?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks
[linux/fpc-iii.git] / net / dccp / ipv6.c
blob0bf41faeffc4c7890273d69796cb4332e31b39ba
1 /*
2 * DCCP over IPv6
3 * Linux INET6 implementation
4 *
5 * Based on net/dccp6/ipv6.c
6 *
7 * Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
8 *
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License
11 * as published by the Free Software Foundation; either version
12 * 2 of the License, or (at your option) any later version.
13 */
14
15 #include <linux/module.h>
16 #include <linux/random.h>
17 #include <linux/slab.h>
18 #include <linux/xfrm.h>
19
20 #include <net/addrconf.h>
21 #include <net/inet_common.h>
22 #include <net/inet_hashtables.h>
23 #include <net/inet_sock.h>
24 #include <net/inet6_connection_sock.h>
25 #include <net/inet6_hashtables.h>
26 #include <net/ip6_route.h>
27 #include <net/ipv6.h>
28 #include <net/protocol.h>
29 #include <net/transp_v6.h>
30 #include <net/ip6_checksum.h>
31 #include <net/xfrm.h>
32 #include <net/secure_seq.h>
33
34 #include "dccp.h"
35 #include "ipv6.h"
36 #include "feat.h"
37
38 /* The per-net dccp.v6_ctl_sk is used for sending RSTs and ACKs */
39
40 static const struct inet_connection_sock_af_ops dccp_ipv6_mapped;
41 static const struct inet_connection_sock_af_ops dccp_ipv6_af_ops;
42
43 /* add pseudo-header to DCCP checksum stored in skb->csum */
44 static inline __sum16 dccp_v6_csum_finish(struct sk_buff *skb,
45 const struct in6_addr *saddr,
46 const struct in6_addr *daddr)
47 {
48 return csum_ipv6_magic(saddr, daddr, skb->len, IPPROTO_DCCP, skb->csum);
49 }
50
51 static inline void dccp_v6_send_check(struct sock *sk, struct sk_buff *skb)
52 {
53 struct ipv6_pinfo *np = inet6_sk(sk);
54 struct dccp_hdr *dh = dccp_hdr(skb);
55
56 dccp_csum_outgoing(skb);
57 dh->dccph_checksum = dccp_v6_csum_finish(skb, &np->saddr, &sk->sk_v6_daddr);
58 }
59
60 static inline __u64 dccp_v6_init_sequence(struct sk_buff *skb)
61 {
62 return secure_dccpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
63 ipv6_hdr(skb)->saddr.s6_addr32,
64 dccp_hdr(skb)->dccph_dport,
65 dccp_hdr(skb)->dccph_sport );
66
67 }
68
69 static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
70 u8 type, u8 code, int offset, __be32 info)
71 {
72 const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
73 const struct dccp_hdr *dh;
74 struct dccp_sock *dp;
75 struct ipv6_pinfo *np;
76 struct sock *sk;
77 int err;
78 __u64 seq;
79 struct net *net = dev_net(skb->dev);
80
81 /* Only need dccph_dport & dccph_sport which are the first
82 * 4 bytes in dccp header.
83 * Our caller (icmpv6_notify()) already pulled 8 bytes for us.
84 */
85 BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_sport) > 8);
86 BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_dport) > 8);
87 dh = (struct dccp_hdr *)(skb->data + offset);
88
89 sk = __inet6_lookup_established(net, &dccp_hashinfo,
90 &hdr->daddr, dh->dccph_dport,
91 &hdr->saddr, ntohs(dh->dccph_sport),
92 inet6_iif(skb));
93
94 if (!sk) {
95 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
96 ICMP6_MIB_INERRORS);
97 return;
98 }
99
100 if (sk->sk_state == DCCP_TIME_WAIT) {
101 inet_twsk_put(inet_twsk(sk));
102 return;
103 }
104 seq = dccp_hdr_seq(dh);
105 if (sk->sk_state == DCCP_NEW_SYN_RECV)
106 return dccp_req_err(sk, seq);
107
108 bh_lock_sock(sk);
109 if (sock_owned_by_user(sk))
110 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
111
112 if (sk->sk_state == DCCP_CLOSED)
113 goto out;
114
115 dp = dccp_sk(sk);
116 if ((1 << sk->sk_state) & ~(DCCPF_REQUESTING | DCCPF_LISTEN) &&
117 !between48(seq, dp->dccps_awl, dp->dccps_awh)) {
118 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
119 goto out;
120 }
121
122 np = inet6_sk(sk);
123
124 if (type == NDISC_REDIRECT) {
125 if (!sock_owned_by_user(sk)) {
126 struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
127
128 if (dst)
129 dst->ops->redirect(dst, sk, skb);
130 }
131 goto out;
132 }
133
134 if (type == ICMPV6_PKT_TOOBIG) {
135 struct dst_entry *dst = NULL;
136
137 if (!ip6_sk_accept_pmtu(sk))
138 goto out;
139
140 if (sock_owned_by_user(sk))
141 goto out;
142 if ((1 << sk->sk_state) & (DCCPF_LISTEN | DCCPF_CLOSED))
143 goto out;
144
145 dst = inet6_csk_update_pmtu(sk, ntohl(info));
146 if (!dst)
147 goto out;
148
149 if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst))
150 dccp_sync_mss(sk, dst_mtu(dst));
151 goto out;
152 }
153
154 icmpv6_err_convert(type, code, &err);
155
156 /* Might be for an request_sock */
157 switch (sk->sk_state) {
158 case DCCP_REQUESTING:
159 case DCCP_RESPOND: /* Cannot happen.
160 It can, it SYNs are crossed. --ANK */
161 if (!sock_owned_by_user(sk)) {
162 DCCP_INC_STATS_BH(DCCP_MIB_ATTEMPTFAILS);
163 sk->sk_err = err;
164 /*
165 * Wake people up to see the error
166 * (see connect in sock.c)
167 */
168 sk->sk_error_report(sk);
169 dccp_done(sk);
170 } else
171 sk->sk_err_soft = err;
172 goto out;
173 }
174
175 if (!sock_owned_by_user(sk) && np->recverr) {
176 sk->sk_err = err;
177 sk->sk_error_report(sk);
178 } else
179 sk->sk_err_soft = err;
180
181 out:
182 bh_unlock_sock(sk);
183 sock_put(sk);
184 }
185
186
187 static int dccp_v6_send_response(const struct sock *sk, struct request_sock *req)
188 {
189 struct inet_request_sock *ireq = inet_rsk(req);
190 struct ipv6_pinfo *np = inet6_sk(sk);
191 struct sk_buff *skb;
192 struct in6_addr *final_p, final;
193 struct flowi6 fl6;
194 int err = -1;
195 struct dst_entry *dst;
196
197 memset(&fl6, 0, sizeof(fl6));
198 fl6.flowi6_proto = IPPROTO_DCCP;
199 fl6.daddr = ireq->ir_v6_rmt_addr;
200 fl6.saddr = ireq->ir_v6_loc_addr;
201 fl6.flowlabel = 0;
202 fl6.flowi6_oif = ireq->ir_iif;
203 fl6.fl6_dport = ireq->ir_rmt_port;
204 fl6.fl6_sport = htons(ireq->ir_num);
205 security_req_classify_flow(req, flowi6_to_flowi(&fl6));
206
207
208 rcu_read_lock();
209 final_p = fl6_update_dst(&fl6, rcu_dereference(np->opt), &final);
210 rcu_read_unlock();
211
212 dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
213 if (IS_ERR(dst)) {
214 err = PTR_ERR(dst);
215 dst = NULL;
216 goto done;
217 }
218
219 skb = dccp_make_response(sk, dst, req);
220 if (skb != NULL) {
221 struct dccp_hdr *dh = dccp_hdr(skb);
222
223 dh->dccph_checksum = dccp_v6_csum_finish(skb,
224 &ireq->ir_v6_loc_addr,
225 &ireq->ir_v6_rmt_addr);
226 fl6.daddr = ireq->ir_v6_rmt_addr;
227 rcu_read_lock();
228 err = ip6_xmit(sk, skb, &fl6, rcu_dereference(np->opt),
229 np->tclass);
230 rcu_read_unlock();
231 err = net_xmit_eval(err);
232 }
233
234 done:
235 dst_release(dst);
236 return err;
237 }
238
239 static void dccp_v6_reqsk_destructor(struct request_sock *req)
240 {
241 dccp_feat_list_purge(&dccp_rsk(req)->dreq_featneg);
242 kfree_skb(inet_rsk(req)->pktopts);
243 }
244
245 static void dccp_v6_ctl_send_reset(const struct sock *sk, struct sk_buff *rxskb)
246 {
247 const struct ipv6hdr *rxip6h;
248 struct sk_buff *skb;
249 struct flowi6 fl6;
250 struct net *net = dev_net(skb_dst(rxskb)->dev);
251 struct sock *ctl_sk = net->dccp.v6_ctl_sk;
252 struct dst_entry *dst;
253
254 if (dccp_hdr(rxskb)->dccph_type == DCCP_PKT_RESET)
255 return;
256
257 if (!ipv6_unicast_destination(rxskb))
258 return;
259
260 skb = dccp_ctl_make_reset(ctl_sk, rxskb);
261 if (skb == NULL)
262 return;
263
264 rxip6h = ipv6_hdr(rxskb);
265 dccp_hdr(skb)->dccph_checksum = dccp_v6_csum_finish(skb, &rxip6h->saddr,
266 &rxip6h->daddr);
267
268 memset(&fl6, 0, sizeof(fl6));
269 fl6.daddr = rxip6h->saddr;
270 fl6.saddr = rxip6h->daddr;
271
272 fl6.flowi6_proto = IPPROTO_DCCP;
273 fl6.flowi6_oif = inet6_iif(rxskb);
274 fl6.fl6_dport = dccp_hdr(skb)->dccph_dport;
275 fl6.fl6_sport = dccp_hdr(skb)->dccph_sport;
276 security_skb_classify_flow(rxskb, flowi6_to_flowi(&fl6));
277
278 /* sk = NULL, but it is safe for now. RST socket required. */
279 dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
280 if (!IS_ERR(dst)) {
281 skb_dst_set(skb, dst);
282 ip6_xmit(ctl_sk, skb, &fl6, NULL, 0);
283 DCCP_INC_STATS_BH(DCCP_MIB_OUTSEGS);
284 DCCP_INC_STATS_BH(DCCP_MIB_OUTRSTS);
285 return;
286 }
287
288 kfree_skb(skb);
289 }
290
291 static struct request_sock_ops dccp6_request_sock_ops = {
292 .family = AF_INET6,
293 .obj_size = sizeof(struct dccp6_request_sock),
294 .rtx_syn_ack = dccp_v6_send_response,
295 .send_ack = dccp_reqsk_send_ack,
296 .destructor = dccp_v6_reqsk_destructor,
297 .send_reset = dccp_v6_ctl_send_reset,
298 .syn_ack_timeout = dccp_syn_ack_timeout,
299 };
300
301 static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
302 {
303 struct request_sock *req;
304 struct dccp_request_sock *dreq;
305 struct inet_request_sock *ireq;
306 struct ipv6_pinfo *np = inet6_sk(sk);
307 const __be32 service = dccp_hdr_request(skb)->dccph_req_service;
308 struct dccp_skb_cb *dcb = DCCP_SKB_CB(skb);
309
310 if (skb->protocol == htons(ETH_P_IP))
311 return dccp_v4_conn_request(sk, skb);
312
313 if (!ipv6_unicast_destination(skb))
314 return 0; /* discard, don't send a reset here */
315
316 if (dccp_bad_service_code(sk, service)) {
317 dcb->dccpd_reset_code = DCCP_RESET_CODE_BAD_SERVICE_CODE;
318 goto drop;
319 }
320 /*
321 * There are no SYN attacks on IPv6, yet...
322 */
323 dcb->dccpd_reset_code = DCCP_RESET_CODE_TOO_BUSY;
324 if (inet_csk_reqsk_queue_is_full(sk))
325 goto drop;
326
327 if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
328 goto drop;
329
330 req = inet_reqsk_alloc(&dccp6_request_sock_ops, sk, true);
331 if (req == NULL)
332 goto drop;
333
334 if (dccp_reqsk_init(req, dccp_sk(sk), skb))
335 goto drop_and_free;
336
337 dreq = dccp_rsk(req);
338 if (dccp_parse_options(sk, dreq, skb))
339 goto drop_and_free;
340
341 if (security_inet_conn_request(sk, skb, req))
342 goto drop_and_free;
343
344 ireq = inet_rsk(req);
345 ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
346 ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
347 ireq->ireq_family = AF_INET6;
348 ireq->ir_mark = inet_request_mark(sk, skb);
349
350 if (ipv6_opt_accepted(sk, skb, IP6CB(skb)) ||
351 np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
352 np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
353 atomic_inc(&skb->users);
354 ireq->pktopts = skb;
355 }
356 ireq->ir_iif = sk->sk_bound_dev_if;
357
358 /* So that link locals have meaning */
359 if (!sk->sk_bound_dev_if &&
360 ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
361 ireq->ir_iif = inet6_iif(skb);
362
363 /*
364 * Step 3: Process LISTEN state
365 *
366 * Set S.ISR, S.GSR, S.SWL, S.SWH from packet or Init Cookie
367 *
368 * Setting S.SWL/S.SWH to is deferred to dccp_create_openreq_child().
369 */
370 dreq->dreq_isr = dcb->dccpd_seq;
371 dreq->dreq_gsr = dreq->dreq_isr;
372 dreq->dreq_iss = dccp_v6_init_sequence(skb);
373 dreq->dreq_gss = dreq->dreq_iss;
374 dreq->dreq_service = service;
375
376 if (dccp_v6_send_response(sk, req))
377 goto drop_and_free;
378
379 inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT);
380 reqsk_put(req);
381 return 0;
382
383 drop_and_free:
384 reqsk_free(req);
385 drop:
386 DCCP_INC_STATS_BH(DCCP_MIB_ATTEMPTFAILS);
387 return -1;
388 }
389
390 static struct sock *dccp_v6_request_recv_sock(const struct sock *sk,
391 struct sk_buff *skb,
392 struct request_sock *req,
393 struct dst_entry *dst,
394 struct request_sock *req_unhash,
395 bool *own_req)
396 {
397 struct inet_request_sock *ireq = inet_rsk(req);
398 struct ipv6_pinfo *newnp;
399 const struct ipv6_pinfo *np = inet6_sk(sk);
400 struct ipv6_txoptions *opt;
401 struct inet_sock *newinet;
402 struct dccp6_sock *newdp6;
403 struct sock *newsk;
404
405 if (skb->protocol == htons(ETH_P_IP)) {
406 /*
407 * v6 mapped
408 */
409 newsk = dccp_v4_request_recv_sock(sk, skb, req, dst,
410 req_unhash, own_req);
411 if (newsk == NULL)
412 return NULL;
413
414 newdp6 = (struct dccp6_sock *)newsk;
415 newinet = inet_sk(newsk);
416 newinet->pinet6 = &newdp6->inet6;
417 newnp = inet6_sk(newsk);
418
419 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
420
421 newnp->saddr = newsk->sk_v6_rcv_saddr;
422
423 inet_csk(newsk)->icsk_af_ops = &dccp_ipv6_mapped;
424 newsk->sk_backlog_rcv = dccp_v4_do_rcv;
425 newnp->pktoptions = NULL;
426 newnp->opt = NULL;
427 newnp->ipv6_mc_list = NULL;
428 newnp->ipv6_ac_list = NULL;
429 newnp->ipv6_fl_list = NULL;
430 newnp->mcast_oif = inet6_iif(skb);
431 newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
432
433 /*
434 * No need to charge this sock to the relevant IPv6 refcnt debug socks count
435 * here, dccp_create_openreq_child now does this for us, see the comment in
436 * that function for the gory details. -acme
437 */
438
439 /* It is tricky place. Until this moment IPv4 tcp
440 worked with IPv6 icsk.icsk_af_ops.
441 Sync it now.
442 */
443 dccp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
444
445 return newsk;
446 }
447
448
449 if (sk_acceptq_is_full(sk))
450 goto out_overflow;
451
452 if (!dst) {
453 struct flowi6 fl6;
454
455 dst = inet6_csk_route_req(sk, &fl6, req, IPPROTO_DCCP);
456 if (!dst)
457 goto out;
458 }
459
460 newsk = dccp_create_openreq_child(sk, req, skb);
461 if (newsk == NULL)
462 goto out_nonewsk;
463
464 /*
465 * No need to charge this sock to the relevant IPv6 refcnt debug socks
466 * count here, dccp_create_openreq_child now does this for us, see the
467 * comment in that function for the gory details. -acme
468 */
469
470 ip6_dst_store(newsk, dst, NULL, NULL);
471 newsk->sk_route_caps = dst->dev->features & ~(NETIF_F_IP_CSUM |
472 NETIF_F_TSO);
473 newdp6 = (struct dccp6_sock *)newsk;
474 newinet = inet_sk(newsk);
475 newinet->pinet6 = &newdp6->inet6;
476 newnp = inet6_sk(newsk);
477
478 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
479
480 newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
481 newnp->saddr = ireq->ir_v6_loc_addr;
482 newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
483 newsk->sk_bound_dev_if = ireq->ir_iif;
484
485 /* Now IPv6 options...
486
487 First: no IPv4 options.
488 */
489 newinet->inet_opt = NULL;
490
491 /* Clone RX bits */
492 newnp->rxopt.all = np->rxopt.all;
493
494 newnp->ipv6_mc_list = NULL;
495 newnp->ipv6_ac_list = NULL;
496 newnp->ipv6_fl_list = NULL;
497 newnp->pktoptions = NULL;
498 newnp->opt = NULL;
499 newnp->mcast_oif = inet6_iif(skb);
500 newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
501
502 /*
503 * Clone native IPv6 options from listening socket (if any)
504 *
505 * Yes, keeping reference count would be much more clever, but we make
506 * one more one thing there: reattach optmem to newsk.
507 */
508 opt = rcu_dereference(np->opt);
509 if (opt) {
510 opt = ipv6_dup_options(newsk, opt);
511 RCU_INIT_POINTER(newnp->opt, opt);
512 }
513 inet_csk(newsk)->icsk_ext_hdr_len = 0;
514 if (opt)
515 inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
516 opt->opt_flen;
517
518 dccp_sync_mss(newsk, dst_mtu(dst));
519
520 newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
521 newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
522
523 if (__inet_inherit_port(sk, newsk) < 0) {
524 inet_csk_prepare_forced_close(newsk);
525 dccp_done(newsk);
526 goto out;
527 }
528 *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash));
529 /* Clone pktoptions received with SYN, if we own the req */
530 if (*own_req && ireq->pktopts) {
531 newnp->pktoptions = skb_clone(ireq->pktopts, GFP_ATOMIC);
532 consume_skb(ireq->pktopts);
533 ireq->pktopts = NULL;
534 if (newnp->pktoptions)
535 skb_set_owner_r(newnp->pktoptions, newsk);
536 }
537
538 return newsk;
539
540 out_overflow:
541 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
542 out_nonewsk:
543 dst_release(dst);
544 out:
545 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
546 return NULL;
547 }
548
549 /* The socket must have it's spinlock held when we get
550 * here.
551 *
552 * We have a potential double-lock case here, so even when
553 * doing backlog processing we use the BH locking scheme.
554 * This is because we cannot sleep with the original spinlock
555 * held.
556 */
557 static int dccp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
558 {
559 struct ipv6_pinfo *np = inet6_sk(sk);
560 struct sk_buff *opt_skb = NULL;
561
562 /* Imagine: socket is IPv6. IPv4 packet arrives,
563 goes to IPv4 receive handler and backlogged.
564 From backlog it always goes here. Kerboom...
565 Fortunately, dccp_rcv_established and rcv_established
566 handle them correctly, but it is not case with
567 dccp_v6_hnd_req and dccp_v6_ctl_send_reset(). --ANK
568 */
569
570 if (skb->protocol == htons(ETH_P_IP))
571 return dccp_v4_do_rcv(sk, skb);
572
573 if (sk_filter(sk, skb))
574 goto discard;
575
576 /*
577 * socket locking is here for SMP purposes as backlog rcv is currently
578 * called with bh processing disabled.
579 */
580
581 /* Do Stevens' IPV6_PKTOPTIONS.
582
583 Yes, guys, it is the only place in our code, where we
584 may make it not affecting IPv4.
585 The rest of code is protocol independent,
586 and I do not like idea to uglify IPv4.
587
588 Actually, all the idea behind IPV6_PKTOPTIONS
589 looks not very well thought. For now we latch
590 options, received in the last packet, enqueued
591 by tcp. Feel free to propose better solution.
592 --ANK (980728)
593 */
594 if (np->rxopt.all)
595 /*
596 * FIXME: Add handling of IPV6_PKTOPTIONS skb. See the comments below
597 * (wrt ipv6_pktopions) and net/ipv6/tcp_ipv6.c for an example.
598 */
599 opt_skb = skb_clone(skb, GFP_ATOMIC);
600
601 if (sk->sk_state == DCCP_OPEN) { /* Fast path */
602 if (dccp_rcv_established(sk, skb, dccp_hdr(skb), skb->len))
603 goto reset;
604 if (opt_skb) {
605 /* XXX This is where we would goto ipv6_pktoptions. */
606 __kfree_skb(opt_skb);
607 }
608 return 0;
609 }
610
611 /*
612 * Step 3: Process LISTEN state
613 * If S.state == LISTEN,
614 * If P.type == Request or P contains a valid Init Cookie option,
615 * (* Must scan the packet's options to check for Init
616 * Cookies. Only Init Cookies are processed here,
617 * however; other options are processed in Step 8. This
618 * scan need only be performed if the endpoint uses Init
619 * Cookies *)
620 * (* Generate a new socket and switch to that socket *)
621 * Set S := new socket for this port pair
622 * S.state = RESPOND
623 * Choose S.ISS (initial seqno) or set from Init Cookies
624 * Initialize S.GAR := S.ISS
625 * Set S.ISR, S.GSR, S.SWL, S.SWH from packet or Init Cookies
626 * Continue with S.state == RESPOND
627 * (* A Response packet will be generated in Step 11 *)
628 * Otherwise,
629 * Generate Reset(No Connection) unless P.type == Reset
630 * Drop packet and return
631 *
632 * NOTE: the check for the packet types is done in
633 * dccp_rcv_state_process
634 */
635
636 if (dccp_rcv_state_process(sk, skb, dccp_hdr(skb), skb->len))
637 goto reset;
638 if (opt_skb) {
639 /* XXX This is where we would goto ipv6_pktoptions. */
640 __kfree_skb(opt_skb);
641 }
642 return 0;
643
644 reset:
645 dccp_v6_ctl_send_reset(sk, skb);
646 discard:
647 if (opt_skb != NULL)
648 __kfree_skb(opt_skb);
649 kfree_skb(skb);
650 return 0;
651 }
652
653 static int dccp_v6_rcv(struct sk_buff *skb)
654 {
655 const struct dccp_hdr *dh;
656 struct sock *sk;
657 int min_cov;
658
659 /* Step 1: Check header basics */
660
661 if (dccp_invalid_packet(skb))
662 goto discard_it;
663
664 /* Step 1: If header checksum is incorrect, drop packet and return. */
665 if (dccp_v6_csum_finish(skb, &ipv6_hdr(skb)->saddr,
666 &ipv6_hdr(skb)->daddr)) {
667 DCCP_WARN("dropped packet with invalid checksum\n");
668 goto discard_it;
669 }
670
671 dh = dccp_hdr(skb);
672
673 DCCP_SKB_CB(skb)->dccpd_seq = dccp_hdr_seq(dh);
674 DCCP_SKB_CB(skb)->dccpd_type = dh->dccph_type;
675
676 if (dccp_packet_without_ack(skb))
677 DCCP_SKB_CB(skb)->dccpd_ack_seq = DCCP_PKT_WITHOUT_ACK_SEQ;
678 else
679 DCCP_SKB_CB(skb)->dccpd_ack_seq = dccp_hdr_ack_seq(skb);
680
681 lookup:
682 sk = __inet6_lookup_skb(&dccp_hashinfo, skb,
683 dh->dccph_sport, dh->dccph_dport,
684 inet6_iif(skb));
685 if (!sk) {
686 dccp_pr_debug("failed to look up flow ID in table and "
687 "get corresponding socket\n");
688 goto no_dccp_socket;
689 }
690
691 /*
692 * Step 2:
693 * ... or S.state == TIMEWAIT,
694 * Generate Reset(No Connection) unless P.type == Reset
695 * Drop packet and return
696 */
697 if (sk->sk_state == DCCP_TIME_WAIT) {
698 dccp_pr_debug("sk->sk_state == DCCP_TIME_WAIT: do_time_wait\n");
699 inet_twsk_put(inet_twsk(sk));
700 goto no_dccp_socket;
701 }
702
703 if (sk->sk_state == DCCP_NEW_SYN_RECV) {
704 struct request_sock *req = inet_reqsk(sk);
705 struct sock *nsk;
706
707 sk = req->rsk_listener;
708 if (unlikely(sk->sk_state != DCCP_LISTEN)) {
709 inet_csk_reqsk_queue_drop_and_put(sk, req);
710 goto lookup;
711 }
712 sock_hold(sk);
713 nsk = dccp_check_req(sk, skb, req);
714 if (!nsk) {
715 reqsk_put(req);
716 goto discard_and_relse;
717 }
718 if (nsk == sk) {
719 reqsk_put(req);
720 } else if (dccp_child_process(sk, nsk, skb)) {
721 dccp_v6_ctl_send_reset(sk, skb);
722 goto discard_and_relse;
723 } else {
724 sock_put(sk);
725 return 0;
726 }
727 }
728 /*
729 * RFC 4340, sec. 9.2.1: Minimum Checksum Coverage
730 * o if MinCsCov = 0, only packets with CsCov = 0 are accepted
731 * o if MinCsCov > 0, also accept packets with CsCov >= MinCsCov
732 */
733 min_cov = dccp_sk(sk)->dccps_pcrlen;
734 if (dh->dccph_cscov && (min_cov == 0 || dh->dccph_cscov < min_cov)) {
735 dccp_pr_debug("Packet CsCov %d does not satisfy MinCsCov %d\n",
736 dh->dccph_cscov, min_cov);
737 /* FIXME: send Data Dropped option (see also dccp_v4_rcv) */
738 goto discard_and_relse;
739 }
740
741 if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
742 goto discard_and_relse;
743
744 return sk_receive_skb(sk, skb, 1) ? -1 : 0;
745
746 no_dccp_socket:
747 if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
748 goto discard_it;
749 /*
750 * Step 2:
751 * If no socket ...
752 * Generate Reset(No Connection) unless P.type == Reset
753 * Drop packet and return
754 */
755 if (dh->dccph_type != DCCP_PKT_RESET) {
756 DCCP_SKB_CB(skb)->dccpd_reset_code =
757 DCCP_RESET_CODE_NO_CONNECTION;
758 dccp_v6_ctl_send_reset(sk, skb);
759 }
760
761 discard_it:
762 kfree_skb(skb);
763 return 0;
764
765 discard_and_relse:
766 sock_put(sk);
767 goto discard_it;
768 }
769
770 static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
771 int addr_len)
772 {
773 struct sockaddr_in6 *usin = (struct sockaddr_in6 *)uaddr;
774 struct inet_connection_sock *icsk = inet_csk(sk);
775 struct inet_sock *inet = inet_sk(sk);
776 struct ipv6_pinfo *np = inet6_sk(sk);
777 struct dccp_sock *dp = dccp_sk(sk);
778 struct in6_addr *saddr = NULL, *final_p, final;
779 struct ipv6_txoptions *opt;
780 struct flowi6 fl6;
781 struct dst_entry *dst;
782 int addr_type;
783 int err;
784
785 dp->dccps_role = DCCP_ROLE_CLIENT;
786
787 if (addr_len < SIN6_LEN_RFC2133)
788 return -EINVAL;
789
790 if (usin->sin6_family != AF_INET6)
791 return -EAFNOSUPPORT;
792
793 memset(&fl6, 0, sizeof(fl6));
794
795 if (np->sndflow) {
796 fl6.flowlabel = usin->sin6_flowinfo & IPV6_FLOWINFO_MASK;
797 IP6_ECN_flow_init(fl6.flowlabel);
798 if (fl6.flowlabel & IPV6_FLOWLABEL_MASK) {
799 struct ip6_flowlabel *flowlabel;
800 flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
801 if (flowlabel == NULL)
802 return -EINVAL;
803 fl6_sock_release(flowlabel);
804 }
805 }
806 /*
807 * connect() to INADDR_ANY means loopback (BSD'ism).
808 */
809 if (ipv6_addr_any(&usin->sin6_addr))
810 usin->sin6_addr.s6_addr[15] = 1;
811
812 addr_type = ipv6_addr_type(&usin->sin6_addr);
813
814 if (addr_type & IPV6_ADDR_MULTICAST)
815 return -ENETUNREACH;
816
817 if (addr_type & IPV6_ADDR_LINKLOCAL) {
818 if (addr_len >= sizeof(struct sockaddr_in6) &&
819 usin->sin6_scope_id) {
820 /* If interface is set while binding, indices
821 * must coincide.
822 */
823 if (sk->sk_bound_dev_if &&
824 sk->sk_bound_dev_if != usin->sin6_scope_id)
825 return -EINVAL;
826
827 sk->sk_bound_dev_if = usin->sin6_scope_id;
828 }
829
830 /* Connect to link-local address requires an interface */
831 if (!sk->sk_bound_dev_if)
832 return -EINVAL;
833 }
834
835 sk->sk_v6_daddr = usin->sin6_addr;
836 np->flow_label = fl6.flowlabel;
837
838 /*
839 * DCCP over IPv4
840 */
841 if (addr_type == IPV6_ADDR_MAPPED) {
842 u32 exthdrlen = icsk->icsk_ext_hdr_len;
843 struct sockaddr_in sin;
844
845 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
846
847 if (__ipv6_only_sock(sk))
848 return -ENETUNREACH;
849
850 sin.sin_family = AF_INET;
851 sin.sin_port = usin->sin6_port;
852 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
853
854 icsk->icsk_af_ops = &dccp_ipv6_mapped;
855 sk->sk_backlog_rcv = dccp_v4_do_rcv;
856
857 err = dccp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
858 if (err) {
859 icsk->icsk_ext_hdr_len = exthdrlen;
860 icsk->icsk_af_ops = &dccp_ipv6_af_ops;
861 sk->sk_backlog_rcv = dccp_v6_do_rcv;
862 goto failure;
863 }
864 np->saddr = sk->sk_v6_rcv_saddr;
865 return err;
866 }
867
868 if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
869 saddr = &sk->sk_v6_rcv_saddr;
870
871 fl6.flowi6_proto = IPPROTO_DCCP;
872 fl6.daddr = sk->sk_v6_daddr;
873 fl6.saddr = saddr ? *saddr : np->saddr;
874 fl6.flowi6_oif = sk->sk_bound_dev_if;
875 fl6.fl6_dport = usin->sin6_port;
876 fl6.fl6_sport = inet->inet_sport;
877 security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
878
879 opt = rcu_dereference_protected(np->opt, sock_owned_by_user(sk));
880 final_p = fl6_update_dst(&fl6, opt, &final);
881
882 dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
883 if (IS_ERR(dst)) {
884 err = PTR_ERR(dst);
885 goto failure;
886 }
887
888 if (saddr == NULL) {
889 saddr = &fl6.saddr;
890 sk->sk_v6_rcv_saddr = *saddr;
891 }
892
893 /* set the source address */
894 np->saddr = *saddr;
895 inet->inet_rcv_saddr = LOOPBACK4_IPV6;
896
897 ip6_dst_store(sk, dst, NULL, NULL);
898
899 icsk->icsk_ext_hdr_len = 0;
900 if (opt)
901 icsk->icsk_ext_hdr_len = opt->opt_flen + opt->opt_nflen;
902
903 inet->inet_dport = usin->sin6_port;
904
905 dccp_set_state(sk, DCCP_REQUESTING);
906 err = inet6_hash_connect(&dccp_death_row, sk);
907 if (err)
908 goto late_failure;
909
910 dp->dccps_iss = secure_dccpv6_sequence_number(np->saddr.s6_addr32,
911 sk->sk_v6_daddr.s6_addr32,
912 inet->inet_sport,
913 inet->inet_dport);
914 err = dccp_connect(sk);
915 if (err)
916 goto late_failure;
917
918 return 0;
919
920 late_failure:
921 dccp_set_state(sk, DCCP_CLOSED);
922 __sk_dst_reset(sk);
923 failure:
924 inet->inet_dport = 0;
925 sk->sk_route_caps = 0;
926 return err;
927 }
928
929 static const struct inet_connection_sock_af_ops dccp_ipv6_af_ops = {
930 .queue_xmit = inet6_csk_xmit,
931 .send_check = dccp_v6_send_check,
932 .rebuild_header = inet6_sk_rebuild_header,
933 .conn_request = dccp_v6_conn_request,
934 .syn_recv_sock = dccp_v6_request_recv_sock,
935 .net_header_len = sizeof(struct ipv6hdr),
936 .setsockopt = ipv6_setsockopt,
937 .getsockopt = ipv6_getsockopt,
938 .addr2sockaddr = inet6_csk_addr2sockaddr,
939 .sockaddr_len = sizeof(struct sockaddr_in6),
940 .bind_conflict = inet6_csk_bind_conflict,
941 #ifdef CONFIG_COMPAT
942 .compat_setsockopt = compat_ipv6_setsockopt,
943 .compat_getsockopt = compat_ipv6_getsockopt,
944 #endif
945 };
946
947 /*
948 * DCCP over IPv4 via INET6 API
949 */
950 static const struct inet_connection_sock_af_ops dccp_ipv6_mapped = {
951 .queue_xmit = ip_queue_xmit,
952 .send_check = dccp_v4_send_check,
953 .rebuild_header = inet_sk_rebuild_header,
954 .conn_request = dccp_v6_conn_request,
955 .syn_recv_sock = dccp_v6_request_recv_sock,
956 .net_header_len = sizeof(struct iphdr),
957 .setsockopt = ipv6_setsockopt,
958 .getsockopt = ipv6_getsockopt,
959 .addr2sockaddr = inet6_csk_addr2sockaddr,
960 .sockaddr_len = sizeof(struct sockaddr_in6),
961 .bind_conflict = inet6_csk_bind_conflict,
962 #ifdef CONFIG_COMPAT
963 .compat_setsockopt = compat_ipv6_setsockopt,
964 .compat_getsockopt = compat_ipv6_getsockopt,
965 #endif
966 };
967
968 /* NOTE: A lot of things set to zero explicitly by call to
969 * sk_alloc() so need not be done here.
970 */
971 static int dccp_v6_init_sock(struct sock *sk)
972 {
973 static __u8 dccp_v6_ctl_sock_initialized;
974 int err = dccp_init_sock(sk, dccp_v6_ctl_sock_initialized);
975
976 if (err == 0) {
977 if (unlikely(!dccp_v6_ctl_sock_initialized))
978 dccp_v6_ctl_sock_initialized = 1;
979 inet_csk(sk)->icsk_af_ops = &dccp_ipv6_af_ops;
980 }
981
982 return err;
983 }
984
985 static void dccp_v6_destroy_sock(struct sock *sk)
986 {
987 dccp_destroy_sock(sk);
988 inet6_destroy_sock(sk);
989 }
990
991 static struct timewait_sock_ops dccp6_timewait_sock_ops = {
992 .twsk_obj_size = sizeof(struct dccp6_timewait_sock),
993 };
994
995 static struct proto dccp_v6_prot = {
996 .name = "DCCPv6",
997 .owner = THIS_MODULE,
998 .close = dccp_close,
999 .connect = dccp_v6_connect,
1000 .disconnect = dccp_disconnect,
1001 .ioctl = dccp_ioctl,
1002 .init = dccp_v6_init_sock,
1003 .setsockopt = dccp_setsockopt,
1004 .getsockopt = dccp_getsockopt,
1005 .sendmsg = dccp_sendmsg,
1006 .recvmsg = dccp_recvmsg,
1007 .backlog_rcv = dccp_v6_do_rcv,
1008 .hash = inet_hash,
1009 .unhash = inet_unhash,
1010 .accept = inet_csk_accept,
1011 .get_port = inet_csk_get_port,
1012 .shutdown = dccp_shutdown,
1013 .destroy = dccp_v6_destroy_sock,
1014 .orphan_count = &dccp_orphan_count,
1015 .max_header = MAX_DCCP_HEADER,
1016 .obj_size = sizeof(struct dccp6_sock),
1017 .slab_flags = SLAB_DESTROY_BY_RCU,
1018 .rsk_prot = &dccp6_request_sock_ops,
1019 .twsk_prot = &dccp6_timewait_sock_ops,
1020 .h.hashinfo = &dccp_hashinfo,
1021 #ifdef CONFIG_COMPAT
1022 .compat_setsockopt = compat_dccp_setsockopt,
1023 .compat_getsockopt = compat_dccp_getsockopt,
1024 #endif
1025 };
1026
1027 static const struct inet6_protocol dccp_v6_protocol = {
1028 .handler = dccp_v6_rcv,
1029 .err_handler = dccp_v6_err,
1030 .flags = INET6_PROTO_NOPOLICY | INET6_PROTO_FINAL,
1031 };
1032
1033 static const struct proto_ops inet6_dccp_ops = {
1034 .family = PF_INET6,
1035 .owner = THIS_MODULE,
1036 .release = inet6_release,
1037 .bind = inet6_bind,
1038 .connect = inet_stream_connect,
1039 .socketpair = sock_no_socketpair,
1040 .accept = inet_accept,
1041 .getname = inet6_getname,
1042 .poll = dccp_poll,
1043 .ioctl = inet6_ioctl,
1044 .listen = inet_dccp_listen,
1045 .shutdown = inet_shutdown,
1046 .setsockopt = sock_common_setsockopt,
1047 .getsockopt = sock_common_getsockopt,
1048 .sendmsg = inet_sendmsg,
1049 .recvmsg = sock_common_recvmsg,
1050 .mmap = sock_no_mmap,
1051 .sendpage = sock_no_sendpage,
1052 #ifdef CONFIG_COMPAT
1053 .compat_setsockopt = compat_sock_common_setsockopt,
1054 .compat_getsockopt = compat_sock_common_getsockopt,
1055 #endif
1056 };
1057
1058 static struct inet_protosw dccp_v6_protosw = {
1059 .type = SOCK_DCCP,
1060 .protocol = IPPROTO_DCCP,
1061 .prot = &dccp_v6_prot,
1062 .ops = &inet6_dccp_ops,
1063 .flags = INET_PROTOSW_ICSK,
1064 };
1065
1066 static int __net_init dccp_v6_init_net(struct net *net)
1067 {
1068 if (dccp_hashinfo.bhash == NULL)
1069 return -ESOCKTNOSUPPORT;
1070
1071 return inet_ctl_sock_create(&net->dccp.v6_ctl_sk, PF_INET6,
1072 SOCK_DCCP, IPPROTO_DCCP, net);
1073 }
1074
1075 static void __net_exit dccp_v6_exit_net(struct net *net)
1076 {
1077 inet_ctl_sock_destroy(net->dccp.v6_ctl_sk);
1078 }
1079
1080 static struct pernet_operations dccp_v6_ops = {
1081 .init = dccp_v6_init_net,
1082 .exit = dccp_v6_exit_net,
1083 };
1084
1085 static int __init dccp_v6_init(void)
1086 {
1087 int err = proto_register(&dccp_v6_prot, 1);
1088
1089 if (err != 0)
1090 goto out;
1091
1092 err = inet6_add_protocol(&dccp_v6_protocol, IPPROTO_DCCP);
1093 if (err != 0)
1094 goto out_unregister_proto;
1095
1096 inet6_register_protosw(&dccp_v6_protosw);
1097
1098 err = register_pernet_subsys(&dccp_v6_ops);
1099 if (err != 0)
1100 goto out_destroy_ctl_sock;
1101 out:
1102 return err;
1103
1104 out_destroy_ctl_sock:
1105 inet6_del_protocol(&dccp_v6_protocol, IPPROTO_DCCP);
1106 inet6_unregister_protosw(&dccp_v6_protosw);
1107 out_unregister_proto:
1108 proto_unregister(&dccp_v6_prot);
1109 goto out;
1110 }
1111
1112 static void __exit dccp_v6_exit(void)
1113 {
1114 unregister_pernet_subsys(&dccp_v6_ops);
1115 inet6_del_protocol(&dccp_v6_protocol, IPPROTO_DCCP);
1116 inet6_unregister_protosw(&dccp_v6_protosw);
1117 proto_unregister(&dccp_v6_prot);
1118 }
1119
1120 module_init(dccp_v6_init);
1121 module_exit(dccp_v6_exit);
1122
1123 /*
1124 * __stringify doesn't likes enums, so use SOCK_DCCP (6) and IPPROTO_DCCP (33)
1125 * values directly, Also cover the case where the protocol is not specified,
1126 * i.e. net-pf-PF_INET6-proto-0-type-SOCK_DCCP
1127 */
1128 MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET6, 33, 6);
1129 MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET6, 0, 6);
1130 MODULE_LICENSE("GPL");
1131 MODULE_AUTHOR("Arnaldo Carvalho de Melo <acme@mandriva.com>");
1132 MODULE_DESCRIPTION("DCCPv6 - Datagram Congestion Controlled Protocol");
Linux with added FPC-III support