdr_reset_len / 4; 551 dh->dccph_x = 1; 552 dccp_hdr_reset(skb)->dccph_reset_code = 553 DCCP_SKB_CB(rxskb)->dccpd_reset_code; 554 555 /* See "8.3.1. Abnormal Termination" in RFC 4340 */ 556 if (DCCP_SKB_CB(rxskb)->dccpd_ack_seq != DCCP_PKT_WITHOUT_ACK_SEQ) 557 dccp_set_seqno(&seqno, DCCP_SKB_CB(rxskb)->dccpd_ack_seq + 1); 558 559 dccp_hdr_set_seq(dh, seqno); 560 dccp_hdr_set_ack(dccp_hdr_ack_bits(skb), DCCP_SKB_CB(rxskb)->dccpd_seq); 561 562 dccp_csum_outgoing(skb); 563 rxiph = ip_hdr(rxskb); 564 dh->dccph_checksum = dccp_v4_csum_finish(skb, rxiph->saddr, 565 rxiph->daddr); 566 567 bh_lock_sock(dccp_v4_ctl_socket->sk); 568 err = ip_build_and_send_pkt(skb, dccp_v4_ctl_socket->sk, 569 rxiph->daddr, rxiph->saddr, NULL); 570 bh_unlock_sock(dccp_v4_ctl_socket->sk); 571 572 if (net_xmit_eval(err) == 0) { 573 DCCP_INC_STATS_BH(DCCP_MIB_OUTSEGS); 574 DCCP_INC_STATS_BH(DCCP_MIB_OUTRSTS); 575 } 576out: 577 dst_release(dst); 578} 579 580static void dccp_v4_reqsk_destructor(struct request_sock *req) 581{ 582 kfree(inet_rsk(req)->opt); 583} 584 585static struct request_sock_ops dccp_request_sock_ops __read_mostly = { 586 .family = PF_INET, 587 .obj_size = sizeof(struct dccp_request_sock), 588 .rtx_syn_ack = dccp_v4_send_response, 589 .send_ack = dccp_reqsk_send_ack, 590 .destructor = dccp_v4_reqsk_destructor, 591 .send_reset = dccp_v4_ctl_send_reset, 592}; 593 594int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb) 595{ 596 struct inet_request_sock *ireq; 597 struct request_sock *req; 598 struct dccp_request_sock *dreq; 599 const __be32 service = dccp_hdr_request(skb)->dccph_req_service; 600 struct dccp_skb_cb *dcb = DCCP_SKB_CB(skb); 601 __u8 reset_code = DCCP_RESET_CODE_TOO_BUSY; 602 603 /* Never answer to DCCP_PKT_REQUESTs send to broadcast or multicast */ 604 if (((struct rtable *)skb->dst)->rt_flags & 605 (RTCF_BROADCAST | RTCF_MULTICAST)) { 606 reset_code = DCCP_RESET_CODE_NO_CONNECTION; 607 goto drop; 608 } 609 610 if (dccp_bad_service_code(sk, service)) { 611 reset_code = DCCP_RESET_CODE_BAD_SERVICE_CODE; 612 goto drop; 613 } 614 /* 615 * TW buckets are converted to open requests without 616 * limitations, they conserve resources and peer is 617 * evidently real one. 618 */ 619 if (inet_csk_reqsk_queue_is_full(sk)) 620 goto drop; 621 622 /* 623 * Accept backlog is full. If we have already queued enough 624 * of warm entries in syn queue, drop request. It is better than 625 * clogging syn queue with openreqs with exponentially increasing 626 * timeout. 627 */ 628 if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1) 629 goto drop; 630 631 req = reqsk_alloc(&dccp_request_sock_ops); 632 if (req == NULL) 633 goto drop; 634 635 if (dccp_parse_options(sk, skb)) 636 goto drop_and_free; 637 638 dccp_reqsk_init(req, skb); 639 640 if (security_inet_conn_request(sk, skb, req)) 641 goto drop_and_free; 642 643 ireq = inet_rsk(req); 644 ireq->loc_addr = ip_hdr(skb)->daddr; 645 ireq->rmt_addr = ip_hdr(skb)->saddr; 646 ireq->opt = NULL; 647 648 /* 649 * Step 3: Process LISTEN state 650 * 651 * Set S.ISR, S.GSR, S.SWL, S.SWH from packet or Init Cookie 652 * 653 * In fact we defer setting S.GSR, S.SWL, S.SWH to 654 * dccp_create_openreq_child. 655 */ 656 dreq = dccp_rsk(req); 657 dreq->dreq_isr = dcb->dccpd_seq; 658 dreq->dreq_iss = dccp_v4_init_sequence(skb); 659 dreq->dreq_service = service; 660 661 if (dccp_v4_send_response(sk, req, NULL)) 662 goto drop_and_free; 663 664 inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT); 665 return 0; 666 667drop_and_free: 668 reqsk_free(req); 669drop: 670 DCCP_INC_STATS_BH(DCCP_MIB_ATTEMPTFAILS); 671 dcb->dccpd_reset_code = reset_code; 672 return -1; 673} 674 675EXPORT_SYMBOL_GPL(dccp_v4_conn_request); 676 677int dccp_v4_do_rcv(struct sock *sk, struct sk_buff *skb) 678{ 679 struct dccp_hdr *dh = dccp_hdr(skb); 680 681 if (sk->sk_state == DCCP_OPEN) { /* Fast path */ 682 if (dccp_rcv_established(sk, skb, dh, skb->len)) 683 goto reset; 684 return 0; 685 } 686 687 /* 688 * Step 3: Process LISTEN state 689 * If P.type == Request or P contains a valid Init Cookie option, 690 * (* Must scan the packet's options to check for Init 691 * Cookies. Only Init Cookies are processed here, 692 * however; other options are processed in Step 8. This 693 * scan need only be performed if the endpoint uses Init 694 * Cookies *) 695 * (* Generate a new socket and switch to that socket *) 696 * Set S := new socket for this port pair 697 * S.state = RESPOND 698 * Choose S.ISS (initial seqno) or set from Init Cookies 699 * Initialize S.GAR := S.ISS 700 * Set S.ISR, S.GSR, S.SWL, S.SWH from packet or Init Cookies 701 * Continue with S.state == RESPOND 702 * (* A Response packet will be generated in Step 11 *) 703 * Otherwise, 704 * Generate Reset(No Connection) unless P.type == Reset 705 * Drop packet and return 706 * 707 * NOTE: the check for the packet types is done in 708 * dccp_rcv_state_process 709 */ 710 if (sk->sk_state == DCCP_LISTEN) { 711 struct sock *nsk = dccp_v4_hnd_req(sk, skb); 712 713 if (nsk == NULL) 714 goto discard; 715 716 if (nsk != sk) { 717 if (dccp_child_process(sk, nsk, skb)) 718 goto reset; 719 return 0; 720 } 721 } 722 723 if (dccp_rcv_state_process(sk, skb, dh, skb->len)) 724 goto reset; 725 return 0; 726 727reset: 728 dccp_v4_ctl_send_reset(sk, skb); 729discard: 730 kfree_skb(skb); 731 return 0; 732} 733 734EXPORT_SYMBOL_GPL(dccp_v4_do_rcv); 735 736/** 737 * dccp_invalid_packet - check for malformed packets 738 * Implements RFC 4340, 8.5: Step 1: Check header basics 739 * Packets that fail these checks are ignored and do not receive Resets. 740 */ 741int dccp_invalid_packet(struct sk_buff *skb) 742{ 743 const struct dccp_hdr *dh; 744 unsigned int cscov; 745 746 if (skb->pkt_type != PACKET_HOST) 747 return 1; 748 749 /* If the packet is shorter than 12 bytes, drop packet and return */ 750 if (!pskb_may_pull(skb, sizeof(struct dccp_hdr))) { 751 DCCP_WARN("pskb_may_pull failed\n"); 752 return 1; 753 } 754 755 dh = dccp_hdr(skb); 756 757 /* If P.type is not understood, drop packet and return */ 758 if (dh->dccph_type >= DCCP_PKT_INVALID) { 759 DCCP_WARN("invalid packet type\n"); 760 return 1; 761 } 762 763 /* 764 * If P.Data Offset is too small for packet type, drop packet and return 765 */ 766 if (dh->dccph_doff < dccp_hdr_len(skb) / sizeof(u32)) { 767 DCCP_WARN("P.Data Offset(%u) too small\n", dh->dccph_doff); 768 return 1; 769 } 770 /* 771 * If P.Data Offset is too too large for packet, drop packet and return 772 */ 773 if (!pskb_may_pull(skb, dh->dccph_doff * sizeof(u32))) { 774 DCCP_WARN("P.Data Offset(%u) too large\n", dh->dccph_doff); 775 return 1; 776 } 777 778 /* 779 * If P.type is not Data, Ack, or DataAck and P.X == 0 (the packet 780 * has short sequence numbers), drop packet and return 781 */ 782 if (dh->dccph_type >= DCCP_PKT_DATA && 783 dh->dccph_type <= DCCP_PKT_DATAACK && dh->dccph_x == 0) { 784 DCCP_WARN("P.type (%s) not Data || [Data]Ack, while P.X == 0\n", 785 dccp_packet_name(dh->dccph_type)); 786 return 1; 787 } 788 789 /* 790 * If P.CsCov is too large for the packet size, drop packet and return. 791 * This must come _before_ checksumming (not as RFC 4340 suggests). 792 */ 793 cscov = dccp_csum_coverage(skb); 794 if (cscov > skb->len) { 795 DCCP_WARN("P.CsCov %u exceeds packet length %d\n", 796 dh->dccph_cscov, skb->len); 797 return 1; 798 } 799 800 /* If header checksum is incorrect, drop packet and return. 801 * (This step is completed in the AF-dependent functions.) */ 802 skb->csum = skb_checksum(skb, 0, cscov, 0); 803 804 return 0; 805} 806 807EXPORT_SYMBOL_GPL(dccp_invalid_packet); 808 809/* this is called when real data arrives */ 810static int dccp_v4_rcv(struct sk_buff *skb) 811{ 812 const struct dccp_hdr *dh; 813 const struct iphdr *iph; 814 struct sock *sk; 815 int min_cov; 816 817 /* Step 1: Check header basics */ 818 819 if (dccp_invalid_packet(skb)) 820 goto discard_it; 821 822 iph = ip_hdr(skb); 823 /* Step 1: If header checksum is incorrect, drop packet and return */ 824 if (dccp_v4_csum_finish(skb, iph->saddr, iph->daddr)) { 825 DCCP_WARN("dropped packet with invalid checksum\n"); 826 goto discard_it; 827 } 828 829 dh = dccp_hdr(skb); 830 831 DCCP_SKB_CB(skb)->dccpd_seq = dccp_hdr_seq(skb); 832 DCCP_SKB_CB(skb)->dccpd_type = dh->dccph_type; 833 834 dccp_pr_debug("%8.8s " 835 "src=%u.%u.%u.%u@%-5d " 836 "dst=%u.%u.%u.%u@%-5d seq=%llu", 837 dccp_packet_name(dh->dccph_type), 838 NIPQUAD(iph->saddr), ntohs(dh->dccph_sport), 839 NIPQUAD(iph->daddr), ntohs(dh->dccph_dport), 840 (unsigned long long) DCCP_SKB_CB(skb)->dccpd_seq); 841 842 if (dccp_packet_without_ack(skb)) { 843 DCCP_SKB_CB(skb)->dccpd_ack_seq = DCCP_PKT_WITHOUT_ACK_SEQ; 844 dccp_pr_debug_cat("\n"); 845 } else { 846 DCCP_SKB_CB(skb)->dccpd_ack_seq = dccp_hdr_ack_seq(skb); 847 dccp_pr_debug_cat(", ack=%llu\n", (unsigned long long) 848 DCCP_SKB_CB(skb)->dccpd_ack_seq); 849 } 850 851 /* Step 2: 852 * Look up flow ID in table and get corresponding socket */ 853 sk = __inet_lookup(&dccp_hashinfo, 854 iph->saddr, dh->dccph_sport, 855 iph->daddr, dh->dccph_dport, inet_iif(skb)); 856 /* 857 * Step 2: 858 * If no socket ... 859 */ 860 if (sk == NULL) { 861 dccp_pr_debug("failed to look up flow ID in table and " 862 "get corresponding socket\n"); 863 goto no_dccp_socket; 864 } 865 866 /* 867 * Step 2: 868 * ... or S.state == TIMEWAIT, 869 * Generate Reset(No Connection) unless P.type == Reset 870 * Drop packet and return 871 */ 872 if (sk->sk_state == DCCP_TIME_WAIT) { 873 dccp_pr_debug("sk->sk_state == DCCP_TIME_WAIT: do_time_wait\n"); 874 inet_twsk_put(inet_twsk(sk)); 875 goto no_dccp_socket; 876 } 877 878 /* 879 * RFC 4340, sec. 9.2.1: Minimum Checksum Coverage 880 * o if MinCsCov = 0, only packets with CsCov = 0 are accepted 881 * o if MinCsCov > 0, also accept packets with CsCov >= MinCsCov 882 */ 883 min_cov = dccp_sk(sk)->dccps_pcrlen; 884 if (dh->dccph_cscov && (min_cov == 0 || dh->dccph_cscov < min_cov)) { 885 dccp_pr_debug("Packet CsCov %d does not satisfy MinCsCov %d\n", 886 dh->dccph_cscov, min_cov); 887 goto discard_and_relse; 888 } 889 890 if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) 891 goto discard_and_relse; 892 nf_reset(skb); 893 894 return sk_receive_skb(sk, skb, 1); 895 896no_dccp_socket: 897 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) 898 goto discard_it; 899 /* 900 * Step 2: 901 * If no socket ... 902 * Generate Reset(No Connection) unless P.type == Reset 903 * Drop packet and return 904 */ 905 if (dh->dccph_type != DCCP_PKT_RESET) { 906 DCCP_SKB_CB(skb)->dccpd_reset_code = 907 DCCP_RESET_CODE_NO_CONNECTION; 908 dccp_v4_ctl_send_reset(sk, skb); 909 } 910 911discard_it: 912 kfree_skb(skb); 913 return 0; 914 915discard_and_relse: 916 sock_put(sk); 917 goto discard_it; 918} 919 920static struct inet_connection_sock_af_ops dccp_ipv4_af_ops = { 921 .queue_xmit = ip_queue_xmit, 922 .send_check = dccp_v4_send_check, 923 .rebuild_header = inet_sk_rebuild_header, 924 .conn_request = dccp_v4_conn_request, 925 .syn_recv_sock = dccp_v4_request_recv_sock, 926 .net_header_len = sizeof(struct iphdr), 927 .setsockopt = ip_setsockopt, 928 .getsockopt = ip_getsockopt, 929 .addr2sockaddr = inet_csk_addr2sockaddr, 930 .sockaddr_len = sizeof(struct sockaddr_in), 931#ifdef CONFIG_COMPAT 932 .compat_setsockopt = compat_ip_setsockopt, 933 .compat_getsockopt = compat_ip_getsockopt, 934#endif 935}; 936 937static int dccp_v4_init_sock(struct sock *sk) 938{ 939 static __u8 dccp_v4_ctl_sock_initialized; 940 int err = dccp_init_sock(sk, dccp_v4_ctl_sock_initialized); 941 942 if (err == 0) { 943 if (unlikely(!dccp_v4_ctl_sock_initialized)) 944 dccp_v4_ctl_sock_initialized = 1; 945 inet_csk(sk)->icsk_af_ops = &dccp_ipv4_af_ops; 946 } 947 948 return err; 949} 950 951static struct timewait_sock_ops dccp_timewait_sock_ops = { 952 .twsk_obj_size = sizeof(struct inet_timewait_sock), 953}; 954 955static struct proto dccp_v4_prot = { 956 .name = "DCCP", 957 .owner = THIS_MODULE, 958 .close = dccp_close, 959 .connect = dccp_v4_connect, 960 .disconnect = dccp_disconnect, 961 .ioctl = dccp_ioctl, 962 .init = dccp_v4_init_sock, 963 .setsockopt = dccp_setsockopt, 964 .getsockopt = dccp_getsockopt, 965 .sendmsg = dccp_sendmsg, 966 .recvmsg = dccp_recvmsg, 967 .backlog_rcv = dccp_v4_do_rcv, 968 .hash = dccp_hash, 969 .unhash = dccp_unhash, 970 .accept = inet_csk_accept, 971 .get_port = dccp_v4_get_port, 972 .shutdown = dccp_shutdown, 973 .destroy = dccp_destroy_sock, 974 .orphan_count = &dccp_orphan_count, 975 .max_header = MAX_DCCP_HEADER, 976 .obj_size = sizeof(struct dccp_sock), 977 .rsk_prot = &dccp_request_sock_ops, 978 .twsk_prot = &dccp_timewait_sock_ops, 979#ifdef CONFIG_COMPAT 980 .compat_setsockopt = compat_dccp_setsockopt, 981 .compat_getsockopt = compat_dccp_getsockopt, 982#endif 983}; 984 985static struct net_protocol dccp_v4_protocol = { 986 .handler = dccp_v4_rcv, 987 .err_handler = dccp_v4_err, 988 .no_policy = 1, 989}; 990 991static const struct proto_ops inet_dccp_ops = { 992 .family = PF_INET, 993 .owner = THIS_MODULE, 994 .release = inet_release, 995 .bind = inet_bind, 996 .connect = inet_stream_connect, 997 .socketpair = sock_no_socketpair, 998 .accept = inet_accept, 999 .getname = inet_getname, 1000 .poll = dccp_poll, 1001 .ioctl = inet_ioctl, 1002 .listen = inet_dccp_listen, 1003 .shutdown = inet_shutdown, 1004 .setsockopt = sock_common_setsockopt, 1005 .getsockopt = sock_common_getsockopt, 1006 .sendmsg = inet_sendmsg, 1007 .recvmsg = sock_common_recvmsg, 1008 .mmap = sock_no_mmap, 1009 .sendpage = sock_no_sendpage, 1010#ifdef CONFIG_COMPAT 1011 .compat_setsockopt = compat_sock_common_setsockopt, 1012 .compat_getsockopt = compat_sock_common_getsockopt, 1013#endif 1014}; 1015 1016static struct inet_protosw dccp_v4_protosw = { 1017 .type = SOCK_DCCP, 1018 .protocol = IPPROTO_DCCP, 1019 .prot = &dccp_v4_prot, 1020 .ops = &inet_dccp_ops, 1021 .capability = -1, 1022 .no_check = 0, 1023 .flags = INET_PROTOSW_ICSK, 1024}; 1025 1026static int __init dccp_v4_init(void) 1027{ 1028 int err = proto_register(&dccp_v4_prot, 1); 1029 1030 if (err != 0) 1031 goto out; 1032 1033 err = inet_add_protocol(&dccp_v4_protocol, IPPROTO_DCCP); 1034 if (err != 0) 1035 goto out_proto_unregister; 1036 1037 inet_register_protosw(&dccp_v4_protosw); 1038 1039 err = inet_csk_ctl_sock_create(&dccp_v4_ctl_socket, PF_INET, 1040 SOCK_DCCP, IPPROTO_DCCP); 1041 if (err) 1042 goto out_unregister_protosw; 1043out: 1044 return err; 1045out_unregister_protosw: 1046 inet_unregister_protosw(&dccp_v4_protosw); 1047 inet_del_protocol(&dccp_v4_protocol, IPPROTO_DCCP); 1048out_proto_unregister: 1049 proto_unregister(&dccp_v4_prot); 1050 goto out; 1051} 1052 1053static void __exit dccp_v4_exit(void) 1054{ 1055 inet_unregister_protosw(&dccp_v4_protosw); 1056 inet_del_protocol(&dccp_v4_protocol, IPPROTO_DCCP); 1057 proto_unregister(&dccp_v4_prot); 1058} 1059 1060module_init(dccp_v4_init); 1061module_exit(dccp_v4_exit); 1062 1063/* 1064 * __stringify doesn't likes enums, so use SOCK_DCCP (6) and IPPROTO_DCCP (33) 1065 * values directly, Also cover the case where the protocol is not specified, 1066 * i.e. net-pf-PF_INET-proto-0-type-SOCK_DCCP 1067 */ 1068MODULE_ALIAS("net-pf-" __stringify(PF_INET) "-proto-33-type-6"); 1069MODULE_ALIAS("net-pf-" __stringify(PF_INET) "-proto-0-type-6"); 1070MODULE_LICENSE("GPL"); 1071MODULE_AUTHOR("Arnaldo Carvalho de Melo <acme@mandriva.com>"); 1072MODULE_DESCRIPTION("DCCP - Datagram Congestion Controlled Protocol"); 1073