1	// SPDX-License-Identifier: GPL-2.0-or-later
2	/* SCTP kernel implementation
3	* (C) Copyright IBM Corp. 2001, 2004
4	* Copyright (c) 1999-2000 Cisco, Inc.
5	* Copyright (c) 1999-2001 Motorola, Inc.
6	* Copyright (c) 2001-2002 Intel Corp.
7	* Copyright (c) 2002 Nokia Corp.
8	*
9	* This is part of the SCTP Linux Kernel Implementation.
10	*
11	* These are the state functions for the state machine.
12	*
13	* Please send any bug reports or fixes you make to the
14	* email address(es):
15	* lksctp developers <linux-sctp@vger.kernel.org>
16	*
17	* Written or modified by:
18	* La Monte H.P. Yarroll <piggy@acm.org>
19	* Karl Knutson <karl@athena.chicago.il.us>
20	* Mathew Kotowsky <kotowsky@sctp.org>
21	* Sridhar Samudrala <samudrala@us.ibm.com>
22	* Jon Grimm <jgrimm@us.ibm.com>
23	* Hui Huang <hui.huang@nokia.com>
24	* Dajiang Zhang <dajiang.zhang@nokia.com>
25	* Daisy Chang <daisyc@us.ibm.com>
26	* Ardelle Fan <ardelle.fan@intel.com>
27	* Ryan Layer <rmlayer@us.ibm.com>
28	* Kevin Gao <kevin.gao@intel.com>
29	*/
30
31	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
32
33	#include <crypto/utils.h>
34	#include <linux/types.h>
35	#include <linux/kernel.h>
36	#include <linux/ip.h>
37	#include <linux/ipv6.h>
38	#include <linux/net.h>
39	#include <linux/inet.h>
40	#include <linux/slab.h>
41	#include <net/sock.h>
42	#include <net/proto_memory.h>
43	#include <net/inet_ecn.h>
44	#include <linux/skbuff.h>
45	#include <net/sctp/sctp.h>
46	#include <net/sctp/sm.h>
47	#include <net/sctp/structs.h>
48
49	#define CREATE_TRACE_POINTS
50	#include <trace/events/sctp.h>
51
52	static struct sctp_packet *sctp_abort_pkt_new(
53	struct net *net,
54	const struct sctp_endpoint *ep,
55	const struct sctp_association *asoc,
56	struct sctp_chunk *chunk,
57	const void *payload, size_t paylen);
58	static int sctp_eat_data(const struct sctp_association *asoc,
59	struct sctp_chunk *chunk,
60	struct sctp_cmd_seq *commands);
61	static struct sctp_packet *sctp_ootb_pkt_new(
62	struct net *net,
63	const struct sctp_association *asoc,
64	const struct sctp_chunk *chunk);
65	static void sctp_send_stale_cookie_err(struct net *net,
66	const struct sctp_endpoint *ep,
67	const struct sctp_association *asoc,
68	const struct sctp_chunk *chunk,
69	struct sctp_cmd_seq *commands,
70	struct sctp_chunk *err_chunk);
71	static enum sctp_disposition sctp_sf_do_5_2_6_stale(
72	struct net *net,
73	const struct sctp_endpoint *ep,
74	const struct sctp_association *asoc,
75	const union sctp_subtype type,
76	void *arg,
77	struct sctp_cmd_seq *commands);
78	static enum sctp_disposition sctp_sf_shut_8_4_5(
79	struct net *net,
80	const struct sctp_endpoint *ep,
81	const struct sctp_association *asoc,
82	const union sctp_subtype type,
83	void *arg,
84	struct sctp_cmd_seq *commands);
85	static enum sctp_disposition sctp_sf_tabort_8_4_8(
86	struct net *net,
87	const struct sctp_endpoint *ep,
88	const struct sctp_association *asoc,
89	const union sctp_subtype type,
90	void *arg,
91	struct sctp_cmd_seq *commands);
92	static enum sctp_disposition sctp_sf_new_encap_port(
93	struct net *net,
94	const struct sctp_endpoint *ep,
95	const struct sctp_association *asoc,
96	const union sctp_subtype type,
97	void *arg,
98	struct sctp_cmd_seq *commands);
99	static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk);
100
101	static enum sctp_disposition sctp_stop_t1_and_abort(
102	struct net *net,
103	struct sctp_cmd_seq *commands,
104	__be16 error, int sk_err,
105	const struct sctp_association *asoc,
106	struct sctp_transport *transport);
107
108	static enum sctp_disposition sctp_sf_abort_violation(
109	struct net *net,
110	const struct sctp_endpoint *ep,
111	const struct sctp_association *asoc,
112	void *arg,
113	struct sctp_cmd_seq *commands,
114	const __u8 *payload,
115	const size_t paylen);
116
117	static enum sctp_disposition sctp_sf_violation_chunklen(
118	struct net *net,
119	const struct sctp_endpoint *ep,
120	const struct sctp_association *asoc,
121	const union sctp_subtype type,
122	void *arg,
123	struct sctp_cmd_seq *commands);
124
125	static enum sctp_disposition sctp_sf_violation_paramlen(
126	struct net *net,
127	const struct sctp_endpoint *ep,
128	const struct sctp_association *asoc,
129	const union sctp_subtype type,
130	void *arg, void *ext,
131	struct sctp_cmd_seq *commands);
132
133	static enum sctp_disposition sctp_sf_violation_ctsn(
134	struct net *net,
135	const struct sctp_endpoint *ep,
136	const struct sctp_association *asoc,
137	const union sctp_subtype type,
138	void *arg,
139	struct sctp_cmd_seq *commands);
140
141	static enum sctp_disposition sctp_sf_violation_chunk(
142	struct net *net,
143	const struct sctp_endpoint *ep,
144	const struct sctp_association *asoc,
145	const union sctp_subtype type,
146	void *arg,
147	struct sctp_cmd_seq *commands);
148
149	static enum sctp_ierror sctp_sf_authenticate(
150	const struct sctp_association *asoc,
151	struct sctp_chunk *chunk);
152
153	static enum sctp_disposition __sctp_sf_do_9_1_abort(
154	struct net *net,
155	const struct sctp_endpoint *ep,
156	const struct sctp_association *asoc,
157	const union sctp_subtype type,
158	void *arg,
159	struct sctp_cmd_seq *commands);
160
161	static enum sctp_disposition
162	__sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep,
163	const struct sctp_association *asoc,
164	const union sctp_subtype type, void *arg,
165	struct sctp_cmd_seq *commands);
166
167	/* Small helper function that checks if the chunk length
168	* is of the appropriate length. The 'required_length' argument
169	* is set to be the size of a specific chunk we are testing.
170	* Return Values: true = Valid length
171	* false = Invalid length
172	*
173	*/
174	static inline bool sctp_chunk_length_valid(struct sctp_chunk *chunk,
175	__u16 required_length)
176	{
177	__u16 chunk_length = ntohs(chunk->chunk_hdr->length);
178
179	/* Previously already marked? */
180	if (unlikely(chunk->pdiscard))
181	return false;
182	if (unlikely(chunk_length < required_length))
183	return false;
184
185	return true;
186	}
187
188	/* Check for format error in an ABORT chunk */
189	static inline bool sctp_err_chunk_valid(struct sctp_chunk *chunk)
190	{
191	struct sctp_errhdr *err;
192
193	sctp_walk_errors(err, chunk->chunk_hdr);
194
195	return (void *)err == (void *)chunk->chunk_end;
196	}
197
198	/**********************************************************
199	* These are the state functions for handling chunk events.
200	**********************************************************/
201
202	/*
203	* Process the final SHUTDOWN COMPLETE.
204	*
205	* Section: 4 (C) (diagram), 9.2
206	* Upon reception of the SHUTDOWN COMPLETE chunk the endpoint will verify
207	* that it is in SHUTDOWN-ACK-SENT state, if it is not the chunk should be
208	* discarded. If the endpoint is in the SHUTDOWN-ACK-SENT state the endpoint
209	* should stop the T2-shutdown timer and remove all knowledge of the
210	* association (and thus the association enters the CLOSED state).
211	*
212	* Verification Tag: 8.5.1(C), sctpimpguide 2.41.
213	* C) Rules for packet carrying SHUTDOWN COMPLETE:
214	* ...
215	* - The receiver of a SHUTDOWN COMPLETE shall accept the packet
216	* if the Verification Tag field of the packet matches its own tag and
217	* the T bit is not set
218	* OR
219	* it is set to its peer's tag and the T bit is set in the Chunk
220	* Flags.
221	* Otherwise, the receiver MUST silently discard the packet
222	* and take no further action. An endpoint MUST ignore the
223	* SHUTDOWN COMPLETE if it is not in the SHUTDOWN-ACK-SENT state.
224	*
225	* Inputs
226	* (endpoint, asoc, chunk)
227	*
228	* Outputs
229	* (asoc, reply_msg, msg_up, timers, counters)
230	*
231	* The return value is the disposition of the chunk.
232	*/
233	enum sctp_disposition sctp_sf_do_4_C(struct net *net,
234	const struct sctp_endpoint *ep,
235	const struct sctp_association *asoc,
236	const union sctp_subtype type,
237	void *arg, struct sctp_cmd_seq *commands)
238	{
239	struct sctp_chunk *chunk = arg;
240	struct sctp_ulpevent *ev;
241
242	if (!sctp_vtag_verify_either(chunk, asoc))
243	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
244
245	/* RFC 2960 6.10 Bundling
246	*
247	* An endpoint MUST NOT bundle INIT, INIT ACK or
248	* SHUTDOWN COMPLETE with any other chunks.
249	*/
250	if (!chunk->singleton)
251	return sctp_sf_violation_chunk(net, ep, asoc, type, arg, commands);
252
253	/* Make sure that the SHUTDOWN_COMPLETE chunk has a valid length. */
254	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_chunkhdr)))
255	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
256	commands);
257
258	/* RFC 2960 10.2 SCTP-to-ULP
259	*
260	* H) SHUTDOWN COMPLETE notification
261	*
262	* When SCTP completes the shutdown procedures (section 9.2) this
263	* notification is passed to the upper layer.
264	*/
265	ev = sctp_ulpevent_make_assoc_change(asoc, flags: 0, state: SCTP_SHUTDOWN_COMP,
266	error: 0, outbound: 0, inbound: 0, NULL, GFP_ATOMIC);
267	if (ev)
268	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_EVENT_ULP,
269	obj: SCTP_ULPEVENT(arg: ev));
270
271	/* Upon reception of the SHUTDOWN COMPLETE chunk the endpoint
272	* will verify that it is in SHUTDOWN-ACK-SENT state, if it is
273	* not the chunk should be discarded. If the endpoint is in
274	* the SHUTDOWN-ACK-SENT state the endpoint should stop the
275	* T2-shutdown timer and remove all knowledge of the
276	* association (and thus the association enters the CLOSED
277	* state).
278	*/
279	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_STOP,
280	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
281
282	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_STOP,
283	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
284
285	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_NEW_STATE,
286	obj: SCTP_STATE(arg: SCTP_STATE_CLOSED));
287
288	SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS);
289	SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
290
291	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_DELETE_TCB, obj: SCTP_NULL());
292
293	return SCTP_DISPOSITION_DELETE_TCB;
294	}
295
296	/*
297	* Respond to a normal INIT chunk.
298	* We are the side that is being asked for an association.
299	*
300	* Section: 5.1 Normal Establishment of an Association, B
301	* B) "Z" shall respond immediately with an INIT ACK chunk. The
302	* destination IP address of the INIT ACK MUST be set to the source
303	* IP address of the INIT to which this INIT ACK is responding. In
304	* the response, besides filling in other parameters, "Z" must set the
305	* Verification Tag field to Tag_A, and also provide its own
306	* Verification Tag (Tag_Z) in the Initiate Tag field.
307	*
308	* Verification Tag: Must be 0.
309	*
310	* Inputs
311	* (endpoint, asoc, chunk)
312	*
313	* Outputs
314	* (asoc, reply_msg, msg_up, timers, counters)
315	*
316	* The return value is the disposition of the chunk.
317	*/
318	enum sctp_disposition sctp_sf_do_5_1B_init(struct net *net,
319	const struct sctp_endpoint *ep,
320	const struct sctp_association *asoc,
321	const union sctp_subtype type,
322	void *arg,
323	struct sctp_cmd_seq *commands)
324	{
325	struct sctp_chunk *chunk = arg, *repl, *err_chunk;
326	struct sctp_unrecognized_param *unk_param;
327	struct sctp_association *new_asoc;
328	struct sctp_packet *packet;
329	int len;
330
331	/* 6.10 Bundling
332	* An endpoint MUST NOT bundle INIT, INIT ACK or
333	* SHUTDOWN COMPLETE with any other chunks.
334	*
335	* IG Section 2.11.2
336	* Furthermore, we require that the receiver of an INIT chunk MUST
337	* enforce these rules by silently discarding an arriving packet
338	* with an INIT chunk that is bundled with other chunks.
339	*/
340	if (!chunk->singleton)
341	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
342
343	/* Make sure that the INIT chunk has a valid length.
344	* Normally, this would cause an ABORT with a Protocol Violation
345	* error, but since we don't have an association, we'll
346	* just discard the packet.
347	*/
348	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_init_chunk)))
349	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
350
351	/* If the packet is an OOTB packet which is temporarily on the
352	* control endpoint, respond with an ABORT.
353	*/
354	if (ep == sctp_sk(net->sctp.ctl_sock)->ep) {
355	SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
356	return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
357	}
358
359	/* 3.1 A packet containing an INIT chunk MUST have a zero Verification
360	* Tag.
361	*/
362	if (chunk->sctp_hdr->vtag != 0)
363	return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
364
365	/* If the INIT is coming toward a closing socket, we'll send back
366	* and ABORT. Essentially, this catches the race of INIT being
367	* backloged to the socket at the same time as the user issues close().
368	* Since the socket and all its associations are going away, we
369	* can treat this OOTB
370	*/
371	if (sctp_sstate(ep->base.sk, CLOSING))
372	return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
373
374	/* Verify the INIT chunk before processing it. */
375	err_chunk = NULL;
376	if (!sctp_verify_init(net, ep, asoc, cid: chunk->chunk_hdr->type,
377	peer_init: (struct sctp_init_chunk *)chunk->chunk_hdr, chunk,
378	err_chunk: &err_chunk)) {
379	/* This chunk contains fatal error. It is to be discarded.
380	* Send an ABORT, with causes if there is any.
381	*/
382	if (err_chunk) {
383	packet = sctp_abort_pkt_new(net, ep, asoc, chunk: arg,
384	payload: (__u8 *)(err_chunk->chunk_hdr) +
385	sizeof(struct sctp_chunkhdr),
386	ntohs(err_chunk->chunk_hdr->length) -
387	sizeof(struct sctp_chunkhdr));
388
389	sctp_chunk_free(err_chunk);
390
391	if (packet) {
392	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SEND_PKT,
393	obj: SCTP_PACKET(arg: packet));
394	SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
395	return SCTP_DISPOSITION_CONSUME;
396	} else {
397	return SCTP_DISPOSITION_NOMEM;
398	}
399	} else {
400	return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg,
401	commands);
402	}
403	}
404
405	/* Grab the INIT header. */
406	chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data;
407
408	/* Tag the variable length parameters. */
409	chunk->param_hdr.v = skb_pull(skb: chunk->skb, len: sizeof(struct sctp_inithdr));
410
411	new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC);
412	if (!new_asoc)
413	goto nomem;
414
415	/* Update socket peer label if first association. */
416	if (security_sctp_assoc_request(asoc: new_asoc, skb: chunk->skb)) {
417	sctp_association_free(new_asoc);
418	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
419	}
420
421	if (sctp_assoc_set_bind_addr_from_ep(asoc: new_asoc,
422	scope: sctp_scope(addr: sctp_source(chunk)),
423	GFP_ATOMIC) < 0)
424	goto nomem_init;
425
426	/* The call, sctp_process_init(), can fail on memory allocation. */
427	if (!sctp_process_init(new_asoc, chunk, peer: sctp_source(chunk),
428	init: (struct sctp_init_chunk *)chunk->chunk_hdr,
429	GFP_ATOMIC))
430	goto nomem_init;
431
432	/* B) "Z" shall respond immediately with an INIT ACK chunk. */
433
434	/* If there are errors need to be reported for unknown parameters,
435	* make sure to reserve enough room in the INIT ACK for them.
436	*/
437	len = 0;
438	if (err_chunk)
439	len = ntohs(err_chunk->chunk_hdr->length) -
440	sizeof(struct sctp_chunkhdr);
441
442	repl = sctp_make_init_ack(asoc: new_asoc, chunk, GFP_ATOMIC, unkparam_len: len);
443	if (!repl)
444	goto nomem_init;
445
446	/* If there are errors need to be reported for unknown parameters,
447	* include them in the outgoing INIT ACK as "Unrecognized parameter"
448	* parameter.
449	*/
450	if (err_chunk) {
451	/* Get the "Unrecognized parameter" parameter(s) out of the
452	* ERROR chunk generated by sctp_verify_init(). Since the
453	* error cause code for "unknown parameter" and the
454	* "Unrecognized parameter" type is the same, we can
455	* construct the parameters in INIT ACK by copying the
456	* ERROR causes over.
457	*/
458	unk_param = (struct sctp_unrecognized_param *)
459	((__u8 *)(err_chunk->chunk_hdr) +
460	sizeof(struct sctp_chunkhdr));
461	/* Replace the cause code with the "Unrecognized parameter"
462	* parameter type.
463	*/
464	sctp_addto_chunk(repl, len, data: unk_param);
465	sctp_chunk_free(err_chunk);
466	}
467
468	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_NEW_ASOC, obj: SCTP_ASOC(arg: new_asoc));
469
470	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: repl));
471
472	/*
473	* Note: After sending out INIT ACK with the State Cookie parameter,
474	* "Z" MUST NOT allocate any resources, nor keep any states for the
475	* new association. Otherwise, "Z" will be vulnerable to resource
476	* attacks.
477	*/
478	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_DELETE_TCB, obj: SCTP_NULL());
479
480	return SCTP_DISPOSITION_DELETE_TCB;
481
482	nomem_init:
483	sctp_association_free(new_asoc);
484	nomem:
485	if (err_chunk)
486	sctp_chunk_free(err_chunk);
487	return SCTP_DISPOSITION_NOMEM;
488	}
489
490	/*
491	* Respond to a normal INIT ACK chunk.
492	* We are the side that is initiating the association.
493	*
494	* Section: 5.1 Normal Establishment of an Association, C
495	* C) Upon reception of the INIT ACK from "Z", "A" shall stop the T1-init
496	* timer and leave COOKIE-WAIT state. "A" shall then send the State
497	* Cookie received in the INIT ACK chunk in a COOKIE ECHO chunk, start
498	* the T1-cookie timer, and enter the COOKIE-ECHOED state.
499	*
500	* Note: The COOKIE ECHO chunk can be bundled with any pending outbound
501	* DATA chunks, but it MUST be the first chunk in the packet and
502	* until the COOKIE ACK is returned the sender MUST NOT send any
503	* other packets to the peer.
504	*
505	* Verification Tag: 3.3.3
506	* If the value of the Initiate Tag in a received INIT ACK chunk is
507	* found to be 0, the receiver MUST treat it as an error and close the
508	* association by transmitting an ABORT.
509	*
510	* Inputs
511	* (endpoint, asoc, chunk)
512	*
513	* Outputs
514	* (asoc, reply_msg, msg_up, timers, counters)
515	*
516	* The return value is the disposition of the chunk.
517	*/
518	enum sctp_disposition sctp_sf_do_5_1C_ack(struct net *net,
519	const struct sctp_endpoint *ep,
520	const struct sctp_association *asoc,
521	const union sctp_subtype type,
522	void *arg,
523	struct sctp_cmd_seq *commands)
524	{
525	struct sctp_init_chunk *initchunk;
526	struct sctp_chunk *chunk = arg;
527	struct sctp_chunk *err_chunk;
528	struct sctp_packet *packet;
529
530	if (!sctp_vtag_verify(chunk, asoc))
531	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
532
533	/* 6.10 Bundling
534	* An endpoint MUST NOT bundle INIT, INIT ACK or
535	* SHUTDOWN COMPLETE with any other chunks.
536	*/
537	if (!chunk->singleton)
538	return sctp_sf_violation_chunk(net, ep, asoc, type, arg, commands);
539
540	/* Make sure that the INIT-ACK chunk has a valid length */
541	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_initack_chunk)))
542	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
543	commands);
544	/* Grab the INIT header. */
545	chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data;
546
547	/* Verify the INIT chunk before processing it. */
548	err_chunk = NULL;
549	if (!sctp_verify_init(net, ep, asoc, cid: chunk->chunk_hdr->type,
550	peer_init: (struct sctp_init_chunk *)chunk->chunk_hdr, chunk,
551	err_chunk: &err_chunk)) {
552
553	enum sctp_error error = SCTP_ERROR_NO_RESOURCE;
554
555	/* This chunk contains fatal error. It is to be discarded.
556	* Send an ABORT, with causes. If there are no causes,
557	* then there wasn't enough memory. Just terminate
558	* the association.
559	*/
560	if (err_chunk) {
561	packet = sctp_abort_pkt_new(net, ep, asoc, chunk: arg,
562	payload: (__u8 *)(err_chunk->chunk_hdr) +
563	sizeof(struct sctp_chunkhdr),
564	ntohs(err_chunk->chunk_hdr->length) -
565	sizeof(struct sctp_chunkhdr));
566
567	sctp_chunk_free(err_chunk);
568
569	if (packet) {
570	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SEND_PKT,
571	obj: SCTP_PACKET(arg: packet));
572	SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
573	error = SCTP_ERROR_INV_PARAM;
574	}
575	}
576
577	/* SCTP-AUTH, Section 6.3:
578	* It should be noted that if the receiver wants to tear
579	* down an association in an authenticated way only, the
580	* handling of malformed packets should not result in
581	* tearing down the association.
582	*
583	* This means that if we only want to abort associations
584	* in an authenticated way (i.e AUTH+ABORT), then we
585	* can't destroy this association just because the packet
586	* was malformed.
587	*/
588	if (sctp_auth_recv_cid(chunk: SCTP_CID_ABORT, asoc))
589	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
590
591	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
592	return sctp_stop_t1_and_abort(net, commands, error, ECONNREFUSED,
593	asoc, transport: chunk->transport);
594	}
595
596	/* Tag the variable length parameters. Note that we never
597	* convert the parameters in an INIT chunk.
598	*/
599	chunk->param_hdr.v = skb_pull(skb: chunk->skb, len: sizeof(struct sctp_inithdr));
600
601	initchunk = (struct sctp_init_chunk *)chunk->chunk_hdr;
602
603	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_PEER_INIT,
604	obj: SCTP_PEER_INIT(arg: initchunk));
605
606	/* SCTP-AUTH: generate the association shared keys so that
607	* we can potentially sign the COOKIE-ECHO.
608	*/
609	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_ASSOC_SHKEY, obj: SCTP_NULL());
610
611	/* Reset init error count upon receipt of INIT-ACK. */
612	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_INIT_COUNTER_RESET, obj: SCTP_NULL());
613
614	/* 5.1 C) "A" shall stop the T1-init timer and leave
615	* COOKIE-WAIT state. "A" shall then ... start the T1-cookie
616	* timer, and enter the COOKIE-ECHOED state.
617	*/
618	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_STOP,
619	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T1_INIT));
620	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_START,
621	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T1_COOKIE));
622	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_NEW_STATE,
623	obj: SCTP_STATE(arg: SCTP_STATE_COOKIE_ECHOED));
624
625	/* 5.1 C) "A" shall then send the State Cookie received in the
626	* INIT ACK chunk in a COOKIE ECHO chunk, ...
627	*/
628	/* If there is any errors to report, send the ERROR chunk generated
629	* for unknown parameters as well.
630	*/
631	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_GEN_COOKIE_ECHO,
632	obj: SCTP_CHUNK(arg: err_chunk));
633
634	return SCTP_DISPOSITION_CONSUME;
635	}
636
637	static bool sctp_auth_chunk_verify(struct net *net, struct sctp_chunk *chunk,
638	const struct sctp_association *asoc)
639	{
640	struct sctp_chunk auth;
641
642	if (!chunk->auth_chunk)
643	return true;
644
645	/* SCTP-AUTH: auth_chunk pointer is only set when the cookie-echo
646	* is supposed to be authenticated and we have to do delayed
647	* authentication. We've just recreated the association using
648	* the information in the cookie and now it's much easier to
649	* do the authentication.
650	*/
651
652	/* Make sure that we and the peer are AUTH capable */
653	if (!net->sctp.auth_enable || !asoc->peer.auth_capable)
654	return false;
655
656	/* set-up our fake chunk so that we can process it */
657	auth.skb = chunk->auth_chunk;
658	auth.asoc = chunk->asoc;
659	auth.sctp_hdr = chunk->sctp_hdr;
660	auth.chunk_hdr = (struct sctp_chunkhdr *)
661	skb_push(skb: chunk->auth_chunk,
662	len: sizeof(struct sctp_chunkhdr));
663	skb_pull(skb: chunk->auth_chunk, len: sizeof(struct sctp_chunkhdr));
664	auth.transport = chunk->transport;
665
666	return sctp_sf_authenticate(asoc, chunk: &auth) == SCTP_IERROR_NO_ERROR;
667	}
668
669	/*
670	* Respond to a normal COOKIE ECHO chunk.
671	* We are the side that is being asked for an association.
672	*
673	* Section: 5.1 Normal Establishment of an Association, D
674	* D) Upon reception of the COOKIE ECHO chunk, Endpoint "Z" will reply
675	* with a COOKIE ACK chunk after building a TCB and moving to
676	* the ESTABLISHED state. A COOKIE ACK chunk may be bundled with
677	* any pending DATA chunks (and/or SACK chunks), but the COOKIE ACK
678	* chunk MUST be the first chunk in the packet.
679	*
680	* IMPLEMENTATION NOTE: An implementation may choose to send the
681	* Communication Up notification to the SCTP user upon reception
682	* of a valid COOKIE ECHO chunk.
683	*
684	* Verification Tag: 8.5.1 Exceptions in Verification Tag Rules
685	* D) Rules for packet carrying a COOKIE ECHO
686	*
687	* - When sending a COOKIE ECHO, the endpoint MUST use the value of the
688	* Initial Tag received in the INIT ACK.
689	*
690	* - The receiver of a COOKIE ECHO follows the procedures in Section 5.
691	*
692	* Inputs
693	* (endpoint, asoc, chunk)
694	*
695	* Outputs
696	* (asoc, reply_msg, msg_up, timers, counters)
697	*
698	* The return value is the disposition of the chunk.
699	*/
700	enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,
701	const struct sctp_endpoint *ep,
702	const struct sctp_association *asoc,
703	const union sctp_subtype type,
704	void *arg,
705	struct sctp_cmd_seq *commands)
706	{
707	struct sctp_ulpevent *ev, *ai_ev = NULL, *auth_ev = NULL;
708	struct sctp_association *new_asoc;
709	struct sctp_init_chunk *peer_init;
710	struct sctp_chunk *chunk = arg;
711	struct sctp_chunk *err_chk_p;
712	struct sctp_chunk *repl;
713	struct sock *sk;
714	int error = 0;
715
716	if (asoc && !sctp_vtag_verify(chunk, asoc))
717	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
718
719	/* If the packet is an OOTB packet which is temporarily on the
720	* control endpoint, respond with an ABORT.
721	*/
722	if (ep == sctp_sk(net->sctp.ctl_sock)->ep) {
723	SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
724	return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
725	}
726
727	/* Make sure that the COOKIE_ECHO chunk has a valid length.
728	* In this case, we check that we have enough for at least a
729	* chunk header. More detailed verification is done
730	* in sctp_unpack_cookie().
731	*/
732	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_chunkhdr)))
733	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
734	commands);
735
736	/* If the endpoint is not listening or if the number of associations
737	* on the TCP-style socket exceed the max backlog, respond with an
738	* ABORT.
739	*/
740	sk = ep->base.sk;
741	if (!sctp_sstate(sk, LISTENING) ||
742	(sctp_style(sk, TCP) && sk_acceptq_is_full(sk)))
743	return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
744
745	/* "Decode" the chunk. We have no optional parameters so we
746	* are in good shape.
747	*/
748	chunk->subh.cookie_hdr =
749	(struct sctp_signed_cookie *)chunk->skb->data;
750	if (!pskb_pull(skb: chunk->skb, ntohs(chunk->chunk_hdr->length) -
751	sizeof(struct sctp_chunkhdr)))
752	goto nomem;
753
754	/* 5.1 D) Upon reception of the COOKIE ECHO chunk, Endpoint
755	* "Z" will reply with a COOKIE ACK chunk after building a TCB
756	* and moving to the ESTABLISHED state.
757	*/
758	new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, err: &error,
759	err_chk_p: &err_chk_p);
760
761	/* FIXME:
762	* If the re-build failed, what is the proper error path
763	* from here?
764	*
765	* [We should abort the association. --piggy]
766	*/
767	if (!new_asoc) {
768	/* FIXME: Several errors are possible. A bad cookie should
769	* be silently discarded, but think about logging it too.
770	*/
771	switch (error) {
772	case -SCTP_IERROR_NOMEM:
773	goto nomem;
774
775	case -SCTP_IERROR_STALE_COOKIE:
776	sctp_send_stale_cookie_err(net, ep, asoc, chunk, commands,
777	err_chunk: err_chk_p);
778	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
779
780	case -SCTP_IERROR_BAD_SIG:
781	default:
782	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
783	}
784	}
785
786	if (security_sctp_assoc_request(asoc: new_asoc, skb: chunk->head_skb ?: chunk->skb)) {
787	sctp_association_free(new_asoc);
788	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
789	}
790
791	/* Delay state machine commands until later.
792	*
793	* Re-build the bind address for the association is done in
794	* the sctp_unpack_cookie() already.
795	*/
796	/* This is a brand-new association, so these are not yet side
797	* effects--it is safe to run them here.
798	*/
799	peer_init = (struct sctp_init_chunk *)(chunk->subh.cookie_hdr + 1);
800	if (!sctp_process_init(new_asoc, chunk,
801	peer: &chunk->subh.cookie_hdr->c.peer_addr,
802	init: peer_init, GFP_ATOMIC))
803	goto nomem_init;
804
805	/* SCTP-AUTH: Now that we've populate required fields in
806	* sctp_process_init, set up the association shared keys as
807	* necessary so that we can potentially authenticate the ACK
808	*/
809	error = sctp_auth_asoc_init_active_key(asoc: new_asoc, GFP_ATOMIC);
810	if (error)
811	goto nomem_init;
812
813	if (!sctp_auth_chunk_verify(net, chunk, asoc: new_asoc)) {
814	sctp_association_free(new_asoc);
815	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
816	}
817
818	repl = sctp_make_cookie_ack(asoc: new_asoc, chunk);
819	if (!repl)
820	goto nomem_init;
821
822	/* RFC 2960 5.1 Normal Establishment of an Association
823	*
824	* D) IMPLEMENTATION NOTE: An implementation may choose to
825	* send the Communication Up notification to the SCTP user
826	* upon reception of a valid COOKIE ECHO chunk.
827	*/
828	ev = sctp_ulpevent_make_assoc_change(asoc: new_asoc, flags: 0, state: SCTP_COMM_UP, error: 0,
829	outbound: new_asoc->c.sinit_num_ostreams,
830	inbound: new_asoc->c.sinit_max_instreams,
831	NULL, GFP_ATOMIC);
832	if (!ev)
833	goto nomem_ev;
834
835	/* Sockets API Draft Section 5.3.1.6
836	* When a peer sends a Adaptation Layer Indication parameter , SCTP
837	* delivers this notification to inform the application that of the
838	* peers requested adaptation layer.
839	*/
840	if (new_asoc->peer.adaptation_ind) {
841	ai_ev = sctp_ulpevent_make_adaptation_indication(asoc: new_asoc,
842	GFP_ATOMIC);
843	if (!ai_ev)
844	goto nomem_aiev;
845	}
846
847	if (!new_asoc->peer.auth_capable) {
848	auth_ev = sctp_ulpevent_make_authkey(asoc: new_asoc, key_id: 0,
849	indication: SCTP_AUTH_NO_AUTH,
850	GFP_ATOMIC);
851	if (!auth_ev)
852	goto nomem_authev;
853	}
854
855	/* Add all the state machine commands now since we've created
856	* everything. This way we don't introduce memory corruptions
857	* during side-effect processing and correctly count established
858	* associations.
859	*/
860	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_NEW_ASOC, obj: SCTP_ASOC(arg: new_asoc));
861	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_NEW_STATE,
862	obj: SCTP_STATE(arg: SCTP_STATE_ESTABLISHED));
863	SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
864	SCTP_INC_STATS(net, SCTP_MIB_PASSIVEESTABS);
865	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_HB_TIMERS_START, obj: SCTP_NULL());
866
867	if (new_asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
868	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_START,
869	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_AUTOCLOSE));
870
871	/* This will send the COOKIE ACK */
872	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: repl));
873
874	/* Queue the ASSOC_CHANGE event */
875	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_EVENT_ULP, obj: SCTP_ULPEVENT(arg: ev));
876
877	/* Send up the Adaptation Layer Indication event */
878	if (ai_ev)
879	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_EVENT_ULP,
880	obj: SCTP_ULPEVENT(arg: ai_ev));
881
882	if (auth_ev)
883	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_EVENT_ULP,
884	obj: SCTP_ULPEVENT(arg: auth_ev));
885
886	return SCTP_DISPOSITION_CONSUME;
887
888	nomem_authev:
889	if (ai_ev)
890	sctp_ulpevent_free(ai_ev);
891	nomem_aiev:
892	sctp_ulpevent_free(ev);
893	nomem_ev:
894	sctp_chunk_free(repl);
895	nomem_init:
896	sctp_association_free(new_asoc);
897	nomem:
898	return SCTP_DISPOSITION_NOMEM;
899	}
900
901	/*
902	* Respond to a normal COOKIE ACK chunk.
903	* We are the side that is asking for an association.
904	*
905	* RFC 2960 5.1 Normal Establishment of an Association
906	*
907	* E) Upon reception of the COOKIE ACK, endpoint "A" will move from the
908	* COOKIE-ECHOED state to the ESTABLISHED state, stopping the T1-cookie
909	* timer. It may also notify its ULP about the successful
910	* establishment of the association with a Communication Up
911	* notification (see Section 10).
912	*
913	* Verification Tag:
914	* Inputs
915	* (endpoint, asoc, chunk)
916	*
917	* Outputs
918	* (asoc, reply_msg, msg_up, timers, counters)
919	*
920	* The return value is the disposition of the chunk.
921	*/
922	enum sctp_disposition sctp_sf_do_5_1E_ca(struct net *net,
923	const struct sctp_endpoint *ep,
924	const struct sctp_association *asoc,
925	const union sctp_subtype type,
926	void *arg,
927	struct sctp_cmd_seq *commands)
928	{
929	struct sctp_chunk *chunk = arg;
930	struct sctp_ulpevent *ev;
931
932	if (!sctp_vtag_verify(chunk, asoc))
933	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
934
935	/* Set peer label for connection. */
936	if (security_sctp_assoc_established(asoc: (struct sctp_association *)asoc,
937	skb: chunk->head_skb ?: chunk->skb))
938	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
939
940	/* Verify that the chunk length for the COOKIE-ACK is OK.
941	* If we don't do this, any bundled chunks may be junked.
942	*/
943	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_chunkhdr)))
944	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
945	commands);
946
947	/* Reset init error count upon receipt of COOKIE-ACK,
948	* to avoid problems with the management of this
949	* counter in stale cookie situations when a transition back
950	* from the COOKIE-ECHOED state to the COOKIE-WAIT
951	* state is performed.
952	*/
953	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_INIT_COUNTER_RESET, obj: SCTP_NULL());
954
955	/* RFC 2960 5.1 Normal Establishment of an Association
956	*
957	* E) Upon reception of the COOKIE ACK, endpoint "A" will move
958	* from the COOKIE-ECHOED state to the ESTABLISHED state,
959	* stopping the T1-cookie timer.
960	*/
961	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_STOP,
962	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T1_COOKIE));
963	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_NEW_STATE,
964	obj: SCTP_STATE(arg: SCTP_STATE_ESTABLISHED));
965	SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
966	SCTP_INC_STATS(net, SCTP_MIB_ACTIVEESTABS);
967	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_HB_TIMERS_START, obj: SCTP_NULL());
968	if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
969	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_START,
970	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_AUTOCLOSE));
971
972	/* It may also notify its ULP about the successful
973	* establishment of the association with a Communication Up
974	* notification (see Section 10).
975	*/
976	ev = sctp_ulpevent_make_assoc_change(asoc, flags: 0, state: SCTP_COMM_UP,
977	error: 0, outbound: asoc->c.sinit_num_ostreams,
978	inbound: asoc->c.sinit_max_instreams,
979	NULL, GFP_ATOMIC);
980
981	if (!ev)
982	goto nomem;
983
984	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_EVENT_ULP, obj: SCTP_ULPEVENT(arg: ev));
985
986	/* Sockets API Draft Section 5.3.1.6
987	* When a peer sends a Adaptation Layer Indication parameter , SCTP
988	* delivers this notification to inform the application that of the
989	* peers requested adaptation layer.
990	*/
991	if (asoc->peer.adaptation_ind) {
992	ev = sctp_ulpevent_make_adaptation_indication(asoc, GFP_ATOMIC);
993	if (!ev)
994	goto nomem;
995
996	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_EVENT_ULP,
997	obj: SCTP_ULPEVENT(arg: ev));
998	}
999
1000	if (!asoc->peer.auth_capable) {
1001	ev = sctp_ulpevent_make_authkey(asoc, key_id: 0, indication: SCTP_AUTH_NO_AUTH,
1002	GFP_ATOMIC);
1003	if (!ev)
1004	goto nomem;
1005	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_EVENT_ULP,
1006	obj: SCTP_ULPEVENT(arg: ev));
1007	}
1008
1009	return SCTP_DISPOSITION_CONSUME;
1010	nomem:
1011	return SCTP_DISPOSITION_NOMEM;
1012	}
1013
1014	/* Generate and sendout a heartbeat packet. */
1015	static enum sctp_disposition sctp_sf_heartbeat(
1016	const struct sctp_endpoint *ep,
1017	const struct sctp_association *asoc,
1018	const union sctp_subtype type,
1019	void *arg,
1020	struct sctp_cmd_seq *commands)
1021	{
1022	struct sctp_transport *transport = (struct sctp_transport *) arg;
1023	struct sctp_chunk *reply;
1024
1025	/* Send a heartbeat to our peer. */
1026	reply = sctp_make_heartbeat(asoc, transport, probe_size: 0);
1027	if (!reply)
1028	return SCTP_DISPOSITION_NOMEM;
1029
1030	/* Set rto_pending indicating that an RTT measurement
1031	* is started with this heartbeat chunk.
1032	*/
1033	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_RTO_PENDING,
1034	obj: SCTP_TRANSPORT(arg: transport));
1035
1036	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: reply));
1037	return SCTP_DISPOSITION_CONSUME;
1038	}
1039
1040	/* Generate a HEARTBEAT packet on the given transport. */
1041	enum sctp_disposition sctp_sf_sendbeat_8_3(struct net *net,
1042	const struct sctp_endpoint *ep,
1043	const struct sctp_association *asoc,
1044	const union sctp_subtype type,
1045	void *arg,
1046	struct sctp_cmd_seq *commands)
1047	{
1048	struct sctp_transport *transport = (struct sctp_transport *) arg;
1049
1050	if (asoc->overall_error_count >= asoc->max_retrans) {
1051	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SET_SK_ERR,
1052	obj: SCTP_ERROR(ETIMEDOUT));
1053	/* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
1054	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_ASSOC_FAILED,
1055	obj: SCTP_PERR(arg: SCTP_ERROR_NO_ERROR));
1056	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
1057	SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
1058	return SCTP_DISPOSITION_DELETE_TCB;
1059	}
1060
1061	/* Section 3.3.5.
1062	* The Sender-specific Heartbeat Info field should normally include
1063	* information about the sender's current time when this HEARTBEAT
1064	* chunk is sent and the destination transport address to which this
1065	* HEARTBEAT is sent (see Section 8.3).
1066	*/
1067
1068	if (transport->param_flags & SPP_HB_ENABLE) {
1069	if (SCTP_DISPOSITION_NOMEM ==
1070	sctp_sf_heartbeat(ep, asoc, type, arg,
1071	commands))
1072	return SCTP_DISPOSITION_NOMEM;
1073
1074	/* Set transport error counter and association error counter
1075	* when sending heartbeat.
1076	*/
1077	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TRANSPORT_HB_SENT,
1078	obj: SCTP_TRANSPORT(arg: transport));
1079	}
1080	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TRANSPORT_IDLE,
1081	obj: SCTP_TRANSPORT(arg: transport));
1082	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_HB_TIMER_UPDATE,
1083	obj: SCTP_TRANSPORT(arg: transport));
1084
1085	return SCTP_DISPOSITION_CONSUME;
1086	}
1087
1088	/* resend asoc strreset_chunk. */
1089	enum sctp_disposition sctp_sf_send_reconf(struct net *net,
1090	const struct sctp_endpoint *ep,
1091	const struct sctp_association *asoc,
1092	const union sctp_subtype type,
1093	void *arg,
1094	struct sctp_cmd_seq *commands)
1095	{
1096	struct sctp_transport *transport = arg;
1097
1098	if (asoc->overall_error_count >= asoc->max_retrans) {
1099	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SET_SK_ERR,
1100	obj: SCTP_ERROR(ETIMEDOUT));
1101	/* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
1102	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_ASSOC_FAILED,
1103	obj: SCTP_PERR(arg: SCTP_ERROR_NO_ERROR));
1104	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
1105	SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
1106	return SCTP_DISPOSITION_DELETE_TCB;
1107	}
1108
1109	sctp_chunk_hold(asoc->strreset_chunk);
1110	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY,
1111	obj: SCTP_CHUNK(arg: asoc->strreset_chunk));
1112	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_STRIKE, obj: SCTP_TRANSPORT(arg: transport));
1113
1114	return SCTP_DISPOSITION_CONSUME;
1115	}
1116
1117	/* send hb chunk with padding for PLPMUTD. */
1118	enum sctp_disposition sctp_sf_send_probe(struct net *net,
1119	const struct sctp_endpoint *ep,
1120	const struct sctp_association *asoc,
1121	const union sctp_subtype type,
1122	void *arg,
1123	struct sctp_cmd_seq *commands)
1124	{
1125	struct sctp_transport *transport = (struct sctp_transport *)arg;
1126	struct sctp_chunk *reply;
1127
1128	if (!sctp_transport_pl_enabled(t: transport))
1129	return SCTP_DISPOSITION_CONSUME;
1130
1131	sctp_transport_pl_send(t: transport);
1132	reply = sctp_make_heartbeat(asoc, transport, probe_size: transport->pl.probe_size);
1133	if (!reply)
1134	return SCTP_DISPOSITION_NOMEM;
1135	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: reply));
1136	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_PROBE_TIMER_UPDATE,
1137	obj: SCTP_TRANSPORT(arg: transport));
1138
1139	return SCTP_DISPOSITION_CONSUME;
1140	}
1141
1142	/*
1143	* Process an heartbeat request.
1144	*
1145	* Section: 8.3 Path Heartbeat
1146	* The receiver of the HEARTBEAT should immediately respond with a
1147	* HEARTBEAT ACK that contains the Heartbeat Information field copied
1148	* from the received HEARTBEAT chunk.
1149	*
1150	* Verification Tag: 8.5 Verification Tag [Normal verification]
1151	* When receiving an SCTP packet, the endpoint MUST ensure that the
1152	* value in the Verification Tag field of the received SCTP packet
1153	* matches its own Tag. If the received Verification Tag value does not
1154	* match the receiver's own tag value, the receiver shall silently
1155	* discard the packet and shall not process it any further except for
1156	* those cases listed in Section 8.5.1 below.
1157	*
1158	* Inputs
1159	* (endpoint, asoc, chunk)
1160	*
1161	* Outputs
1162	* (asoc, reply_msg, msg_up, timers, counters)
1163	*
1164	* The return value is the disposition of the chunk.
1165	*/
1166	enum sctp_disposition sctp_sf_beat_8_3(struct net *net,
1167	const struct sctp_endpoint *ep,
1168	const struct sctp_association *asoc,
1169	const union sctp_subtype type,
1170	void *arg, struct sctp_cmd_seq *commands)
1171	{
1172	struct sctp_paramhdr *param_hdr;
1173	struct sctp_chunk *chunk = arg;
1174	struct sctp_chunk *reply;
1175	size_t paylen = 0;
1176
1177	if (!sctp_vtag_verify(chunk, asoc))
1178	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1179
1180	/* Make sure that the HEARTBEAT chunk has a valid length. */
1181	if (!sctp_chunk_length_valid(chunk,
1182	required_length: sizeof(struct sctp_heartbeat_chunk)))
1183	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1184	commands);
1185
1186	/* 8.3 The receiver of the HEARTBEAT should immediately
1187	* respond with a HEARTBEAT ACK that contains the Heartbeat
1188	* Information field copied from the received HEARTBEAT chunk.
1189	*/
1190	chunk->subh.hb_hdr = (struct sctp_heartbeathdr *)chunk->skb->data;
1191	param_hdr = (struct sctp_paramhdr *)chunk->subh.hb_hdr;
1192	paylen = ntohs(chunk->chunk_hdr->length) - sizeof(struct sctp_chunkhdr);
1193
1194	if (ntohs(param_hdr->length) > paylen)
1195	return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
1196	ext: param_hdr, commands);
1197
1198	if (!pskb_pull(skb: chunk->skb, len: paylen))
1199	goto nomem;
1200
1201	reply = sctp_make_heartbeat_ack(asoc, chunk, payload: param_hdr, paylen);
1202	if (!reply)
1203	goto nomem;
1204
1205	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: reply));
1206	return SCTP_DISPOSITION_CONSUME;
1207
1208	nomem:
1209	return SCTP_DISPOSITION_NOMEM;
1210	}
1211
1212	/*
1213	* Process the returning HEARTBEAT ACK.
1214	*
1215	* Section: 8.3 Path Heartbeat
1216	* Upon the receipt of the HEARTBEAT ACK, the sender of the HEARTBEAT
1217	* should clear the error counter of the destination transport
1218	* address to which the HEARTBEAT was sent, and mark the destination
1219	* transport address as active if it is not so marked. The endpoint may
1220	* optionally report to the upper layer when an inactive destination
1221	* address is marked as active due to the reception of the latest
1222	* HEARTBEAT ACK. The receiver of the HEARTBEAT ACK must also
1223	* clear the association overall error count as well (as defined
1224	* in section 8.1).
1225	*
1226	* The receiver of the HEARTBEAT ACK should also perform an RTT
1227	* measurement for that destination transport address using the time
1228	* value carried in the HEARTBEAT ACK chunk.
1229	*
1230	* Verification Tag: 8.5 Verification Tag [Normal verification]
1231	*
1232	* Inputs
1233	* (endpoint, asoc, chunk)
1234	*
1235	* Outputs
1236	* (asoc, reply_msg, msg_up, timers, counters)
1237	*
1238	* The return value is the disposition of the chunk.
1239	*/
1240	enum sctp_disposition sctp_sf_backbeat_8_3(struct net *net,
1241	const struct sctp_endpoint *ep,
1242	const struct sctp_association *asoc,
1243	const union sctp_subtype type,
1244	void *arg,
1245	struct sctp_cmd_seq *commands)
1246	{
1247	struct sctp_sender_hb_info *hbinfo;
1248	struct sctp_chunk *chunk = arg;
1249	struct sctp_transport *link;
1250	unsigned long max_interval;
1251	union sctp_addr from_addr;
1252
1253	if (!sctp_vtag_verify(chunk, asoc))
1254	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1255
1256	/* Make sure that the HEARTBEAT-ACK chunk has a valid length. */
1257	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_chunkhdr) +
1258	sizeof(*hbinfo)))
1259	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1260	commands);
1261
1262	hbinfo = (struct sctp_sender_hb_info *)chunk->skb->data;
1263	/* Make sure that the length of the parameter is what we expect */
1264	if (ntohs(hbinfo->param_hdr.length) != sizeof(*hbinfo))
1265	return SCTP_DISPOSITION_DISCARD;
1266
1267	from_addr = hbinfo->daddr;
1268	link = sctp_assoc_lookup_paddr(asoc, &from_addr);
1269
1270	/* This should never happen, but lets log it if so. */
1271	if (unlikely(!link)) {
1272	if (from_addr.sa.sa_family == AF_INET6) {
1273	net_warn_ratelimited("%s association %p could not find address %pI6\n",
1274	__func__,
1275	asoc,
1276	&from_addr.v6.sin6_addr);
1277	} else {
1278	net_warn_ratelimited("%s association %p could not find address %pI4\n",
1279	__func__,
1280	asoc,
1281	&from_addr.v4.sin_addr.s_addr);
1282	}
1283	return SCTP_DISPOSITION_DISCARD;
1284	}
1285
1286	/* Validate the 64-bit random nonce. */
1287	if (hbinfo->hb_nonce != link->hb_nonce)
1288	return SCTP_DISPOSITION_DISCARD;
1289
1290	if (hbinfo->probe_size) {
1291	if (hbinfo->probe_size != link->pl.probe_size ||
1292	!sctp_transport_pl_enabled(t: link))
1293	return SCTP_DISPOSITION_DISCARD;
1294
1295	if (sctp_transport_pl_recv(t: link))
1296	return SCTP_DISPOSITION_CONSUME;
1297
1298	return sctp_sf_send_probe(net, ep, asoc, type, arg: link, commands);
1299	}
1300
1301	max_interval = link->hbinterval + link->rto;
1302
1303	/* Check if the timestamp looks valid. */
1304	if (time_after(hbinfo->sent_at, jiffies) ||
1305	time_after(jiffies, hbinfo->sent_at + max_interval)) {
1306	pr_debug("%s: HEARTBEAT ACK with invalid timestamp received "
1307	"for transport:%p\n", __func__, link);
1308
1309	return SCTP_DISPOSITION_DISCARD;
1310	}
1311
1312	/* 8.3 Upon the receipt of the HEARTBEAT ACK, the sender of
1313	* the HEARTBEAT should clear the error counter of the
1314	* destination transport address to which the HEARTBEAT was
1315	* sent and mark the destination transport address as active if
1316	* it is not so marked.
1317	*/
1318	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TRANSPORT_ON, obj: SCTP_TRANSPORT(arg: link));
1319
1320	return SCTP_DISPOSITION_CONSUME;
1321	}
1322
1323	/* Helper function to send out an abort for the restart
1324	* condition.
1325	*/
1326	static int sctp_sf_send_restart_abort(struct net *net, union sctp_addr *ssa,
1327	struct sctp_chunk *init,
1328	struct sctp_cmd_seq *commands)
1329	{
1330	struct sctp_af *af = sctp_get_af_specific(ssa->v4.sin_family);
1331	union sctp_addr_param *addrparm;
1332	struct sctp_errhdr *errhdr;
1333	char buffer[sizeof(*errhdr) + sizeof(*addrparm)];
1334	struct sctp_endpoint *ep;
1335	struct sctp_packet *pkt;
1336	int len;
1337
1338	/* Build the error on the stack. We are way to malloc crazy
1339	* throughout the code today.
1340	*/
1341	errhdr = (struct sctp_errhdr *)buffer;
1342	addrparm = (union sctp_addr_param *)(errhdr + 1);
1343
1344	/* Copy into a parm format. */
1345	len = af->to_addr_param(ssa, addrparm);
1346	len += sizeof(*errhdr);
1347
1348	errhdr->cause = SCTP_ERROR_RESTART;
1349	errhdr->length = htons(len);
1350
1351	/* Assign to the control socket. */
1352	ep = sctp_sk(net->sctp.ctl_sock)->ep;
1353
1354	/* Association is NULL since this may be a restart attack and we
1355	* want to send back the attacker's vtag.
1356	*/
1357	pkt = sctp_abort_pkt_new(net, ep, NULL, chunk: init, payload: errhdr, paylen: len);
1358
1359	if (!pkt)
1360	goto out;
1361	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SEND_PKT, obj: SCTP_PACKET(arg: pkt));
1362
1363	SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
1364
1365	/* Discard the rest of the inbound packet. */
1366	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_DISCARD_PACKET, obj: SCTP_NULL());
1367
1368	out:
1369	/* Even if there is no memory, treat as a failure so
1370	* the packet will get dropped.
1371	*/
1372	return 0;
1373	}
1374
1375	static bool list_has_sctp_addr(const struct list_head *list,
1376	union sctp_addr *ipaddr)
1377	{
1378	struct sctp_transport *addr;
1379
1380	list_for_each_entry(addr, list, transports) {
1381	if (sctp_cmp_addr_exact(ss1: ipaddr, ss2: &addr->ipaddr))
1382	return true;
1383	}
1384
1385	return false;
1386	}
1387	/* A restart is occurring, check to make sure no new addresses
1388	* are being added as we may be under a takeover attack.
1389	*/
1390	static int sctp_sf_check_restart_addrs(const struct sctp_association *new_asoc,
1391	const struct sctp_association *asoc,
1392	struct sctp_chunk *init,
1393	struct sctp_cmd_seq *commands)
1394	{
1395	struct net *net = new_asoc->base.net;
1396	struct sctp_transport *new_addr;
1397	int ret = 1;
1398
1399	/* Implementor's Guide - Section 5.2.2
1400	* ...
1401	* Before responding the endpoint MUST check to see if the
1402	* unexpected INIT adds new addresses to the association. If new
1403	* addresses are added to the association, the endpoint MUST respond
1404	* with an ABORT..
1405	*/
1406
1407	/* Search through all current addresses and make sure
1408	* we aren't adding any new ones.
1409	*/
1410	list_for_each_entry(new_addr, &new_asoc->peer.transport_addr_list,
1411	transports) {
1412	if (!list_has_sctp_addr(list: &asoc->peer.transport_addr_list,
1413	ipaddr: &new_addr->ipaddr)) {
1414	sctp_sf_send_restart_abort(net, ssa: &new_addr->ipaddr, init,
1415	commands);
1416	ret = 0;
1417	break;
1418	}
1419	}
1420
1421	/* Return success if all addresses were found. */
1422	return ret;
1423	}
1424
1425	/* Populate the verification/tie tags based on overlapping INIT
1426	* scenario.
1427	*
1428	* Note: Do not use in CLOSED or SHUTDOWN-ACK-SENT state.
1429	*/
1430	static void sctp_tietags_populate(struct sctp_association *new_asoc,
1431	const struct sctp_association *asoc)
1432	{
1433	switch (asoc->state) {
1434
1435	/* 5.2.1 INIT received in COOKIE-WAIT or COOKIE-ECHOED State */
1436
1437	case SCTP_STATE_COOKIE_WAIT:
1438	new_asoc->c.my_vtag = asoc->c.my_vtag;
1439	new_asoc->c.my_ttag = asoc->c.my_vtag;
1440	new_asoc->c.peer_ttag = 0;
1441	break;
1442
1443	case SCTP_STATE_COOKIE_ECHOED:
1444	new_asoc->c.my_vtag = asoc->c.my_vtag;
1445	new_asoc->c.my_ttag = asoc->c.my_vtag;
1446	new_asoc->c.peer_ttag = asoc->c.peer_vtag;
1447	break;
1448
1449	/* 5.2.2 Unexpected INIT in States Other than CLOSED, COOKIE-ECHOED,
1450	* COOKIE-WAIT and SHUTDOWN-ACK-SENT
1451	*/
1452	default:
1453	new_asoc->c.my_ttag = asoc->c.my_vtag;
1454	new_asoc->c.peer_ttag = asoc->c.peer_vtag;
1455	break;
1456	}
1457
1458	/* Other parameters for the endpoint SHOULD be copied from the
1459	* existing parameters of the association (e.g. number of
1460	* outbound streams) into the INIT ACK and cookie.
1461	*/
1462	new_asoc->rwnd = asoc->rwnd;
1463	new_asoc->c.sinit_num_ostreams = asoc->c.sinit_num_ostreams;
1464	new_asoc->c.sinit_max_instreams = asoc->c.sinit_max_instreams;
1465	new_asoc->c.initial_tsn = asoc->c.initial_tsn;
1466	}
1467
1468	/*
1469	* Compare vtag/tietag values to determine unexpected COOKIE-ECHO
1470	* handling action.
1471	*
1472	* RFC 2960 5.2.4 Handle a COOKIE ECHO when a TCB exists.
1473	*
1474	* Returns value representing action to be taken. These action values
1475	* correspond to Action/Description values in RFC 2960, Table 2.
1476	*/
1477	static char sctp_tietags_compare(struct sctp_association *new_asoc,
1478	const struct sctp_association *asoc)
1479	{
1480	/* In this case, the peer may have restarted. */
1481	if ((asoc->c.my_vtag != new_asoc->c.my_vtag) &&
1482	(asoc->c.peer_vtag != new_asoc->c.peer_vtag) &&
1483	(asoc->c.my_vtag == new_asoc->c.my_ttag) &&
1484	(asoc->c.peer_vtag == new_asoc->c.peer_ttag))
1485	return 'A';
1486
1487	/* Collision case B. */
1488	if ((asoc->c.my_vtag == new_asoc->c.my_vtag) &&
1489	((asoc->c.peer_vtag != new_asoc->c.peer_vtag) ||
1490	(0 == asoc->c.peer_vtag))) {
1491	return 'B';
1492	}
1493
1494	/* Collision case D. */
1495	if ((asoc->c.my_vtag == new_asoc->c.my_vtag) &&
1496	(asoc->c.peer_vtag == new_asoc->c.peer_vtag))
1497	return 'D';
1498
1499	/* Collision case C. */
1500	if ((asoc->c.my_vtag != new_asoc->c.my_vtag) &&
1501	(asoc->c.peer_vtag == new_asoc->c.peer_vtag) &&
1502	(0 == new_asoc->c.my_ttag) &&
1503	(0 == new_asoc->c.peer_ttag))
1504	return 'C';
1505
1506	/* No match to any of the special cases; discard this packet. */
1507	return 'E';
1508	}
1509
1510	/* Common helper routine for both duplicate and simultaneous INIT
1511	* chunk handling.
1512	*/
1513	static enum sctp_disposition sctp_sf_do_unexpected_init(
1514	struct net *net,
1515	const struct sctp_endpoint *ep,
1516	const struct sctp_association *asoc,
1517	const union sctp_subtype type,
1518	void *arg,
1519	struct sctp_cmd_seq *commands)
1520	{
1521	struct sctp_chunk *chunk = arg, *repl, *err_chunk;
1522	struct sctp_unrecognized_param *unk_param;
1523	struct sctp_association *new_asoc;
1524	enum sctp_disposition retval;
1525	struct sctp_packet *packet;
1526	int len;
1527
1528	/* 6.10 Bundling
1529	* An endpoint MUST NOT bundle INIT, INIT ACK or
1530	* SHUTDOWN COMPLETE with any other chunks.
1531	*
1532	* IG Section 2.11.2
1533	* Furthermore, we require that the receiver of an INIT chunk MUST
1534	* enforce these rules by silently discarding an arriving packet
1535	* with an INIT chunk that is bundled with other chunks.
1536	*/
1537	if (!chunk->singleton)
1538	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1539
1540	/* Make sure that the INIT chunk has a valid length. */
1541	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_init_chunk)))
1542	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1543
1544	/* 3.1 A packet containing an INIT chunk MUST have a zero Verification
1545	* Tag.
1546	*/
1547	if (chunk->sctp_hdr->vtag != 0)
1548	return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
1549
1550	if (SCTP_INPUT_CB(chunk->skb)->encap_port != chunk->transport->encap_port)
1551	return sctp_sf_new_encap_port(net, ep, asoc, type, arg, commands);
1552
1553	/* Grab the INIT header. */
1554	chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data;
1555
1556	/* Tag the variable length parameters. */
1557	chunk->param_hdr.v = skb_pull(skb: chunk->skb, len: sizeof(struct sctp_inithdr));
1558
1559	/* Verify the INIT chunk before processing it. */
1560	err_chunk = NULL;
1561	if (!sctp_verify_init(net, ep, asoc, cid: chunk->chunk_hdr->type,
1562	peer_init: (struct sctp_init_chunk *)chunk->chunk_hdr, chunk,
1563	err_chunk: &err_chunk)) {
1564	/* This chunk contains fatal error. It is to be discarded.
1565	* Send an ABORT, with causes if there is any.
1566	*/
1567	if (err_chunk) {
1568	packet = sctp_abort_pkt_new(net, ep, asoc, chunk: arg,
1569	payload: (__u8 *)(err_chunk->chunk_hdr) +
1570	sizeof(struct sctp_chunkhdr),
1571	ntohs(err_chunk->chunk_hdr->length) -
1572	sizeof(struct sctp_chunkhdr));
1573
1574	if (packet) {
1575	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SEND_PKT,
1576	obj: SCTP_PACKET(arg: packet));
1577	SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
1578	retval = SCTP_DISPOSITION_CONSUME;
1579	} else {
1580	retval = SCTP_DISPOSITION_NOMEM;
1581	}
1582	goto cleanup;
1583	} else {
1584	return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg,
1585	commands);
1586	}
1587	}
1588
1589	/*
1590	* Other parameters for the endpoint SHOULD be copied from the
1591	* existing parameters of the association (e.g. number of
1592	* outbound streams) into the INIT ACK and cookie.
1593	* FIXME: We are copying parameters from the endpoint not the
1594	* association.
1595	*/
1596	new_asoc = sctp_make_temp_asoc(ep, chunk, GFP_ATOMIC);
1597	if (!new_asoc)
1598	goto nomem;
1599
1600	/* Update socket peer label if first association. */
1601	if (security_sctp_assoc_request(asoc: new_asoc, skb: chunk->skb)) {
1602	sctp_association_free(new_asoc);
1603	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1604	}
1605
1606	if (sctp_assoc_set_bind_addr_from_ep(asoc: new_asoc,
1607	scope: sctp_scope(addr: sctp_source(chunk)), GFP_ATOMIC) < 0)
1608	goto nomem;
1609
1610	/* In the outbound INIT ACK the endpoint MUST copy its current
1611	* Verification Tag and Peers Verification tag into a reserved
1612	* place (local tie-tag and per tie-tag) within the state cookie.
1613	*/
1614	if (!sctp_process_init(new_asoc, chunk, peer: sctp_source(chunk),
1615	init: (struct sctp_init_chunk *)chunk->chunk_hdr,
1616	GFP_ATOMIC))
1617	goto nomem;
1618
1619	/* Make sure no new addresses are being added during the
1620	* restart. Do not do this check for COOKIE-WAIT state,
1621	* since there are no peer addresses to check against.
1622	* Upon return an ABORT will have been sent if needed.
1623	*/
1624	if (!sctp_state(asoc, COOKIE_WAIT)) {
1625	if (!sctp_sf_check_restart_addrs(new_asoc, asoc, init: chunk,
1626	commands)) {
1627	retval = SCTP_DISPOSITION_CONSUME;
1628	goto nomem_retval;
1629	}
1630	}
1631
1632	sctp_tietags_populate(new_asoc, asoc);
1633
1634	/* B) "Z" shall respond immediately with an INIT ACK chunk. */
1635
1636	/* If there are errors need to be reported for unknown parameters,
1637	* make sure to reserve enough room in the INIT ACK for them.
1638	*/
1639	len = 0;
1640	if (err_chunk) {
1641	len = ntohs(err_chunk->chunk_hdr->length) -
1642	sizeof(struct sctp_chunkhdr);
1643	}
1644
1645	repl = sctp_make_init_ack(asoc: new_asoc, chunk, GFP_ATOMIC, unkparam_len: len);
1646	if (!repl)
1647	goto nomem;
1648
1649	/* If there are errors need to be reported for unknown parameters,
1650	* include them in the outgoing INIT ACK as "Unrecognized parameter"
1651	* parameter.
1652	*/
1653	if (err_chunk) {
1654	/* Get the "Unrecognized parameter" parameter(s) out of the
1655	* ERROR chunk generated by sctp_verify_init(). Since the
1656	* error cause code for "unknown parameter" and the
1657	* "Unrecognized parameter" type is the same, we can
1658	* construct the parameters in INIT ACK by copying the
1659	* ERROR causes over.
1660	*/
1661	unk_param = (struct sctp_unrecognized_param *)
1662	((__u8 *)(err_chunk->chunk_hdr) +
1663	sizeof(struct sctp_chunkhdr));
1664	/* Replace the cause code with the "Unrecognized parameter"
1665	* parameter type.
1666	*/
1667	sctp_addto_chunk(repl, len, data: unk_param);
1668	}
1669
1670	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_NEW_ASOC, obj: SCTP_ASOC(arg: new_asoc));
1671	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: repl));
1672
1673	/*
1674	* Note: After sending out INIT ACK with the State Cookie parameter,
1675	* "Z" MUST NOT allocate any resources for this new association.
1676	* Otherwise, "Z" will be vulnerable to resource attacks.
1677	*/
1678	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_DELETE_TCB, obj: SCTP_NULL());
1679	retval = SCTP_DISPOSITION_CONSUME;
1680
1681	return retval;
1682
1683	nomem:
1684	retval = SCTP_DISPOSITION_NOMEM;
1685	nomem_retval:
1686	if (new_asoc)
1687	sctp_association_free(new_asoc);
1688	cleanup:
1689	if (err_chunk)
1690	sctp_chunk_free(err_chunk);
1691	return retval;
1692	}
1693
1694	/*
1695	* Handle simultaneous INIT.
1696	* This means we started an INIT and then we got an INIT request from
1697	* our peer.
1698	*
1699	* Section: 5.2.1 INIT received in COOKIE-WAIT or COOKIE-ECHOED State (Item B)
1700	* This usually indicates an initialization collision, i.e., each
1701	* endpoint is attempting, at about the same time, to establish an
1702	* association with the other endpoint.
1703	*
1704	* Upon receipt of an INIT in the COOKIE-WAIT or COOKIE-ECHOED state, an
1705	* endpoint MUST respond with an INIT ACK using the same parameters it
1706	* sent in its original INIT chunk (including its Verification Tag,
1707	* unchanged). These original parameters are combined with those from the
1708	* newly received INIT chunk. The endpoint shall also generate a State
1709	* Cookie with the INIT ACK. The endpoint uses the parameters sent in its
1710	* INIT to calculate the State Cookie.
1711	*
1712	* After that, the endpoint MUST NOT change its state, the T1-init
1713	* timer shall be left running and the corresponding TCB MUST NOT be
1714	* destroyed. The normal procedures for handling State Cookies when
1715	* a TCB exists will resolve the duplicate INITs to a single association.
1716	*
1717	* For an endpoint that is in the COOKIE-ECHOED state it MUST populate
1718	* its Tie-Tags with the Tag information of itself and its peer (see
1719	* section 5.2.2 for a description of the Tie-Tags).
1720	*
1721	* Verification Tag: Not explicit, but an INIT can not have a valid
1722	* verification tag, so we skip the check.
1723	*
1724	* Inputs
1725	* (endpoint, asoc, chunk)
1726	*
1727	* Outputs
1728	* (asoc, reply_msg, msg_up, timers, counters)
1729	*
1730	* The return value is the disposition of the chunk.
1731	*/
1732	enum sctp_disposition sctp_sf_do_5_2_1_siminit(
1733	struct net *net,
1734	const struct sctp_endpoint *ep,
1735	const struct sctp_association *asoc,
1736	const union sctp_subtype type,
1737	void *arg,
1738	struct sctp_cmd_seq *commands)
1739	{
1740	/* Call helper to do the real work for both simultaneous and
1741	* duplicate INIT chunk handling.
1742	*/
1743	return sctp_sf_do_unexpected_init(net, ep, asoc, type, arg, commands);
1744	}
1745
1746	/*
1747	* Handle duplicated INIT messages. These are usually delayed
1748	* restransmissions.
1749	*
1750	* Section: 5.2.2 Unexpected INIT in States Other than CLOSED,
1751	* COOKIE-ECHOED and COOKIE-WAIT
1752	*
1753	* Unless otherwise stated, upon reception of an unexpected INIT for
1754	* this association, the endpoint shall generate an INIT ACK with a
1755	* State Cookie. In the outbound INIT ACK the endpoint MUST copy its
1756	* current Verification Tag and peer's Verification Tag into a reserved
1757	* place within the state cookie. We shall refer to these locations as
1758	* the Peer's-Tie-Tag and the Local-Tie-Tag. The outbound SCTP packet
1759	* containing this INIT ACK MUST carry a Verification Tag value equal to
1760	* the Initiation Tag found in the unexpected INIT. And the INIT ACK
1761	* MUST contain a new Initiation Tag (randomly generated see Section
1762	* 5.3.1). Other parameters for the endpoint SHOULD be copied from the
1763	* existing parameters of the association (e.g. number of outbound
1764	* streams) into the INIT ACK and cookie.
1765	*
1766	* After sending out the INIT ACK, the endpoint shall take no further
1767	* actions, i.e., the existing association, including its current state,
1768	* and the corresponding TCB MUST NOT be changed.
1769	*
1770	* Note: Only when a TCB exists and the association is not in a COOKIE-
1771	* WAIT state are the Tie-Tags populated. For a normal association INIT
1772	* (i.e. the endpoint is in a COOKIE-WAIT state), the Tie-Tags MUST be
1773	* set to 0 (indicating that no previous TCB existed). The INIT ACK and
1774	* State Cookie are populated as specified in section 5.2.1.
1775	*
1776	* Verification Tag: Not specified, but an INIT has no way of knowing
1777	* what the verification tag could be, so we ignore it.
1778	*
1779	* Inputs
1780	* (endpoint, asoc, chunk)
1781	*
1782	* Outputs
1783	* (asoc, reply_msg, msg_up, timers, counters)
1784	*
1785	* The return value is the disposition of the chunk.
1786	*/
1787	enum sctp_disposition sctp_sf_do_5_2_2_dupinit(
1788	struct net *net,
1789	const struct sctp_endpoint *ep,
1790	const struct sctp_association *asoc,
1791	const union sctp_subtype type,
1792	void *arg,
1793	struct sctp_cmd_seq *commands)
1794	{
1795	/* Call helper to do the real work for both simultaneous and
1796	* duplicate INIT chunk handling.
1797	*/
1798	return sctp_sf_do_unexpected_init(net, ep, asoc, type, arg, commands);
1799	}
1800
1801
1802	/*
1803	* Unexpected INIT-ACK handler.
1804	*
1805	* Section 5.2.3
1806	* If an INIT ACK received by an endpoint in any state other than the
1807	* COOKIE-WAIT state, the endpoint should discard the INIT ACK chunk.
1808	* An unexpected INIT ACK usually indicates the processing of an old or
1809	* duplicated INIT chunk.
1810	*/
1811	enum sctp_disposition sctp_sf_do_5_2_3_initack(
1812	struct net *net,
1813	const struct sctp_endpoint *ep,
1814	const struct sctp_association *asoc,
1815	const union sctp_subtype type,
1816	void *arg,
1817	struct sctp_cmd_seq *commands)
1818	{
1819	/* Per the above section, we'll discard the chunk if we have an
1820	* endpoint. If this is an OOTB INIT-ACK, treat it as such.
1821	*/
1822	if (ep == sctp_sk(net->sctp.ctl_sock)->ep)
1823	return sctp_sf_ootb(net, ep, asoc, type, arg, commands);
1824	else
1825	return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
1826	}
1827
1828	static int sctp_sf_do_assoc_update(struct sctp_association *asoc,
1829	struct sctp_association *new,
1830	struct sctp_cmd_seq *cmds)
1831	{
1832	struct net *net = asoc->base.net;
1833	struct sctp_chunk *abort;
1834
1835	if (!sctp_assoc_update(old: asoc, new))
1836	return 0;
1837
1838	abort = sctp_make_abort(asoc, NULL, hint: sizeof(struct sctp_errhdr));
1839	if (abort) {
1840	sctp_init_cause(chunk: abort, cause: SCTP_ERROR_RSRC_LOW, paylen: 0);
1841	sctp_add_cmd_sf(seq: cmds, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: abort));
1842	}
1843	sctp_add_cmd_sf(seq: cmds, verb: SCTP_CMD_SET_SK_ERR, obj: SCTP_ERROR(ECONNABORTED));
1844	sctp_add_cmd_sf(seq: cmds, verb: SCTP_CMD_ASSOC_FAILED,
1845	obj: SCTP_PERR(arg: SCTP_ERROR_RSRC_LOW));
1846	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
1847	SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
1848
1849	return -ENOMEM;
1850	}
1851
1852	/* Unexpected COOKIE-ECHO handler for peer restart (Table 2, action 'A')
1853	*
1854	* Section 5.2.4
1855	* A) In this case, the peer may have restarted.
1856	*/
1857	static enum sctp_disposition sctp_sf_do_dupcook_a(
1858	struct net *net,
1859	const struct sctp_endpoint *ep,
1860	const struct sctp_association *asoc,
1861	struct sctp_chunk *chunk,
1862	struct sctp_cmd_seq *commands,
1863	struct sctp_association *new_asoc)
1864	{
1865	struct sctp_init_chunk *peer_init;
1866	enum sctp_disposition disposition;
1867	struct sctp_ulpevent *ev;
1868	struct sctp_chunk *repl;
1869	struct sctp_chunk *err;
1870
1871	/* new_asoc is a brand-new association, so these are not yet
1872	* side effects--it is safe to run them here.
1873	*/
1874	peer_init = (struct sctp_init_chunk *)(chunk->subh.cookie_hdr + 1);
1875	if (!sctp_process_init(new_asoc, chunk, peer: sctp_source(chunk), init: peer_init,
1876	GFP_ATOMIC))
1877	goto nomem;
1878
1879	if (sctp_auth_asoc_init_active_key(asoc: new_asoc, GFP_ATOMIC))
1880	goto nomem;
1881
1882	if (!sctp_auth_chunk_verify(net, chunk, asoc: new_asoc))
1883	return SCTP_DISPOSITION_DISCARD;
1884
1885	/* Make sure no new addresses are being added during the
1886	* restart. Though this is a pretty complicated attack
1887	* since you'd have to get inside the cookie.
1888	*/
1889	if (!sctp_sf_check_restart_addrs(new_asoc, asoc, init: chunk, commands))
1890	return SCTP_DISPOSITION_CONSUME;
1891
1892	/* If the endpoint is in the SHUTDOWN-ACK-SENT state and recognizes
1893	* the peer has restarted (Action A), it MUST NOT setup a new
1894	* association but instead resend the SHUTDOWN ACK and send an ERROR
1895	* chunk with a "Cookie Received while Shutting Down" error cause to
1896	* its peer.
1897	*/
1898	if (sctp_state(asoc, SHUTDOWN_ACK_SENT)) {
1899	disposition = __sctp_sf_do_9_2_reshutack(net, ep, asoc,
1900	type: SCTP_ST_CHUNK(arg: chunk->chunk_hdr->type),
1901	arg: chunk, commands);
1902	if (SCTP_DISPOSITION_NOMEM == disposition)
1903	goto nomem;
1904
1905	err = sctp_make_op_error(asoc, chunk,
1906	cause_code: SCTP_ERROR_COOKIE_IN_SHUTDOWN,
1907	NULL, paylen: 0, reserve_tail: 0);
1908	if (err)
1909	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY,
1910	obj: SCTP_CHUNK(arg: err));
1911
1912	return SCTP_DISPOSITION_CONSUME;
1913	}
1914
1915	/* For now, stop pending T3-rtx and SACK timers, fail any unsent/unacked
1916	* data. Consider the optional choice of resending of this data.
1917	*/
1918	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_T3_RTX_TIMERS_STOP, obj: SCTP_NULL());
1919	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_STOP,
1920	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_SACK));
1921	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_PURGE_OUTQUEUE, obj: SCTP_NULL());
1922
1923	/* Stop pending T4-rto timer, teardown ASCONF queue, ASCONF-ACK queue
1924	* and ASCONF-ACK cache.
1925	*/
1926	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_STOP,
1927	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T4_RTO));
1928	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_PURGE_ASCONF_QUEUE, obj: SCTP_NULL());
1929
1930	/* Update the content of current association. */
1931	if (sctp_sf_do_assoc_update(asoc: (struct sctp_association *)asoc, new: new_asoc, cmds: commands))
1932	goto nomem;
1933
1934	repl = sctp_make_cookie_ack(asoc, chunk);
1935	if (!repl)
1936	goto nomem;
1937
1938	/* Report association restart to upper layer. */
1939	ev = sctp_ulpevent_make_assoc_change(asoc, flags: 0, state: SCTP_RESTART, error: 0,
1940	outbound: asoc->c.sinit_num_ostreams,
1941	inbound: asoc->c.sinit_max_instreams,
1942	NULL, GFP_ATOMIC);
1943	if (!ev)
1944	goto nomem_ev;
1945
1946	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_EVENT_ULP, obj: SCTP_ULPEVENT(arg: ev));
1947	if ((sctp_state(asoc, SHUTDOWN_PENDING) ||
1948	sctp_state(asoc, SHUTDOWN_SENT)) &&
1949	(sctp_sstate(asoc->base.sk, CLOSING) ||
1950	sock_flag(sk: asoc->base.sk, flag: SOCK_DEAD))) {
1951	/* If the socket has been closed by user, don't
1952	* transition to ESTABLISHED. Instead trigger SHUTDOWN
1953	* bundled with COOKIE_ACK.
1954	*/
1955	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: repl));
1956	return sctp_sf_do_9_2_start_shutdown(net, ep, asoc,
1957	SCTP_ST_CHUNK(arg: 0), repl,
1958	commands);
1959	} else {
1960	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_NEW_STATE,
1961	obj: SCTP_STATE(arg: SCTP_STATE_ESTABLISHED));
1962	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: repl));
1963	}
1964	return SCTP_DISPOSITION_CONSUME;
1965
1966	nomem_ev:
1967	sctp_chunk_free(repl);
1968	nomem:
1969	return SCTP_DISPOSITION_NOMEM;
1970	}
1971
1972	/* Unexpected COOKIE-ECHO handler for setup collision (Table 2, action 'B')
1973	*
1974	* Section 5.2.4
1975	* B) In this case, both sides may be attempting to start an association
1976	* at about the same time but the peer endpoint started its INIT
1977	* after responding to the local endpoint's INIT
1978	*/
1979	/* This case represents an initialization collision. */
1980	static enum sctp_disposition sctp_sf_do_dupcook_b(
1981	struct net *net,
1982	const struct sctp_endpoint *ep,
1983	const struct sctp_association *asoc,
1984	struct sctp_chunk *chunk,
1985	struct sctp_cmd_seq *commands,
1986	struct sctp_association *new_asoc)
1987	{
1988	struct sctp_init_chunk *peer_init;
1989	struct sctp_chunk *repl;
1990
1991	/* new_asoc is a brand-new association, so these are not yet
1992	* side effects--it is safe to run them here.
1993	*/
1994	peer_init = (struct sctp_init_chunk *)(chunk->subh.cookie_hdr + 1);
1995	if (!sctp_process_init(new_asoc, chunk, peer: sctp_source(chunk), init: peer_init,
1996	GFP_ATOMIC))
1997	goto nomem;
1998
1999	if (sctp_auth_asoc_init_active_key(asoc: new_asoc, GFP_ATOMIC))
2000	goto nomem;
2001
2002	if (!sctp_auth_chunk_verify(net, chunk, asoc: new_asoc))
2003	return SCTP_DISPOSITION_DISCARD;
2004
2005	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_NEW_STATE,
2006	obj: SCTP_STATE(arg: SCTP_STATE_ESTABLISHED));
2007	if (asoc->state < SCTP_STATE_ESTABLISHED)
2008	SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
2009	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_HB_TIMERS_START, obj: SCTP_NULL());
2010
2011	/* Update the content of current association. */
2012	if (sctp_sf_do_assoc_update(asoc: (struct sctp_association *)asoc, new: new_asoc, cmds: commands))
2013	goto nomem;
2014
2015	repl = sctp_make_cookie_ack(asoc, chunk);
2016	if (!repl)
2017	goto nomem;
2018
2019	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: repl));
2020
2021	/* RFC 2960 5.1 Normal Establishment of an Association
2022	*
2023	* D) IMPLEMENTATION NOTE: An implementation may choose to
2024	* send the Communication Up notification to the SCTP user
2025	* upon reception of a valid COOKIE ECHO chunk.
2026	*
2027	* Sadly, this needs to be implemented as a side-effect, because
2028	* we are not guaranteed to have set the association id of the real
2029	* association and so these notifications need to be delayed until
2030	* the association id is allocated.
2031	*/
2032
2033	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_ASSOC_CHANGE, obj: SCTP_U8(arg: SCTP_COMM_UP));
2034
2035	/* Sockets API Draft Section 5.3.1.6
2036	* When a peer sends a Adaptation Layer Indication parameter , SCTP
2037	* delivers this notification to inform the application that of the
2038	* peers requested adaptation layer.
2039	*
2040	* This also needs to be done as a side effect for the same reason as
2041	* above.
2042	*/
2043	if (asoc->peer.adaptation_ind)
2044	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_ADAPTATION_IND, obj: SCTP_NULL());
2045
2046	if (!asoc->peer.auth_capable)
2047	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_PEER_NO_AUTH, obj: SCTP_NULL());
2048
2049	return SCTP_DISPOSITION_CONSUME;
2050
2051	nomem:
2052	return SCTP_DISPOSITION_NOMEM;
2053	}
2054
2055	/* Unexpected COOKIE-ECHO handler for setup collision (Table 2, action 'C')
2056	*
2057	* Section 5.2.4
2058	* C) In this case, the local endpoint's cookie has arrived late.
2059	* Before it arrived, the local endpoint sent an INIT and received an
2060	* INIT-ACK and finally sent a COOKIE ECHO with the peer's same tag
2061	* but a new tag of its own.
2062	*/
2063	/* This case represents an initialization collision. */
2064	static enum sctp_disposition sctp_sf_do_dupcook_c(
2065	struct net *net,
2066	const struct sctp_endpoint *ep,
2067	const struct sctp_association *asoc,
2068	struct sctp_chunk *chunk,
2069	struct sctp_cmd_seq *commands,
2070	struct sctp_association *new_asoc)
2071	{
2072	/* The cookie should be silently discarded.
2073	* The endpoint SHOULD NOT change states and should leave
2074	* any timers running.
2075	*/
2076	return SCTP_DISPOSITION_DISCARD;
2077	}
2078
2079	/* Unexpected COOKIE-ECHO handler lost chunk (Table 2, action 'D')
2080	*
2081	* Section 5.2.4
2082	*
2083	* D) When both local and remote tags match the endpoint should always
2084	* enter the ESTABLISHED state, if it has not already done so.
2085	*/
2086	/* This case represents an initialization collision. */
2087	static enum sctp_disposition sctp_sf_do_dupcook_d(
2088	struct net *net,
2089	const struct sctp_endpoint *ep,
2090	const struct sctp_association *asoc,
2091	struct sctp_chunk *chunk,
2092	struct sctp_cmd_seq *commands,
2093	struct sctp_association *new_asoc)
2094	{
2095	struct sctp_ulpevent *ev = NULL, *ai_ev = NULL, *auth_ev = NULL;
2096	struct sctp_chunk *repl;
2097
2098	/* Clarification from Implementor's Guide:
2099	* D) When both local and remote tags match the endpoint should
2100	* enter the ESTABLISHED state, if it is in the COOKIE-ECHOED state.
2101	* It should stop any cookie timer that may be running and send
2102	* a COOKIE ACK.
2103	*/
2104
2105	if (!sctp_auth_chunk_verify(net, chunk, asoc))
2106	return SCTP_DISPOSITION_DISCARD;
2107
2108	/* Don't accidentally move back into established state. */
2109	if (asoc->state < SCTP_STATE_ESTABLISHED) {
2110	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_STOP,
2111	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T1_COOKIE));
2112	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_NEW_STATE,
2113	obj: SCTP_STATE(arg: SCTP_STATE_ESTABLISHED));
2114	SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
2115	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_HB_TIMERS_START,
2116	obj: SCTP_NULL());
2117
2118	/* RFC 2960 5.1 Normal Establishment of an Association
2119	*
2120	* D) IMPLEMENTATION NOTE: An implementation may choose
2121	* to send the Communication Up notification to the
2122	* SCTP user upon reception of a valid COOKIE
2123	* ECHO chunk.
2124	*/
2125	ev = sctp_ulpevent_make_assoc_change(asoc, flags: 0,
2126	state: SCTP_COMM_UP, error: 0,
2127	outbound: asoc->c.sinit_num_ostreams,
2128	inbound: asoc->c.sinit_max_instreams,
2129	NULL, GFP_ATOMIC);
2130	if (!ev)
2131	goto nomem;
2132
2133	/* Sockets API Draft Section 5.3.1.6
2134	* When a peer sends a Adaptation Layer Indication parameter,
2135	* SCTP delivers this notification to inform the application
2136	* that of the peers requested adaptation layer.
2137	*/
2138	if (asoc->peer.adaptation_ind) {
2139	ai_ev = sctp_ulpevent_make_adaptation_indication(asoc,
2140	GFP_ATOMIC);
2141	if (!ai_ev)
2142	goto nomem;
2143
2144	}
2145
2146	if (!asoc->peer.auth_capable) {
2147	auth_ev = sctp_ulpevent_make_authkey(asoc, key_id: 0,
2148	indication: SCTP_AUTH_NO_AUTH,
2149	GFP_ATOMIC);
2150	if (!auth_ev)
2151	goto nomem;
2152	}
2153	}
2154
2155	repl = sctp_make_cookie_ack(asoc, chunk);
2156	if (!repl)
2157	goto nomem;
2158
2159	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: repl));
2160
2161	if (ev)
2162	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_EVENT_ULP,
2163	obj: SCTP_ULPEVENT(arg: ev));
2164	if (ai_ev)
2165	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_EVENT_ULP,
2166	obj: SCTP_ULPEVENT(arg: ai_ev));
2167	if (auth_ev)
2168	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_EVENT_ULP,
2169	obj: SCTP_ULPEVENT(arg: auth_ev));
2170
2171	return SCTP_DISPOSITION_CONSUME;
2172
2173	nomem:
2174	if (auth_ev)
2175	sctp_ulpevent_free(auth_ev);
2176	if (ai_ev)
2177	sctp_ulpevent_free(ai_ev);
2178	if (ev)
2179	sctp_ulpevent_free(ev);
2180	return SCTP_DISPOSITION_NOMEM;
2181	}
2182
2183	/*
2184	* Handle a duplicate COOKIE-ECHO. This usually means a cookie-carrying
2185	* chunk was retransmitted and then delayed in the network.
2186	*
2187	* Section: 5.2.4 Handle a COOKIE ECHO when a TCB exists
2188	*
2189	* Verification Tag: None. Do cookie validation.
2190	*
2191	* Inputs
2192	* (endpoint, asoc, chunk)
2193	*
2194	* Outputs
2195	* (asoc, reply_msg, msg_up, timers, counters)
2196	*
2197	* The return value is the disposition of the chunk.
2198	*/
2199	enum sctp_disposition sctp_sf_do_5_2_4_dupcook(
2200	struct net *net,
2201	const struct sctp_endpoint *ep,
2202	const struct sctp_association *asoc,
2203	const union sctp_subtype type,
2204	void *arg,
2205	struct sctp_cmd_seq *commands)
2206	{
2207	struct sctp_association *new_asoc;
2208	struct sctp_chunk *chunk = arg;
2209	enum sctp_disposition retval;
2210	struct sctp_chunk *err_chk_p;
2211	int error = 0;
2212	char action;
2213
2214	/* Make sure that the chunk has a valid length from the protocol
2215	* perspective. In this case check to make sure we have at least
2216	* enough for the chunk header. Cookie length verification is
2217	* done later.
2218	*/
2219	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_chunkhdr))) {
2220	if (!sctp_vtag_verify(chunk, asoc))
2221	asoc = NULL;
2222	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, commands);
2223	}
2224
2225	/* "Decode" the chunk. We have no optional parameters so we
2226	* are in good shape.
2227	*/
2228	chunk->subh.cookie_hdr = (struct sctp_signed_cookie *)chunk->skb->data;
2229	if (!pskb_pull(skb: chunk->skb, ntohs(chunk->chunk_hdr->length) -
2230	sizeof(struct sctp_chunkhdr)))
2231	goto nomem;
2232
2233	/* In RFC 2960 5.2.4 3, if both Verification Tags in the State Cookie
2234	* of a duplicate COOKIE ECHO match the Verification Tags of the
2235	* current association, consider the State Cookie valid even if
2236	* the lifespan is exceeded.
2237	*/
2238	new_asoc = sctp_unpack_cookie(ep, asoc, chunk, GFP_ATOMIC, err: &error,
2239	err_chk_p: &err_chk_p);
2240
2241	/* FIXME:
2242	* If the re-build failed, what is the proper error path
2243	* from here?
2244	*
2245	* [We should abort the association. --piggy]
2246	*/
2247	if (!new_asoc) {
2248	/* FIXME: Several errors are possible. A bad cookie should
2249	* be silently discarded, but think about logging it too.
2250	*/
2251	switch (error) {
2252	case -SCTP_IERROR_NOMEM:
2253	goto nomem;
2254
2255	case -SCTP_IERROR_STALE_COOKIE:
2256	sctp_send_stale_cookie_err(net, ep, asoc, chunk, commands,
2257	err_chunk: err_chk_p);
2258	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2259	case -SCTP_IERROR_BAD_SIG:
2260	default:
2261	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2262	}
2263	}
2264
2265	/* Set temp so that it won't be added into hashtable */
2266	new_asoc->temp = 1;
2267
2268	/* Compare the tie_tag in cookie with the verification tag of
2269	* current association.
2270	*/
2271	action = sctp_tietags_compare(new_asoc, asoc);
2272
2273	/* In cases C and E the association doesn't enter the ESTABLISHED
2274	* state, so there is no need to call security_sctp_assoc_request().
2275	*/
2276	switch (action) {
2277	case 'A': /* Association restart. */
2278	case 'B': /* Collision case B. */
2279	case 'D': /* Collision case D. */
2280	/* Update socket peer label if first association. */
2281	if (security_sctp_assoc_request(asoc: (struct sctp_association *)asoc,
2282	skb: chunk->head_skb ?: chunk->skb)) {
2283	sctp_association_free(new_asoc);
2284	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2285	}
2286	break;
2287	}
2288
2289	switch (action) {
2290	case 'A': /* Association restart. */
2291	retval = sctp_sf_do_dupcook_a(net, ep, asoc, chunk, commands,
2292	new_asoc);
2293	break;
2294
2295	case 'B': /* Collision case B. */
2296	retval = sctp_sf_do_dupcook_b(net, ep, asoc, chunk, commands,
2297	new_asoc);
2298	break;
2299
2300	case 'C': /* Collision case C. */
2301	retval = sctp_sf_do_dupcook_c(net, ep, asoc, chunk, commands,
2302	new_asoc);
2303	break;
2304
2305	case 'D': /* Collision case D. */
2306	retval = sctp_sf_do_dupcook_d(net, ep, asoc, chunk, commands,
2307	new_asoc);
2308	break;
2309
2310	default: /* Discard packet for all others. */
2311	retval = sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2312	break;
2313	}
2314
2315	/* Delete the temporary new association. */
2316	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SET_ASOC, obj: SCTP_ASOC(arg: new_asoc));
2317	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_DELETE_TCB, obj: SCTP_NULL());
2318
2319	/* Restore association pointer to provide SCTP command interpreter
2320	* with a valid context in case it needs to manipulate
2321	* the queues */
2322	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SET_ASOC,
2323	obj: SCTP_ASOC(arg: (struct sctp_association *)asoc));
2324
2325	return retval;
2326
2327	nomem:
2328	return SCTP_DISPOSITION_NOMEM;
2329	}
2330
2331	/*
2332	* Process an ABORT. (SHUTDOWN-PENDING state)
2333	*
2334	* See sctp_sf_do_9_1_abort().
2335	*/
2336	enum sctp_disposition sctp_sf_shutdown_pending_abort(
2337	struct net *net,
2338	const struct sctp_endpoint *ep,
2339	const struct sctp_association *asoc,
2340	const union sctp_subtype type,
2341	void *arg,
2342	struct sctp_cmd_seq *commands)
2343	{
2344	struct sctp_chunk *chunk = arg;
2345
2346	if (!sctp_vtag_verify_either(chunk, asoc))
2347	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2348
2349	/* Make sure that the ABORT chunk has a valid length.
2350	* Since this is an ABORT chunk, we have to discard it
2351	* because of the following text:
2352	* RFC 2960, Section 3.3.7
2353	* If an endpoint receives an ABORT with a format error or for an
2354	* association that doesn't exist, it MUST silently discard it.
2355	* Because the length is "invalid", we can't really discard just
2356	* as we do not know its true length. So, to be safe, discard the
2357	* packet.
2358	*/
2359	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_abort_chunk)))
2360	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2361
2362	/* ADD-IP: Special case for ABORT chunks
2363	* F4) One special consideration is that ABORT Chunks arriving
2364	* destined to the IP address being deleted MUST be
2365	* ignored (see Section 5.3.1 for further details).
2366	*/
2367	if (SCTP_ADDR_DEL ==
2368	sctp_bind_addr_state(bp: &asoc->base.bind_addr, addr: &chunk->dest))
2369	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2370
2371	if (!sctp_err_chunk_valid(chunk))
2372	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2373
2374	return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
2375	}
2376
2377	/*
2378	* Process an ABORT. (SHUTDOWN-SENT state)
2379	*
2380	* See sctp_sf_do_9_1_abort().
2381	*/
2382	enum sctp_disposition sctp_sf_shutdown_sent_abort(
2383	struct net *net,
2384	const struct sctp_endpoint *ep,
2385	const struct sctp_association *asoc,
2386	const union sctp_subtype type,
2387	void *arg,
2388	struct sctp_cmd_seq *commands)
2389	{
2390	struct sctp_chunk *chunk = arg;
2391
2392	if (!sctp_vtag_verify_either(chunk, asoc))
2393	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2394
2395	/* Make sure that the ABORT chunk has a valid length.
2396	* Since this is an ABORT chunk, we have to discard it
2397	* because of the following text:
2398	* RFC 2960, Section 3.3.7
2399	* If an endpoint receives an ABORT with a format error or for an
2400	* association that doesn't exist, it MUST silently discard it.
2401	* Because the length is "invalid", we can't really discard just
2402	* as we do not know its true length. So, to be safe, discard the
2403	* packet.
2404	*/
2405	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_abort_chunk)))
2406	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2407
2408	/* ADD-IP: Special case for ABORT chunks
2409	* F4) One special consideration is that ABORT Chunks arriving
2410	* destined to the IP address being deleted MUST be
2411	* ignored (see Section 5.3.1 for further details).
2412	*/
2413	if (SCTP_ADDR_DEL ==
2414	sctp_bind_addr_state(bp: &asoc->base.bind_addr, addr: &chunk->dest))
2415	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2416
2417	if (!sctp_err_chunk_valid(chunk))
2418	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2419
2420	/* Stop the T2-shutdown timer. */
2421	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_STOP,
2422	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
2423
2424	/* Stop the T5-shutdown guard timer. */
2425	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_STOP,
2426	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
2427
2428	return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
2429	}
2430
2431	/*
2432	* Process an ABORT. (SHUTDOWN-ACK-SENT state)
2433	*
2434	* See sctp_sf_do_9_1_abort().
2435	*/
2436	enum sctp_disposition sctp_sf_shutdown_ack_sent_abort(
2437	struct net *net,
2438	const struct sctp_endpoint *ep,
2439	const struct sctp_association *asoc,
2440	const union sctp_subtype type,
2441	void *arg,
2442	struct sctp_cmd_seq *commands)
2443	{
2444	/* The same T2 timer, so we should be able to use
2445	* common function with the SHUTDOWN-SENT state.
2446	*/
2447	return sctp_sf_shutdown_sent_abort(net, ep, asoc, type, arg, commands);
2448	}
2449
2450	/*
2451	* Handle an Error received in COOKIE_ECHOED state.
2452	*
2453	* Only handle the error type of stale COOKIE Error, the other errors will
2454	* be ignored.
2455	*
2456	* Inputs
2457	* (endpoint, asoc, chunk)
2458	*
2459	* Outputs
2460	* (asoc, reply_msg, msg_up, timers, counters)
2461	*
2462	* The return value is the disposition of the chunk.
2463	*/
2464	enum sctp_disposition sctp_sf_cookie_echoed_err(
2465	struct net *net,
2466	const struct sctp_endpoint *ep,
2467	const struct sctp_association *asoc,
2468	const union sctp_subtype type,
2469	void *arg,
2470	struct sctp_cmd_seq *commands)
2471	{
2472	struct sctp_chunk *chunk = arg;
2473	struct sctp_errhdr *err;
2474
2475	if (!sctp_vtag_verify(chunk, asoc))
2476	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2477
2478	/* Make sure that the ERROR chunk has a valid length.
2479	* The parameter walking depends on this as well.
2480	*/
2481	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_operr_chunk)))
2482	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2483	commands);
2484
2485	/* Process the error here */
2486	/* FUTURE FIXME: When PR-SCTP related and other optional
2487	* parms are emitted, this will have to change to handle multiple
2488	* errors.
2489	*/
2490	sctp_walk_errors(err, chunk->chunk_hdr) {
2491	if (SCTP_ERROR_STALE_COOKIE == err->cause)
2492	return sctp_sf_do_5_2_6_stale(net, ep, asoc, type,
2493	arg, commands);
2494	}
2495
2496	/* It is possible to have malformed error causes, and that
2497	* will cause us to end the walk early. However, since
2498	* we are discarding the packet, there should be no adverse
2499	* affects.
2500	*/
2501	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2502	}
2503
2504	/*
2505	* Handle a Stale COOKIE Error
2506	*
2507	* Section: 5.2.6 Handle Stale COOKIE Error
2508	* If the association is in the COOKIE-ECHOED state, the endpoint may elect
2509	* one of the following three alternatives.
2510	* ...
2511	* 3) Send a new INIT chunk to the endpoint, adding a Cookie
2512	* Preservative parameter requesting an extension to the lifetime of
2513	* the State Cookie. When calculating the time extension, an
2514	* implementation SHOULD use the RTT information measured based on the
2515	* previous COOKIE ECHO / ERROR exchange, and should add no more
2516	* than 1 second beyond the measured RTT, due to long State Cookie
2517	* lifetimes making the endpoint more subject to a replay attack.
2518	*
2519	* Verification Tag: Not explicit, but safe to ignore.
2520	*
2521	* Inputs
2522	* (endpoint, asoc, chunk)
2523	*
2524	* Outputs
2525	* (asoc, reply_msg, msg_up, timers, counters)
2526	*
2527	* The return value is the disposition of the chunk.
2528	*/
2529	static enum sctp_disposition sctp_sf_do_5_2_6_stale(
2530	struct net *net,
2531	const struct sctp_endpoint *ep,
2532	const struct sctp_association *asoc,
2533	const union sctp_subtype type,
2534	void *arg,
2535	struct sctp_cmd_seq *commands)
2536	{
2537	int attempts = asoc->init_err_counter + 1;
2538	struct sctp_chunk *chunk = arg, *reply;
2539	struct sctp_cookie_preserve_param bht;
2540	struct sctp_bind_addr *bp;
2541	struct sctp_errhdr *err;
2542	u32 stale;
2543
2544	if (attempts > asoc->max_init_attempts) {
2545	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SET_SK_ERR,
2546	obj: SCTP_ERROR(ETIMEDOUT));
2547	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_INIT_FAILED,
2548	obj: SCTP_PERR(arg: SCTP_ERROR_STALE_COOKIE));
2549	return SCTP_DISPOSITION_DELETE_TCB;
2550	}
2551
2552	err = (struct sctp_errhdr *)(chunk->skb->data);
2553
2554	/* When calculating the time extension, an implementation
2555	* SHOULD use the RTT information measured based on the
2556	* previous COOKIE ECHO / ERROR exchange, and should add no
2557	* more than 1 second beyond the measured RTT, due to long
2558	* State Cookie lifetimes making the endpoint more subject to
2559	* a replay attack.
2560	* Measure of Staleness's unit is usec. (1/1000000 sec)
2561	* Suggested Cookie Life-span Increment's unit is msec.
2562	* (1/1000 sec)
2563	* In general, if you use the suggested cookie life, the value
2564	* found in the field of measure of staleness should be doubled
2565	* to give ample time to retransmit the new cookie and thus
2566	* yield a higher probability of success on the reattempt.
2567	*/
2568	stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err)));
2569	stale = (stale * 2) / 1000;
2570
2571	bht.param_hdr.type = SCTP_PARAM_COOKIE_PRESERVATIVE;
2572	bht.param_hdr.length = htons(sizeof(bht));
2573	bht.lifespan_increment = htonl(stale);
2574
2575	/* Build that new INIT chunk. */
2576	bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
2577	reply = sctp_make_init(asoc, bp, GFP_ATOMIC, vparam_len: sizeof(bht));
2578	if (!reply)
2579	goto nomem;
2580
2581	sctp_addto_chunk(reply, len: sizeof(bht), data: &bht);
2582
2583	/* Clear peer's init_tag cached in assoc as we are sending a new INIT */
2584	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_CLEAR_INIT_TAG, obj: SCTP_NULL());
2585
2586	/* Stop pending T3-rtx and heartbeat timers */
2587	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_T3_RTX_TIMERS_STOP, obj: SCTP_NULL());
2588	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_HB_TIMERS_STOP, obj: SCTP_NULL());
2589
2590	/* Delete non-primary peer ip addresses since we are transitioning
2591	* back to the COOKIE-WAIT state
2592	*/
2593	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_DEL_NON_PRIMARY, obj: SCTP_NULL());
2594
2595	/* If we've sent any data bundled with COOKIE-ECHO we will need to
2596	* resend
2597	*/
2598	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_T1_RETRAN,
2599	obj: SCTP_TRANSPORT(arg: asoc->peer.primary_path));
2600
2601	/* Cast away the const modifier, as we want to just
2602	* rerun it through as a sideffect.
2603	*/
2604	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_INIT_COUNTER_INC, obj: SCTP_NULL());
2605
2606	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_STOP,
2607	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T1_COOKIE));
2608	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_NEW_STATE,
2609	obj: SCTP_STATE(arg: SCTP_STATE_COOKIE_WAIT));
2610	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_START,
2611	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T1_INIT));
2612
2613	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: reply));
2614
2615	return SCTP_DISPOSITION_CONSUME;
2616
2617	nomem:
2618	return SCTP_DISPOSITION_NOMEM;
2619	}
2620
2621	/*
2622	* Process an ABORT.
2623	*
2624	* Section: 9.1
2625	* After checking the Verification Tag, the receiving endpoint shall
2626	* remove the association from its record, and shall report the
2627	* termination to its upper layer.
2628	*
2629	* Verification Tag: 8.5.1 Exceptions in Verification Tag Rules
2630	* B) Rules for packet carrying ABORT:
2631	*
2632	* - The endpoint shall always fill in the Verification Tag field of the
2633	* outbound packet with the destination endpoint's tag value if it
2634	* is known.
2635	*
2636	* - If the ABORT is sent in response to an OOTB packet, the endpoint
2637	* MUST follow the procedure described in Section 8.4.
2638	*
2639	* - The receiver MUST accept the packet if the Verification Tag
2640	* matches either its own tag, OR the tag of its peer. Otherwise, the
2641	* receiver MUST silently discard the packet and take no further
2642	* action.
2643	*
2644	* Inputs
2645	* (endpoint, asoc, chunk)
2646	*
2647	* Outputs
2648	* (asoc, reply_msg, msg_up, timers, counters)
2649	*
2650	* The return value is the disposition of the chunk.
2651	*/
2652	enum sctp_disposition sctp_sf_do_9_1_abort(
2653	struct net *net,
2654	const struct sctp_endpoint *ep,
2655	const struct sctp_association *asoc,
2656	const union sctp_subtype type,
2657	void *arg,
2658	struct sctp_cmd_seq *commands)
2659	{
2660	struct sctp_chunk *chunk = arg;
2661
2662	if (!sctp_vtag_verify_either(chunk, asoc))
2663	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2664
2665	/* Make sure that the ABORT chunk has a valid length.
2666	* Since this is an ABORT chunk, we have to discard it
2667	* because of the following text:
2668	* RFC 2960, Section 3.3.7
2669	* If an endpoint receives an ABORT with a format error or for an
2670	* association that doesn't exist, it MUST silently discard it.
2671	* Because the length is "invalid", we can't really discard just
2672	* as we do not know its true length. So, to be safe, discard the
2673	* packet.
2674	*/
2675	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_abort_chunk)))
2676	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2677
2678	/* ADD-IP: Special case for ABORT chunks
2679	* F4) One special consideration is that ABORT Chunks arriving
2680	* destined to the IP address being deleted MUST be
2681	* ignored (see Section 5.3.1 for further details).
2682	*/
2683	if (SCTP_ADDR_DEL ==
2684	sctp_bind_addr_state(bp: &asoc->base.bind_addr, addr: &chunk->dest))
2685	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2686
2687	if (!sctp_err_chunk_valid(chunk))
2688	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2689
2690	return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
2691	}
2692
2693	static enum sctp_disposition __sctp_sf_do_9_1_abort(
2694	struct net *net,
2695	const struct sctp_endpoint *ep,
2696	const struct sctp_association *asoc,
2697	const union sctp_subtype type,
2698	void *arg,
2699	struct sctp_cmd_seq *commands)
2700	{
2701	__be16 error = SCTP_ERROR_NO_ERROR;
2702	struct sctp_chunk *chunk = arg;
2703	unsigned int len;
2704
2705	/* See if we have an error cause code in the chunk. */
2706	len = ntohs(chunk->chunk_hdr->length);
2707	if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
2708	error = ((struct sctp_errhdr *)chunk->skb->data)->cause;
2709
2710	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SET_SK_ERR, obj: SCTP_ERROR(ECONNRESET));
2711	/* ASSOC_FAILED will DELETE_TCB. */
2712	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_ASSOC_FAILED, obj: SCTP_PERR(arg: error));
2713	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
2714	SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
2715
2716	return SCTP_DISPOSITION_ABORT;
2717	}
2718
2719	/*
2720	* Process an ABORT. (COOKIE-WAIT state)
2721	*
2722	* See sctp_sf_do_9_1_abort() above.
2723	*/
2724	enum sctp_disposition sctp_sf_cookie_wait_abort(
2725	struct net *net,
2726	const struct sctp_endpoint *ep,
2727	const struct sctp_association *asoc,
2728	const union sctp_subtype type,
2729	void *arg,
2730	struct sctp_cmd_seq *commands)
2731	{
2732	__be16 error = SCTP_ERROR_NO_ERROR;
2733	struct sctp_chunk *chunk = arg;
2734	unsigned int len;
2735
2736	if (!sctp_vtag_verify_either(chunk, asoc))
2737	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2738
2739	/* Make sure that the ABORT chunk has a valid length.
2740	* Since this is an ABORT chunk, we have to discard it
2741	* because of the following text:
2742	* RFC 2960, Section 3.3.7
2743	* If an endpoint receives an ABORT with a format error or for an
2744	* association that doesn't exist, it MUST silently discard it.
2745	* Because the length is "invalid", we can't really discard just
2746	* as we do not know its true length. So, to be safe, discard the
2747	* packet.
2748	*/
2749	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_abort_chunk)))
2750	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2751
2752	/* See if we have an error cause code in the chunk. */
2753	len = ntohs(chunk->chunk_hdr->length);
2754	if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
2755	error = ((struct sctp_errhdr *)chunk->skb->data)->cause;
2756
2757	return sctp_stop_t1_and_abort(net, commands, error, ECONNREFUSED, asoc,
2758	transport: chunk->transport);
2759	}
2760
2761	/*
2762	* Process an incoming ICMP as an ABORT. (COOKIE-WAIT state)
2763	*/
2764	enum sctp_disposition sctp_sf_cookie_wait_icmp_abort(
2765	struct net *net,
2766	const struct sctp_endpoint *ep,
2767	const struct sctp_association *asoc,
2768	const union sctp_subtype type,
2769	void *arg,
2770	struct sctp_cmd_seq *commands)
2771	{
2772	return sctp_stop_t1_and_abort(net, commands, error: SCTP_ERROR_NO_ERROR,
2773	ENOPROTOOPT, asoc,
2774	transport: (struct sctp_transport *)arg);
2775	}
2776
2777	/*
2778	* Process an ABORT. (COOKIE-ECHOED state)
2779	*/
2780	enum sctp_disposition sctp_sf_cookie_echoed_abort(
2781	struct net *net,
2782	const struct sctp_endpoint *ep,
2783	const struct sctp_association *asoc,
2784	const union sctp_subtype type,
2785	void *arg,
2786	struct sctp_cmd_seq *commands)
2787	{
2788	/* There is a single T1 timer, so we should be able to use
2789	* common function with the COOKIE-WAIT state.
2790	*/
2791	return sctp_sf_cookie_wait_abort(net, ep, asoc, type, arg, commands);
2792	}
2793
2794	/*
2795	* Stop T1 timer and abort association with "INIT failed".
2796	*
2797	* This is common code called by several sctp_sf_*_abort() functions above.
2798	*/
2799	static enum sctp_disposition sctp_stop_t1_and_abort(
2800	struct net *net,
2801	struct sctp_cmd_seq *commands,
2802	__be16 error, int sk_err,
2803	const struct sctp_association *asoc,
2804	struct sctp_transport *transport)
2805	{
2806	pr_debug("%s: ABORT received (INIT)\n", __func__);
2807
2808	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_NEW_STATE,
2809	obj: SCTP_STATE(arg: SCTP_STATE_CLOSED));
2810	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
2811	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_STOP,
2812	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T1_INIT));
2813	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SET_SK_ERR, obj: SCTP_ERROR(arg: sk_err));
2814	/* CMD_INIT_FAILED will DELETE_TCB. */
2815	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_INIT_FAILED,
2816	obj: SCTP_PERR(arg: error));
2817
2818	return SCTP_DISPOSITION_ABORT;
2819	}
2820
2821	/*
2822	* sctp_sf_do_9_2_shut
2823	*
2824	* Section: 9.2
2825	* Upon the reception of the SHUTDOWN, the peer endpoint shall
2826	* - enter the SHUTDOWN-RECEIVED state,
2827	*
2828	* - stop accepting new data from its SCTP user
2829	*
2830	* - verify, by checking the Cumulative TSN Ack field of the chunk,
2831	* that all its outstanding DATA chunks have been received by the
2832	* SHUTDOWN sender.
2833	*
2834	* Once an endpoint as reached the SHUTDOWN-RECEIVED state it MUST NOT
2835	* send a SHUTDOWN in response to a ULP request. And should discard
2836	* subsequent SHUTDOWN chunks.
2837	*
2838	* If there are still outstanding DATA chunks left, the SHUTDOWN
2839	* receiver shall continue to follow normal data transmission
2840	* procedures defined in Section 6 until all outstanding DATA chunks
2841	* are acknowledged; however, the SHUTDOWN receiver MUST NOT accept
2842	* new data from its SCTP user.
2843	*
2844	* Verification Tag: 8.5 Verification Tag [Normal verification]
2845	*
2846	* Inputs
2847	* (endpoint, asoc, chunk)
2848	*
2849	* Outputs
2850	* (asoc, reply_msg, msg_up, timers, counters)
2851	*
2852	* The return value is the disposition of the chunk.
2853	*/
2854	enum sctp_disposition sctp_sf_do_9_2_shutdown(
2855	struct net *net,
2856	const struct sctp_endpoint *ep,
2857	const struct sctp_association *asoc,
2858	const union sctp_subtype type,
2859	void *arg,
2860	struct sctp_cmd_seq *commands)
2861	{
2862	enum sctp_disposition disposition;
2863	struct sctp_chunk *chunk = arg;
2864	struct sctp_shutdownhdr *sdh;
2865	struct sctp_ulpevent *ev;
2866	__u32 ctsn;
2867
2868	if (!sctp_vtag_verify(chunk, asoc))
2869	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2870
2871	/* Make sure that the SHUTDOWN chunk has a valid length. */
2872	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_shutdown_chunk)))
2873	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2874	commands);
2875
2876	/* Convert the elaborate header. */
2877	sdh = (struct sctp_shutdownhdr *)chunk->skb->data;
2878	skb_pull(skb: chunk->skb, len: sizeof(*sdh));
2879	chunk->subh.shutdown_hdr = sdh;
2880	ctsn = ntohl(sdh->cum_tsn_ack);
2881
2882	if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
2883	pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn,
2884	asoc->ctsn_ack_point);
2885
2886	return SCTP_DISPOSITION_DISCARD;
2887	}
2888
2889	/* If Cumulative TSN Ack beyond the max tsn currently
2890	* send, terminating the association and respond to the
2891	* sender with an ABORT.
2892	*/
2893	if (!TSN_lt(ctsn, asoc->next_tsn))
2894	return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands);
2895
2896	/* API 5.3.1.5 SCTP_SHUTDOWN_EVENT
2897	* When a peer sends a SHUTDOWN, SCTP delivers this notification to
2898	* inform the application that it should cease sending data.
2899	*/
2900	ev = sctp_ulpevent_make_shutdown_event(asoc, flags: 0, GFP_ATOMIC);
2901	if (!ev) {
2902	disposition = SCTP_DISPOSITION_NOMEM;
2903	goto out;
2904	}
2905	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_EVENT_ULP, obj: SCTP_ULPEVENT(arg: ev));
2906
2907	/* Upon the reception of the SHUTDOWN, the peer endpoint shall
2908	* - enter the SHUTDOWN-RECEIVED state,
2909	* - stop accepting new data from its SCTP user
2910	*
2911	* [This is implicit in the new state.]
2912	*/
2913	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_NEW_STATE,
2914	obj: SCTP_STATE(arg: SCTP_STATE_SHUTDOWN_RECEIVED));
2915	disposition = SCTP_DISPOSITION_CONSUME;
2916
2917	if (sctp_outq_is_empty(&asoc->outqueue)) {
2918	disposition = sctp_sf_do_9_2_shutdown_ack(net, ep, asoc, type,
2919	arg, commands);
2920	}
2921
2922	if (SCTP_DISPOSITION_NOMEM == disposition)
2923	goto out;
2924
2925	/* - verify, by checking the Cumulative TSN Ack field of the
2926	* chunk, that all its outstanding DATA chunks have been
2927	* received by the SHUTDOWN sender.
2928	*/
2929	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_PROCESS_CTSN,
2930	obj: SCTP_BE32(arg: chunk->subh.shutdown_hdr->cum_tsn_ack));
2931
2932	out:
2933	return disposition;
2934	}
2935
2936	/*
2937	* sctp_sf_do_9_2_shut_ctsn
2938	*
2939	* Once an endpoint has reached the SHUTDOWN-RECEIVED state,
2940	* it MUST NOT send a SHUTDOWN in response to a ULP request.
2941	* The Cumulative TSN Ack of the received SHUTDOWN chunk
2942	* MUST be processed.
2943	*/
2944	enum sctp_disposition sctp_sf_do_9_2_shut_ctsn(
2945	struct net *net,
2946	const struct sctp_endpoint *ep,
2947	const struct sctp_association *asoc,
2948	const union sctp_subtype type,
2949	void *arg,
2950	struct sctp_cmd_seq *commands)
2951	{
2952	struct sctp_chunk *chunk = arg;
2953	struct sctp_shutdownhdr *sdh;
2954	__u32 ctsn;
2955
2956	if (!sctp_vtag_verify(chunk, asoc))
2957	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2958
2959	/* Make sure that the SHUTDOWN chunk has a valid length. */
2960	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_shutdown_chunk)))
2961	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
2962	commands);
2963
2964	sdh = (struct sctp_shutdownhdr *)chunk->skb->data;
2965	ctsn = ntohl(sdh->cum_tsn_ack);
2966
2967	if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
2968	pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn,
2969	asoc->ctsn_ack_point);
2970
2971	return SCTP_DISPOSITION_DISCARD;
2972	}
2973
2974	/* If Cumulative TSN Ack beyond the max tsn currently
2975	* send, terminating the association and respond to the
2976	* sender with an ABORT.
2977	*/
2978	if (!TSN_lt(ctsn, asoc->next_tsn))
2979	return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands);
2980
2981	/* verify, by checking the Cumulative TSN Ack field of the
2982	* chunk, that all its outstanding DATA chunks have been
2983	* received by the SHUTDOWN sender.
2984	*/
2985	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_PROCESS_CTSN,
2986	obj: SCTP_BE32(arg: sdh->cum_tsn_ack));
2987
2988	return SCTP_DISPOSITION_CONSUME;
2989	}
2990
2991	/* RFC 2960 9.2
2992	* If an endpoint is in SHUTDOWN-ACK-SENT state and receives an INIT chunk
2993	* (e.g., if the SHUTDOWN COMPLETE was lost) with source and destination
2994	* transport addresses (either in the IP addresses or in the INIT chunk)
2995	* that belong to this association, it should discard the INIT chunk and
2996	* retransmit the SHUTDOWN ACK chunk.
2997	*/
2998	static enum sctp_disposition
2999	__sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep,
3000	const struct sctp_association *asoc,
3001	const union sctp_subtype type, void *arg,
3002	struct sctp_cmd_seq *commands)
3003	{
3004	struct sctp_chunk *chunk = arg;
3005	struct sctp_chunk *reply;
3006
3007	/* Make sure that the chunk has a valid length */
3008	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_chunkhdr)))
3009	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3010	commands);
3011
3012	/* Since we are not going to really process this INIT, there
3013	* is no point in verifying chunk boundaries. Just generate
3014	* the SHUTDOWN ACK.
3015	*/
3016	reply = sctp_make_shutdown_ack(asoc, chunk);
3017	if (NULL == reply)
3018	goto nomem;
3019
3020	/* Set the transport for the SHUTDOWN ACK chunk and the timeout for
3021	* the T2-SHUTDOWN timer.
3022	*/
3023	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SETUP_T2, obj: SCTP_CHUNK(arg: reply));
3024
3025	/* and restart the T2-shutdown timer. */
3026	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_RESTART,
3027	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
3028
3029	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: reply));
3030
3031	return SCTP_DISPOSITION_CONSUME;
3032	nomem:
3033	return SCTP_DISPOSITION_NOMEM;
3034	}
3035
3036	enum sctp_disposition
3037	sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep,
3038	const struct sctp_association *asoc,
3039	const union sctp_subtype type, void *arg,
3040	struct sctp_cmd_seq *commands)
3041	{
3042	struct sctp_chunk *chunk = arg;
3043
3044	if (!chunk->singleton)
3045	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3046
3047	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_init_chunk)))
3048	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3049
3050	if (chunk->sctp_hdr->vtag != 0)
3051	return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
3052
3053	return __sctp_sf_do_9_2_reshutack(net, ep, asoc, type, arg, commands);
3054	}
3055
3056	/*
3057	* sctp_sf_do_ecn_cwr
3058	*
3059	* Section: Appendix A: Explicit Congestion Notification
3060	*
3061	* CWR:
3062	*
3063	* RFC 2481 details a specific bit for a sender to send in the header of
3064	* its next outbound TCP segment to indicate to its peer that it has
3065	* reduced its congestion window. This is termed the CWR bit. For
3066	* SCTP the same indication is made by including the CWR chunk.
3067	* This chunk contains one data element, i.e. the TSN number that
3068	* was sent in the ECNE chunk. This element represents the lowest
3069	* TSN number in the datagram that was originally marked with the
3070	* CE bit.
3071	*
3072	* Verification Tag: 8.5 Verification Tag [Normal verification]
3073	* Inputs
3074	* (endpoint, asoc, chunk)
3075	*
3076	* Outputs
3077	* (asoc, reply_msg, msg_up, timers, counters)
3078	*
3079	* The return value is the disposition of the chunk.
3080	*/
3081	enum sctp_disposition sctp_sf_do_ecn_cwr(struct net *net,
3082	const struct sctp_endpoint *ep,
3083	const struct sctp_association *asoc,
3084	const union sctp_subtype type,
3085	void *arg,
3086	struct sctp_cmd_seq *commands)
3087	{
3088	struct sctp_chunk *chunk = arg;
3089	struct sctp_cwrhdr *cwr;
3090	u32 lowest_tsn;
3091
3092	if (!sctp_vtag_verify(chunk, asoc))
3093	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3094
3095	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_ecne_chunk)))
3096	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3097	commands);
3098
3099	cwr = (struct sctp_cwrhdr *)chunk->skb->data;
3100	skb_pull(skb: chunk->skb, len: sizeof(*cwr));
3101
3102	lowest_tsn = ntohl(cwr->lowest_tsn);
3103
3104	/* Does this CWR ack the last sent congestion notification? */
3105	if (TSN_lte(asoc->last_ecne_tsn, lowest_tsn)) {
3106	/* Stop sending ECNE. */
3107	sctp_add_cmd_sf(seq: commands,
3108	verb: SCTP_CMD_ECN_CWR,
3109	obj: SCTP_U32(arg: lowest_tsn));
3110	}
3111	return SCTP_DISPOSITION_CONSUME;
3112	}
3113
3114	/*
3115	* sctp_sf_do_ecne
3116	*
3117	* Section: Appendix A: Explicit Congestion Notification
3118	*
3119	* ECN-Echo
3120	*
3121	* RFC 2481 details a specific bit for a receiver to send back in its
3122	* TCP acknowledgements to notify the sender of the Congestion
3123	* Experienced (CE) bit having arrived from the network. For SCTP this
3124	* same indication is made by including the ECNE chunk. This chunk
3125	* contains one data element, i.e. the lowest TSN associated with the IP
3126	* datagram marked with the CE bit.....
3127	*
3128	* Verification Tag: 8.5 Verification Tag [Normal verification]
3129	* Inputs
3130	* (endpoint, asoc, chunk)
3131	*
3132	* Outputs
3133	* (asoc, reply_msg, msg_up, timers, counters)
3134	*
3135	* The return value is the disposition of the chunk.
3136	*/
3137	enum sctp_disposition sctp_sf_do_ecne(struct net *net,
3138	const struct sctp_endpoint *ep,
3139	const struct sctp_association *asoc,
3140	const union sctp_subtype type,
3141	void *arg, struct sctp_cmd_seq *commands)
3142	{
3143	struct sctp_chunk *chunk = arg;
3144	struct sctp_ecnehdr *ecne;
3145
3146	if (!sctp_vtag_verify(chunk, asoc))
3147	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3148
3149	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_ecne_chunk)))
3150	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3151	commands);
3152
3153	ecne = (struct sctp_ecnehdr *)chunk->skb->data;
3154	skb_pull(skb: chunk->skb, len: sizeof(*ecne));
3155
3156	/* If this is a newer ECNE than the last CWR packet we sent out */
3157	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_ECN_ECNE,
3158	obj: SCTP_U32(ntohl(ecne->lowest_tsn)));
3159
3160	return SCTP_DISPOSITION_CONSUME;
3161	}
3162
3163	/*
3164	* Section: 6.2 Acknowledgement on Reception of DATA Chunks
3165	*
3166	* The SCTP endpoint MUST always acknowledge the reception of each valid
3167	* DATA chunk.
3168	*
3169	* The guidelines on delayed acknowledgement algorithm specified in
3170	* Section 4.2 of [RFC2581] SHOULD be followed. Specifically, an
3171	* acknowledgement SHOULD be generated for at least every second packet
3172	* (not every second DATA chunk) received, and SHOULD be generated within
3173	* 200 ms of the arrival of any unacknowledged DATA chunk. In some
3174	* situations it may be beneficial for an SCTP transmitter to be more
3175	* conservative than the algorithms detailed in this document allow.
3176	* However, an SCTP transmitter MUST NOT be more aggressive than the
3177	* following algorithms allow.
3178	*
3179	* A SCTP receiver MUST NOT generate more than one SACK for every
3180	* incoming packet, other than to update the offered window as the
3181	* receiving application consumes new data.
3182	*
3183	* Verification Tag: 8.5 Verification Tag [Normal verification]
3184	*
3185	* Inputs
3186	* (endpoint, asoc, chunk)
3187	*
3188	* Outputs
3189	* (asoc, reply_msg, msg_up, timers, counters)
3190	*
3191	* The return value is the disposition of the chunk.
3192	*/
3193	enum sctp_disposition sctp_sf_eat_data_6_2(struct net *net,
3194	const struct sctp_endpoint *ep,
3195	const struct sctp_association *asoc,
3196	const union sctp_subtype type,
3197	void *arg,
3198	struct sctp_cmd_seq *commands)
3199	{
3200	union sctp_arg force = SCTP_NOFORCE();
3201	struct sctp_chunk *chunk = arg;
3202	int error;
3203
3204	if (!sctp_vtag_verify(chunk, asoc)) {
3205	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPORT_BAD_TAG,
3206	obj: SCTP_NULL());
3207	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3208	}
3209
3210	if (!sctp_chunk_length_valid(chunk, required_length: sctp_datachk_len(stream: &asoc->stream)))
3211	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3212	commands);
3213
3214	error = sctp_eat_data(asoc, chunk, commands);
3215	switch (error) {
3216	case SCTP_IERROR_NO_ERROR:
3217	break;
3218	case SCTP_IERROR_HIGH_TSN:
3219	case SCTP_IERROR_BAD_STREAM:
3220	SCTP_INC_STATS(net, SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
3221	goto discard_noforce;
3222	case SCTP_IERROR_DUP_TSN:
3223	case SCTP_IERROR_IGNORE_TSN:
3224	SCTP_INC_STATS(net, SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
3225	goto discard_force;
3226	case SCTP_IERROR_NO_DATA:
3227	return SCTP_DISPOSITION_ABORT;
3228	case SCTP_IERROR_PROTO_VIOLATION:
3229	return sctp_sf_abort_violation(net, ep, asoc, arg: chunk, commands,
3230	payload: (u8 *)chunk->subh.data_hdr,
3231	paylen: sctp_datahdr_len(stream: &asoc->stream));
3232	default:
3233	BUG();
3234	}
3235
3236	if (chunk->chunk_hdr->flags & SCTP_DATA_SACK_IMM)
3237	force = SCTP_FORCE();
3238
3239	if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) {
3240	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_RESTART,
3241	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_AUTOCLOSE));
3242	}
3243
3244	/* If this is the last chunk in a packet, we need to count it
3245	* toward sack generation. Note that we need to SACK every
3246	* OTHER packet containing data chunks, EVEN IF WE DISCARD
3247	* THEM. We elect to NOT generate SACK's if the chunk fails
3248	* the verification tag test.
3249	*
3250	* RFC 2960 6.2 Acknowledgement on Reception of DATA Chunks
3251	*
3252	* The SCTP endpoint MUST always acknowledge the reception of
3253	* each valid DATA chunk.
3254	*
3255	* The guidelines on delayed acknowledgement algorithm
3256	* specified in Section 4.2 of [RFC2581] SHOULD be followed.
3257	* Specifically, an acknowledgement SHOULD be generated for at
3258	* least every second packet (not every second DATA chunk)
3259	* received, and SHOULD be generated within 200 ms of the
3260	* arrival of any unacknowledged DATA chunk. In some
3261	* situations it may be beneficial for an SCTP transmitter to
3262	* be more conservative than the algorithms detailed in this
3263	* document allow. However, an SCTP transmitter MUST NOT be
3264	* more aggressive than the following algorithms allow.
3265	*/
3266	if (chunk->end_of_packet)
3267	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_GEN_SACK, obj: force);
3268
3269	return SCTP_DISPOSITION_CONSUME;
3270
3271	discard_force:
3272	/* RFC 2960 6.2 Acknowledgement on Reception of DATA Chunks
3273	*
3274	* When a packet arrives with duplicate DATA chunk(s) and with
3275	* no new DATA chunk(s), the endpoint MUST immediately send a
3276	* SACK with no delay. If a packet arrives with duplicate
3277	* DATA chunk(s) bundled with new DATA chunks, the endpoint
3278	* MAY immediately send a SACK. Normally receipt of duplicate
3279	* DATA chunks will occur when the original SACK chunk was lost
3280	* and the peer's RTO has expired. The duplicate TSN number(s)
3281	* SHOULD be reported in the SACK as duplicate.
3282	*/
3283	/* In our case, we split the MAY SACK advice up whether or not
3284	* the last chunk is a duplicate.'
3285	*/
3286	if (chunk->end_of_packet)
3287	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_GEN_SACK, obj: SCTP_FORCE());
3288	return SCTP_DISPOSITION_DISCARD;
3289
3290	discard_noforce:
3291	if (chunk->end_of_packet)
3292	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_GEN_SACK, obj: force);
3293
3294	return SCTP_DISPOSITION_DISCARD;
3295	}
3296
3297	/*
3298	* sctp_sf_eat_data_fast_4_4
3299	*
3300	* Section: 4 (4)
3301	* (4) In SHUTDOWN-SENT state the endpoint MUST acknowledge any received
3302	* DATA chunks without delay.
3303	*
3304	* Verification Tag: 8.5 Verification Tag [Normal verification]
3305	* Inputs
3306	* (endpoint, asoc, chunk)
3307	*
3308	* Outputs
3309	* (asoc, reply_msg, msg_up, timers, counters)
3310	*
3311	* The return value is the disposition of the chunk.
3312	*/
3313	enum sctp_disposition sctp_sf_eat_data_fast_4_4(
3314	struct net *net,
3315	const struct sctp_endpoint *ep,
3316	const struct sctp_association *asoc,
3317	const union sctp_subtype type,
3318	void *arg,
3319	struct sctp_cmd_seq *commands)
3320	{
3321	struct sctp_chunk *chunk = arg;
3322	int error;
3323
3324	if (!sctp_vtag_verify(chunk, asoc)) {
3325	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPORT_BAD_TAG,
3326	obj: SCTP_NULL());
3327	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3328	}
3329
3330	if (!sctp_chunk_length_valid(chunk, required_length: sctp_datachk_len(stream: &asoc->stream)))
3331	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3332	commands);
3333
3334	error = sctp_eat_data(asoc, chunk, commands);
3335	switch (error) {
3336	case SCTP_IERROR_NO_ERROR:
3337	case SCTP_IERROR_HIGH_TSN:
3338	case SCTP_IERROR_DUP_TSN:
3339	case SCTP_IERROR_IGNORE_TSN:
3340	case SCTP_IERROR_BAD_STREAM:
3341	break;
3342	case SCTP_IERROR_NO_DATA:
3343	return SCTP_DISPOSITION_ABORT;
3344	case SCTP_IERROR_PROTO_VIOLATION:
3345	return sctp_sf_abort_violation(net, ep, asoc, arg: chunk, commands,
3346	payload: (u8 *)chunk->subh.data_hdr,
3347	paylen: sctp_datahdr_len(stream: &asoc->stream));
3348	default:
3349	BUG();
3350	}
3351
3352	/* Go a head and force a SACK, since we are shutting down. */
3353
3354	/* Implementor's Guide.
3355	*
3356	* While in SHUTDOWN-SENT state, the SHUTDOWN sender MUST immediately
3357	* respond to each received packet containing one or more DATA chunk(s)
3358	* with a SACK, a SHUTDOWN chunk, and restart the T2-shutdown timer
3359	*/
3360	if (chunk->end_of_packet) {
3361	/* We must delay the chunk creation since the cumulative
3362	* TSN has not been updated yet.
3363	*/
3364	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_GEN_SHUTDOWN, obj: SCTP_NULL());
3365	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_GEN_SACK, obj: SCTP_FORCE());
3366	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_RESTART,
3367	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
3368	}
3369
3370	return SCTP_DISPOSITION_CONSUME;
3371	}
3372
3373	/*
3374	* Section: 6.2 Processing a Received SACK
3375	* D) Any time a SACK arrives, the endpoint performs the following:
3376	*
3377	* i) If Cumulative TSN Ack is less than the Cumulative TSN Ack Point,
3378	* then drop the SACK. Since Cumulative TSN Ack is monotonically
3379	* increasing, a SACK whose Cumulative TSN Ack is less than the
3380	* Cumulative TSN Ack Point indicates an out-of-order SACK.
3381	*
3382	* ii) Set rwnd equal to the newly received a_rwnd minus the number
3383	* of bytes still outstanding after processing the Cumulative TSN Ack
3384	* and the Gap Ack Blocks.
3385	*
3386	* iii) If the SACK is missing a TSN that was previously
3387	* acknowledged via a Gap Ack Block (e.g., the data receiver
3388	* reneged on the data), then mark the corresponding DATA chunk
3389	* as available for retransmit: Mark it as missing for fast
3390	* retransmit as described in Section 7.2.4 and if no retransmit
3391	* timer is running for the destination address to which the DATA
3392	* chunk was originally transmitted, then T3-rtx is started for
3393	* that destination address.
3394	*
3395	* Verification Tag: 8.5 Verification Tag [Normal verification]
3396	*
3397	* Inputs
3398	* (endpoint, asoc, chunk)
3399	*
3400	* Outputs
3401	* (asoc, reply_msg, msg_up, timers, counters)
3402	*
3403	* The return value is the disposition of the chunk.
3404	*/
3405	enum sctp_disposition sctp_sf_eat_sack_6_2(struct net *net,
3406	const struct sctp_endpoint *ep,
3407	const struct sctp_association *asoc,
3408	const union sctp_subtype type,
3409	void *arg,
3410	struct sctp_cmd_seq *commands)
3411	{
3412	struct sctp_chunk *chunk = arg;
3413	struct sctp_sackhdr *sackh;
3414	__u32 ctsn;
3415
3416	if (!sctp_vtag_verify(chunk, asoc))
3417	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3418
3419	/* Make sure that the SACK chunk has a valid length. */
3420	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_sack_chunk)))
3421	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3422	commands);
3423
3424	/* Pull the SACK chunk from the data buffer */
3425	sackh = sctp_sm_pull_sack(chunk);
3426	/* Was this a bogus SACK? */
3427	if (!sackh)
3428	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3429	chunk->subh.sack_hdr = sackh;
3430	ctsn = ntohl(sackh->cum_tsn_ack);
3431
3432	/* If Cumulative TSN Ack beyond the max tsn currently
3433	* send, terminating the association and respond to the
3434	* sender with an ABORT.
3435	*/
3436	if (TSN_lte(asoc->next_tsn, ctsn))
3437	return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands);
3438
3439	trace_sctp_probe(ep, asoc, chunk);
3440
3441	/* i) If Cumulative TSN Ack is less than the Cumulative TSN
3442	* Ack Point, then drop the SACK. Since Cumulative TSN
3443	* Ack is monotonically increasing, a SACK whose
3444	* Cumulative TSN Ack is less than the Cumulative TSN Ack
3445	* Point indicates an out-of-order SACK.
3446	*/
3447	if (TSN_lt(ctsn, asoc->ctsn_ack_point)) {
3448	pr_debug("%s: ctsn:%x, ctsn_ack_point:%x\n", __func__, ctsn,
3449	asoc->ctsn_ack_point);
3450
3451	return SCTP_DISPOSITION_DISCARD;
3452	}
3453
3454	/* Return this SACK for further processing. */
3455	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_PROCESS_SACK, obj: SCTP_CHUNK(arg: chunk));
3456
3457	/* Note: We do the rest of the work on the PROCESS_SACK
3458	* sideeffect.
3459	*/
3460	return SCTP_DISPOSITION_CONSUME;
3461	}
3462
3463	/*
3464	* Generate an ABORT in response to a packet.
3465	*
3466	* Section: 8.4 Handle "Out of the blue" Packets, sctpimpguide 2.41
3467	*
3468	* 8) The receiver should respond to the sender of the OOTB packet with
3469	* an ABORT. When sending the ABORT, the receiver of the OOTB packet
3470	* MUST fill in the Verification Tag field of the outbound packet
3471	* with the value found in the Verification Tag field of the OOTB
3472	* packet and set the T-bit in the Chunk Flags to indicate that the
3473	* Verification Tag is reflected. After sending this ABORT, the
3474	* receiver of the OOTB packet shall discard the OOTB packet and take
3475	* no further action.
3476	*
3477	* Verification Tag:
3478	*
3479	* The return value is the disposition of the chunk.
3480	*/
3481	static enum sctp_disposition sctp_sf_tabort_8_4_8(
3482	struct net *net,
3483	const struct sctp_endpoint *ep,
3484	const struct sctp_association *asoc,
3485	const union sctp_subtype type,
3486	void *arg,
3487	struct sctp_cmd_seq *commands)
3488	{
3489	struct sctp_packet *packet = NULL;
3490	struct sctp_chunk *chunk = arg;
3491	struct sctp_chunk *abort;
3492
3493	packet = sctp_ootb_pkt_new(net, asoc, chunk);
3494	if (!packet)
3495	return SCTP_DISPOSITION_NOMEM;
3496
3497	/* Make an ABORT. The T bit will be set if the asoc
3498	* is NULL.
3499	*/
3500	abort = sctp_make_abort(asoc, chunk, hint: 0);
3501	if (!abort) {
3502	sctp_ootb_pkt_free(packet);
3503	return SCTP_DISPOSITION_NOMEM;
3504	}
3505
3506	/* Reflect vtag if T-Bit is set */
3507	if (sctp_test_T_bit(abort))
3508	packet->vtag = ntohl(chunk->sctp_hdr->vtag);
3509
3510	/* Set the skb to the belonging sock for accounting. */
3511	abort->skb->sk = ep->base.sk;
3512
3513	sctp_packet_append_chunk(packet, chunk: abort);
3514
3515	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SEND_PKT, obj: SCTP_PACKET(arg: packet));
3516
3517	SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
3518
3519	sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3520	return SCTP_DISPOSITION_CONSUME;
3521	}
3522
3523	/* Handling of SCTP Packets Containing an INIT Chunk Matching an
3524	* Existing Associations when the UDP encap port is incorrect.
3525	*
3526	* From Section 4 at draft-tuexen-tsvwg-sctp-udp-encaps-cons-03.
3527	*/
3528	static enum sctp_disposition sctp_sf_new_encap_port(
3529	struct net *net,
3530	const struct sctp_endpoint *ep,
3531	const struct sctp_association *asoc,
3532	const union sctp_subtype type,
3533	void *arg,
3534	struct sctp_cmd_seq *commands)
3535	{
3536	struct sctp_packet *packet = NULL;
3537	struct sctp_chunk *chunk = arg;
3538	struct sctp_chunk *abort;
3539
3540	packet = sctp_ootb_pkt_new(net, asoc, chunk);
3541	if (!packet)
3542	return SCTP_DISPOSITION_NOMEM;
3543
3544	abort = sctp_make_new_encap_port(asoc, chunk);
3545	if (!abort) {
3546	sctp_ootb_pkt_free(packet);
3547	return SCTP_DISPOSITION_NOMEM;
3548	}
3549
3550	abort->skb->sk = ep->base.sk;
3551
3552	sctp_packet_append_chunk(packet, chunk: abort);
3553
3554	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SEND_PKT,
3555	obj: SCTP_PACKET(arg: packet));
3556
3557	SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
3558
3559	sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3560	return SCTP_DISPOSITION_CONSUME;
3561	}
3562
3563	/*
3564	* Received an ERROR chunk from peer. Generate SCTP_REMOTE_ERROR
3565	* event as ULP notification for each cause included in the chunk.
3566	*
3567	* API 5.3.1.3 - SCTP_REMOTE_ERROR
3568	*
3569	* The return value is the disposition of the chunk.
3570	*/
3571	enum sctp_disposition sctp_sf_operr_notify(struct net *net,
3572	const struct sctp_endpoint *ep,
3573	const struct sctp_association *asoc,
3574	const union sctp_subtype type,
3575	void *arg,
3576	struct sctp_cmd_seq *commands)
3577	{
3578	struct sctp_chunk *chunk = arg;
3579	struct sctp_errhdr *err;
3580
3581	if (!sctp_vtag_verify(chunk, asoc))
3582	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3583
3584	/* Make sure that the ERROR chunk has a valid length. */
3585	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_operr_chunk)))
3586	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3587	commands);
3588	sctp_walk_errors(err, chunk->chunk_hdr);
3589	if ((void *)err != (void *)chunk->chunk_end)
3590	return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
3591	ext: (void *)err, commands);
3592
3593	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_PROCESS_OPERR,
3594	obj: SCTP_CHUNK(arg: chunk));
3595
3596	return SCTP_DISPOSITION_CONSUME;
3597	}
3598
3599	/*
3600	* Process an inbound SHUTDOWN ACK.
3601	*
3602	* From Section 9.2:
3603	* Upon the receipt of the SHUTDOWN ACK, the SHUTDOWN sender shall
3604	* stop the T2-shutdown timer, send a SHUTDOWN COMPLETE chunk to its
3605	* peer, and remove all record of the association.
3606	*
3607	* The return value is the disposition.
3608	*/
3609	enum sctp_disposition sctp_sf_do_9_2_final(struct net *net,
3610	const struct sctp_endpoint *ep,
3611	const struct sctp_association *asoc,
3612	const union sctp_subtype type,
3613	void *arg,
3614	struct sctp_cmd_seq *commands)
3615	{
3616	struct sctp_chunk *chunk = arg;
3617	struct sctp_chunk *reply;
3618	struct sctp_ulpevent *ev;
3619
3620	if (!sctp_vtag_verify(chunk, asoc))
3621	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3622
3623	/* Make sure that the SHUTDOWN_ACK chunk has a valid length. */
3624	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_chunkhdr)))
3625	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3626	commands);
3627	/* 10.2 H) SHUTDOWN COMPLETE notification
3628	*
3629	* When SCTP completes the shutdown procedures (section 9.2) this
3630	* notification is passed to the upper layer.
3631	*/
3632	ev = sctp_ulpevent_make_assoc_change(asoc, flags: 0, state: SCTP_SHUTDOWN_COMP,
3633	error: 0, outbound: 0, inbound: 0, NULL, GFP_ATOMIC);
3634	if (!ev)
3635	goto nomem;
3636
3637	/* ...send a SHUTDOWN COMPLETE chunk to its peer, */
3638	reply = sctp_make_shutdown_complete(asoc, chunk);
3639	if (!reply)
3640	goto nomem_chunk;
3641
3642	/* Do all the commands now (after allocation), so that we
3643	* have consistent state if memory allocation fails
3644	*/
3645	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_EVENT_ULP, obj: SCTP_ULPEVENT(arg: ev));
3646
3647	/* Upon the receipt of the SHUTDOWN ACK, the SHUTDOWN sender shall
3648	* stop the T2-shutdown timer,
3649	*/
3650	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_STOP,
3651	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
3652
3653	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_STOP,
3654	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
3655
3656	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_NEW_STATE,
3657	obj: SCTP_STATE(arg: SCTP_STATE_CLOSED));
3658	SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS);
3659	SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
3660	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: reply));
3661
3662	/* ...and remove all record of the association. */
3663	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_DELETE_TCB, obj: SCTP_NULL());
3664	return SCTP_DISPOSITION_DELETE_TCB;
3665
3666	nomem_chunk:
3667	sctp_ulpevent_free(ev);
3668	nomem:
3669	return SCTP_DISPOSITION_NOMEM;
3670	}
3671
3672	/*
3673	* RFC 2960, 8.4 - Handle "Out of the blue" Packets, sctpimpguide 2.41.
3674	*
3675	* 5) If the packet contains a SHUTDOWN ACK chunk, the receiver should
3676	* respond to the sender of the OOTB packet with a SHUTDOWN COMPLETE.
3677	* When sending the SHUTDOWN COMPLETE, the receiver of the OOTB
3678	* packet must fill in the Verification Tag field of the outbound
3679	* packet with the Verification Tag received in the SHUTDOWN ACK and
3680	* set the T-bit in the Chunk Flags to indicate that the Verification
3681	* Tag is reflected.
3682	*
3683	* 8) The receiver should respond to the sender of the OOTB packet with
3684	* an ABORT. When sending the ABORT, the receiver of the OOTB packet
3685	* MUST fill in the Verification Tag field of the outbound packet
3686	* with the value found in the Verification Tag field of the OOTB
3687	* packet and set the T-bit in the Chunk Flags to indicate that the
3688	* Verification Tag is reflected. After sending this ABORT, the
3689	* receiver of the OOTB packet shall discard the OOTB packet and take
3690	* no further action.
3691	*/
3692	enum sctp_disposition sctp_sf_ootb(struct net *net,
3693	const struct sctp_endpoint *ep,
3694	const struct sctp_association *asoc,
3695	const union sctp_subtype type,
3696	void *arg, struct sctp_cmd_seq *commands)
3697	{
3698	struct sctp_chunk *chunk = arg;
3699	struct sk_buff *skb = chunk->skb;
3700	struct sctp_chunkhdr *ch;
3701	struct sctp_errhdr *err;
3702	int ootb_cookie_ack = 0;
3703	int ootb_shut_ack = 0;
3704	__u8 *ch_end;
3705
3706	SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
3707
3708	if (asoc && !sctp_vtag_verify(chunk, asoc))
3709	asoc = NULL;
3710
3711	ch = (struct sctp_chunkhdr *)chunk->chunk_hdr;
3712	do {
3713	/* Report violation if the chunk is less then minimal */
3714	if (ntohs(ch->length) < sizeof(*ch))
3715	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3716	commands);
3717
3718	/* Report violation if chunk len overflows */
3719	ch_end = ((__u8 *)ch) + SCTP_PAD4(ntohs(ch->length));
3720	if (ch_end > skb_tail_pointer(skb))
3721	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3722	commands);
3723
3724	/* Now that we know we at least have a chunk header,
3725	* do things that are type appropriate.
3726	*/
3727	if (SCTP_CID_SHUTDOWN_ACK == ch->type)
3728	ootb_shut_ack = 1;
3729
3730	/* RFC 2960, Section 3.3.7
3731	* Moreover, under any circumstances, an endpoint that
3732	* receives an ABORT MUST NOT respond to that ABORT by
3733	* sending an ABORT of its own.
3734	*/
3735	if (SCTP_CID_ABORT == ch->type)
3736	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3737
3738	/* RFC 8.4, 7) If the packet contains a "Stale cookie" ERROR
3739	* or a COOKIE ACK the SCTP Packet should be silently
3740	* discarded.
3741	*/
3742
3743	if (SCTP_CID_COOKIE_ACK == ch->type)
3744	ootb_cookie_ack = 1;
3745
3746	if (SCTP_CID_ERROR == ch->type) {
3747	sctp_walk_errors(err, ch) {
3748	if (SCTP_ERROR_STALE_COOKIE == err->cause) {
3749	ootb_cookie_ack = 1;
3750	break;
3751	}
3752	}
3753	}
3754
3755	ch = (struct sctp_chunkhdr *)ch_end;
3756	} while (ch_end + sizeof(*ch) < skb_tail_pointer(skb));
3757
3758	if (ootb_shut_ack)
3759	return sctp_sf_shut_8_4_5(net, ep, asoc, type, arg, commands);
3760	else if (ootb_cookie_ack)
3761	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3762	else
3763	return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
3764	}
3765
3766	/*
3767	* Handle an "Out of the blue" SHUTDOWN ACK.
3768	*
3769	* Section: 8.4 5, sctpimpguide 2.41.
3770	*
3771	* 5) If the packet contains a SHUTDOWN ACK chunk, the receiver should
3772	* respond to the sender of the OOTB packet with a SHUTDOWN COMPLETE.
3773	* When sending the SHUTDOWN COMPLETE, the receiver of the OOTB
3774	* packet must fill in the Verification Tag field of the outbound
3775	* packet with the Verification Tag received in the SHUTDOWN ACK and
3776	* set the T-bit in the Chunk Flags to indicate that the Verification
3777	* Tag is reflected.
3778	*
3779	* Inputs
3780	* (endpoint, asoc, type, arg, commands)
3781	*
3782	* Outputs
3783	* (enum sctp_disposition)
3784	*
3785	* The return value is the disposition of the chunk.
3786	*/
3787	static enum sctp_disposition sctp_sf_shut_8_4_5(
3788	struct net *net,
3789	const struct sctp_endpoint *ep,
3790	const struct sctp_association *asoc,
3791	const union sctp_subtype type,
3792	void *arg,
3793	struct sctp_cmd_seq *commands)
3794	{
3795	struct sctp_packet *packet = NULL;
3796	struct sctp_chunk *chunk = arg;
3797	struct sctp_chunk *shut;
3798
3799	packet = sctp_ootb_pkt_new(net, asoc, chunk);
3800	if (!packet)
3801	return SCTP_DISPOSITION_NOMEM;
3802
3803	/* Make an SHUTDOWN_COMPLETE.
3804	* The T bit will be set if the asoc is NULL.
3805	*/
3806	shut = sctp_make_shutdown_complete(asoc, chunk);
3807	if (!shut) {
3808	sctp_ootb_pkt_free(packet);
3809	return SCTP_DISPOSITION_NOMEM;
3810	}
3811
3812	/* Reflect vtag if T-Bit is set */
3813	if (sctp_test_T_bit(shut))
3814	packet->vtag = ntohl(chunk->sctp_hdr->vtag);
3815
3816	/* Set the skb to the belonging sock for accounting. */
3817	shut->skb->sk = ep->base.sk;
3818
3819	sctp_packet_append_chunk(packet, chunk: shut);
3820
3821	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SEND_PKT,
3822	obj: SCTP_PACKET(arg: packet));
3823
3824	SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
3825
3826	/* We need to discard the rest of the packet to prevent
3827	* potential boomming attacks from additional bundled chunks.
3828	* This is documented in SCTP Threats ID.
3829	*/
3830	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3831	}
3832
3833	/*
3834	* Handle SHUTDOWN ACK in COOKIE_ECHOED or COOKIE_WAIT state.
3835	*
3836	* Verification Tag: 8.5.1 E) Rules for packet carrying a SHUTDOWN ACK
3837	* If the receiver is in COOKIE-ECHOED or COOKIE-WAIT state the
3838	* procedures in section 8.4 SHOULD be followed, in other words it
3839	* should be treated as an Out Of The Blue packet.
3840	* [This means that we do NOT check the Verification Tag on these
3841	* chunks. --piggy ]
3842	*
3843	*/
3844	enum sctp_disposition sctp_sf_do_8_5_1_E_sa(struct net *net,
3845	const struct sctp_endpoint *ep,
3846	const struct sctp_association *asoc,
3847	const union sctp_subtype type,
3848	void *arg,
3849	struct sctp_cmd_seq *commands)
3850	{
3851	struct sctp_chunk *chunk = arg;
3852
3853	if (!sctp_vtag_verify(chunk, asoc))
3854	asoc = NULL;
3855
3856	/* Make sure that the SHUTDOWN_ACK chunk has a valid length. */
3857	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_chunkhdr)))
3858	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3859	commands);
3860
3861	/* Although we do have an association in this case, it corresponds
3862	* to a restarted association. So the packet is treated as an OOTB
3863	* packet and the state function that handles OOTB SHUTDOWN_ACK is
3864	* called with a NULL association.
3865	*/
3866	SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
3867
3868	return sctp_sf_shut_8_4_5(net, ep, NULL, type, arg, commands);
3869	}
3870
3871	/* ADDIP Section 4.2 Upon reception of an ASCONF Chunk. */
3872	enum sctp_disposition sctp_sf_do_asconf(struct net *net,
3873	const struct sctp_endpoint *ep,
3874	const struct sctp_association *asoc,
3875	const union sctp_subtype type,
3876	void *arg,
3877	struct sctp_cmd_seq *commands)
3878	{
3879	struct sctp_paramhdr *err_param = NULL;
3880	struct sctp_chunk *asconf_ack = NULL;
3881	struct sctp_chunk *chunk = arg;
3882	struct sctp_addiphdr *hdr;
3883	__u32 serial;
3884
3885	if (!sctp_vtag_verify(chunk, asoc)) {
3886	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPORT_BAD_TAG,
3887	obj: SCTP_NULL());
3888	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3889	}
3890
3891	/* Make sure that the ASCONF ADDIP chunk has a valid length. */
3892	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_addip_chunk)))
3893	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
3894	commands);
3895
3896	/* ADD-IP: Section 4.1.1
3897	* This chunk MUST be sent in an authenticated way by using
3898	* the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk
3899	* is received unauthenticated it MUST be silently discarded as
3900	* described in [I-D.ietf-tsvwg-sctp-auth].
3901	*/
3902	if (!asoc->peer.asconf_capable ||
3903	(!net->sctp.addip_noauth && !chunk->auth))
3904	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
3905
3906	hdr = (struct sctp_addiphdr *)chunk->skb->data;
3907	serial = ntohl(hdr->serial);
3908
3909	/* Verify the ASCONF chunk before processing it. */
3910	if (!sctp_verify_asconf(asoc, chunk, addr_param_needed: true, errp: &err_param))
3911	return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
3912	ext: (void *)err_param, commands);
3913
3914	/* ADDIP 5.2 E1) Compare the value of the serial number to the value
3915	* the endpoint stored in a new association variable
3916	* 'Peer-Serial-Number'.
3917	*/
3918	if (serial == asoc->peer.addip_serial + 1) {
3919	/* If this is the first instance of ASCONF in the packet,
3920	* we can clean our old ASCONF-ACKs.
3921	*/
3922	if (!chunk->has_asconf)
3923	sctp_assoc_clean_asconf_ack_cache(asoc);
3924
3925	/* ADDIP 5.2 E4) When the Sequence Number matches the next one
3926	* expected, process the ASCONF as described below and after
3927	* processing the ASCONF Chunk, append an ASCONF-ACK Chunk to
3928	* the response packet and cache a copy of it (in the event it
3929	* later needs to be retransmitted).
3930	*
3931	* Essentially, do V1-V5.
3932	*/
3933	asconf_ack = sctp_process_asconf(asoc: (struct sctp_association *)
3934	asoc, asconf: chunk);
3935	if (!asconf_ack)
3936	return SCTP_DISPOSITION_NOMEM;
3937	} else if (serial < asoc->peer.addip_serial + 1) {
3938	/* ADDIP 5.2 E2)
3939	* If the value found in the Sequence Number is less than the
3940	* ('Peer- Sequence-Number' + 1), simply skip to the next
3941	* ASCONF, and include in the outbound response packet
3942	* any previously cached ASCONF-ACK response that was
3943	* sent and saved that matches the Sequence Number of the
3944	* ASCONF. Note: It is possible that no cached ASCONF-ACK
3945	* Chunk exists. This will occur when an older ASCONF
3946	* arrives out of order. In such a case, the receiver
3947	* should skip the ASCONF Chunk and not include ASCONF-ACK
3948	* Chunk for that chunk.
3949	*/
3950	asconf_ack = sctp_assoc_lookup_asconf_ack(asoc, serial: hdr->serial);
3951	if (!asconf_ack)
3952	return SCTP_DISPOSITION_DISCARD;
3953
3954	/* Reset the transport so that we select the correct one
3955	* this time around. This is to make sure that we don't
3956	* accidentally use a stale transport that's been removed.
3957	*/
3958	asconf_ack->transport = NULL;
3959	} else {
3960	/* ADDIP 5.2 E5) Otherwise, the ASCONF Chunk is discarded since
3961	* it must be either a stale packet or from an attacker.
3962	*/
3963	return SCTP_DISPOSITION_DISCARD;
3964	}
3965
3966	/* ADDIP 5.2 E6) The destination address of the SCTP packet
3967	* containing the ASCONF-ACK Chunks MUST be the source address of
3968	* the SCTP packet that held the ASCONF Chunks.
3969	*
3970	* To do this properly, we'll set the destination address of the chunk
3971	* and at the transmit time, will try look up the transport to use.
3972	* Since ASCONFs may be bundled, the correct transport may not be
3973	* created until we process the entire packet, thus this workaround.
3974	*/
3975	asconf_ack->dest = chunk->source;
3976	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: asconf_ack));
3977	if (asoc->new_transport) {
3978	sctp_sf_heartbeat(ep, asoc, type, arg: asoc->new_transport, commands);
3979	((struct sctp_association *)asoc)->new_transport = NULL;
3980	}
3981
3982	return SCTP_DISPOSITION_CONSUME;
3983	}
3984
3985	static enum sctp_disposition sctp_send_next_asconf(
3986	struct net *net,
3987	const struct sctp_endpoint *ep,
3988	struct sctp_association *asoc,
3989	const union sctp_subtype type,
3990	struct sctp_cmd_seq *commands)
3991	{
3992	struct sctp_chunk *asconf;
3993	struct list_head *entry;
3994
3995	if (list_empty(head: &asoc->addip_chunk_list))
3996	return SCTP_DISPOSITION_CONSUME;
3997
3998	entry = asoc->addip_chunk_list.next;
3999	asconf = list_entry(entry, struct sctp_chunk, list);
4000
4001	list_del_init(entry);
4002	sctp_chunk_hold(asconf);
4003	asoc->addip_last_asconf = asconf;
4004
4005	return sctp_sf_do_prm_asconf(net, ep, asoc, type, asconf, commands);
4006	}
4007
4008	/*
4009	* ADDIP Section 4.3 General rules for address manipulation
4010	* When building TLV parameters for the ASCONF Chunk that will add or
4011	* delete IP addresses the D0 to D13 rules should be applied:
4012	*/
4013	enum sctp_disposition sctp_sf_do_asconf_ack(struct net *net,
4014	const struct sctp_endpoint *ep,
4015	const struct sctp_association *asoc,
4016	const union sctp_subtype type,
4017	void *arg,
4018	struct sctp_cmd_seq *commands)
4019	{
4020	struct sctp_chunk *last_asconf = asoc->addip_last_asconf;
4021	struct sctp_paramhdr *err_param = NULL;
4022	struct sctp_chunk *asconf_ack = arg;
4023	struct sctp_addiphdr *addip_hdr;
4024	__u32 sent_serial, rcvd_serial;
4025	struct sctp_chunk *abort;
4026
4027	if (!sctp_vtag_verify(chunk: asconf_ack, asoc)) {
4028	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPORT_BAD_TAG,
4029	obj: SCTP_NULL());
4030	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4031	}
4032
4033	/* Make sure that the ADDIP chunk has a valid length. */
4034	if (!sctp_chunk_length_valid(chunk: asconf_ack,
4035	required_length: sizeof(struct sctp_addip_chunk)))
4036	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4037	commands);
4038
4039	/* ADD-IP, Section 4.1.2:
4040	* This chunk MUST be sent in an authenticated way by using
4041	* the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk
4042	* is received unauthenticated it MUST be silently discarded as
4043	* described in [I-D.ietf-tsvwg-sctp-auth].
4044	*/
4045	if (!asoc->peer.asconf_capable ||
4046	(!net->sctp.addip_noauth && !asconf_ack->auth))
4047	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4048
4049	addip_hdr = (struct sctp_addiphdr *)asconf_ack->skb->data;
4050	rcvd_serial = ntohl(addip_hdr->serial);
4051
4052	/* Verify the ASCONF-ACK chunk before processing it. */
4053	if (!sctp_verify_asconf(asoc, chunk: asconf_ack, addr_param_needed: false, errp: &err_param))
4054	return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
4055	ext: (void *)err_param, commands);
4056
4057	if (last_asconf) {
4058	addip_hdr = last_asconf->subh.addip_hdr;
4059	sent_serial = ntohl(addip_hdr->serial);
4060	} else {
4061	sent_serial = asoc->addip_serial - 1;
4062	}
4063
4064	/* D0) If an endpoint receives an ASCONF-ACK that is greater than or
4065	* equal to the next serial number to be used but no ASCONF chunk is
4066	* outstanding the endpoint MUST ABORT the association. Note that a
4067	* sequence number is greater than if it is no more than 2^^31-1
4068	* larger than the current sequence number (using serial arithmetic).
4069	*/
4070	if (ADDIP_SERIAL_gte(rcvd_serial, sent_serial + 1) &&
4071	!(asoc->addip_last_asconf)) {
4072	abort = sctp_make_abort(asoc, chunk: asconf_ack,
4073	hint: sizeof(struct sctp_errhdr));
4074	if (abort) {
4075	sctp_init_cause(chunk: abort, cause: SCTP_ERROR_ASCONF_ACK, paylen: 0);
4076	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY,
4077	obj: SCTP_CHUNK(arg: abort));
4078	}
4079	/* We are going to ABORT, so we might as well stop
4080	* processing the rest of the chunks in the packet.
4081	*/
4082	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_STOP,
4083	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T4_RTO));
4084	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_DISCARD_PACKET, obj: SCTP_NULL());
4085	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SET_SK_ERR,
4086	obj: SCTP_ERROR(ECONNABORTED));
4087	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_ASSOC_FAILED,
4088	obj: SCTP_PERR(arg: SCTP_ERROR_ASCONF_ACK));
4089	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
4090	SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
4091	return SCTP_DISPOSITION_ABORT;
4092	}
4093
4094	if ((rcvd_serial == sent_serial) && asoc->addip_last_asconf) {
4095	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_STOP,
4096	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T4_RTO));
4097
4098	if (!sctp_process_asconf_ack(asoc: (struct sctp_association *)asoc,
4099	asconf_ack))
4100	return sctp_send_next_asconf(net, ep,
4101	asoc: (struct sctp_association *)asoc,
4102	type, commands);
4103
4104	abort = sctp_make_abort(asoc, chunk: asconf_ack,
4105	hint: sizeof(struct sctp_errhdr));
4106	if (abort) {
4107	sctp_init_cause(chunk: abort, cause: SCTP_ERROR_RSRC_LOW, paylen: 0);
4108	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY,
4109	obj: SCTP_CHUNK(arg: abort));
4110	}
4111	/* We are going to ABORT, so we might as well stop
4112	* processing the rest of the chunks in the packet.
4113	*/
4114	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_DISCARD_PACKET, obj: SCTP_NULL());
4115	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SET_SK_ERR,
4116	obj: SCTP_ERROR(ECONNABORTED));
4117	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_ASSOC_FAILED,
4118	obj: SCTP_PERR(arg: SCTP_ERROR_ASCONF_ACK));
4119	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
4120	SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
4121	return SCTP_DISPOSITION_ABORT;
4122	}
4123
4124	return SCTP_DISPOSITION_DISCARD;
4125	}
4126
4127	/* RE-CONFIG Section 5.2 Upon reception of an RECONF Chunk. */
4128	enum sctp_disposition sctp_sf_do_reconf(struct net *net,
4129	const struct sctp_endpoint *ep,
4130	const struct sctp_association *asoc,
4131	const union sctp_subtype type,
4132	void *arg,
4133	struct sctp_cmd_seq *commands)
4134	{
4135	struct sctp_paramhdr *err_param = NULL;
4136	struct sctp_chunk *chunk = arg;
4137	struct sctp_reconf_chunk *hdr;
4138	union sctp_params param;
4139
4140	if (!sctp_vtag_verify(chunk, asoc)) {
4141	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPORT_BAD_TAG,
4142	obj: SCTP_NULL());
4143	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4144	}
4145
4146	/* Make sure that the RECONF chunk has a valid length. */
4147	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(*hdr)))
4148	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4149	commands);
4150
4151	if (!sctp_verify_reconf(asoc, chunk, errp: &err_param))
4152	return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
4153	ext: (void *)err_param, commands);
4154
4155	hdr = (struct sctp_reconf_chunk *)chunk->chunk_hdr;
4156	sctp_walk_params(param, hdr) {
4157	struct sctp_chunk *reply = NULL;
4158	struct sctp_ulpevent *ev = NULL;
4159
4160	if (param.p->type == SCTP_PARAM_RESET_OUT_REQUEST)
4161	reply = sctp_process_strreset_outreq(
4162	asoc: (struct sctp_association *)asoc, param, evp: &ev);
4163	else if (param.p->type == SCTP_PARAM_RESET_IN_REQUEST)
4164	reply = sctp_process_strreset_inreq(
4165	asoc: (struct sctp_association *)asoc, param, evp: &ev);
4166	else if (param.p->type == SCTP_PARAM_RESET_TSN_REQUEST)
4167	reply = sctp_process_strreset_tsnreq(
4168	asoc: (struct sctp_association *)asoc, param, evp: &ev);
4169	else if (param.p->type == SCTP_PARAM_RESET_ADD_OUT_STREAMS)
4170	reply = sctp_process_strreset_addstrm_out(
4171	asoc: (struct sctp_association *)asoc, param, evp: &ev);
4172	else if (param.p->type == SCTP_PARAM_RESET_ADD_IN_STREAMS)
4173	reply = sctp_process_strreset_addstrm_in(
4174	asoc: (struct sctp_association *)asoc, param, evp: &ev);
4175	else if (param.p->type == SCTP_PARAM_RESET_RESPONSE)
4176	reply = sctp_process_strreset_resp(
4177	asoc: (struct sctp_association *)asoc, param, evp: &ev);
4178
4179	if (ev)
4180	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_EVENT_ULP,
4181	obj: SCTP_ULPEVENT(arg: ev));
4182
4183	if (reply)
4184	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY,
4185	obj: SCTP_CHUNK(arg: reply));
4186	}
4187
4188	return SCTP_DISPOSITION_CONSUME;
4189	}
4190
4191	/*
4192	* PR-SCTP Section 3.6 Receiver Side Implementation of PR-SCTP
4193	*
4194	* When a FORWARD TSN chunk arrives, the data receiver MUST first update
4195	* its cumulative TSN point to the value carried in the FORWARD TSN
4196	* chunk, and then MUST further advance its cumulative TSN point locally
4197	* if possible.
4198	* After the above processing, the data receiver MUST stop reporting any
4199	* missing TSNs earlier than or equal to the new cumulative TSN point.
4200	*
4201	* Verification Tag: 8.5 Verification Tag [Normal verification]
4202	*
4203	* The return value is the disposition of the chunk.
4204	*/
4205	enum sctp_disposition sctp_sf_eat_fwd_tsn(struct net *net,
4206	const struct sctp_endpoint *ep,
4207	const struct sctp_association *asoc,
4208	const union sctp_subtype type,
4209	void *arg,
4210	struct sctp_cmd_seq *commands)
4211	{
4212	struct sctp_fwdtsn_hdr *fwdtsn_hdr;
4213	struct sctp_chunk *chunk = arg;
4214	__u16 len;
4215	__u32 tsn;
4216
4217	if (!sctp_vtag_verify(chunk, asoc)) {
4218	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPORT_BAD_TAG,
4219	obj: SCTP_NULL());
4220	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4221	}
4222
4223	if (!asoc->peer.prsctp_capable)
4224	return sctp_sf_unk_chunk(net, ep, asoc, type, arg, commands);
4225
4226	/* Make sure that the FORWARD_TSN chunk has valid length. */
4227	if (!sctp_chunk_length_valid(chunk, required_length: sctp_ftsnchk_len(stream: &asoc->stream)))
4228	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4229	commands);
4230
4231	fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data;
4232	chunk->subh.fwdtsn_hdr = fwdtsn_hdr;
4233	len = ntohs(chunk->chunk_hdr->length);
4234	len -= sizeof(struct sctp_chunkhdr);
4235	skb_pull(skb: chunk->skb, len);
4236
4237	tsn = ntohl(fwdtsn_hdr->new_cum_tsn);
4238	pr_debug("%s: TSN 0x%x\n", __func__, tsn);
4239
4240	/* The TSN is too high--silently discard the chunk and count on it
4241	* getting retransmitted later.
4242	*/
4243	if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
4244	goto discard_noforce;
4245
4246	if (!asoc->stream.si->validate_ftsn(chunk))
4247	goto discard_noforce;
4248
4249	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPORT_FWDTSN, obj: SCTP_U32(arg: tsn));
4250	if (len > sctp_ftsnhdr_len(stream: &asoc->stream))
4251	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_PROCESS_FWDTSN,
4252	obj: SCTP_CHUNK(arg: chunk));
4253
4254	/* Count this as receiving DATA. */
4255	if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) {
4256	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_RESTART,
4257	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_AUTOCLOSE));
4258	}
4259
4260	/* FIXME: For now send a SACK, but DATA processing may
4261	* send another.
4262	*/
4263	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_GEN_SACK, obj: SCTP_NOFORCE());
4264
4265	return SCTP_DISPOSITION_CONSUME;
4266
4267	discard_noforce:
4268	return SCTP_DISPOSITION_DISCARD;
4269	}
4270
4271	enum sctp_disposition sctp_sf_eat_fwd_tsn_fast(
4272	struct net *net,
4273	const struct sctp_endpoint *ep,
4274	const struct sctp_association *asoc,
4275	const union sctp_subtype type,
4276	void *arg,
4277	struct sctp_cmd_seq *commands)
4278	{
4279	struct sctp_fwdtsn_hdr *fwdtsn_hdr;
4280	struct sctp_chunk *chunk = arg;
4281	__u16 len;
4282	__u32 tsn;
4283
4284	if (!sctp_vtag_verify(chunk, asoc)) {
4285	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPORT_BAD_TAG,
4286	obj: SCTP_NULL());
4287	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4288	}
4289
4290	if (!asoc->peer.prsctp_capable)
4291	return sctp_sf_unk_chunk(net, ep, asoc, type, arg, commands);
4292
4293	/* Make sure that the FORWARD_TSN chunk has a valid length. */
4294	if (!sctp_chunk_length_valid(chunk, required_length: sctp_ftsnchk_len(stream: &asoc->stream)))
4295	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4296	commands);
4297
4298	fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data;
4299	chunk->subh.fwdtsn_hdr = fwdtsn_hdr;
4300	len = ntohs(chunk->chunk_hdr->length);
4301	len -= sizeof(struct sctp_chunkhdr);
4302	skb_pull(skb: chunk->skb, len);
4303
4304	tsn = ntohl(fwdtsn_hdr->new_cum_tsn);
4305	pr_debug("%s: TSN 0x%x\n", __func__, tsn);
4306
4307	/* The TSN is too high--silently discard the chunk and count on it
4308	* getting retransmitted later.
4309	*/
4310	if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
4311	goto gen_shutdown;
4312
4313	if (!asoc->stream.si->validate_ftsn(chunk))
4314	goto gen_shutdown;
4315
4316	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPORT_FWDTSN, obj: SCTP_U32(arg: tsn));
4317	if (len > sctp_ftsnhdr_len(stream: &asoc->stream))
4318	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_PROCESS_FWDTSN,
4319	obj: SCTP_CHUNK(arg: chunk));
4320
4321	/* Go a head and force a SACK, since we are shutting down. */
4322	gen_shutdown:
4323	/* Implementor's Guide.
4324	*
4325	* While in SHUTDOWN-SENT state, the SHUTDOWN sender MUST immediately
4326	* respond to each received packet containing one or more DATA chunk(s)
4327	* with a SACK, a SHUTDOWN chunk, and restart the T2-shutdown timer
4328	*/
4329	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_GEN_SHUTDOWN, obj: SCTP_NULL());
4330	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_GEN_SACK, obj: SCTP_FORCE());
4331	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_RESTART,
4332	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
4333
4334	return SCTP_DISPOSITION_CONSUME;
4335	}
4336
4337	/*
4338	* SCTP-AUTH Section 6.3 Receiving authenticated chunks
4339	*
4340	* The receiver MUST use the HMAC algorithm indicated in the HMAC
4341	* Identifier field. If this algorithm was not specified by the
4342	* receiver in the HMAC-ALGO parameter in the INIT or INIT-ACK chunk
4343	* during association setup, the AUTH chunk and all chunks after it MUST
4344	* be discarded and an ERROR chunk SHOULD be sent with the error cause
4345	* defined in Section 4.1.
4346	*
4347	* If an endpoint with no shared key receives a Shared Key Identifier
4348	* other than 0, it MUST silently discard all authenticated chunks. If
4349	* the endpoint has at least one endpoint pair shared key for the peer,
4350	* it MUST use the key specified by the Shared Key Identifier if a
4351	* key has been configured for that Shared Key Identifier. If no
4352	* endpoint pair shared key has been configured for that Shared Key
4353	* Identifier, all authenticated chunks MUST be silently discarded.
4354	*
4355	* Verification Tag: 8.5 Verification Tag [Normal verification]
4356	*
4357	* The return value is the disposition of the chunk.
4358	*/
4359	static enum sctp_ierror sctp_sf_authenticate(
4360	const struct sctp_association *asoc,
4361	struct sctp_chunk *chunk)
4362	{
4363	struct sctp_shared_key *sh_key = NULL;
4364	struct sctp_authhdr *auth_hdr;
4365	__u8 *save_digest, *digest;
4366	const struct sctp_hmac *hmac;
4367	unsigned int sig_len;
4368	__u16 key_id;
4369
4370	/* Pull in the auth header, so we can do some more verification */
4371	auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
4372	chunk->subh.auth_hdr = auth_hdr;
4373	skb_pull(skb: chunk->skb, len: sizeof(*auth_hdr));
4374
4375	/* Make sure that we support the HMAC algorithm from the auth
4376	* chunk.
4377	*/
4378	if (!sctp_auth_asoc_verify_hmac_id(asoc, hmac_id: auth_hdr->hmac_id))
4379	return SCTP_IERROR_AUTH_BAD_HMAC;
4380
4381	/* Make sure that the provided shared key identifier has been
4382	* configured
4383	*/
4384	key_id = ntohs(auth_hdr->shkey_id);
4385	if (key_id != asoc->active_key_id) {
4386	sh_key = sctp_auth_get_shkey(asoc, key_id);
4387	if (!sh_key)
4388	return SCTP_IERROR_AUTH_BAD_KEYID;
4389	}
4390
4391	/* Make sure that the length of the signature matches what
4392	* we expect.
4393	*/
4394	sig_len = ntohs(chunk->chunk_hdr->length) -
4395	sizeof(struct sctp_auth_chunk);
4396	hmac = sctp_auth_get_hmac(ntohs(auth_hdr->hmac_id));
4397	if (sig_len != hmac->hmac_len)
4398	return SCTP_IERROR_PROTO_VIOLATION;
4399
4400	/* Now that we've done validation checks, we can compute and
4401	* verify the hmac. The steps involved are:
4402	* 1. Save the digest from the chunk.
4403	* 2. Zero out the digest in the chunk.
4404	* 3. Compute the new digest
4405	* 4. Compare saved and new digests.
4406	*/
4407	digest = (u8 *)(auth_hdr + 1);
4408	skb_pull(skb: chunk->skb, len: sig_len);
4409
4410	save_digest = kmemdup(digest, sig_len, GFP_ATOMIC);
4411	if (!save_digest)
4412	goto nomem;
4413
4414	memset(digest, 0, sig_len);
4415
4416	sctp_auth_calculate_hmac(asoc, skb: chunk->skb,
4417	auth: (struct sctp_auth_chunk *)chunk->chunk_hdr,
4418	ep_key: sh_key, GFP_ATOMIC);
4419
4420	/* Discard the packet if the digests do not match */
4421	if (crypto_memneq(a: save_digest, b: digest, size: sig_len)) {
4422	kfree(objp: save_digest);
4423	return SCTP_IERROR_BAD_SIG;
4424	}
4425
4426	kfree(objp: save_digest);
4427	chunk->auth = 1;
4428
4429	return SCTP_IERROR_NO_ERROR;
4430	nomem:
4431	return SCTP_IERROR_NOMEM;
4432	}
4433
4434	enum sctp_disposition sctp_sf_eat_auth(struct net *net,
4435	const struct sctp_endpoint *ep,
4436	const struct sctp_association *asoc,
4437	const union sctp_subtype type,
4438	void *arg, struct sctp_cmd_seq *commands)
4439	{
4440	struct sctp_chunk *chunk = arg;
4441	struct sctp_authhdr *auth_hdr;
4442	struct sctp_chunk *err_chunk;
4443	enum sctp_ierror error;
4444
4445	/* Make sure that the peer has AUTH capable */
4446	if (!asoc->peer.auth_capable)
4447	return sctp_sf_unk_chunk(net, ep, asoc, type, arg, commands);
4448
4449	if (!sctp_vtag_verify(chunk, asoc)) {
4450	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPORT_BAD_TAG,
4451	obj: SCTP_NULL());
4452	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4453	}
4454
4455	/* Make sure that the AUTH chunk has valid length. */
4456	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_auth_chunk)))
4457	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4458	commands);
4459
4460	auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
4461	error = sctp_sf_authenticate(asoc, chunk);
4462	switch (error) {
4463	case SCTP_IERROR_AUTH_BAD_HMAC:
4464	/* Generate the ERROR chunk and discard the rest
4465	* of the packet
4466	*/
4467	err_chunk = sctp_make_op_error(asoc, chunk,
4468	cause_code: SCTP_ERROR_UNSUP_HMAC,
4469	payload: &auth_hdr->hmac_id,
4470	paylen: sizeof(__u16), reserve_tail: 0);
4471	if (err_chunk) {
4472	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY,
4473	obj: SCTP_CHUNK(arg: err_chunk));
4474	}
4475	fallthrough;
4476	case SCTP_IERROR_AUTH_BAD_KEYID:
4477	case SCTP_IERROR_BAD_SIG:
4478	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4479
4480	case SCTP_IERROR_PROTO_VIOLATION:
4481	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4482	commands);
4483
4484	case SCTP_IERROR_NOMEM:
4485	return SCTP_DISPOSITION_NOMEM;
4486
4487	default: /* Prevent gcc warnings */
4488	break;
4489	}
4490
4491	if (asoc->active_key_id != ntohs(auth_hdr->shkey_id)) {
4492	struct sctp_ulpevent *ev;
4493
4494	ev = sctp_ulpevent_make_authkey(asoc, ntohs(auth_hdr->shkey_id),
4495	indication: SCTP_AUTH_NEW_KEY, GFP_ATOMIC);
4496
4497	if (!ev)
4498	return SCTP_DISPOSITION_NOMEM;
4499
4500	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_EVENT_ULP,
4501	obj: SCTP_ULPEVENT(arg: ev));
4502	}
4503
4504	return SCTP_DISPOSITION_CONSUME;
4505	}
4506
4507	/*
4508	* Process an unknown chunk.
4509	*
4510	* Section: 3.2. Also, 2.1 in the implementor's guide.
4511	*
4512	* Chunk Types are encoded such that the highest-order two bits specify
4513	* the action that must be taken if the processing endpoint does not
4514	* recognize the Chunk Type.
4515	*
4516	* 00 - Stop processing this SCTP packet and discard it, do not process
4517	* any further chunks within it.
4518	*
4519	* 01 - Stop processing this SCTP packet and discard it, do not process
4520	* any further chunks within it, and report the unrecognized
4521	* chunk in an 'Unrecognized Chunk Type'.
4522	*
4523	* 10 - Skip this chunk and continue processing.
4524	*
4525	* 11 - Skip this chunk and continue processing, but report in an ERROR
4526	* Chunk using the 'Unrecognized Chunk Type' cause of error.
4527	*
4528	* The return value is the disposition of the chunk.
4529	*/
4530	enum sctp_disposition sctp_sf_unk_chunk(struct net *net,
4531	const struct sctp_endpoint *ep,
4532	const struct sctp_association *asoc,
4533	const union sctp_subtype type,
4534	void *arg,
4535	struct sctp_cmd_seq *commands)
4536	{
4537	struct sctp_chunk *unk_chunk = arg;
4538	struct sctp_chunk *err_chunk;
4539	struct sctp_chunkhdr *hdr;
4540
4541	pr_debug("%s: processing unknown chunk id:%d\n", __func__, type.chunk);
4542
4543	if (!sctp_vtag_verify(chunk: unk_chunk, asoc))
4544	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4545
4546	/* Make sure that the chunk has a valid length.
4547	* Since we don't know the chunk type, we use a general
4548	* chunkhdr structure to make a comparison.
4549	*/
4550	if (!sctp_chunk_length_valid(chunk: unk_chunk, required_length: sizeof(*hdr)))
4551	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4552	commands);
4553
4554	switch (type.chunk & SCTP_CID_ACTION_MASK) {
4555	case SCTP_CID_ACTION_DISCARD:
4556	/* Discard the packet. */
4557	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4558	case SCTP_CID_ACTION_DISCARD_ERR:
4559	/* Generate an ERROR chunk as response. */
4560	hdr = unk_chunk->chunk_hdr;
4561	err_chunk = sctp_make_op_error(asoc, chunk: unk_chunk,
4562	cause_code: SCTP_ERROR_UNKNOWN_CHUNK, payload: hdr,
4563	SCTP_PAD4(ntohs(hdr->length)),
4564	reserve_tail: 0);
4565	if (err_chunk) {
4566	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY,
4567	obj: SCTP_CHUNK(arg: err_chunk));
4568	}
4569
4570	/* Discard the packet. */
4571	sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4572	return SCTP_DISPOSITION_CONSUME;
4573	case SCTP_CID_ACTION_SKIP:
4574	/* Skip the chunk. */
4575	return SCTP_DISPOSITION_DISCARD;
4576	case SCTP_CID_ACTION_SKIP_ERR:
4577	/* Generate an ERROR chunk as response. */
4578	hdr = unk_chunk->chunk_hdr;
4579	err_chunk = sctp_make_op_error(asoc, chunk: unk_chunk,
4580	cause_code: SCTP_ERROR_UNKNOWN_CHUNK, payload: hdr,
4581	SCTP_PAD4(ntohs(hdr->length)),
4582	reserve_tail: 0);
4583	if (err_chunk) {
4584	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY,
4585	obj: SCTP_CHUNK(arg: err_chunk));
4586	}
4587	/* Skip the chunk. */
4588	return SCTP_DISPOSITION_CONSUME;
4589	default:
4590	break;
4591	}
4592
4593	return SCTP_DISPOSITION_DISCARD;
4594	}
4595
4596	/*
4597	* Discard the chunk.
4598	*
4599	* Section: 0.2, 5.2.3, 5.2.5, 5.2.6, 6.0, 8.4.6, 8.5.1c, 9.2
4600	* [Too numerous to mention...]
4601	* Verification Tag: No verification needed.
4602	* Inputs
4603	* (endpoint, asoc, chunk)
4604	*
4605	* Outputs
4606	* (asoc, reply_msg, msg_up, timers, counters)
4607	*
4608	* The return value is the disposition of the chunk.
4609	*/
4610	enum sctp_disposition sctp_sf_discard_chunk(struct net *net,
4611	const struct sctp_endpoint *ep,
4612	const struct sctp_association *asoc,
4613	const union sctp_subtype type,
4614	void *arg,
4615	struct sctp_cmd_seq *commands)
4616	{
4617	struct sctp_chunk *chunk = arg;
4618
4619	if (asoc && !sctp_vtag_verify(chunk, asoc))
4620	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4621
4622	/* Make sure that the chunk has a valid length.
4623	* Since we don't know the chunk type, we use a general
4624	* chunkhdr structure to make a comparison.
4625	*/
4626	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_chunkhdr)))
4627	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4628	commands);
4629
4630	pr_debug("%s: chunk:%d is discarded\n", __func__, type.chunk);
4631
4632	return SCTP_DISPOSITION_DISCARD;
4633	}
4634
4635	/*
4636	* Discard the whole packet.
4637	*
4638	* Section: 8.4 2)
4639	*
4640	* 2) If the OOTB packet contains an ABORT chunk, the receiver MUST
4641	* silently discard the OOTB packet and take no further action.
4642	*
4643	* Verification Tag: No verification necessary
4644	*
4645	* Inputs
4646	* (endpoint, asoc, chunk)
4647	*
4648	* Outputs
4649	* (asoc, reply_msg, msg_up, timers, counters)
4650	*
4651	* The return value is the disposition of the chunk.
4652	*/
4653	enum sctp_disposition sctp_sf_pdiscard(struct net *net,
4654	const struct sctp_endpoint *ep,
4655	const struct sctp_association *asoc,
4656	const union sctp_subtype type,
4657	void *arg, struct sctp_cmd_seq *commands)
4658	{
4659	SCTP_INC_STATS(net, SCTP_MIB_IN_PKT_DISCARDS);
4660	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_DISCARD_PACKET, obj: SCTP_NULL());
4661
4662	return SCTP_DISPOSITION_CONSUME;
4663	}
4664
4665
4666	/*
4667	* The other end is violating protocol.
4668	*
4669	* Section: Not specified
4670	* Verification Tag: Not specified
4671	* Inputs
4672	* (endpoint, asoc, chunk)
4673	*
4674	* Outputs
4675	* (asoc, reply_msg, msg_up, timers, counters)
4676	*
4677	* We simply tag the chunk as a violation. The state machine will log
4678	* the violation and continue.
4679	*/
4680	enum sctp_disposition sctp_sf_violation(struct net *net,
4681	const struct sctp_endpoint *ep,
4682	const struct sctp_association *asoc,
4683	const union sctp_subtype type,
4684	void *arg,
4685	struct sctp_cmd_seq *commands)
4686	{
4687	struct sctp_chunk *chunk = arg;
4688
4689	if (!sctp_vtag_verify(chunk, asoc))
4690	return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
4691
4692	/* Make sure that the chunk has a valid length. */
4693	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(struct sctp_chunkhdr)))
4694	return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
4695	commands);
4696
4697	return SCTP_DISPOSITION_VIOLATION;
4698	}
4699
4700	/*
4701	* Common function to handle a protocol violation.
4702	*/
4703	static enum sctp_disposition sctp_sf_abort_violation(
4704	struct net *net,
4705	const struct sctp_endpoint *ep,
4706	const struct sctp_association *asoc,
4707	void *arg,
4708	struct sctp_cmd_seq *commands,
4709	const __u8 *payload,
4710	const size_t paylen)
4711	{
4712	struct sctp_packet *packet = NULL;
4713	struct sctp_chunk *chunk = arg;
4714	struct sctp_chunk *abort = NULL;
4715
4716	/* SCTP-AUTH, Section 6.3:
4717	* It should be noted that if the receiver wants to tear
4718	* down an association in an authenticated way only, the
4719	* handling of malformed packets should not result in
4720	* tearing down the association.
4721	*
4722	* This means that if we only want to abort associations
4723	* in an authenticated way (i.e AUTH+ABORT), then we
4724	* can't destroy this association just because the packet
4725	* was malformed.
4726	*/
4727	if (sctp_auth_recv_cid(chunk: SCTP_CID_ABORT, asoc))
4728	goto discard;
4729
4730	/* Make the abort chunk. */
4731	abort = sctp_make_abort_violation(asoc, chunk, payload, paylen);
4732	if (!abort)
4733	goto nomem;
4734
4735	if (asoc) {
4736	/* Treat INIT-ACK as a special case during COOKIE-WAIT. */
4737	if (chunk->chunk_hdr->type == SCTP_CID_INIT_ACK &&
4738	!asoc->peer.i.init_tag) {
4739	struct sctp_initack_chunk *initack;
4740
4741	initack = (struct sctp_initack_chunk *)chunk->chunk_hdr;
4742	if (!sctp_chunk_length_valid(chunk, required_length: sizeof(*initack)))
4743	abort->chunk_hdr->flags |= SCTP_CHUNK_FLAG_T;
4744	else {
4745	unsigned int inittag;
4746
4747	inittag = ntohl(initack->init_hdr.init_tag);
4748	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_UPDATE_INITTAG,
4749	obj: SCTP_U32(arg: inittag));
4750	}
4751	}
4752
4753	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: abort));
4754	SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
4755
4756	if (asoc->state <= SCTP_STATE_COOKIE_ECHOED) {
4757	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_STOP,
4758	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T1_INIT));
4759	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SET_SK_ERR,
4760	obj: SCTP_ERROR(ECONNREFUSED));
4761	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_INIT_FAILED,
4762	obj: SCTP_PERR(arg: SCTP_ERROR_PROTO_VIOLATION));
4763	} else {
4764	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SET_SK_ERR,
4765	obj: SCTP_ERROR(ECONNABORTED));
4766	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_ASSOC_FAILED,
4767	obj: SCTP_PERR(arg: SCTP_ERROR_PROTO_VIOLATION));
4768	SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
4769	}
4770	} else {
4771	packet = sctp_ootb_pkt_new(net, asoc, chunk);
4772
4773	if (!packet)
4774	goto nomem_pkt;
4775
4776	if (sctp_test_T_bit(abort))
4777	packet->vtag = ntohl(chunk->sctp_hdr->vtag);
4778
4779	abort->skb->sk = ep->base.sk;
4780
4781	sctp_packet_append_chunk(packet, chunk: abort);
4782
4783	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SEND_PKT,
4784	obj: SCTP_PACKET(arg: packet));
4785
4786	SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
4787	}
4788
4789	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
4790
4791	discard:
4792	sctp_sf_pdiscard(net, ep, asoc, type: SCTP_ST_CHUNK(arg: 0), arg, commands);
4793	return SCTP_DISPOSITION_ABORT;
4794
4795	nomem_pkt:
4796	sctp_chunk_free(abort);
4797	nomem:
4798	return SCTP_DISPOSITION_NOMEM;
4799	}
4800
4801	/*
4802	* Handle a protocol violation when the chunk length is invalid.
4803	* "Invalid" length is identified as smaller than the minimal length a
4804	* given chunk can be. For example, a SACK chunk has invalid length
4805	* if its length is set to be smaller than the size of struct sctp_sack_chunk.
4806	*
4807	* We inform the other end by sending an ABORT with a Protocol Violation
4808	* error code.
4809	*
4810	* Section: Not specified
4811	* Verification Tag: Nothing to do
4812	* Inputs
4813	* (endpoint, asoc, chunk)
4814	*
4815	* Outputs
4816	* (reply_msg, msg_up, counters)
4817	*
4818	* Generate an ABORT chunk and terminate the association.
4819	*/
4820	static enum sctp_disposition sctp_sf_violation_chunklen(
4821	struct net *net,
4822	const struct sctp_endpoint *ep,
4823	const struct sctp_association *asoc,
4824	const union sctp_subtype type,
4825	void *arg,
4826	struct sctp_cmd_seq *commands)
4827	{
4828	static const char err_str[] = "The following chunk had invalid length:";
4829
4830	return sctp_sf_abort_violation(net, ep, asoc, arg, commands, payload: err_str,
4831	paylen: sizeof(err_str));
4832	}
4833
4834	/*
4835	* Handle a protocol violation when the parameter length is invalid.
4836	* If the length is smaller than the minimum length of a given parameter,
4837	* or accumulated length in multi parameters exceeds the end of the chunk,
4838	* the length is considered as invalid.
4839	*/
4840	static enum sctp_disposition sctp_sf_violation_paramlen(
4841	struct net *net,
4842	const struct sctp_endpoint *ep,
4843	const struct sctp_association *asoc,
4844	const union sctp_subtype type,
4845	void *arg, void *ext,
4846	struct sctp_cmd_seq *commands)
4847	{
4848	struct sctp_paramhdr *param = ext;
4849	struct sctp_chunk *abort = NULL;
4850	struct sctp_chunk *chunk = arg;
4851
4852	if (sctp_auth_recv_cid(chunk: SCTP_CID_ABORT, asoc))
4853	goto discard;
4854
4855	/* Make the abort chunk. */
4856	abort = sctp_make_violation_paramlen(asoc, chunk, param);
4857	if (!abort)
4858	goto nomem;
4859
4860	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: abort));
4861	SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
4862
4863	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SET_SK_ERR,
4864	obj: SCTP_ERROR(ECONNABORTED));
4865	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_ASSOC_FAILED,
4866	obj: SCTP_PERR(arg: SCTP_ERROR_PROTO_VIOLATION));
4867	SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
4868	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
4869
4870	discard:
4871	sctp_sf_pdiscard(net, ep, asoc, type: SCTP_ST_CHUNK(arg: 0), arg, commands);
4872	return SCTP_DISPOSITION_ABORT;
4873	nomem:
4874	return SCTP_DISPOSITION_NOMEM;
4875	}
4876
4877	/* Handle a protocol violation when the peer trying to advance the
4878	* cumulative tsn ack to a point beyond the max tsn currently sent.
4879	*
4880	* We inform the other end by sending an ABORT with a Protocol Violation
4881	* error code.
4882	*/
4883	static enum sctp_disposition sctp_sf_violation_ctsn(
4884	struct net *net,
4885	const struct sctp_endpoint *ep,
4886	const struct sctp_association *asoc,
4887	const union sctp_subtype type,
4888	void *arg,
4889	struct sctp_cmd_seq *commands)
4890	{
4891	static const char err_str[] = "The cumulative tsn ack beyond the max tsn currently sent:";
4892
4893	return sctp_sf_abort_violation(net, ep, asoc, arg, commands, payload: err_str,
4894	paylen: sizeof(err_str));
4895	}
4896
4897	/* Handle protocol violation of an invalid chunk bundling. For example,
4898	* when we have an association and we receive bundled INIT-ACK, or
4899	* SHUTDOWN-COMPLETE, our peer is clearly violating the "MUST NOT bundle"
4900	* statement from the specs. Additionally, there might be an attacker
4901	* on the path and we may not want to continue this communication.
4902	*/
4903	static enum sctp_disposition sctp_sf_violation_chunk(
4904	struct net *net,
4905	const struct sctp_endpoint *ep,
4906	const struct sctp_association *asoc,
4907	const union sctp_subtype type,
4908	void *arg,
4909	struct sctp_cmd_seq *commands)
4910	{
4911	static const char err_str[] = "The following chunk violates protocol:";
4912
4913	return sctp_sf_abort_violation(net, ep, asoc, arg, commands, payload: err_str,
4914	paylen: sizeof(err_str));
4915	}
4916	/***************************************************************************
4917	* These are the state functions for handling primitive (Section 10) events.
4918	***************************************************************************/
4919	/*
4920	* sctp_sf_do_prm_asoc
4921	*
4922	* Section: 10.1 ULP-to-SCTP
4923	* B) Associate
4924	*
4925	* Format: ASSOCIATE(local SCTP instance name, destination transport addr,
4926	* outbound stream count)
4927	* -> association id [,destination transport addr list] [,outbound stream
4928	* count]
4929	*
4930	* This primitive allows the upper layer to initiate an association to a
4931	* specific peer endpoint.
4932	*
4933	* The peer endpoint shall be specified by one of the transport addresses
4934	* which defines the endpoint (see Section 1.4). If the local SCTP
4935	* instance has not been initialized, the ASSOCIATE is considered an
4936	* error.
4937	* [This is not relevant for the kernel implementation since we do all
4938	* initialization at boot time. It we hadn't initialized we wouldn't
4939	* get anywhere near this code.]
4940	*
4941	* An association id, which is a local handle to the SCTP association,
4942	* will be returned on successful establishment of the association. If
4943	* SCTP is not able to open an SCTP association with the peer endpoint,
4944	* an error is returned.
4945	* [In the kernel implementation, the struct sctp_association needs to
4946	* be created BEFORE causing this primitive to run.]
4947	*
4948	* Other association parameters may be returned, including the
4949	* complete destination transport addresses of the peer as well as the
4950	* outbound stream count of the local endpoint. One of the transport
4951	* address from the returned destination addresses will be selected by
4952	* the local endpoint as default primary path for sending SCTP packets
4953	* to this peer. The returned "destination transport addr list" can
4954	* be used by the ULP to change the default primary path or to force
4955	* sending a packet to a specific transport address. [All of this
4956	* stuff happens when the INIT ACK arrives. This is a NON-BLOCKING
4957	* function.]
4958	*
4959	* Mandatory attributes:
4960	*
4961	* o local SCTP instance name - obtained from the INITIALIZE operation.
4962	* [This is the argument asoc.]
4963	* o destination transport addr - specified as one of the transport
4964	* addresses of the peer endpoint with which the association is to be
4965	* established.
4966	* [This is asoc->peer.active_path.]
4967	* o outbound stream count - the number of outbound streams the ULP
4968	* would like to open towards this peer endpoint.
4969	* [BUG: This is not currently implemented.]
4970	* Optional attributes:
4971	*
4972	* None.
4973	*
4974	* The return value is a disposition.
4975	*/
4976	enum sctp_disposition sctp_sf_do_prm_asoc(struct net *net,
4977	const struct sctp_endpoint *ep,
4978	const struct sctp_association *asoc,
4979	const union sctp_subtype type,
4980	void *arg,
4981	struct sctp_cmd_seq *commands)
4982	{
4983	struct sctp_association *my_asoc;
4984	struct sctp_chunk *repl;
4985
4986	/* The comment below says that we enter COOKIE-WAIT AFTER
4987	* sending the INIT, but that doesn't actually work in our
4988	* implementation...
4989	*/
4990	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_NEW_STATE,
4991	obj: SCTP_STATE(arg: SCTP_STATE_COOKIE_WAIT));
4992
4993	/* RFC 2960 5.1 Normal Establishment of an Association
4994	*
4995	* A) "A" first sends an INIT chunk to "Z". In the INIT, "A"
4996	* must provide its Verification Tag (Tag_A) in the Initiate
4997	* Tag field. Tag_A SHOULD be a random number in the range of
4998	* 1 to 4294967295 (see 5.3.1 for Tag value selection). ...
4999	*/
5000
5001	repl = sctp_make_init(asoc, bp: &asoc->base.bind_addr, GFP_ATOMIC, vparam_len: 0);
5002	if (!repl)
5003	goto nomem;
5004
5005	/* Choose transport for INIT. */
5006	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_INIT_CHOOSE_TRANSPORT,
5007	obj: SCTP_CHUNK(arg: repl));
5008
5009	/* Cast away the const modifier, as we want to just
5010	* rerun it through as a sideffect.
5011	*/
5012	my_asoc = (struct sctp_association *)asoc;
5013	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_NEW_ASOC, obj: SCTP_ASOC(arg: my_asoc));
5014
5015	/* After sending the INIT, "A" starts the T1-init timer and
5016	* enters the COOKIE-WAIT state.
5017	*/
5018	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_START,
5019	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T1_INIT));
5020	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: repl));
5021	return SCTP_DISPOSITION_CONSUME;
5022
5023	nomem:
5024	return SCTP_DISPOSITION_NOMEM;
5025	}
5026
5027	/*
5028	* Process the SEND primitive.
5029	*
5030	* Section: 10.1 ULP-to-SCTP
5031	* E) Send
5032	*
5033	* Format: SEND(association id, buffer address, byte count [,context]
5034	* [,stream id] [,life time] [,destination transport address]
5035	* [,unorder flag] [,no-bundle flag] [,payload protocol-id] )
5036	* -> result
5037	*
5038	* This is the main method to send user data via SCTP.
5039	*
5040	* Mandatory attributes:
5041	*
5042	* o association id - local handle to the SCTP association
5043	*
5044	* o buffer address - the location where the user message to be
5045	* transmitted is stored;
5046	*
5047	* o byte count - The size of the user data in number of bytes;
5048	*
5049	* Optional attributes:
5050	*
5051	* o context - an optional 32 bit integer that will be carried in the
5052	* sending failure notification to the ULP if the transportation of
5053	* this User Message fails.
5054	*
5055	* o stream id - to indicate which stream to send the data on. If not
5056	* specified, stream 0 will be used.
5057	*
5058	* o life time - specifies the life time of the user data. The user data
5059	* will not be sent by SCTP after the life time expires. This
5060	* parameter can be used to avoid efforts to transmit stale
5061	* user messages. SCTP notifies the ULP if the data cannot be
5062	* initiated to transport (i.e. sent to the destination via SCTP's
5063	* send primitive) within the life time variable. However, the
5064	* user data will be transmitted if SCTP has attempted to transmit a
5065	* chunk before the life time expired.
5066	*
5067	* o destination transport address - specified as one of the destination
5068	* transport addresses of the peer endpoint to which this packet
5069	* should be sent. Whenever possible, SCTP should use this destination
5070	* transport address for sending the packets, instead of the current
5071	* primary path.
5072	*
5073	* o unorder flag - this flag, if present, indicates that the user
5074	* would like the data delivered in an unordered fashion to the peer
5075	* (i.e., the U flag is set to 1 on all DATA chunks carrying this
5076	* message).
5077	*
5078	* o no-bundle flag - instructs SCTP not to bundle this user data with
5079	* other outbound DATA chunks. SCTP MAY still bundle even when
5080	* this flag is present, when faced with network congestion.
5081	*
5082	* o payload protocol-id - A 32 bit unsigned integer that is to be
5083	* passed to the peer indicating the type of payload protocol data
5084	* being transmitted. This value is passed as opaque data by SCTP.
5085	*
5086	* The return value is the disposition.
5087	*/
5088	enum sctp_disposition sctp_sf_do_prm_send(struct net *net,
5089	const struct sctp_endpoint *ep,
5090	const struct sctp_association *asoc,
5091	const union sctp_subtype type,
5092	void *arg,
5093	struct sctp_cmd_seq *commands)
5094	{
5095	struct sctp_datamsg *msg = arg;
5096
5097	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SEND_MSG, obj: SCTP_DATAMSG(arg: msg));
5098	return SCTP_DISPOSITION_CONSUME;
5099	}
5100
5101	/*
5102	* Process the SHUTDOWN primitive.
5103	*
5104	* Section: 10.1:
5105	* C) Shutdown
5106	*
5107	* Format: SHUTDOWN(association id)
5108	* -> result
5109	*
5110	* Gracefully closes an association. Any locally queued user data
5111	* will be delivered to the peer. The association will be terminated only
5112	* after the peer acknowledges all the SCTP packets sent. A success code
5113	* will be returned on successful termination of the association. If
5114	* attempting to terminate the association results in a failure, an error
5115	* code shall be returned.
5116	*
5117	* Mandatory attributes:
5118	*
5119	* o association id - local handle to the SCTP association
5120	*
5121	* Optional attributes:
5122	*
5123	* None.
5124	*
5125	* The return value is the disposition.
5126	*/
5127	enum sctp_disposition sctp_sf_do_9_2_prm_shutdown(
5128	struct net *net,
5129	const struct sctp_endpoint *ep,
5130	const struct sctp_association *asoc,
5131	const union sctp_subtype type,
5132	void *arg,
5133	struct sctp_cmd_seq *commands)
5134	{
5135	enum sctp_disposition disposition;
5136
5137	/* From 9.2 Shutdown of an Association
5138	* Upon receipt of the SHUTDOWN primitive from its upper
5139	* layer, the endpoint enters SHUTDOWN-PENDING state and
5140	* remains there until all outstanding data has been
5141	* acknowledged by its peer. The endpoint accepts no new data
5142	* from its upper layer, but retransmits data to the far end
5143	* if necessary to fill gaps.
5144	*/
5145	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_NEW_STATE,
5146	obj: SCTP_STATE(arg: SCTP_STATE_SHUTDOWN_PENDING));
5147
5148	disposition = SCTP_DISPOSITION_CONSUME;
5149	if (sctp_outq_is_empty(&asoc->outqueue)) {
5150	disposition = sctp_sf_do_9_2_start_shutdown(net, ep, asoc, type,
5151	arg, commands);
5152	}
5153
5154	return disposition;
5155	}
5156
5157	/*
5158	* Process the ABORT primitive.
5159	*
5160	* Section: 10.1:
5161	* C) Abort
5162	*
5163	* Format: Abort(association id [, cause code])
5164	* -> result
5165	*
5166	* Ungracefully closes an association. Any locally queued user data
5167	* will be discarded and an ABORT chunk is sent to the peer. A success code
5168	* will be returned on successful abortion of the association. If
5169	* attempting to abort the association results in a failure, an error
5170	* code shall be returned.
5171	*
5172	* Mandatory attributes:
5173	*
5174	* o association id - local handle to the SCTP association
5175	*
5176	* Optional attributes:
5177	*
5178	* o cause code - reason of the abort to be passed to the peer
5179	*
5180	* None.
5181	*
5182	* The return value is the disposition.
5183	*/
5184	enum sctp_disposition sctp_sf_do_9_1_prm_abort(
5185	struct net *net,
5186	const struct sctp_endpoint *ep,
5187	const struct sctp_association *asoc,
5188	const union sctp_subtype type,
5189	void *arg,
5190	struct sctp_cmd_seq *commands)
5191	{
5192	/* From 9.1 Abort of an Association
5193	* Upon receipt of the ABORT primitive from its upper
5194	* layer, the endpoint enters CLOSED state and
5195	* discard all outstanding data has been
5196	* acknowledged by its peer. The endpoint accepts no new data
5197	* from its upper layer, but retransmits data to the far end
5198	* if necessary to fill gaps.
5199	*/
5200	struct sctp_chunk *abort = arg;
5201
5202	if (abort)
5203	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: abort));
5204
5205	/* Even if we can't send the ABORT due to low memory delete the
5206	* TCB. This is a departure from our typical NOMEM handling.
5207	*/
5208
5209	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SET_SK_ERR,
5210	obj: SCTP_ERROR(ECONNABORTED));
5211	/* Delete the established association. */
5212	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_ASSOC_FAILED,
5213	obj: SCTP_PERR(arg: SCTP_ERROR_USER_ABORT));
5214
5215	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
5216	SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
5217
5218	return SCTP_DISPOSITION_ABORT;
5219	}
5220
5221	/* We tried an illegal operation on an association which is closed. */
5222	enum sctp_disposition sctp_sf_error_closed(struct net *net,
5223	const struct sctp_endpoint *ep,
5224	const struct sctp_association *asoc,
5225	const union sctp_subtype type,
5226	void *arg,
5227	struct sctp_cmd_seq *commands)
5228	{
5229	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPORT_ERROR, obj: SCTP_ERROR(arg: -EINVAL));
5230	return SCTP_DISPOSITION_CONSUME;
5231	}
5232
5233	/* We tried an illegal operation on an association which is shutting
5234	* down.
5235	*/
5236	enum sctp_disposition sctp_sf_error_shutdown(
5237	struct net *net,
5238	const struct sctp_endpoint *ep,
5239	const struct sctp_association *asoc,
5240	const union sctp_subtype type,
5241	void *arg,
5242	struct sctp_cmd_seq *commands)
5243	{
5244	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPORT_ERROR,
5245	obj: SCTP_ERROR(arg: -ESHUTDOWN));
5246	return SCTP_DISPOSITION_CONSUME;
5247	}
5248
5249	/*
5250	* sctp_cookie_wait_prm_shutdown
5251	*
5252	* Section: 4 Note: 2
5253	* Verification Tag:
5254	* Inputs
5255	* (endpoint, asoc)
5256	*
5257	* The RFC does not explicitly address this issue, but is the route through the
5258	* state table when someone issues a shutdown while in COOKIE_WAIT state.
5259	*
5260	* Outputs
5261	* (timers)
5262	*/
5263	enum sctp_disposition sctp_sf_cookie_wait_prm_shutdown(
5264	struct net *net,
5265	const struct sctp_endpoint *ep,
5266	const struct sctp_association *asoc,
5267	const union sctp_subtype type,
5268	void *arg,
5269	struct sctp_cmd_seq *commands)
5270	{
5271	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_STOP,
5272	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T1_INIT));
5273
5274	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_NEW_STATE,
5275	obj: SCTP_STATE(arg: SCTP_STATE_CLOSED));
5276
5277	SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS);
5278
5279	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_DELETE_TCB, obj: SCTP_NULL());
5280
5281	return SCTP_DISPOSITION_DELETE_TCB;
5282	}
5283
5284	/*
5285	* sctp_cookie_echoed_prm_shutdown
5286	*
5287	* Section: 4 Note: 2
5288	* Verification Tag:
5289	* Inputs
5290	* (endpoint, asoc)
5291	*
5292	* The RFC does not explicitly address this issue, but is the route through the
5293	* state table when someone issues a shutdown while in COOKIE_ECHOED state.
5294	*
5295	* Outputs
5296	* (timers)
5297	*/
5298	enum sctp_disposition sctp_sf_cookie_echoed_prm_shutdown(
5299	struct net *net,
5300	const struct sctp_endpoint *ep,
5301	const struct sctp_association *asoc,
5302	const union sctp_subtype type,
5303	void *arg,
5304	struct sctp_cmd_seq *commands)
5305	{
5306	/* There is a single T1 timer, so we should be able to use
5307	* common function with the COOKIE-WAIT state.
5308	*/
5309	return sctp_sf_cookie_wait_prm_shutdown(net, ep, asoc, type, arg, commands);
5310	}
5311
5312	/*
5313	* sctp_sf_cookie_wait_prm_abort
5314	*
5315	* Section: 4 Note: 2
5316	* Verification Tag:
5317	* Inputs
5318	* (endpoint, asoc)
5319	*
5320	* The RFC does not explicitly address this issue, but is the route through the
5321	* state table when someone issues an abort while in COOKIE_WAIT state.
5322	*
5323	* Outputs
5324	* (timers)
5325	*/
5326	enum sctp_disposition sctp_sf_cookie_wait_prm_abort(
5327	struct net *net,
5328	const struct sctp_endpoint *ep,
5329	const struct sctp_association *asoc,
5330	const union sctp_subtype type,
5331	void *arg,
5332	struct sctp_cmd_seq *commands)
5333	{
5334	struct sctp_chunk *abort = arg;
5335
5336	/* Stop T1-init timer */
5337	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_STOP,
5338	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T1_INIT));
5339
5340	if (abort)
5341	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: abort));
5342
5343	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_NEW_STATE,
5344	obj: SCTP_STATE(arg: SCTP_STATE_CLOSED));
5345
5346	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
5347
5348	/* Even if we can't send the ABORT due to low memory delete the
5349	* TCB. This is a departure from our typical NOMEM handling.
5350	*/
5351
5352	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SET_SK_ERR,
5353	obj: SCTP_ERROR(ECONNREFUSED));
5354	/* Delete the established association. */
5355	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_INIT_FAILED,
5356	obj: SCTP_PERR(arg: SCTP_ERROR_USER_ABORT));
5357
5358	return SCTP_DISPOSITION_ABORT;
5359	}
5360
5361	/*
5362	* sctp_sf_cookie_echoed_prm_abort
5363	*
5364	* Section: 4 Note: 3
5365	* Verification Tag:
5366	* Inputs
5367	* (endpoint, asoc)
5368	*
5369	* The RFC does not explcitly address this issue, but is the route through the
5370	* state table when someone issues an abort while in COOKIE_ECHOED state.
5371	*
5372	* Outputs
5373	* (timers)
5374	*/
5375	enum sctp_disposition sctp_sf_cookie_echoed_prm_abort(
5376	struct net *net,
5377	const struct sctp_endpoint *ep,
5378	const struct sctp_association *asoc,
5379	const union sctp_subtype type,
5380	void *arg,
5381	struct sctp_cmd_seq *commands)
5382	{
5383	/* There is a single T1 timer, so we should be able to use
5384	* common function with the COOKIE-WAIT state.
5385	*/
5386	return sctp_sf_cookie_wait_prm_abort(net, ep, asoc, type, arg, commands);
5387	}
5388
5389	/*
5390	* sctp_sf_shutdown_pending_prm_abort
5391	*
5392	* Inputs
5393	* (endpoint, asoc)
5394	*
5395	* The RFC does not explicitly address this issue, but is the route through the
5396	* state table when someone issues an abort while in SHUTDOWN-PENDING state.
5397	*
5398	* Outputs
5399	* (timers)
5400	*/
5401	enum sctp_disposition sctp_sf_shutdown_pending_prm_abort(
5402	struct net *net,
5403	const struct sctp_endpoint *ep,
5404	const struct sctp_association *asoc,
5405	const union sctp_subtype type,
5406	void *arg,
5407	struct sctp_cmd_seq *commands)
5408	{
5409	/* Stop the T5-shutdown guard timer. */
5410	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_STOP,
5411	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5412
5413	return sctp_sf_do_9_1_prm_abort(net, ep, asoc, type, arg, commands);
5414	}
5415
5416	/*
5417	* sctp_sf_shutdown_sent_prm_abort
5418	*
5419	* Inputs
5420	* (endpoint, asoc)
5421	*
5422	* The RFC does not explicitly address this issue, but is the route through the
5423	* state table when someone issues an abort while in SHUTDOWN-SENT state.
5424	*
5425	* Outputs
5426	* (timers)
5427	*/
5428	enum sctp_disposition sctp_sf_shutdown_sent_prm_abort(
5429	struct net *net,
5430	const struct sctp_endpoint *ep,
5431	const struct sctp_association *asoc,
5432	const union sctp_subtype type,
5433	void *arg,
5434	struct sctp_cmd_seq *commands)
5435	{
5436	/* Stop the T2-shutdown timer. */
5437	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_STOP,
5438	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5439
5440	/* Stop the T5-shutdown guard timer. */
5441	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_STOP,
5442	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5443
5444	return sctp_sf_do_9_1_prm_abort(net, ep, asoc, type, arg, commands);
5445	}
5446
5447	/*
5448	* sctp_sf_cookie_echoed_prm_abort
5449	*
5450	* Inputs
5451	* (endpoint, asoc)
5452	*
5453	* The RFC does not explcitly address this issue, but is the route through the
5454	* state table when someone issues an abort while in COOKIE_ECHOED state.
5455	*
5456	* Outputs
5457	* (timers)
5458	*/
5459	enum sctp_disposition sctp_sf_shutdown_ack_sent_prm_abort(
5460	struct net *net,
5461	const struct sctp_endpoint *ep,
5462	const struct sctp_association *asoc,
5463	const union sctp_subtype type,
5464	void *arg,
5465	struct sctp_cmd_seq *commands)
5466	{
5467	/* The same T2 timer, so we should be able to use
5468	* common function with the SHUTDOWN-SENT state.
5469	*/
5470	return sctp_sf_shutdown_sent_prm_abort(net, ep, asoc, type, arg, commands);
5471	}
5472
5473	/*
5474	* Process the REQUESTHEARTBEAT primitive
5475	*
5476	* 10.1 ULP-to-SCTP
5477	* J) Request Heartbeat
5478	*
5479	* Format: REQUESTHEARTBEAT(association id, destination transport address)
5480	*
5481	* -> result
5482	*
5483	* Instructs the local endpoint to perform a HeartBeat on the specified
5484	* destination transport address of the given association. The returned
5485	* result should indicate whether the transmission of the HEARTBEAT
5486	* chunk to the destination address is successful.
5487	*
5488	* Mandatory attributes:
5489	*
5490	* o association id - local handle to the SCTP association
5491	*
5492	* o destination transport address - the transport address of the
5493	* association on which a heartbeat should be issued.
5494	*/
5495	enum sctp_disposition sctp_sf_do_prm_requestheartbeat(
5496	struct net *net,
5497	const struct sctp_endpoint *ep,
5498	const struct sctp_association *asoc,
5499	const union sctp_subtype type,
5500	void *arg,
5501	struct sctp_cmd_seq *commands)
5502	{
5503	if (SCTP_DISPOSITION_NOMEM == sctp_sf_heartbeat(ep, asoc, type,
5504	arg: (struct sctp_transport *)arg, commands))
5505	return SCTP_DISPOSITION_NOMEM;
5506
5507	/*
5508	* RFC 2960 (bis), section 8.3
5509	*
5510	* D) Request an on-demand HEARTBEAT on a specific destination
5511	* transport address of a given association.
5512	*
5513	* The endpoint should increment the respective error counter of
5514	* the destination transport address each time a HEARTBEAT is sent
5515	* to that address and not acknowledged within one RTO.
5516	*
5517	*/
5518	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TRANSPORT_HB_SENT,
5519	obj: SCTP_TRANSPORT(arg));
5520	return SCTP_DISPOSITION_CONSUME;
5521	}
5522
5523	/*
5524	* ADDIP Section 4.1 ASCONF Chunk Procedures
5525	* When an endpoint has an ASCONF signaled change to be sent to the
5526	* remote endpoint it should do A1 to A9
5527	*/
5528	enum sctp_disposition sctp_sf_do_prm_asconf(struct net *net,
5529	const struct sctp_endpoint *ep,
5530	const struct sctp_association *asoc,
5531	const union sctp_subtype type,
5532	void *arg,
5533	struct sctp_cmd_seq *commands)
5534	{
5535	struct sctp_chunk *chunk = arg;
5536
5537	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SETUP_T4, obj: SCTP_CHUNK(arg: chunk));
5538	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_START,
5539	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T4_RTO));
5540	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: chunk));
5541	return SCTP_DISPOSITION_CONSUME;
5542	}
5543
5544	/* RE-CONFIG Section 5.1 RECONF Chunk Procedures */
5545	enum sctp_disposition sctp_sf_do_prm_reconf(struct net *net,
5546	const struct sctp_endpoint *ep,
5547	const struct sctp_association *asoc,
5548	const union sctp_subtype type,
5549	void *arg,
5550	struct sctp_cmd_seq *commands)
5551	{
5552	struct sctp_chunk *chunk = arg;
5553
5554	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: chunk));
5555	return SCTP_DISPOSITION_CONSUME;
5556	}
5557
5558	/*
5559	* Ignore the primitive event
5560	*
5561	* The return value is the disposition of the primitive.
5562	*/
5563	enum sctp_disposition sctp_sf_ignore_primitive(
5564	struct net *net,
5565	const struct sctp_endpoint *ep,
5566	const struct sctp_association *asoc,
5567	const union sctp_subtype type,
5568	void *arg,
5569	struct sctp_cmd_seq *commands)
5570	{
5571	pr_debug("%s: primitive type:%d is ignored\n", __func__,
5572	type.primitive);
5573
5574	return SCTP_DISPOSITION_DISCARD;
5575	}
5576
5577	/***************************************************************************
5578	* These are the state functions for the OTHER events.
5579	***************************************************************************/
5580
5581	/*
5582	* When the SCTP stack has no more user data to send or retransmit, this
5583	* notification is given to the user. Also, at the time when a user app
5584	* subscribes to this event, if there is no data to be sent or
5585	* retransmit, the stack will immediately send up this notification.
5586	*/
5587	enum sctp_disposition sctp_sf_do_no_pending_tsn(
5588	struct net *net,
5589	const struct sctp_endpoint *ep,
5590	const struct sctp_association *asoc,
5591	const union sctp_subtype type,
5592	void *arg,
5593	struct sctp_cmd_seq *commands)
5594	{
5595	struct sctp_ulpevent *event;
5596
5597	event = sctp_ulpevent_make_sender_dry_event(asoc, GFP_ATOMIC);
5598	if (!event)
5599	return SCTP_DISPOSITION_NOMEM;
5600
5601	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_EVENT_ULP, obj: SCTP_ULPEVENT(arg: event));
5602
5603	return SCTP_DISPOSITION_CONSUME;
5604	}
5605
5606	/*
5607	* Start the shutdown negotiation.
5608	*
5609	* From Section 9.2:
5610	* Once all its outstanding data has been acknowledged, the endpoint
5611	* shall send a SHUTDOWN chunk to its peer including in the Cumulative
5612	* TSN Ack field the last sequential TSN it has received from the peer.
5613	* It shall then start the T2-shutdown timer and enter the SHUTDOWN-SENT
5614	* state. If the timer expires, the endpoint must re-send the SHUTDOWN
5615	* with the updated last sequential TSN received from its peer.
5616	*
5617	* The return value is the disposition.
5618	*/
5619	enum sctp_disposition sctp_sf_do_9_2_start_shutdown(
5620	struct net *net,
5621	const struct sctp_endpoint *ep,
5622	const struct sctp_association *asoc,
5623	const union sctp_subtype type,
5624	void *arg,
5625	struct sctp_cmd_seq *commands)
5626	{
5627	struct sctp_chunk *reply;
5628
5629	/* Once all its outstanding data has been acknowledged, the
5630	* endpoint shall send a SHUTDOWN chunk to its peer including
5631	* in the Cumulative TSN Ack field the last sequential TSN it
5632	* has received from the peer.
5633	*/
5634	reply = sctp_make_shutdown(asoc, chunk: arg);
5635	if (!reply)
5636	goto nomem;
5637
5638	/* Set the transport for the SHUTDOWN chunk and the timeout for the
5639	* T2-shutdown timer.
5640	*/
5641	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SETUP_T2, obj: SCTP_CHUNK(arg: reply));
5642
5643	/* It shall then start the T2-shutdown timer */
5644	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_START,
5645	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5646
5647	/* RFC 4960 Section 9.2
5648	* The sender of the SHUTDOWN MAY also start an overall guard timer
5649	* 'T5-shutdown-guard' to bound the overall time for shutdown sequence.
5650	*/
5651	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_RESTART,
5652	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5653
5654	if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
5655	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_STOP,
5656	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_AUTOCLOSE));
5657
5658	/* and enter the SHUTDOWN-SENT state. */
5659	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_NEW_STATE,
5660	obj: SCTP_STATE(arg: SCTP_STATE_SHUTDOWN_SENT));
5661
5662	/* sctp-implguide 2.10 Issues with Heartbeating and failover
5663	*
5664	* HEARTBEAT ... is discontinued after sending either SHUTDOWN
5665	* or SHUTDOWN-ACK.
5666	*/
5667	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_HB_TIMERS_STOP, obj: SCTP_NULL());
5668
5669	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: reply));
5670
5671	return SCTP_DISPOSITION_CONSUME;
5672
5673	nomem:
5674	return SCTP_DISPOSITION_NOMEM;
5675	}
5676
5677	/*
5678	* Generate a SHUTDOWN ACK now that everything is SACK'd.
5679	*
5680	* From Section 9.2:
5681	*
5682	* If it has no more outstanding DATA chunks, the SHUTDOWN receiver
5683	* shall send a SHUTDOWN ACK and start a T2-shutdown timer of its own,
5684	* entering the SHUTDOWN-ACK-SENT state. If the timer expires, the
5685	* endpoint must re-send the SHUTDOWN ACK.
5686	*
5687	* The return value is the disposition.
5688	*/
5689	enum sctp_disposition sctp_sf_do_9_2_shutdown_ack(
5690	struct net *net,
5691	const struct sctp_endpoint *ep,
5692	const struct sctp_association *asoc,
5693	const union sctp_subtype type,
5694	void *arg,
5695	struct sctp_cmd_seq *commands)
5696	{
5697	struct sctp_chunk *chunk = arg;
5698	struct sctp_chunk *reply;
5699
5700	/* There are 2 ways of getting here:
5701	* 1) called in response to a SHUTDOWN chunk
5702	* 2) called when SCTP_EVENT_NO_PENDING_TSN event is issued.
5703	*
5704	* For the case (2), the arg parameter is set to NULL. We need
5705	* to check that we have a chunk before accessing it's fields.
5706	*/
5707	if (chunk) {
5708	if (!sctp_vtag_verify(chunk, asoc))
5709	return sctp_sf_pdiscard(net, ep, asoc, type, arg,
5710	commands);
5711
5712	/* Make sure that the SHUTDOWN chunk has a valid length. */
5713	if (!sctp_chunk_length_valid(
5714	chunk, required_length: sizeof(struct sctp_shutdown_chunk)))
5715	return sctp_sf_violation_chunklen(net, ep, asoc, type,
5716	arg, commands);
5717	}
5718
5719	/* If it has no more outstanding DATA chunks, the SHUTDOWN receiver
5720	* shall send a SHUTDOWN ACK ...
5721	*/
5722	reply = sctp_make_shutdown_ack(asoc, chunk);
5723	if (!reply)
5724	goto nomem;
5725
5726	/* Set the transport for the SHUTDOWN ACK chunk and the timeout for
5727	* the T2-shutdown timer.
5728	*/
5729	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SETUP_T2, obj: SCTP_CHUNK(arg: reply));
5730
5731	/* and start/restart a T2-shutdown timer of its own, */
5732	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_RESTART,
5733	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
5734
5735	if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
5736	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_STOP,
5737	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_AUTOCLOSE));
5738
5739	/* Enter the SHUTDOWN-ACK-SENT state. */
5740	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_NEW_STATE,
5741	obj: SCTP_STATE(arg: SCTP_STATE_SHUTDOWN_ACK_SENT));
5742
5743	/* sctp-implguide 2.10 Issues with Heartbeating and failover
5744	*
5745	* HEARTBEAT ... is discontinued after sending either SHUTDOWN
5746	* or SHUTDOWN-ACK.
5747	*/
5748	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_HB_TIMERS_STOP, obj: SCTP_NULL());
5749
5750	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: reply));
5751
5752	return SCTP_DISPOSITION_CONSUME;
5753
5754	nomem:
5755	return SCTP_DISPOSITION_NOMEM;
5756	}
5757
5758	/*
5759	* Ignore the event defined as other
5760	*
5761	* The return value is the disposition of the event.
5762	*/
5763	enum sctp_disposition sctp_sf_ignore_other(struct net *net,
5764	const struct sctp_endpoint *ep,
5765	const struct sctp_association *asoc,
5766	const union sctp_subtype type,
5767	void *arg,
5768	struct sctp_cmd_seq *commands)
5769	{
5770	pr_debug("%s: the event other type:%d is ignored\n",
5771	__func__, type.other);
5772
5773	return SCTP_DISPOSITION_DISCARD;
5774	}
5775
5776	/************************************************************
5777	* These are the state functions for handling timeout events.
5778	************************************************************/
5779
5780	/*
5781	* RTX Timeout
5782	*
5783	* Section: 6.3.3 Handle T3-rtx Expiration
5784	*
5785	* Whenever the retransmission timer T3-rtx expires for a destination
5786	* address, do the following:
5787	* [See below]
5788	*
5789	* The return value is the disposition of the chunk.
5790	*/
5791	enum sctp_disposition sctp_sf_do_6_3_3_rtx(struct net *net,
5792	const struct sctp_endpoint *ep,
5793	const struct sctp_association *asoc,
5794	const union sctp_subtype type,
5795	void *arg,
5796	struct sctp_cmd_seq *commands)
5797	{
5798	struct sctp_transport *transport = arg;
5799
5800	SCTP_INC_STATS(net, SCTP_MIB_T3_RTX_EXPIREDS);
5801
5802	if (asoc->overall_error_count >= asoc->max_retrans) {
5803	if (asoc->peer.zero_window_announced &&
5804	asoc->state == SCTP_STATE_SHUTDOWN_PENDING) {
5805	/*
5806	* We are here likely because the receiver had its rwnd
5807	* closed for a while and we have not been able to
5808	* transmit the locally queued data within the maximum
5809	* retransmission attempts limit. Start the T5
5810	* shutdown guard timer to give the receiver one last
5811	* chance and some additional time to recover before
5812	* aborting.
5813	*/
5814	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_START_ONCE,
5815	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
5816	} else {
5817	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SET_SK_ERR,
5818	obj: SCTP_ERROR(ETIMEDOUT));
5819	/* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
5820	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_ASSOC_FAILED,
5821	obj: SCTP_PERR(arg: SCTP_ERROR_NO_ERROR));
5822	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
5823	SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
5824	return SCTP_DISPOSITION_DELETE_TCB;
5825	}
5826	}
5827
5828	/* E1) For the destination address for which the timer
5829	* expires, adjust its ssthresh with rules defined in Section
5830	* 7.2.3 and set the cwnd <- MTU.
5831	*/
5832
5833	/* E2) For the destination address for which the timer
5834	* expires, set RTO <- RTO * 2 ("back off the timer"). The
5835	* maximum value discussed in rule C7 above (RTO.max) may be
5836	* used to provide an upper bound to this doubling operation.
5837	*/
5838
5839	/* E3) Determine how many of the earliest (i.e., lowest TSN)
5840	* outstanding DATA chunks for the address for which the
5841	* T3-rtx has expired will fit into a single packet, subject
5842	* to the MTU constraint for the path corresponding to the
5843	* destination transport address to which the retransmission
5844	* is being sent (this may be different from the address for
5845	* which the timer expires [see Section 6.4]). Call this
5846	* value K. Bundle and retransmit those K DATA chunks in a
5847	* single packet to the destination endpoint.
5848	*
5849	* Note: Any DATA chunks that were sent to the address for
5850	* which the T3-rtx timer expired but did not fit in one MTU
5851	* (rule E3 above), should be marked for retransmission and
5852	* sent as soon as cwnd allows (normally when a SACK arrives).
5853	*/
5854
5855	/* Do some failure management (Section 8.2). */
5856	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_STRIKE, obj: SCTP_TRANSPORT(arg: transport));
5857
5858	/* NB: Rules E4 and F1 are implicit in R1. */
5859	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_RETRAN, obj: SCTP_TRANSPORT(arg: transport));
5860
5861	return SCTP_DISPOSITION_CONSUME;
5862	}
5863
5864	/*
5865	* Generate delayed SACK on timeout
5866	*
5867	* Section: 6.2 Acknowledgement on Reception of DATA Chunks
5868	*
5869	* The guidelines on delayed acknowledgement algorithm specified in
5870	* Section 4.2 of [RFC2581] SHOULD be followed. Specifically, an
5871	* acknowledgement SHOULD be generated for at least every second packet
5872	* (not every second DATA chunk) received, and SHOULD be generated
5873	* within 200 ms of the arrival of any unacknowledged DATA chunk. In
5874	* some situations it may be beneficial for an SCTP transmitter to be
5875	* more conservative than the algorithms detailed in this document
5876	* allow. However, an SCTP transmitter MUST NOT be more aggressive than
5877	* the following algorithms allow.
5878	*/
5879	enum sctp_disposition sctp_sf_do_6_2_sack(struct net *net,
5880	const struct sctp_endpoint *ep,
5881	const struct sctp_association *asoc,
5882	const union sctp_subtype type,
5883	void *arg,
5884	struct sctp_cmd_seq *commands)
5885	{
5886	SCTP_INC_STATS(net, SCTP_MIB_DELAY_SACK_EXPIREDS);
5887	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_GEN_SACK, obj: SCTP_FORCE());
5888	return SCTP_DISPOSITION_CONSUME;
5889	}
5890
5891	/*
5892	* sctp_sf_t1_init_timer_expire
5893	*
5894	* Section: 4 Note: 2
5895	* Verification Tag:
5896	* Inputs
5897	* (endpoint, asoc)
5898	*
5899	* RFC 2960 Section 4 Notes
5900	* 2) If the T1-init timer expires, the endpoint MUST retransmit INIT
5901	* and re-start the T1-init timer without changing state. This MUST
5902	* be repeated up to 'Max.Init.Retransmits' times. After that, the
5903	* endpoint MUST abort the initialization process and report the
5904	* error to SCTP user.
5905	*
5906	* Outputs
5907	* (timers, events)
5908	*
5909	*/
5910	enum sctp_disposition sctp_sf_t1_init_timer_expire(
5911	struct net *net,
5912	const struct sctp_endpoint *ep,
5913	const struct sctp_association *asoc,
5914	const union sctp_subtype type,
5915	void *arg,
5916	struct sctp_cmd_seq *commands)
5917	{
5918	int attempts = asoc->init_err_counter + 1;
5919	struct sctp_chunk *repl = NULL;
5920	struct sctp_bind_addr *bp;
5921
5922	pr_debug("%s: timer T1 expired (INIT)\n", __func__);
5923
5924	SCTP_INC_STATS(net, SCTP_MIB_T1_INIT_EXPIREDS);
5925
5926	if (attempts <= asoc->max_init_attempts) {
5927	bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
5928	repl = sctp_make_init(asoc, bp, GFP_ATOMIC, vparam_len: 0);
5929	if (!repl)
5930	return SCTP_DISPOSITION_NOMEM;
5931
5932	/* Choose transport for INIT. */
5933	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_INIT_CHOOSE_TRANSPORT,
5934	obj: SCTP_CHUNK(arg: repl));
5935
5936	/* Issue a sideeffect to do the needed accounting. */
5937	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_INIT_RESTART,
5938	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T1_INIT));
5939
5940	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: repl));
5941	} else {
5942	pr_debug("%s: giving up on INIT, attempts:%d "
5943	"max_init_attempts:%d\n", __func__, attempts,
5944	asoc->max_init_attempts);
5945
5946	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SET_SK_ERR,
5947	obj: SCTP_ERROR(ETIMEDOUT));
5948	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_INIT_FAILED,
5949	obj: SCTP_PERR(arg: SCTP_ERROR_NO_ERROR));
5950	return SCTP_DISPOSITION_DELETE_TCB;
5951	}
5952
5953	return SCTP_DISPOSITION_CONSUME;
5954	}
5955
5956	/*
5957	* sctp_sf_t1_cookie_timer_expire
5958	*
5959	* Section: 4 Note: 2
5960	* Verification Tag:
5961	* Inputs
5962	* (endpoint, asoc)
5963	*
5964	* RFC 2960 Section 4 Notes
5965	* 3) If the T1-cookie timer expires, the endpoint MUST retransmit
5966	* COOKIE ECHO and re-start the T1-cookie timer without changing
5967	* state. This MUST be repeated up to 'Max.Init.Retransmits' times.
5968	* After that, the endpoint MUST abort the initialization process and
5969	* report the error to SCTP user.
5970	*
5971	* Outputs
5972	* (timers, events)
5973	*
5974	*/
5975	enum sctp_disposition sctp_sf_t1_cookie_timer_expire(
5976	struct net *net,
5977	const struct sctp_endpoint *ep,
5978	const struct sctp_association *asoc,
5979	const union sctp_subtype type,
5980	void *arg,
5981	struct sctp_cmd_seq *commands)
5982	{
5983	int attempts = asoc->init_err_counter + 1;
5984	struct sctp_chunk *repl = NULL;
5985
5986	pr_debug("%s: timer T1 expired (COOKIE-ECHO)\n", __func__);
5987
5988	SCTP_INC_STATS(net, SCTP_MIB_T1_COOKIE_EXPIREDS);
5989
5990	if (attempts <= asoc->max_init_attempts) {
5991	repl = sctp_make_cookie_echo(asoc, NULL);
5992	if (!repl)
5993	return SCTP_DISPOSITION_NOMEM;
5994
5995	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_INIT_CHOOSE_TRANSPORT,
5996	obj: SCTP_CHUNK(arg: repl));
5997	/* Issue a sideeffect to do the needed accounting. */
5998	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_COOKIEECHO_RESTART,
5999	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T1_COOKIE));
6000
6001	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: repl));
6002	} else {
6003	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SET_SK_ERR,
6004	obj: SCTP_ERROR(ETIMEDOUT));
6005	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_INIT_FAILED,
6006	obj: SCTP_PERR(arg: SCTP_ERROR_NO_ERROR));
6007	return SCTP_DISPOSITION_DELETE_TCB;
6008	}
6009
6010	return SCTP_DISPOSITION_CONSUME;
6011	}
6012
6013	/* RFC2960 9.2 If the timer expires, the endpoint must re-send the SHUTDOWN
6014	* with the updated last sequential TSN received from its peer.
6015	*
6016	* An endpoint should limit the number of retransmission of the
6017	* SHUTDOWN chunk to the protocol parameter 'Association.Max.Retrans'.
6018	* If this threshold is exceeded the endpoint should destroy the TCB and
6019	* MUST report the peer endpoint unreachable to the upper layer (and
6020	* thus the association enters the CLOSED state). The reception of any
6021	* packet from its peer (i.e. as the peer sends all of its queued DATA
6022	* chunks) should clear the endpoint's retransmission count and restart
6023	* the T2-Shutdown timer, giving its peer ample opportunity to transmit
6024	* all of its queued DATA chunks that have not yet been sent.
6025	*/
6026	enum sctp_disposition sctp_sf_t2_timer_expire(
6027	struct net *net,
6028	const struct sctp_endpoint *ep,
6029	const struct sctp_association *asoc,
6030	const union sctp_subtype type,
6031	void *arg,
6032	struct sctp_cmd_seq *commands)
6033	{
6034	struct sctp_chunk *reply = NULL;
6035
6036	pr_debug("%s: timer T2 expired\n", __func__);
6037
6038	SCTP_INC_STATS(net, SCTP_MIB_T2_SHUTDOWN_EXPIREDS);
6039
6040	((struct sctp_association *)asoc)->shutdown_retries++;
6041
6042	if (asoc->overall_error_count >= asoc->max_retrans) {
6043	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SET_SK_ERR,
6044	obj: SCTP_ERROR(ETIMEDOUT));
6045	/* Note: CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
6046	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_ASSOC_FAILED,
6047	obj: SCTP_PERR(arg: SCTP_ERROR_NO_ERROR));
6048	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
6049	SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
6050	return SCTP_DISPOSITION_DELETE_TCB;
6051	}
6052
6053	switch (asoc->state) {
6054	case SCTP_STATE_SHUTDOWN_SENT:
6055	reply = sctp_make_shutdown(asoc, NULL);
6056	break;
6057
6058	case SCTP_STATE_SHUTDOWN_ACK_SENT:
6059	reply = sctp_make_shutdown_ack(asoc, NULL);
6060	break;
6061
6062	default:
6063	BUG();
6064	break;
6065	}
6066
6067	if (!reply)
6068	goto nomem;
6069
6070	/* Do some failure management (Section 8.2).
6071	* If we remove the transport an SHUTDOWN was last sent to, don't
6072	* do failure management.
6073	*/
6074	if (asoc->shutdown_last_sent_to)
6075	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_STRIKE,
6076	obj: SCTP_TRANSPORT(arg: asoc->shutdown_last_sent_to));
6077
6078	/* Set the transport for the SHUTDOWN/ACK chunk and the timeout for
6079	* the T2-shutdown timer.
6080	*/
6081	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SETUP_T2, obj: SCTP_CHUNK(arg: reply));
6082
6083	/* Restart the T2-shutdown timer. */
6084	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_RESTART,
6085	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
6086	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: reply));
6087	return SCTP_DISPOSITION_CONSUME;
6088
6089	nomem:
6090	return SCTP_DISPOSITION_NOMEM;
6091	}
6092
6093	/*
6094	* ADDIP Section 4.1 ASCONF Chunk Procedures
6095	* If the T4 RTO timer expires the endpoint should do B1 to B5
6096	*/
6097	enum sctp_disposition sctp_sf_t4_timer_expire(
6098	struct net *net,
6099	const struct sctp_endpoint *ep,
6100	const struct sctp_association *asoc,
6101	const union sctp_subtype type,
6102	void *arg,
6103	struct sctp_cmd_seq *commands)
6104	{
6105	struct sctp_chunk *chunk = asoc->addip_last_asconf;
6106	struct sctp_transport *transport = chunk->transport;
6107
6108	SCTP_INC_STATS(net, SCTP_MIB_T4_RTO_EXPIREDS);
6109
6110	/* ADDIP 4.1 B1) Increment the error counters and perform path failure
6111	* detection on the appropriate destination address as defined in
6112	* RFC2960 [5] section 8.1 and 8.2.
6113	*/
6114	if (transport)
6115	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_STRIKE,
6116	obj: SCTP_TRANSPORT(arg: transport));
6117
6118	/* Reconfig T4 timer and transport. */
6119	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SETUP_T4, obj: SCTP_CHUNK(arg: chunk));
6120
6121	/* ADDIP 4.1 B2) Increment the association error counters and perform
6122	* endpoint failure detection on the association as defined in
6123	* RFC2960 [5] section 8.1 and 8.2.
6124	* association error counter is incremented in SCTP_CMD_STRIKE.
6125	*/
6126	if (asoc->overall_error_count >= asoc->max_retrans) {
6127	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_STOP,
6128	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T4_RTO));
6129	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SET_SK_ERR,
6130	obj: SCTP_ERROR(ETIMEDOUT));
6131	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_ASSOC_FAILED,
6132	obj: SCTP_PERR(arg: SCTP_ERROR_NO_ERROR));
6133	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
6134	SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
6135	return SCTP_DISPOSITION_ABORT;
6136	}
6137
6138	/* ADDIP 4.1 B3) Back-off the destination address RTO value to which
6139	* the ASCONF chunk was sent by doubling the RTO timer value.
6140	* This is done in SCTP_CMD_STRIKE.
6141	*/
6142
6143	/* ADDIP 4.1 B4) Re-transmit the ASCONF Chunk last sent and if possible
6144	* choose an alternate destination address (please refer to RFC2960
6145	* [5] section 6.4.1). An endpoint MUST NOT add new parameters to this
6146	* chunk, it MUST be the same (including its serial number) as the last
6147	* ASCONF sent.
6148	*/
6149	sctp_chunk_hold(asoc->addip_last_asconf);
6150	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY,
6151	obj: SCTP_CHUNK(arg: asoc->addip_last_asconf));
6152
6153	/* ADDIP 4.1 B5) Restart the T-4 RTO timer. Note that if a different
6154	* destination is selected, then the RTO used will be that of the new
6155	* destination address.
6156	*/
6157	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_TIMER_RESTART,
6158	obj: SCTP_TO(arg: SCTP_EVENT_TIMEOUT_T4_RTO));
6159
6160	return SCTP_DISPOSITION_CONSUME;
6161	}
6162
6163	/* sctpimpguide-05 Section 2.12.2
6164	* The sender of the SHUTDOWN MAY also start an overall guard timer
6165	* 'T5-shutdown-guard' to bound the overall time for shutdown sequence.
6166	* At the expiration of this timer the sender SHOULD abort the association
6167	* by sending an ABORT chunk.
6168	*/
6169	enum sctp_disposition sctp_sf_t5_timer_expire(
6170	struct net *net,
6171	const struct sctp_endpoint *ep,
6172	const struct sctp_association *asoc,
6173	const union sctp_subtype type,
6174	void *arg,
6175	struct sctp_cmd_seq *commands)
6176	{
6177	struct sctp_chunk *reply = NULL;
6178
6179	pr_debug("%s: timer T5 expired\n", __func__);
6180
6181	SCTP_INC_STATS(net, SCTP_MIB_T5_SHUTDOWN_GUARD_EXPIREDS);
6182
6183	reply = sctp_make_abort(asoc, NULL, hint: 0);
6184	if (!reply)
6185	goto nomem;
6186
6187	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY, obj: SCTP_CHUNK(arg: reply));
6188	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SET_SK_ERR,
6189	obj: SCTP_ERROR(ETIMEDOUT));
6190	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_ASSOC_FAILED,
6191	obj: SCTP_PERR(arg: SCTP_ERROR_NO_ERROR));
6192
6193	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
6194	SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
6195
6196	return SCTP_DISPOSITION_DELETE_TCB;
6197	nomem:
6198	return SCTP_DISPOSITION_NOMEM;
6199	}
6200
6201	/* Handle expiration of AUTOCLOSE timer. When the autoclose timer expires,
6202	* the association is automatically closed by starting the shutdown process.
6203	* The work that needs to be done is same as when SHUTDOWN is initiated by
6204	* the user. So this routine looks same as sctp_sf_do_9_2_prm_shutdown().
6205	*/
6206	enum sctp_disposition sctp_sf_autoclose_timer_expire(
6207	struct net *net,
6208	const struct sctp_endpoint *ep,
6209	const struct sctp_association *asoc,
6210	const union sctp_subtype type,
6211	void *arg,
6212	struct sctp_cmd_seq *commands)
6213	{
6214	enum sctp_disposition disposition;
6215
6216	SCTP_INC_STATS(net, SCTP_MIB_AUTOCLOSE_EXPIREDS);
6217
6218	/* From 9.2 Shutdown of an Association
6219	* Upon receipt of the SHUTDOWN primitive from its upper
6220	* layer, the endpoint enters SHUTDOWN-PENDING state and
6221	* remains there until all outstanding data has been
6222	* acknowledged by its peer. The endpoint accepts no new data
6223	* from its upper layer, but retransmits data to the far end
6224	* if necessary to fill gaps.
6225	*/
6226	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_NEW_STATE,
6227	obj: SCTP_STATE(arg: SCTP_STATE_SHUTDOWN_PENDING));
6228
6229	disposition = SCTP_DISPOSITION_CONSUME;
6230	if (sctp_outq_is_empty(&asoc->outqueue)) {
6231	disposition = sctp_sf_do_9_2_start_shutdown(net, ep, asoc, type,
6232	NULL, commands);
6233	}
6234
6235	return disposition;
6236	}
6237
6238	/*****************************************************************************
6239	* These are sa state functions which could apply to all types of events.
6240	****************************************************************************/
6241
6242	/*
6243	* This table entry is not implemented.
6244	*
6245	* Inputs
6246	* (endpoint, asoc, chunk)
6247	*
6248	* The return value is the disposition of the chunk.
6249	*/
6250	enum sctp_disposition sctp_sf_not_impl(struct net *net,
6251	const struct sctp_endpoint *ep,
6252	const struct sctp_association *asoc,
6253	const union sctp_subtype type,
6254	void *arg, struct sctp_cmd_seq *commands)
6255	{
6256	return SCTP_DISPOSITION_NOT_IMPL;
6257	}
6258
6259	/*
6260	* This table entry represents a bug.
6261	*
6262	* Inputs
6263	* (endpoint, asoc, chunk)
6264	*
6265	* The return value is the disposition of the chunk.
6266	*/
6267	enum sctp_disposition sctp_sf_bug(struct net *net,
6268	const struct sctp_endpoint *ep,
6269	const struct sctp_association *asoc,
6270	const union sctp_subtype type,
6271	void *arg, struct sctp_cmd_seq *commands)
6272	{
6273	return SCTP_DISPOSITION_BUG;
6274	}
6275
6276	/*
6277	* This table entry represents the firing of a timer in the wrong state.
6278	* Since timer deletion cannot be guaranteed a timer 'may' end up firing
6279	* when the association is in the wrong state. This event should
6280	* be ignored, so as to prevent any rearming of the timer.
6281	*
6282	* Inputs
6283	* (endpoint, asoc, chunk)
6284	*
6285	* The return value is the disposition of the chunk.
6286	*/
6287	enum sctp_disposition sctp_sf_timer_ignore(struct net *net,
6288	const struct sctp_endpoint *ep,
6289	const struct sctp_association *asoc,
6290	const union sctp_subtype type,
6291	void *arg,
6292	struct sctp_cmd_seq *commands)
6293	{
6294	pr_debug("%s: timer %d ignored\n", __func__, type.chunk);
6295
6296	return SCTP_DISPOSITION_CONSUME;
6297	}
6298
6299	/********************************************************************
6300	* 2nd Level Abstractions
6301	********************************************************************/
6302
6303	/* Pull the SACK chunk based on the SACK header. */
6304	static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk)
6305	{
6306	struct sctp_sackhdr *sack;
6307	__u16 num_dup_tsns;
6308	unsigned int len;
6309	__u16 num_blocks;
6310
6311	/* Protect ourselves from reading too far into
6312	* the skb from a bogus sender.
6313	*/
6314	sack = (struct sctp_sackhdr *) chunk->skb->data;
6315
6316	num_blocks = ntohs(sack->num_gap_ack_blocks);
6317	num_dup_tsns = ntohs(sack->num_dup_tsns);
6318	len = sizeof(struct sctp_sackhdr);
6319	len += (num_blocks + num_dup_tsns) * sizeof(__u32);
6320	if (len > chunk->skb->len)
6321	return NULL;
6322
6323	skb_pull(skb: chunk->skb, len);
6324
6325	return sack;
6326	}
6327
6328	/* Create an ABORT packet to be sent as a response, with the specified
6329	* error causes.
6330	*/
6331	static struct sctp_packet *sctp_abort_pkt_new(
6332	struct net *net,
6333	const struct sctp_endpoint *ep,
6334	const struct sctp_association *asoc,
6335	struct sctp_chunk *chunk,
6336	const void *payload, size_t paylen)
6337	{
6338	struct sctp_packet *packet;
6339	struct sctp_chunk *abort;
6340
6341	packet = sctp_ootb_pkt_new(net, asoc, chunk);
6342
6343	if (packet) {
6344	/* Make an ABORT.
6345	* The T bit will be set if the asoc is NULL.
6346	*/
6347	abort = sctp_make_abort(asoc, chunk, hint: paylen);
6348	if (!abort) {
6349	sctp_ootb_pkt_free(packet);
6350	return NULL;
6351	}
6352
6353	/* Reflect vtag if T-Bit is set */
6354	if (sctp_test_T_bit(abort))
6355	packet->vtag = ntohl(chunk->sctp_hdr->vtag);
6356
6357	/* Add specified error causes, i.e., payload, to the
6358	* end of the chunk.
6359	*/
6360	sctp_addto_chunk(abort, len: paylen, data: payload);
6361
6362	/* Set the skb to the belonging sock for accounting. */
6363	abort->skb->sk = ep->base.sk;
6364
6365	sctp_packet_append_chunk(packet, chunk: abort);
6366
6367	}
6368
6369	return packet;
6370	}
6371
6372	/* Allocate a packet for responding in the OOTB conditions. */
6373	static struct sctp_packet *sctp_ootb_pkt_new(
6374	struct net *net,
6375	const struct sctp_association *asoc,
6376	const struct sctp_chunk *chunk)
6377	{
6378	struct sctp_transport *transport;
6379	struct sctp_packet *packet;
6380	__u16 sport, dport;
6381	__u32 vtag;
6382
6383	/* Get the source and destination port from the inbound packet. */
6384	sport = ntohs(chunk->sctp_hdr->dest);
6385	dport = ntohs(chunk->sctp_hdr->source);
6386
6387	/* The V-tag is going to be the same as the inbound packet if no
6388	* association exists, otherwise, use the peer's vtag.
6389	*/
6390	if (asoc) {
6391	/* Special case the INIT-ACK as there is no peer's vtag
6392	* yet.
6393	*/
6394	switch (chunk->chunk_hdr->type) {
6395	case SCTP_CID_INIT:
6396	case SCTP_CID_INIT_ACK:
6397	{
6398	struct sctp_initack_chunk *initack;
6399
6400	initack = (struct sctp_initack_chunk *)chunk->chunk_hdr;
6401	vtag = ntohl(initack->init_hdr.init_tag);
6402	break;
6403	}
6404	default:
6405	vtag = asoc->peer.i.init_tag;
6406	break;
6407	}
6408	} else {
6409	/* Special case the INIT and stale COOKIE_ECHO as there is no
6410	* vtag yet.
6411	*/
6412	switch (chunk->chunk_hdr->type) {
6413	case SCTP_CID_INIT:
6414	{
6415	struct sctp_init_chunk *init;
6416
6417	init = (struct sctp_init_chunk *)chunk->chunk_hdr;
6418	vtag = ntohl(init->init_hdr.init_tag);
6419	break;
6420	}
6421	default:
6422	vtag = ntohl(chunk->sctp_hdr->vtag);
6423	break;
6424	}
6425	}
6426
6427	/* Make a transport for the bucket, Eliza... */
6428	transport = sctp_transport_new(net, sctp_source(chunk), GFP_ATOMIC);
6429	if (!transport)
6430	goto nomem;
6431
6432	transport->encap_port = SCTP_INPUT_CB(chunk->skb)->encap_port;
6433
6434	/* Cache a route for the transport with the chunk's destination as
6435	* the source address.
6436	*/
6437	sctp_transport_route(transport, (union sctp_addr *)&chunk->dest,
6438	sctp_sk(net->sctp.ctl_sock));
6439
6440	packet = &transport->packet;
6441	sctp_packet_init(packet, transport, sport, dport);
6442	sctp_packet_config(packet, vtag, 0);
6443
6444	return packet;
6445
6446	nomem:
6447	return NULL;
6448	}
6449
6450	/* Free the packet allocated earlier for responding in the OOTB condition. */
6451	void sctp_ootb_pkt_free(struct sctp_packet *packet)
6452	{
6453	sctp_transport_free(packet->transport);
6454	}
6455
6456	/* Send a stale cookie error when a invalid COOKIE ECHO chunk is found */
6457	static void sctp_send_stale_cookie_err(struct net *net,
6458	const struct sctp_endpoint *ep,
6459	const struct sctp_association *asoc,
6460	const struct sctp_chunk *chunk,
6461	struct sctp_cmd_seq *commands,
6462	struct sctp_chunk *err_chunk)
6463	{
6464	struct sctp_packet *packet;
6465
6466	if (err_chunk) {
6467	packet = sctp_ootb_pkt_new(net, asoc, chunk);
6468	if (packet) {
6469	struct sctp_signed_cookie *cookie;
6470
6471	/* Override the OOTB vtag from the cookie. */
6472	cookie = chunk->subh.cookie_hdr;
6473	packet->vtag = cookie->c.peer_vtag;
6474
6475	/* Set the skb to the belonging sock for accounting. */
6476	err_chunk->skb->sk = ep->base.sk;
6477	sctp_packet_append_chunk(packet, chunk: err_chunk);
6478	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SEND_PKT,
6479	obj: SCTP_PACKET(arg: packet));
6480	SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
6481	} else
6482	sctp_chunk_free (err_chunk);
6483	}
6484	}
6485
6486
6487	/* Process a data chunk */
6488	static int sctp_eat_data(const struct sctp_association *asoc,
6489	struct sctp_chunk *chunk,
6490	struct sctp_cmd_seq *commands)
6491	{
6492	struct sctp_tsnmap *map = (struct sctp_tsnmap *)&asoc->peer.tsn_map;
6493	struct sock *sk = asoc->base.sk;
6494	struct net *net = sock_net(sk);
6495	struct sctp_datahdr *data_hdr;
6496	struct sctp_chunk *err;
6497	enum sctp_verb deliver;
6498	size_t datalen;
6499	__u32 tsn;
6500	int tmp;
6501
6502	data_hdr = (struct sctp_datahdr *)chunk->skb->data;
6503	chunk->subh.data_hdr = data_hdr;
6504	skb_pull(skb: chunk->skb, len: sctp_datahdr_len(stream: &asoc->stream));
6505
6506	tsn = ntohl(data_hdr->tsn);
6507	pr_debug("%s: TSN 0x%x\n", __func__, tsn);
6508
6509	/* ASSERT: Now skb->data is really the user data. */
6510
6511	/* Process ECN based congestion.
6512	*
6513	* Since the chunk structure is reused for all chunks within
6514	* a packet, we use ecn_ce_done to track if we've already
6515	* done CE processing for this packet.
6516	*
6517	* We need to do ECN processing even if we plan to discard the
6518	* chunk later.
6519	*/
6520
6521	if (asoc->peer.ecn_capable && !chunk->ecn_ce_done) {
6522	struct sctp_af *af = SCTP_INPUT_CB(chunk->skb)->af;
6523	chunk->ecn_ce_done = 1;
6524
6525	if (af->is_ce(sctp_gso_headskb(skb: chunk->skb))) {
6526	/* Do real work as side effect. */
6527	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_ECN_CE,
6528	obj: SCTP_U32(arg: tsn));
6529	}
6530	}
6531
6532	tmp = sctp_tsnmap_check(&asoc->peer.tsn_map, tsn);
6533	if (tmp < 0) {
6534	/* The TSN is too high--silently discard the chunk and
6535	* count on it getting retransmitted later.
6536	*/
6537	if (chunk->asoc)
6538	chunk->asoc->stats.outofseqtsns++;
6539	return SCTP_IERROR_HIGH_TSN;
6540	} else if (tmp > 0) {
6541	/* This is a duplicate. Record it. */
6542	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPORT_DUP, obj: SCTP_U32(arg: tsn));
6543	return SCTP_IERROR_DUP_TSN;
6544	}
6545
6546	/* This is a new TSN. */
6547
6548	/* Discard if there is no room in the receive window.
6549	* Actually, allow a little bit of overflow (up to a MTU).
6550	*/
6551	datalen = ntohs(chunk->chunk_hdr->length);
6552	datalen -= sctp_datachk_len(stream: &asoc->stream);
6553
6554	deliver = SCTP_CMD_CHUNK_ULP;
6555
6556	/* Think about partial delivery. */
6557	if ((datalen >= asoc->rwnd) && (!asoc->ulpq.pd_mode)) {
6558
6559	/* Even if we don't accept this chunk there is
6560	* memory pressure.
6561	*/
6562	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_PART_DELIVER, obj: SCTP_NULL());
6563	}
6564
6565	/* Spill over rwnd a little bit. Note: While allowed, this spill over
6566	* seems a bit troublesome in that frag_point varies based on
6567	* PMTU. In cases, such as loopback, this might be a rather
6568	* large spill over.
6569	*/
6570	if ((!chunk->data_accepted) && (!asoc->rwnd || asoc->rwnd_over ||
6571	(datalen > asoc->rwnd + asoc->frag_point))) {
6572
6573	/* If this is the next TSN, consider reneging to make
6574	* room. Note: Playing nice with a confused sender. A
6575	* malicious sender can still eat up all our buffer
6576	* space and in the future we may want to detect and
6577	* do more drastic reneging.
6578	*/
6579	if (sctp_tsnmap_has_gap(map) &&
6580	(sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
6581	pr_debug("%s: reneging for tsn:%u\n", __func__, tsn);
6582	deliver = SCTP_CMD_RENEGE;
6583	} else {
6584	pr_debug("%s: discard tsn:%u len:%zu, rwnd:%d\n",
6585	__func__, tsn, datalen, asoc->rwnd);
6586
6587	return SCTP_IERROR_IGNORE_TSN;
6588	}
6589	}
6590
6591	/*
6592	* Also try to renege to limit our memory usage in the event that
6593	* we are under memory pressure
6594	* If we can't renege, don't worry about it, the sk_rmem_schedule
6595	* in sctp_ulpevent_make_rcvmsg will drop the frame if we grow our
6596	* memory usage too much
6597	*/
6598	if (sk_under_memory_pressure(sk)) {
6599	if (sctp_tsnmap_has_gap(map) &&
6600	(sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
6601	pr_debug("%s: under pressure, reneging for tsn:%u\n",
6602	__func__, tsn);
6603	deliver = SCTP_CMD_RENEGE;
6604	}
6605	}
6606
6607	/*
6608	* Section 3.3.10.9 No User Data (9)
6609	*
6610	* Cause of error
6611	* ---------------
6612	* No User Data: This error cause is returned to the originator of a
6613	* DATA chunk if a received DATA chunk has no user data.
6614	*/
6615	if (unlikely(0 == datalen)) {
6616	err = sctp_make_abort_no_data(asoc, chunk, tsn);
6617	if (err) {
6618	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY,
6619	obj: SCTP_CHUNK(arg: err));
6620	}
6621	/* We are going to ABORT, so we might as well stop
6622	* processing the rest of the chunks in the packet.
6623	*/
6624	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_DISCARD_PACKET, obj: SCTP_NULL());
6625	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_SET_SK_ERR,
6626	obj: SCTP_ERROR(ECONNABORTED));
6627	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_ASSOC_FAILED,
6628	obj: SCTP_PERR(arg: SCTP_ERROR_NO_DATA));
6629	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
6630	SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
6631	return SCTP_IERROR_NO_DATA;
6632	}
6633
6634	chunk->data_accepted = 1;
6635
6636	/* Note: Some chunks may get overcounted (if we drop) or overcounted
6637	* if we renege and the chunk arrives again.
6638	*/
6639	if (chunk->chunk_hdr->flags & SCTP_DATA_UNORDERED) {
6640	SCTP_INC_STATS(net, SCTP_MIB_INUNORDERCHUNKS);
6641	if (chunk->asoc)
6642	chunk->asoc->stats.iuodchunks++;
6643	} else {
6644	SCTP_INC_STATS(net, SCTP_MIB_INORDERCHUNKS);
6645	if (chunk->asoc)
6646	chunk->asoc->stats.iodchunks++;
6647	}
6648
6649	/* RFC 2960 6.5 Stream Identifier and Stream Sequence Number
6650	*
6651	* If an endpoint receive a DATA chunk with an invalid stream
6652	* identifier, it shall acknowledge the reception of the DATA chunk
6653	* following the normal procedure, immediately send an ERROR chunk
6654	* with cause set to "Invalid Stream Identifier" (See Section 3.3.10)
6655	* and discard the DATA chunk.
6656	*/
6657	if (ntohs(data_hdr->stream) >= asoc->stream.incnt) {
6658	/* Mark tsn as received even though we drop it */
6659	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPORT_TSN, obj: SCTP_U32(arg: tsn));
6660
6661	err = sctp_make_op_error(asoc, chunk, cause_code: SCTP_ERROR_INV_STRM,
6662	payload: &data_hdr->stream,
6663	paylen: sizeof(data_hdr->stream),
6664	reserve_tail: sizeof(u16));
6665	if (err)
6666	sctp_add_cmd_sf(seq: commands, verb: SCTP_CMD_REPLY,
6667	obj: SCTP_CHUNK(arg: err));
6668	return SCTP_IERROR_BAD_STREAM;
6669	}
6670
6671	/* Check to see if the SSN is possible for this TSN.
6672	* The biggest gap we can record is 4K wide. Since SSNs wrap
6673	* at an unsigned short, there is no way that an SSN can
6674	* wrap and for a valid TSN. We can simply check if the current
6675	* SSN is smaller then the next expected one. If it is, it wrapped
6676	* and is invalid.
6677	*/
6678	if (!asoc->stream.si->validate_data(chunk))
6679	return SCTP_IERROR_PROTO_VIOLATION;
6680
6681	/* Send the data up to the user. Note: Schedule the
6682	* SCTP_CMD_CHUNK_ULP cmd before the SCTP_CMD_GEN_SACK, as the SACK
6683	* chunk needs the updated rwnd.
6684	*/
6685	sctp_add_cmd_sf(seq: commands, verb: deliver, obj: SCTP_CHUNK(arg: chunk));
6686
6687	return SCTP_IERROR_NO_ERROR;
6688	}
6689