socket.c 208 KB
Newer Older
1
/* SCTP kernel implementation
Linus Torvalds's avatar
Linus Torvalds committed
2
3
4
5
6
7
8
 * (C) Copyright IBM Corp. 2001, 2004
 * Copyright (c) 1999-2000 Cisco, Inc.
 * Copyright (c) 1999-2001 Motorola, Inc.
 * Copyright (c) 2001-2003 Intel Corp.
 * Copyright (c) 2001-2002 Nokia, Inc.
 * Copyright (c) 2001 La Monte H.P. Yarroll
 *
9
 * This file is part of the SCTP kernel implementation
Linus Torvalds's avatar
Linus Torvalds committed
10
11
12
13
14
15
16
17
 *
 * These functions interface with the sockets layer to implement the
 * SCTP Extensions for the Sockets API.
 *
 * Note that the descriptions from the specification are USER level
 * functions--this file is the functions which populate the struct proto
 * for SCTP which is the BOTTOM of the sockets interface.
 *
18
 * This SCTP implementation is free software;
Linus Torvalds's avatar
Linus Torvalds committed
19
20
21
22
23
 * you can redistribute it and/or modify it under the terms of
 * the GNU General Public License as published by
 * the Free Software Foundation; either version 2, or (at your option)
 * any later version.
 *
24
 * This SCTP implementation is distributed in the hope that it
Linus Torvalds's avatar
Linus Torvalds committed
25
26
27
28
29
30
 * will be useful, but WITHOUT ANY WARRANTY; without even the implied
 *                 ************************
 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
31
32
 * along with GNU CC; see the file COPYING.  If not, see
 * <http://www.gnu.org/licenses/>.
Linus Torvalds's avatar
Linus Torvalds committed
33
34
35
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
36
 *    lksctp developers <linux-sctp@vger.kernel.org>
Linus Torvalds's avatar
Linus Torvalds committed
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
 *
 * Written or modified by:
 *    La Monte H.P. Yarroll <piggy@acm.org>
 *    Narasimha Budihal     <narsi@refcode.org>
 *    Karl Knutson          <karl@athena.chicago.il.us>
 *    Jon Grimm             <jgrimm@us.ibm.com>
 *    Xingang Guo           <xingang.guo@intel.com>
 *    Daisy Chang           <daisyc@us.ibm.com>
 *    Sridhar Samudrala     <samudrala@us.ibm.com>
 *    Inaky Perez-Gonzalez  <inaky.gonzalez@intel.com>
 *    Ardelle Fan	    <ardelle.fan@intel.com>
 *    Ryan Layer	    <rmlayer@us.ibm.com>
 *    Anup Pemmaiah         <pemmaiah@cc.usu.edu>
 *    Kevin Gao             <kevin.gao@intel.com>
 */

53
54
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

Linus Torvalds's avatar
Linus Torvalds committed
55
56
57
58
59
#include <linux/types.h>
#include <linux/kernel.h>
#include <linux/wait.h>
#include <linux/time.h>
#include <linux/ip.h>
60
#include <linux/capability.h>
Linus Torvalds's avatar
Linus Torvalds committed
61
62
63
64
#include <linux/fcntl.h>
#include <linux/poll.h>
#include <linux/init.h>
#include <linux/crypto.h>
65
#include <linux/slab.h>
66
#include <linux/file.h>
67
#include <linux/compat.h>
Linus Torvalds's avatar
Linus Torvalds committed
68
69
70
71
72
73

#include <net/ip.h>
#include <net/icmp.h>
#include <net/route.h>
#include <net/ipv6.h>
#include <net/inet_common.h>
74
#include <net/busy_poll.h>
Linus Torvalds's avatar
Linus Torvalds committed
75
76

#include <linux/socket.h> /* for sa_family_t */
77
#include <linux/export.h>
Linus Torvalds's avatar
Linus Torvalds committed
78
79
80
81
82
83
84
85
86
#include <net/sock.h>
#include <net/sctp/sctp.h>
#include <net/sctp/sm.h>

/* Forward declarations for internal helper functions. */
static int sctp_writeable(struct sock *sk);
static void sctp_wfree(struct sk_buff *skb);
static int sctp_wait_for_sndbuf(struct sctp_association *, long *timeo_p,
				size_t msg_len);
87
static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p);
Linus Torvalds's avatar
Linus Torvalds committed
88
89
90
static int sctp_wait_for_connect(struct sctp_association *, long *timeo_p);
static int sctp_wait_for_accept(struct sock *sk, long timeo);
static void sctp_wait_for_close(struct sock *sk, long timeo);
91
static void sctp_destruct_sock(struct sock *sk);
Linus Torvalds's avatar
Linus Torvalds committed
92
93
94
95
96
97
98
99
100
101
102
103
104
static struct sctp_af *sctp_sockaddr_af(struct sctp_sock *opt,
					union sctp_addr *addr, int len);
static int sctp_bindx_add(struct sock *, struct sockaddr *, int);
static int sctp_bindx_rem(struct sock *, struct sockaddr *, int);
static int sctp_send_asconf_add_ip(struct sock *, struct sockaddr *, int);
static int sctp_send_asconf_del_ip(struct sock *, struct sockaddr *, int);
static int sctp_send_asconf(struct sctp_association *asoc,
			    struct sctp_chunk *chunk);
static int sctp_do_bind(struct sock *, union sctp_addr *, int);
static int sctp_autobind(struct sock *sk);
static void sctp_sock_migrate(struct sock *, struct sock *,
			      struct sctp_association *, sctp_socket_type_t);

105
static int sctp_memory_pressure;
Eric Dumazet's avatar
Eric Dumazet committed
106
static atomic_long_t sctp_memory_allocated;
107
struct percpu_counter sctp_sockets_allocated;
108

109
static void sctp_enter_memory_pressure(struct sock *sk)
110
111
112
113
114
{
	sctp_memory_pressure = 1;
}


Linus Torvalds's avatar
Linus Torvalds committed
115
116
117
/* Get the sndbuf space available at the time on the association.  */
static inline int sctp_wspace(struct sctp_association *asoc)
{
118
	int amt;
Linus Torvalds's avatar
Linus Torvalds committed
119

120
121
122
	if (asoc->ep->sndbuf_policy)
		amt = asoc->sndbuf_used;
	else
123
		amt = sk_wmem_alloc_get(asoc->base.sk);
124
125
126
127
128
129
130
131
132

	if (amt >= asoc->base.sk->sk_sndbuf) {
		if (asoc->base.sk->sk_userlocks & SOCK_SNDBUF_LOCK)
			amt = 0;
		else {
			amt = sk_stream_wspace(asoc->base.sk);
			if (amt < 0)
				amt = 0;
		}
133
	} else {
134
		amt = asoc->base.sk->sk_sndbuf - amt;
135
	}
Linus Torvalds's avatar
Linus Torvalds committed
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
	return amt;
}

/* Increment the used sndbuf space count of the corresponding association by
 * the size of the outgoing data chunk.
 * Also, set the skb destructor for sndbuf accounting later.
 *
 * Since it is always 1-1 between chunk and skb, and also a new skb is always
 * allocated for chunk bundling in sctp_packet_transmit(), we can use the
 * destructor in the data chunk skb for the purpose of the sndbuf space
 * tracking.
 */
static inline void sctp_set_owner_w(struct sctp_chunk *chunk)
{
	struct sctp_association *asoc = chunk->asoc;
	struct sock *sk = asoc->base.sk;

	/* The sndbuf space is tracked per association.  */
	sctp_association_hold(asoc);

156
157
	skb_set_owner_w(chunk->skb, sk);

Linus Torvalds's avatar
Linus Torvalds committed
158
159
	chunk->skb->destructor = sctp_wfree;
	/* Save the chunk pointer in skb for sctp_wfree to use later.  */
160
	skb_shinfo(chunk->skb)->destructor_arg = chunk;
Linus Torvalds's avatar
Linus Torvalds committed
161

162
163
164
165
166
	asoc->sndbuf_used += SCTP_DATA_SNDSIZE(chunk) +
				sizeof(struct sk_buff) +
				sizeof(struct sctp_chunk);

	atomic_add(sizeof(struct sctp_chunk), &sk->sk_wmem_alloc);
167
168
	sk->sk_wmem_queued += chunk->skb->truesize;
	sk_mem_charge(sk, chunk->skb->truesize);
Linus Torvalds's avatar
Linus Torvalds committed
169
170
171
172
173
174
175
176
177
178
179
180
181
182
}

/* Verify that this is a valid address. */
static inline int sctp_verify_addr(struct sock *sk, union sctp_addr *addr,
				   int len)
{
	struct sctp_af *af;

	/* Verify basic sockaddr. */
	af = sctp_sockaddr_af(sctp_sk(sk), addr, len);
	if (!af)
		return -EINVAL;

	/* Is this a valid SCTP address?  */
183
	if (!af->addr_valid(addr, sctp_sk(sk), NULL))
Linus Torvalds's avatar
Linus Torvalds committed
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
		return -EINVAL;

	if (!sctp_sk(sk)->pf->send_verify(sctp_sk(sk), (addr)))
		return -EINVAL;

	return 0;
}

/* Look up the association by its id.  If this is not a UDP-style
 * socket, the ID field is always ignored.
 */
struct sctp_association *sctp_id2assoc(struct sock *sk, sctp_assoc_t id)
{
	struct sctp_association *asoc = NULL;

	/* If this is not a UDP-style socket, assoc id should be ignored. */
	if (!sctp_style(sk, UDP)) {
		/* Return NULL if the socket state is not ESTABLISHED. It
		 * could be a TCP-style listening socket or a socket which
		 * hasn't yet called connect() to establish an association.
		 */
		if (!sctp_sstate(sk, ESTABLISHED))
			return NULL;

		/* Get the first and the only association from the list. */
		if (!list_empty(&sctp_sk(sk)->ep->asocs))
			asoc = list_entry(sctp_sk(sk)->ep->asocs.next,
					  struct sctp_association, asocs);
		return asoc;
	}

	/* Otherwise this is a UDP-style socket. */
	if (!id || (id == (sctp_assoc_t)-1))
		return NULL;

	spin_lock_bh(&sctp_assocs_id_lock);
	asoc = (struct sctp_association *)idr_find(&sctp_assocs_id, (int)id);
	spin_unlock_bh(&sctp_assocs_id_lock);

	if (!asoc || (asoc->base.sk != sk) || asoc->base.dead)
		return NULL;

	return asoc;
}

/* Look up the transport from an address and an assoc id. If both address and
 * id are specified, the associations matching the address and the id should be
 * the same.
 */
static struct sctp_transport *sctp_addr_id2transport(struct sock *sk,
					      struct sockaddr_storage *addr,
					      sctp_assoc_t id)
{
	struct sctp_association *addr_asoc = NULL, *id_asoc = NULL;
	struct sctp_transport *transport;
	union sctp_addr *laddr = (union sctp_addr *)addr;

	addr_asoc = sctp_endpoint_lookup_assoc(sctp_sk(sk)->ep,
242
					       laddr,
Linus Torvalds's avatar
Linus Torvalds committed
243
244
245
246
247
248
249
250
251
					       &transport);

	if (!addr_asoc)
		return NULL;

	id_asoc = sctp_id2assoc(sk, id);
	if (id_asoc && (id_asoc != addr_asoc))
		return NULL;

252
	sctp_get_pf_specific(sk->sk_family)->addr_to_user(sctp_sk(sk),
Linus Torvalds's avatar
Linus Torvalds committed
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
						(union sctp_addr *)addr);

	return transport;
}

/* API 3.1.2 bind() - UDP Style Syntax
 * The syntax of bind() is,
 *
 *   ret = bind(int sd, struct sockaddr *addr, int addrlen);
 *
 *   sd      - the socket descriptor returned by socket().
 *   addr    - the address structure (struct sockaddr_in or struct
 *             sockaddr_in6 [RFC 2553]),
 *   addr_len - the size of the address structure.
 */
268
static int sctp_bind(struct sock *sk, struct sockaddr *addr, int addr_len)
Linus Torvalds's avatar
Linus Torvalds committed
269
270
271
{
	int retval = 0;

272
	lock_sock(sk);
Linus Torvalds's avatar
Linus Torvalds committed
273

274
275
	pr_debug("%s: sk:%p, addr:%p, addr_len:%d\n", __func__, sk,
		 addr, addr_len);
Linus Torvalds's avatar
Linus Torvalds committed
276
277
278

	/* Disallow binding twice. */
	if (!sctp_sk(sk)->ep->base.bind_addr.port)
279
		retval = sctp_do_bind(sk, (union sctp_addr *)addr,
Linus Torvalds's avatar
Linus Torvalds committed
280
281
282
283
				      addr_len);
	else
		retval = -EINVAL;

284
	release_sock(sk);
Linus Torvalds's avatar
Linus Torvalds committed
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300

	return retval;
}

static long sctp_get_port_local(struct sock *, union sctp_addr *);

/* Verify this is a valid sockaddr. */
static struct sctp_af *sctp_sockaddr_af(struct sctp_sock *opt,
					union sctp_addr *addr, int len)
{
	struct sctp_af *af;

	/* Check minimum size.  */
	if (len < sizeof (struct sockaddr))
		return NULL;

301
302
303
304
305
306
307
308
309
310
	/* V4 mapped address are really of AF_INET family */
	if (addr->sa.sa_family == AF_INET6 &&
	    ipv6_addr_v4mapped(&addr->v6.sin6_addr)) {
		if (!opt->pf->af_supported(AF_INET, opt))
			return NULL;
	} else {
		/* Does this PF support this AF? */
		if (!opt->pf->af_supported(addr->sa.sa_family, opt))
			return NULL;
	}
Linus Torvalds's avatar
Linus Torvalds committed
311
312
313
314
315
316
317
318
319
320
321

	/* If we get this far, af is valid. */
	af = sctp_get_af_specific(addr->sa.sa_family);

	if (len < af->sockaddr_len)
		return NULL;

	return af;
}

/* Bind a local address either to an endpoint or to an association.  */
322
static int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)
Linus Torvalds's avatar
Linus Torvalds committed
323
{
324
	struct net *net = sock_net(sk);
Linus Torvalds's avatar
Linus Torvalds committed
325
326
327
328
329
330
331
332
333
	struct sctp_sock *sp = sctp_sk(sk);
	struct sctp_endpoint *ep = sp->ep;
	struct sctp_bind_addr *bp = &ep->base.bind_addr;
	struct sctp_af *af;
	unsigned short snum;
	int ret = 0;

	/* Common sockaddr verification. */
	af = sctp_sockaddr_af(sp, addr, len);
334
	if (!af) {
335
336
		pr_debug("%s: sk:%p, newaddr:%p, len:%d EINVAL\n",
			 __func__, sk, addr, len);
Linus Torvalds's avatar
Linus Torvalds committed
337
		return -EINVAL;
338
339
340
341
	}

	snum = ntohs(addr->v4.sin_port);

342
343
	pr_debug("%s: sk:%p, new addr:%pISc, port:%d, new port:%d, len:%d\n",
		 __func__, sk, &addr->sa, bp->port, snum, len);
Linus Torvalds's avatar
Linus Torvalds committed
344
345
346
347
348

	/* PF specific bind() address verification. */
	if (!sp->pf->bind_verify(sp, addr))
		return -EADDRNOTAVAIL;

349
350
351
352
353
354
355
356
	/* We must either be unbound, or bind to the same port.
	 * It's OK to allow 0 ports if we are already bound.
	 * We'll just inhert an already bound port in this case
	 */
	if (bp->port) {
		if (!snum)
			snum = bp->port;
		else if (snum != bp->port) {
357
358
			pr_debug("%s: new port %d doesn't match existing port "
				 "%d\n", __func__, snum, bp->port);
359
360
			return -EINVAL;
		}
Linus Torvalds's avatar
Linus Torvalds committed
361
362
	}

363
364
	if (snum && snum < PROT_SOCK &&
	    !ns_capable(net->user_ns, CAP_NET_BIND_SERVICE))
Linus Torvalds's avatar
Linus Torvalds committed
365
366
		return -EACCES;

367
368
369
370
371
372
	/* See if the address matches any of the addresses we may have
	 * already bound before checking against other endpoints.
	 */
	if (sctp_bind_addr_match(bp, addr, sp))
		return -EINVAL;

Linus Torvalds's avatar
Linus Torvalds committed
373
374
375
376
	/* Make sure we are allowed to bind here.
	 * The function sctp_get_port_local() does duplicate address
	 * detection.
	 */
377
	addr->v4.sin_port = htons(snum);
Linus Torvalds's avatar
Linus Torvalds committed
378
	if ((ret = sctp_get_port_local(sk, addr))) {
379
		return -EADDRINUSE;
Linus Torvalds's avatar
Linus Torvalds committed
380
381
382
383
	}

	/* Refresh ephemeral port.  */
	if (!bp->port)
384
		bp->port = inet_sk(sk)->inet_num;
Linus Torvalds's avatar
Linus Torvalds committed
385

386
387
388
	/* Add the address to the bind address list.
	 * Use GFP_ATOMIC since BHs will be disabled.
	 */
389
	ret = sctp_add_bind_addr(bp, addr, SCTP_ADDR_SRC, GFP_ATOMIC);
Linus Torvalds's avatar
Linus Torvalds committed
390
391
392

	/* Copy back into socket for getsockname() use. */
	if (!ret) {
393
		inet_sk(sk)->inet_sport = htons(inet_sk(sk)->inet_num);
394
		sp->pf->to_sk_saddr(addr, sk);
Linus Torvalds's avatar
Linus Torvalds committed
395
396
397
398
399
400
401
	}

	return ret;
}

 /* ADDIP Section 4.1.1 Congestion Control of ASCONF Chunks
 *
402
 * R1) One and only one ASCONF Chunk MAY be in transit and unacknowledged
Linus Torvalds's avatar
Linus Torvalds committed
403
 * at any one time.  If a sender, after sending an ASCONF chunk, decides
404
 * it needs to transfer another ASCONF Chunk, it MUST wait until the
Linus Torvalds's avatar
Linus Torvalds committed
405
 * ASCONF-ACK Chunk returns from the previous ASCONF Chunk before sending a
406
407
 * subsequent ASCONF. Note this restriction binds each side, so at any
 * time two ASCONF may be in-transit on any given association (one sent
Linus Torvalds's avatar
Linus Torvalds committed
408
409
410
411
412
 * from each endpoint).
 */
static int sctp_send_asconf(struct sctp_association *asoc,
			    struct sctp_chunk *chunk)
{
413
	struct net 	*net = sock_net(asoc->base.sk);
Linus Torvalds's avatar
Linus Torvalds committed
414
415
416
417
	int		retval = 0;

	/* If there is an outstanding ASCONF chunk, queue it for later
	 * transmission.
418
	 */
Linus Torvalds's avatar
Linus Torvalds committed
419
	if (asoc->addip_last_asconf) {
420
		list_add_tail(&chunk->list, &asoc->addip_chunk_list);
421
		goto out;
Linus Torvalds's avatar
Linus Torvalds committed
422
423
424
425
	}

	/* Hold the chunk until an ASCONF_ACK is received. */
	sctp_chunk_hold(chunk);
426
	retval = sctp_primitive_ASCONF(net, asoc, chunk);
Linus Torvalds's avatar
Linus Torvalds committed
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
	if (retval)
		sctp_chunk_free(chunk);
	else
		asoc->addip_last_asconf = chunk;

out:
	return retval;
}

/* Add a list of addresses as bind addresses to local endpoint or
 * association.
 *
 * Basically run through each address specified in the addrs/addrcnt
 * array/length pair, determine if it is IPv6 or IPv4 and call
 * sctp_do_bind() on it.
 *
 * If any of them fails, then the operation will be reversed and the
 * ones that were added will be removed.
 *
 * Only sctp_setsockopt_bindx() is supposed to call this function.
 */
448
static int sctp_bindx_add(struct sock *sk, struct sockaddr *addrs, int addrcnt)
Linus Torvalds's avatar
Linus Torvalds committed
449
450
451
452
453
454
455
{
	int cnt;
	int retval = 0;
	void *addr_buf;
	struct sockaddr *sa_addr;
	struct sctp_af *af;

456
457
	pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n", __func__, sk,
		 addrs, addrcnt);
Linus Torvalds's avatar
Linus Torvalds committed
458
459
460
461
462
463

	addr_buf = addrs;
	for (cnt = 0; cnt < addrcnt; cnt++) {
		/* The list may contain either IPv4 or IPv6 address;
		 * determine the address length for walking thru the list.
		 */
Joe Perches's avatar
Joe Perches committed
464
		sa_addr = addr_buf;
Linus Torvalds's avatar
Linus Torvalds committed
465
466
467
468
469
470
		af = sctp_get_af_specific(sa_addr->sa_family);
		if (!af) {
			retval = -EINVAL;
			goto err_bindx_add;
		}

471
		retval = sctp_do_bind(sk, (union sctp_addr *)sa_addr,
Linus Torvalds's avatar
Linus Torvalds committed
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
				      af->sockaddr_len);

		addr_buf += af->sockaddr_len;

err_bindx_add:
		if (retval < 0) {
			/* Failed. Cleanup the ones that have been added */
			if (cnt > 0)
				sctp_bindx_rem(sk, addrs, cnt);
			return retval;
		}
	}

	return retval;
}

/* Send an ASCONF chunk with Add IP address parameters to all the peers of the
 * associations that are part of the endpoint indicating that a list of local
 * addresses are added to the endpoint.
 *
492
 * If any of the addresses is already in the bind address list of the
Linus Torvalds's avatar
Linus Torvalds committed
493
494
495
496
497
 * association, we do not send the chunk for that association.  But it will not
 * affect other associations.
 *
 * Only sctp_setsockopt_bindx() is supposed to call this function.
 */
498
static int sctp_send_asconf_add_ip(struct sock		*sk,
Linus Torvalds's avatar
Linus Torvalds committed
499
500
501
				   struct sockaddr	*addrs,
				   int 			addrcnt)
{
502
	struct net *net = sock_net(sk);
Linus Torvalds's avatar
Linus Torvalds committed
503
504
505
506
507
508
509
	struct sctp_sock		*sp;
	struct sctp_endpoint		*ep;
	struct sctp_association		*asoc;
	struct sctp_bind_addr		*bp;
	struct sctp_chunk		*chunk;
	struct sctp_sockaddr_entry	*laddr;
	union sctp_addr			*addr;
510
	union sctp_addr			saveaddr;
Linus Torvalds's avatar
Linus Torvalds committed
511
512
513
514
515
516
	void				*addr_buf;
	struct sctp_af			*af;
	struct list_head		*p;
	int 				i;
	int 				retval = 0;

517
	if (!net->sctp.addip_enable)
Linus Torvalds's avatar
Linus Torvalds committed
518
519
520
521
522
		return retval;

	sp = sctp_sk(sk);
	ep = sp->ep;

523
524
	pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n",
		 __func__, sk, addrs, addrcnt);
Linus Torvalds's avatar
Linus Torvalds committed
525

526
	list_for_each_entry(asoc, &ep->asocs, asocs) {
Linus Torvalds's avatar
Linus Torvalds committed
527
528
529
530
531
532
533
534
535
536
		if (!asoc->peer.asconf_capable)
			continue;

		if (asoc->peer.addip_disabled_mask & SCTP_PARAM_ADD_IP)
			continue;

		if (!sctp_state(asoc, ESTABLISHED))
			continue;

		/* Check if any address in the packed array of addresses is
537
538
		 * in the bind address list of the association. If so,
		 * do not send the asconf chunk to its peer, but continue with
Linus Torvalds's avatar
Linus Torvalds committed
539
540
541
542
		 * other associations.
		 */
		addr_buf = addrs;
		for (i = 0; i < addrcnt; i++) {
Joe Perches's avatar
Joe Perches committed
543
			addr = addr_buf;
Linus Torvalds's avatar
Linus Torvalds committed
544
545
546
547
548
549
550
551
552
553
554
555
556
557
			af = sctp_get_af_specific(addr->v4.sin_family);
			if (!af) {
				retval = -EINVAL;
				goto out;
			}

			if (sctp_assoc_lookup_laddr(asoc, addr))
				break;

			addr_buf += af->sockaddr_len;
		}
		if (i < addrcnt)
			continue;

558
559
		/* Use the first valid address in bind addr list of
		 * association as Address Parameter of ASCONF CHUNK.
Linus Torvalds's avatar
Linus Torvalds committed
560
561
562
563
		 */
		bp = &asoc->base.bind_addr;
		p = bp->address_list.next;
		laddr = list_entry(p, struct sctp_sockaddr_entry, list);
564
		chunk = sctp_make_asconf_update_ip(asoc, &laddr->a, addrs,
Linus Torvalds's avatar
Linus Torvalds committed
565
566
567
568
569
570
						   addrcnt, SCTP_PARAM_ADD_IP);
		if (!chunk) {
			retval = -ENOMEM;
			goto out;
		}

571
572
		/* Add the new addresses to the bind address list with
		 * use_as_src set to 0.
Linus Torvalds's avatar
Linus Torvalds committed
573
		 */
574
575
		addr_buf = addrs;
		for (i = 0; i < addrcnt; i++) {
Joe Perches's avatar
Joe Perches committed
576
			addr = addr_buf;
577
578
			af = sctp_get_af_specific(addr->v4.sin_family);
			memcpy(&saveaddr, addr, af->sockaddr_len);
579
580
			retval = sctp_add_bind_addr(bp, &saveaddr,
						    SCTP_ADDR_NEW, GFP_ATOMIC);
581
582
			addr_buf += af->sockaddr_len;
		}
583
584
585
586
587
588
589
590
591
592
593
		if (asoc->src_out_of_asoc_ok) {
			struct sctp_transport *trans;

			list_for_each_entry(trans,
			    &asoc->peer.transport_addr_list, transports) {
				/* Clear the source and route cache */
				dst_release(trans->dst);
				trans->cwnd = min(4*asoc->pathmtu, max_t(__u32,
				    2*asoc->pathmtu, 4380));
				trans->ssthresh = asoc->peer.i.a_rwnd;
				trans->rto = asoc->rto_initial;
594
				sctp_max_rto(asoc, trans);
595
596
597
598
599
600
				trans->rtt = trans->srtt = trans->rttvar = 0;
				sctp_transport_route(trans, NULL,
				    sctp_sk(asoc->base.sk));
			}
		}
		retval = sctp_send_asconf(asoc, chunk);
Linus Torvalds's avatar
Linus Torvalds committed
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
	}

out:
	return retval;
}

/* Remove a list of addresses from bind addresses list.  Do not remove the
 * last address.
 *
 * Basically run through each address specified in the addrs/addrcnt
 * array/length pair, determine if it is IPv6 or IPv4 and call
 * sctp_del_bind() on it.
 *
 * If any of them fails, then the operation will be reversed and the
 * ones that were removed will be added back.
 *
 * At least one address has to be left; if only one address is
 * available, the operation will return -EBUSY.
 *
 * Only sctp_setsockopt_bindx() is supposed to call this function.
 */
622
static int sctp_bindx_rem(struct sock *sk, struct sockaddr *addrs, int addrcnt)
Linus Torvalds's avatar
Linus Torvalds committed
623
624
625
626
627
628
629
{
	struct sctp_sock *sp = sctp_sk(sk);
	struct sctp_endpoint *ep = sp->ep;
	int cnt;
	struct sctp_bind_addr *bp = &ep->base.bind_addr;
	int retval = 0;
	void *addr_buf;
630
	union sctp_addr *sa_addr;
Linus Torvalds's avatar
Linus Torvalds committed
631
632
	struct sctp_af *af;

633
634
	pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n",
		 __func__, sk, addrs, addrcnt);
Linus Torvalds's avatar
Linus Torvalds committed
635
636
637
638
639
640
641
642
643
644
645
646
647

	addr_buf = addrs;
	for (cnt = 0; cnt < addrcnt; cnt++) {
		/* If the bind address list is empty or if there is only one
		 * bind address, there is nothing more to be removed (we need
		 * at least one address here).
		 */
		if (list_empty(&bp->address_list) ||
		    (sctp_list_single_entry(&bp->address_list))) {
			retval = -EBUSY;
			goto err_bindx_rem;
		}

Joe Perches's avatar
Joe Perches committed
648
		sa_addr = addr_buf;
649
		af = sctp_get_af_specific(sa_addr->sa.sa_family);
Linus Torvalds's avatar
Linus Torvalds committed
650
651
652
653
		if (!af) {
			retval = -EINVAL;
			goto err_bindx_rem;
		}
654
655
656
657
658
659

		if (!af->addr_valid(sa_addr, sp, NULL)) {
			retval = -EADDRNOTAVAIL;
			goto err_bindx_rem;
		}

660
661
		if (sa_addr->v4.sin_port &&
		    sa_addr->v4.sin_port != htons(bp->port)) {
Linus Torvalds's avatar
Linus Torvalds committed
662
663
664
665
			retval = -EINVAL;
			goto err_bindx_rem;
		}

666
667
668
		if (!sa_addr->v4.sin_port)
			sa_addr->v4.sin_port = htons(bp->port);

Linus Torvalds's avatar
Linus Torvalds committed
669
670
671
672
673
674
675
		/* FIXME - There is probably a need to check if sk->sk_saddr and
		 * sk->sk_rcv_addr are currently set to one of the addresses to
		 * be removed. This is something which needs to be looked into
		 * when we are fixing the outstanding issues with multi-homing
		 * socket routing and failover schemes. Refer to comments in
		 * sctp_do_bind(). -daisy
		 */
676
		retval = sctp_del_bind_addr(bp, sa_addr);
Linus Torvalds's avatar
Linus Torvalds committed
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694

		addr_buf += af->sockaddr_len;
err_bindx_rem:
		if (retval < 0) {
			/* Failed. Add the ones that has been removed back */
			if (cnt > 0)
				sctp_bindx_add(sk, addrs, cnt);
			return retval;
		}
	}

	return retval;
}

/* Send an ASCONF chunk with Delete IP address parameters to all the peers of
 * the associations that are part of the endpoint indicating that a list of
 * local addresses are removed from the endpoint.
 *
695
 * If any of the addresses is already in the bind address list of the
Linus Torvalds's avatar
Linus Torvalds committed
696
697
698
699
700
701
702
703
704
 * association, we do not send the chunk for that association.  But it will not
 * affect other associations.
 *
 * Only sctp_setsockopt_bindx() is supposed to call this function.
 */
static int sctp_send_asconf_del_ip(struct sock		*sk,
				   struct sockaddr	*addrs,
				   int			addrcnt)
{
705
	struct net *net = sock_net(sk);
Linus Torvalds's avatar
Linus Torvalds committed
706
707
708
	struct sctp_sock	*sp;
	struct sctp_endpoint	*ep;
	struct sctp_association	*asoc;
709
	struct sctp_transport	*transport;
Linus Torvalds's avatar
Linus Torvalds committed
710
711
712
713
714
	struct sctp_bind_addr	*bp;
	struct sctp_chunk	*chunk;
	union sctp_addr		*laddr;
	void			*addr_buf;
	struct sctp_af		*af;
715
	struct sctp_sockaddr_entry *saddr;
Linus Torvalds's avatar
Linus Torvalds committed
716
717
	int 			i;
	int 			retval = 0;
718
	int			stored = 0;
Linus Torvalds's avatar
Linus Torvalds committed
719

720
	chunk = NULL;
721
	if (!net->sctp.addip_enable)
Linus Torvalds's avatar
Linus Torvalds committed
722
723
724
725
726
		return retval;

	sp = sctp_sk(sk);
	ep = sp->ep;

727
728
	pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n",
		 __func__, sk, addrs, addrcnt);
Linus Torvalds's avatar
Linus Torvalds committed
729

730
	list_for_each_entry(asoc, &ep->asocs, asocs) {
Linus Torvalds's avatar
Linus Torvalds committed
731
732
733
734
735
736
737
738
739
740
741

		if (!asoc->peer.asconf_capable)
			continue;

		if (asoc->peer.addip_disabled_mask & SCTP_PARAM_DEL_IP)
			continue;

		if (!sctp_state(asoc, ESTABLISHED))
			continue;

		/* Check if any address in the packed array of addresses is
742
		 * not present in the bind address list of the association.
Linus Torvalds's avatar
Linus Torvalds committed
743
744
745
746
747
		 * If so, do not send the asconf chunk to its peer, but
		 * continue with other associations.
		 */
		addr_buf = addrs;
		for (i = 0; i < addrcnt; i++) {
Joe Perches's avatar
Joe Perches committed
748
			laddr = addr_buf;
Linus Torvalds's avatar
Linus Torvalds committed
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
			af = sctp_get_af_specific(laddr->v4.sin_family);
			if (!af) {
				retval = -EINVAL;
				goto out;
			}

			if (!sctp_assoc_lookup_laddr(asoc, laddr))
				break;

			addr_buf += af->sockaddr_len;
		}
		if (i < addrcnt)
			continue;

		/* Find one address in the association's bind address list
		 * that is not in the packed array of addresses. This is to
		 * make sure that we do not delete all the addresses in the
		 * association.
		 */
		bp = &asoc->base.bind_addr;
		laddr = sctp_find_unmatch_addr(bp, (union sctp_addr *)addrs,
					       addrcnt, sp);
771
772
773
774
775
		if ((laddr == NULL) && (addrcnt == 1)) {
			if (asoc->asconf_addr_del_pending)
				continue;
			asoc->asconf_addr_del_pending =
			    kzalloc(sizeof(union sctp_addr), GFP_ATOMIC);
776
777
778
779
			if (asoc->asconf_addr_del_pending == NULL) {
				retval = -ENOMEM;
				goto out;
			}
780
781
782
783
784
785
786
787
788
789
790
791
792
			asoc->asconf_addr_del_pending->sa.sa_family =
				    addrs->sa_family;
			asoc->asconf_addr_del_pending->v4.sin_port =
				    htons(bp->port);
			if (addrs->sa_family == AF_INET) {
				struct sockaddr_in *sin;

				sin = (struct sockaddr_in *)addrs;
				asoc->asconf_addr_del_pending->v4.sin_addr.s_addr = sin->sin_addr.s_addr;
			} else if (addrs->sa_family == AF_INET6) {
				struct sockaddr_in6 *sin6;

				sin6 = (struct sockaddr_in6 *)addrs;
Alexey Dobriyan's avatar
Alexey Dobriyan committed
793
				asoc->asconf_addr_del_pending->v6.sin6_addr = sin6->sin6_addr;
794
			}
795
796
797
798
799

			pr_debug("%s: keep the last address asoc:%p %pISc at %p\n",
				 __func__, asoc, &asoc->asconf_addr_del_pending->sa,
				 asoc->asconf_addr_del_pending);

800
801
802
803
			asoc->src_out_of_asoc_ok = 1;
			stored = 1;
			goto skip_mkasconf;
		}
Linus Torvalds's avatar
Linus Torvalds committed
804

805
806
807
		if (laddr == NULL)
			return -EINVAL;

808
809
810
811
		/* We do not need RCU protection throughout this loop
		 * because this is done under a socket lock from the
		 * setsockopt call.
		 */
Linus Torvalds's avatar
Linus Torvalds committed
812
813
814
815
816
817
818
		chunk = sctp_make_asconf_update_ip(asoc, laddr, addrs, addrcnt,
						   SCTP_PARAM_DEL_IP);
		if (!chunk) {
			retval = -ENOMEM;
			goto out;
		}

819
skip_mkasconf:
820
821
822
823
824
		/* Reset use_as_src flag for the addresses in the bind address
		 * list that are to be deleted.
		 */
		addr_buf = addrs;
		for (i = 0; i < addrcnt; i++) {
Joe Perches's avatar
Joe Perches committed
825
			laddr = addr_buf;
826
			af = sctp_get_af_specific(laddr->v4.sin_family);
827
			list_for_each_entry(saddr, &bp->address_list, list) {
828
				if (sctp_cmp_addr_exact(&saddr->a, laddr))
829
					saddr->state = SCTP_ADDR_DEL;
830
831
832
			}
			addr_buf += af->sockaddr_len;
		}
Linus Torvalds's avatar
Linus Torvalds committed
833

834
835
836
		/* Update the route and saddr entries for all the transports
		 * as some of the addresses in the bind address list are
		 * about to be deleted and cannot be used as source addresses.
Linus Torvalds's avatar
Linus Torvalds committed
837
		 */
838
839
		list_for_each_entry(transport, &asoc->peer.transport_addr_list,
					transports) {
840
841
842
843
844
			dst_release(transport->dst);
			sctp_transport_route(transport, NULL,
					     sctp_sk(asoc->base.sk));
		}

845
846
847
		if (stored)
			/* We don't need to transmit ASCONF */
			continue;
848
		retval = sctp_send_asconf(asoc, chunk);
Linus Torvalds's avatar
Linus Torvalds committed
849
850
851
852
853
	}
out:
	return retval;
}

854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
/* set addr events to assocs in the endpoint.  ep and addr_wq must be locked */
int sctp_asconf_mgmt(struct sctp_sock *sp, struct sctp_sockaddr_entry *addrw)
{
	struct sock *sk = sctp_opt2sk(sp);
	union sctp_addr *addr;
	struct sctp_af *af;

	/* It is safe to write port space in caller. */
	addr = &addrw->a;
	addr->v4.sin_port = htons(sp->ep->base.bind_addr.port);
	af = sctp_get_af_specific(addr->sa.sa_family);
	if (!af)
		return -EINVAL;
	if (sctp_verify_addr(sk, addr, af->sockaddr_len))
		return -EINVAL;

	if (addrw->state == SCTP_ADDR_NEW)
		return sctp_send_asconf_add_ip(sk, (struct sockaddr *)addr, 1);
	else
		return sctp_send_asconf_del_ip(sk, (struct sockaddr *)addr, 1);
}

Linus Torvalds's avatar
Linus Torvalds committed
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
/* Helper for tunneling sctp_bindx() requests through sctp_setsockopt()
 *
 * API 8.1
 * int sctp_bindx(int sd, struct sockaddr *addrs, int addrcnt,
 *                int flags);
 *
 * If sd is an IPv4 socket, the addresses passed must be IPv4 addresses.
 * If the sd is an IPv6 socket, the addresses passed can either be IPv4
 * or IPv6 addresses.
 *
 * A single address may be specified as INADDR_ANY or IN6ADDR_ANY, see
 * Section 3.1.2 for this usage.
 *
 * addrs is a pointer to an array of one or more socket addresses. Each
 * address is contained in its appropriate structure (i.e. struct
 * sockaddr_in or struct sockaddr_in6) the family of the address type
Ville Nuorvala's avatar
Ville Nuorvala committed
892
 * must be used to distinguish the address length (note that this
Linus Torvalds's avatar
Linus Torvalds committed
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
 * representation is termed a "packed array" of addresses). The caller
 * specifies the number of addresses in the array with addrcnt.
 *
 * On success, sctp_bindx() returns 0. On failure, sctp_bindx() returns
 * -1, and sets errno to the appropriate error code.
 *
 * For SCTP, the port given in each socket address must be the same, or
 * sctp_bindx() will fail, setting errno to EINVAL.
 *
 * The flags parameter is formed from the bitwise OR of zero or more of
 * the following currently defined flags:
 *
 * SCTP_BINDX_ADD_ADDR
 *
 * SCTP_BINDX_REM_ADDR
 *
 * SCTP_BINDX_ADD_ADDR directs SCTP to add the given addresses to the
 * association, and SCTP_BINDX_REM_ADDR directs SCTP to remove the given
 * addresses from the association. The two flags are mutually exclusive;
 * if both are given, sctp_bindx() will fail with EINVAL. A caller may
 * not remove all addresses from an association; sctp_bindx() will
 * reject such an attempt with EINVAL.
 *
 * An application can use sctp_bindx(SCTP_BINDX_ADD_ADDR) to associate
 * additional addresses with an endpoint after calling bind().  Or use
 * sctp_bindx(SCTP_BINDX_REM_ADDR) to remove some addresses a listening
 * socket is associated with so that no new association accepted will be
 * associated with those addresses. If the endpoint supports dynamic
 * address a SCTP_BINDX_REM_ADDR or SCTP_BINDX_ADD_ADDR may cause a
 * endpoint to send the appropriate message to the peer to change the
 * peers address lists.
 *
 * Adding and removing addresses from a connected association is
 * optional functionality. Implementations that do not support this
 * functionality should return EOPNOTSUPP.
 *
 * Basically do nothing but copying the addresses from user to kernel
 * land and invoking either sctp_bindx_add() or sctp_bindx_rem() on the sk.
931
932
 * This is used for tunneling the sctp_bindx() request through sctp_setsockopt()
 * from userspace.
Linus Torvalds's avatar
Linus Torvalds committed
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
 *
 * We don't use copy_from_user() for optimization: we first do the
 * sanity checks (buffer size -fast- and access check-healthy
 * pointer); if all of those succeed, then we can alloc the memory
 * (expensive operation) needed to copy the data to kernel. Then we do
 * the copying without checking the user space area
 * (__copy_from_user()).
 *
 * On exit there is no need to do sockfd_put(), sys_setsockopt() does
 * it.
 *
 * sk        The sk of the socket
 * addrs     The pointer to the addresses in user land
 * addrssize Size of the addrs buffer
 * op        Operation to perform (add or remove, see the flags of
 *           sctp_bindx)
 *
 * Returns 0 if ok, <0 errno code on error.
 */
952
static int sctp_setsockopt_bindx(struct sock *sk,
953
954
				 struct sockaddr __user *addrs,
				 int addrs_size, int op)
Linus Torvalds's avatar
Linus Torvalds committed
955
956
957
958
959
960
961
962
963
{
	struct sockaddr *kaddrs;
	int err;
	int addrcnt = 0;
	int walk_size = 0;
	struct sockaddr *sa_addr;
	void *addr_buf;
	struct sctp_af *af;

964
965
	pr_debug("%s: sk:%p addrs:%p addrs_size:%d opt:%d\n",
		 __func__, sk, addrs, addrs_size, op);
Linus Torvalds's avatar
Linus Torvalds committed
966
967
968
969
970
971
972
973
974

	if (unlikely(addrs_size <= 0))
		return -EINVAL;

	/* Check the user passed a healthy pointer.  */
	if (unlikely(!access_ok(VERIFY_READ, addrs, addrs_size)))
		return -EFAULT;

	/* Alloc space for the address array in kernel memory.  */
975
	kaddrs = kmalloc(addrs_size, GFP_USER | __GFP_NOWARN);
Linus Torvalds's avatar
Linus Torvalds committed
976
977
978
979
980
981
982
983
	if (unlikely(!kaddrs))
		return -ENOMEM;

	if (__copy_from_user(kaddrs, addrs, addrs_size)) {
		kfree(kaddrs);
		return -EFAULT;
	}

984
	/* Walk through the addrs buffer and count the number of addresses. */
Linus Torvalds's avatar
Linus Torvalds committed
985
986
	addr_buf = kaddrs;
	while (walk_size < addrs_size) {
987
988
989
990
991
		if (walk_size + sizeof(sa_family_t) > addrs_size) {
			kfree(kaddrs);
			return -EINVAL;
		}

Joe Perches's avatar
Joe Perches committed
992
		sa_addr = addr_buf;
Linus Torvalds's avatar
Linus Torvalds committed
993
994
995
996
		af = sctp_get_af_specific(sa_addr->sa_family);

		/* If the address family is not supported or if this address
		 * causes the address buffer to overflow return EINVAL.
997
		 */
Linus Torvalds's avatar
Linus Torvalds committed
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
		if (!af || (walk_size + af->sockaddr_len) > addrs_size) {
			kfree(kaddrs);
			return -EINVAL;
		}
		addrcnt++;
		addr_buf += af->sockaddr_len;
		walk_size += af->sockaddr_len;
	}

	/* Do the work. */
	switch (op) {
	case SCTP_BINDX_ADD_ADDR:
		err = sctp_bindx_add(sk, kaddrs, addrcnt);
		if (err)
			goto out;
		err = sctp_send_asconf_add_ip(sk, kaddrs, addrcnt);
		break;

	case SCTP_BINDX_REM_ADDR:
		err = sctp_bindx_rem(sk, kaddrs, addrcnt);
		if (err)
			goto out;
		err = sctp_send_asconf_del_ip(sk, kaddrs, addrcnt);
		break;

	default:
		err = -EINVAL;
		break;
1026
	}
Linus Torvalds's avatar
Linus Torvalds committed
1027
1028
1029
1030
1031
1032
1033

out:
	kfree(kaddrs);

	return err;
}

1034
1035
1036
1037
1038
/* __sctp_connect(struct sock* sk, struct sockaddr *kaddrs, int addrs_size)
 *
 * Common routine for handling connect() and sctp_connectx().
 * Connect will come in with just a single address.
 */
1039
static int __sctp_connect(struct sock *sk,
1040
			  struct sockaddr *kaddrs,
1041
1042
			  int addrs_size,
			  sctp_assoc_t *assoc_id)
1043
{
1044
	struct net *net = sock_net(sk);
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
	struct sctp_sock *sp;
	struct sctp_endpoint *ep;
	struct sctp_association *asoc = NULL;
	struct sctp_association *asoc2;
	struct sctp_transport *transport;
	union sctp_addr to;
	sctp_scope_t scope;
	long timeo;
	int err = 0;
	int addrcnt = 0;
	int walk_size = 0;
1056
	union sctp_addr *sa_addr = NULL;
1057
	void *addr_buf;
1058
	unsigned short port;
1059
	unsigned int f_flags = 0;
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077

	sp = sctp_sk(sk);
	ep = sp->ep;

	/* connect() cannot be done on a socket that is already in ESTABLISHED
	 * state - UDP-style peeled off socket or a TCP-style socket that
	 * is already connected.
	 * It cannot be done even on a TCP-style listening socket.
	 */
	if (sctp_sstate(sk, ESTABLISHED) ||
	    (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING))) {
		err = -EISCONN;
		goto out_free;
	}

	/* Walk through the addrs buffer and count the number of addresses. */
	addr_buf = kaddrs;
	while (walk_size < addrs_size) {
1078
1079
		struct sctp_af *af;

1080
1081
1082
1083
1084
		if (walk_size + sizeof(sa_family_t) > addrs_size) {
			err = -EINVAL;
			goto out_free;
		}

Joe Perches's avatar
Joe Perches committed
1085
		sa_addr = addr_buf;
1086
		af = sctp_get_af_specific(sa_addr->sa.sa_family);
1087
1088
1089
1090
1091
1092
1093
1094
1095

		/* If the address family is not supported or if this address
		 * causes the address buffer to overflow return EINVAL.
		 */
		if (!af || (walk_size + af->sockaddr_len) > addrs_size) {
			err = -EINVAL;
			goto out_free;
		}

1096
1097
		port = ntohs(sa_addr->v4.sin_port);

1098
1099
1100
1101
		/* Save current address so we can work with it */
		memcpy(&to, sa_addr, af->sockaddr_len);

		err = sctp_verify_addr(sk, &to, af->sockaddr_len);
1102
1103
1104
		if (err)
			goto out_free;

1105
1106
1107
		/* Make sure the destination port is correctly set
		 * in all addresses.
		 */
1108
1109
		if (asoc && asoc->peer.port && asoc->peer.port != port) {
			err = -EINVAL;
1110
			goto out_free;
1111
		}
1112
1113
1114
1115

		/* Check if there already is a matching association on the
		 * endpoint (other than the one created here).
		 */
1116
		asoc2 = sctp_endpoint_lookup_assoc(ep, &to, &transport);
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
		if (asoc2 && asoc2 != asoc) {
			if (asoc2->state >= SCTP_STATE_ESTABLISHED)
				err = -EISCONN;
			else
				err = -EALREADY;
			goto out_free;
		}

		/* If we could not find a matching association on the endpoint,
		 * make sure that there is no peeled-off association matching
		 * the peer address even on another socket.
		 */
1129
		if (sctp_endpoint_is_peeled_off(ep, &to)) {
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
			err = -EADDRNOTAVAIL;
			goto out_free;
		}

		if (!asoc) {
			/* If a bind() or sctp_bindx() is not called prior to
			 * an sctp_connectx() call, the system picks an
			 * ephemeral port and will choose an address set
			 * equivalent to binding with a wildcard address.
			 */
			if (!ep->base.bind_addr.port) {
				if (sctp_autobind(sk)) {
					err = -EAGAIN;
					goto out_free;
				}
1145
1146
			} else {
				/*
1147
1148
1149
1150
				 * If an unprivileged user inherits a 1-many
				 * style socket with open associations on a
				 * privileged port, it MAY be permitted to
				 * accept new associations, but it SHOULD NOT
1151
1152
1153
				 * be permitted to open new associations.
				 */
				if (ep->base.bind_addr.port < PROT_SOCK &&
1154
				    !ns_capable(net->user_ns, CAP_NET_BIND_SERVICE)) {
1155
1156
1157
					err = -EACCES;
					goto out_free;
				}
1158
1159
			}

1160
			scope = sctp_scope(&to);
1161
1162
1163
1164
1165
			asoc = sctp_association_new(ep, sk, scope, GFP_KERNEL);
			if (!asoc) {
				err = -ENOMEM;
				goto out_free;
			}
1166
1167
1168
1169
1170
1171
1172

			err = sctp_assoc_set_bind_addr_from_ep(asoc, scope,
							      GFP_KERNEL);
			if (err < 0) {
				goto out_free;
			}

1173
1174
1175
		}

		/* Prime the peer's transport structures.  */
1176
		transport = sctp_assoc_add_peer(asoc, &to, GFP_KERNEL,
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
						SCTP_UNKNOWN);
		if (!transport) {
			err = -ENOMEM;
			goto out_free;
		}

		addrcnt++;
		addr_buf += af->sockaddr_len;
		walk_size += af->sockaddr_len;
	}

1188
1189
1190
1191
1192
1193
1194
1195
1196
	/* In case the user of sctp_connectx() wants an association
	 * id back, assign one now.
	 */
	if (assoc_id) {
		err = sctp_assoc_set_id(asoc, GFP_KERNEL);
		if (err < 0)
			goto out_free;
	}

1197
	err = sctp_primitive_ASSOCIATE(net, asoc, NULL);
1198
1199
1200
1201
1202
	if (err < 0) {
		goto out_free;
	}

	/* Initialize sk's dport and daddr for getpeername() */
1203
	inet_sk(sk)->inet_dport = htons(asoc->peer.port);
1204
	sp->pf->to_sk_daddr(sa_addr, sk);
1205
	sk->sk_err = 0;
1206

1207
1208
1209
1210
1211
1212
1213
1214
	/* in-kernel sockets don't generally have a file allocated to them
	 * if all they do is call sock_create_kern().
	 */
	if (sk->sk_socket->file)
		f_flags = sk->sk_socket->file->f_flags;

	timeo = sock_sndtimeo(sk, f_flags & O_NONBLOCK);

1215
	err = sctp_wait_for_connect(asoc, &timeo);
1216
	if ((err == 0 || err == -EINPROGRESS) && assoc_id)
1217
		*assoc_id = asoc->assoc_id;
1218
1219
1220
1221
1222

	/* Don't free association on exit. */
	asoc = NULL;

out_free:
1223
1224
	pr_debug("%s: took out_free path with asoc:%p kaddrs:%p err:%d\n",
		 __func__, asoc, kaddrs, err);
1225

1226
1227
1228
1229
1230
1231
	if (asoc) {
		/* sctp_primitive_ASSOCIATE may have added this association
		 * To the hash table, try to unhash it, just in case, its a noop
		 * if it wasn't hashed so we're safe
		 */
		sctp_unhash_established(asoc);
1232
		sctp_association_free(asoc);
1233
	}
1234
1235
1236
1237
1238
1239
	return err;
}

/* Helper for tunneling sctp_connectx() requests through sctp_setsockopt()
 *
 * API 8.9
1240
1241
 * int sctp_connectx(int sd, struct sockaddr *addrs, int addrcnt,
 * 			sctp_assoc_t *asoc);
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
 *
 * If sd is an IPv4 socket, the addresses passed must be IPv4 addresses.
 * If the sd is an IPv6 socket, the addresses passed can either be IPv4
 * or IPv6 addresses.
 *
 * A single address may be specified as INADDR_ANY or IN6ADDR_ANY, see
 * Section 3.1.2 for this usage.
 *
 * addrs is a pointer to an array of one or more socket addresses. Each
 * address is contained in its appropriate structure (i.e. struct
 * sockaddr_in or struct sockaddr_in6) the family of the address type
 * must be used to distengish the address length (note that this
 * representation is termed a "packed array" of addresses). The caller
 * specifies the number of addresses in the array with addrcnt.
 *
1257
1258
1259
1260
 * On success, sctp_connectx() returns 0. It also sets the assoc_id to
 * the association id of the new association.  On failure, sctp_connectx()
 * returns -1, and sets errno to the appropriate error code.  The assoc_id
 * is not touched by the kernel.
1261
1262
1263
1264
1265
1266
1267
1268
 *
 * For SCTP, the port given in each socket address must be the same, or
 * sctp_connectx() will fail, setting errno to EINVAL.
 *
 * An application can use sctp_connectx to initiate an association with
 * an endpoint that is multi-homed.  Much like sctp_bindx() this call
 * allows a caller to specify multiple addresses at which a peer can be
 * reached.  The way the SCTP stack uses the list of addresses to set up
Lucas De Marchi's avatar
Lucas De Marchi committed
1269
 * the association is implementation dependent.  This function only
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
 * specifies that the stack will try to make use of all the addresses in
 * the list when needed.
 *
 * Note that the list of addresses passed in is only used for setting up
 * the association.  It does not necessarily equal the set of addresses
 * the peer uses for the resulting association.  If the caller wants to
 * find out the set of peer addresses, it must use sctp_getpaddrs() to
 * retrieve them after the association has been set up.
 *
 * Basically do nothing but copying the addresses from user to kernel
 * land and invoking either sctp_connectx(). This is used for tunneling
 * the sctp_connectx() request through sctp_setsockopt() from userspace.
 *
 * We don't use copy_from_user() for optimization: we first do the
 * sanity checks (buffer size -fast- and access check-healthy
 * pointer); if all of those succeed, then we can alloc the memory
 * (expensive operation) needed to copy the data to kernel. Then we do
 * the copying without checking the user space area
 * (__copy_from_user()).
 *
 * On exit there is no need to do sockfd_put(), sys_setsockopt() does
 * it.
 *
 * sk        The sk of the socket
 * addrs     The pointer to the addresses in user land
 * addrssize Size of the addrs buffer
 *
1297
 * Returns >=0 if ok, <0 errno code on error.
1298
 */
1299
static int __sctp_setsockopt_connectx(struct sock *sk,
1300
				      struct sockaddr __user *addrs,
1301
1302
				      int addrs_size,
				      sctp_assoc_t *assoc_id)
1303
1304
1305
1306
{
	int err = 0;
	struct sockaddr *kaddrs;

1307
1308
	pr_debug("%s: sk:%p addrs:%p addrs_size:%d\n",
		 __func__, sk, addrs, addrs_size);
1309
1310
1311
1312
1313
1314
1315
1316
1317

	if (unlikely(addrs_size <= 0))
		return -EINVAL;

	/* Check the user passed a healthy pointer.  */
	if (unlikely(!access_ok(VERIFY_READ, addrs, addrs_size)))
		return -EFAULT;

	/* Alloc space for the address array in kernel memory.  */
1318
	kaddrs = kmalloc(addrs_size, GFP_KERNEL);
1319
1320
1321
1322
1323
1324
	if (unlikely(!kaddrs))
		return -ENOMEM;

	if (__copy_from_user(kaddrs, addrs, addrs_size)) {
		err = -EFAULT;
	} else {
1325
		err = __sctp_connect(sk, kaddrs, addrs_size, assoc_id);
1326
1327
1328
	}

	kfree(kaddrs);
1329

1330
1331
1332
	return err;
}

1333
1334
1335
1336
/*
 * This is an older interface.  It's kept for backward compatibility
 * to the option that doesn't provide association id.
 */
1337
static int sctp_setsockopt_connectx_old(struct sock *sk,
1338
1339
					struct sockaddr __user *addrs,
					int addrs_size)
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
{
	return __sctp_setsockopt_connectx(sk, addrs, addrs_size, NULL);
}

/*
 * New interface for the API.  The since the API is done with a socket
 * option, to make it simple we feed back the association id is as a return
 * indication to the call.  Error is always negative and association id is
 * always positive.
 */
1350
static int sctp_setsockopt_connectx(struct sock *sk,
1351
1352
				    struct sockaddr __user *addrs,
				    int addrs_size)
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
{
	sctp_assoc_t assoc_id = 0;
	int err = 0;

	err = __sctp_setsockopt_connectx(sk, addrs, addrs_size, &assoc_id);

	if (err)
		return err;
	else
		return assoc_id;
}

1365
/*
1366
1367
 * New (hopefully final) interface for the API.
 * We use the sctp_getaddrs_old structure so that use-space library
1368
 * can avoid any unnecessary allocations. The only different part
1369
 * is that we store the actual length of the address buffer into the
1370
 * addrs_num structure member. That way we can re-use the existing
1371
 * code.
1372
 */
1373
1374
1375
1376
1377
1378
1379
1380
#ifdef CONFIG_COMPAT
struct compat_sctp_getaddrs_old {
	sctp_assoc_t	assoc_id;
	s32		addr_num;
	compat_uptr_t	addrs;		/* struct sockaddr * */
};
#endif

1381
static int sctp_getsockopt_connectx3(struct sock *sk, int len,
1382
1383
				     char __user *optval,
				     int __user *optlen)
1384
{
1385
	struct sctp_getaddrs_old param;
1386
1387
1388
	sctp_assoc_t assoc_id = 0;
	int err = 0;

1389
1390
1391
#ifdef CONFIG_COMPAT
	if (is_compat_task()) {
		struct compat_sctp_getaddrs_old param32;
1392

1393
1394
1395
1396
		if (len < sizeof(param32))
			return -EINVAL;
		if (copy_from_user(&param32, optval, sizeof(param32)))
			return -EFAULT;
1397

1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
		param.assoc_id = param32.assoc_id;
		param.addr_num = param32.addr_num;
		param.addrs = compat_ptr(param32.addrs);
	} else
#endif
	{
		if (len < sizeof(param))
			return -EINVAL;
		if (copy_from_user(&param, optval, sizeof(param)))
			return -EFAULT;
	}
1409

1410
1411
1412
	err = __sctp_setsockopt_connectx(sk, (struct sockaddr __user *)
					 param.addrs, param.addr_num,
					 &assoc_id);
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
	if (err == 0 || err == -EINPROGRESS) {
		if (copy_to_user(optval, &assoc_id, sizeof(assoc_id)))
			return -EFAULT;
		if (put_user(sizeof(assoc_id), optlen))
			return -EFAULT;
	}

	return err;
}

Linus Torvalds's avatar
Linus Torvalds committed
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
/* API 3.1.4 close() - UDP Style Syntax
 * Applications use close() to perform graceful shutdown (as described in
 * Section 10.1 of [SCTP]) on ALL the associations currently represented
 * by a UDP-style socket.
 *
 * The syntax is
 *
 *   ret = close(int sd);
 *
 *   sd      - the socket descriptor of the associations to be closed.
 *
 * To gracefully shutdown a specific association represented by the
 * UDP-style socket, an application should use the sendmsg() call,
 * passing no user data, but including the appropriate flag in the
 * ancillary data (see Section xxxx).
 *
 * If sd in the close() call is a branched-off socket representing only
 * one association, the shutdown is performed on that association only.
 *
 * 4.1.6 close() - TCP Style Syntax
 *
 * Applications use close() to gracefully close down an association.
 *
 * The syntax is:
 *
 *    int close(int sd);
 *
 *      sd      - the socket descriptor of the association to be closed.
 *
 * After an application calls close() on a socket descriptor, no further
 * socket operations will succeed on that descriptor.
 *
 * API 7.1.4 SO_LINGER
 *
 * An application using the TCP-style socket can use this option to
 * perform the SCTP ABORT primitive.  The linger option structure is:
 *
 *  struct  linger {
 *     int     l_onoff;                // option on/off
 *     int     l_linger;               // linger time
 * };
 *
 * To enable the option, set l_onoff to 1.  If the l_linger value is set
 * to 0, calling close() is the same as the ABORT primitive.  If the
 * value is set to a negative value, the setsockopt() call will return
 * an error.  If the value is set to a positive value linger_time, the
 * close() can be blocked for at most linger_time ms.  If the graceful
 * shutdown phase does not finish during this period, close() will
 * return but the graceful shutdown phase continues in the system.
 */
1473
static void sctp_close(struct sock *sk, long timeout)
Linus Torvalds's avatar
Linus Torvalds committed
1474
{
1475
	struct net *net = sock_net(sk);
Linus Torvalds's avatar
Linus Torvalds committed
1476
1477
1478
	struct sctp_endpoint *ep;
	struct sctp_association *asoc;
	struct list_head *pos, *temp;
1479
	unsigned int data_was_unread;
Linus Torvalds's avatar
Linus Torvalds committed
1480

1481
	pr_debug("%s: sk:%p, timeout:%ld\n", __func__, sk, timeout);
Linus Torvalds's avatar
Linus Torvalds committed
1482

1483
	lock_sock(sk);
Linus Torvalds's avatar
Linus Torvalds committed
1484
	sk->sk_shutdown = SHUTDOWN_MASK;
1485
	sk->sk_state = SCTP_SS_CLOSING;
Linus Torvalds's avatar
Linus Torvalds committed
1486
1487
1488

	ep = sctp_sk(sk)->ep;

1489
1490
1491
1492
	/* Clean up any skbs sitting on the receive queue.  */
	data_was_unread = sctp_queue_purge_ulpevents(&sk->sk_receive_queue);
	data_was_unread += sctp_queue_purge_ulpevents(&sctp_sk(sk)->pd_lobby);

1493
	/* Walk all associations on an endpoint.  */
Linus Torvalds's avatar
Linus Torvalds committed
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
	list_for_each_safe(pos, temp, &ep->asocs) {
		asoc = list_entry(pos, struct sctp_association, asocs);

		if (sctp_style(sk, TCP)) {
			/* A closed association can still be in the list if
			 * it belongs to a TCP-style listening socket that is
			 * not yet accepted. If so, free it. If not, send an
			 * ABORT or SHUTDOWN based on the linger options.
			 */
			if (sctp_state(asoc, CLOSED)) {
				sctp_unhash_established(asoc);
				sctp_association_free(asoc);
1506
1507
1508
				continue;
			}
		}
Linus Torvalds's avatar
Linus Torvalds committed
1509

1510
1511
1512
		if (data_was_unread || !skb_queue_empty(&asoc->ulpq.lobby) ||
		    !skb_queue_empty(&asoc->ulpq.reasm) ||
		    (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime)) {
1513
1514
1515
1516
			struct sctp_chunk *chunk;

			chunk = sctp_make_abort_user(asoc, NULL, 0);
			if (chunk)
1517
				sctp_primitive_ABORT(net, asoc, chunk);
1518
		} else
1519
			sctp_primitive_SHUTDOWN(net, asoc, NULL);
Linus Torvalds's avatar
Linus Torvalds committed
1520
1521
1522
1523
1524
1525
1526
	}

	/* On a TCP-style socket, block for at most linger_time if set. */
	if (sctp_style(sk,