socket.c 219 KB
Newer Older
1
/* SCTP kernel implementation
Linus Torvalds's avatar
Linus Torvalds committed
2
3
4
5
6
7
8
 * (C) Copyright IBM Corp. 2001, 2004
 * Copyright (c) 1999-2000 Cisco, Inc.
 * Copyright (c) 1999-2001 Motorola, Inc.
 * Copyright (c) 2001-2003 Intel Corp.
 * Copyright (c) 2001-2002 Nokia, Inc.
 * Copyright (c) 2001 La Monte H.P. Yarroll
 *
9
 * This file is part of the SCTP kernel implementation
Linus Torvalds's avatar
Linus Torvalds committed
10
11
12
13
14
15
16
17
 *
 * These functions interface with the sockets layer to implement the
 * SCTP Extensions for the Sockets API.
 *
 * Note that the descriptions from the specification are USER level
 * functions--this file is the functions which populate the struct proto
 * for SCTP which is the BOTTOM of the sockets interface.
 *
18
 * This SCTP implementation is free software;
Linus Torvalds's avatar
Linus Torvalds committed
19
20
21
22
23
 * you can redistribute it and/or modify it under the terms of
 * the GNU General Public License as published by
 * the Free Software Foundation; either version 2, or (at your option)
 * any later version.
 *
24
 * This SCTP implementation is distributed in the hope that it
Linus Torvalds's avatar
Linus Torvalds committed
25
26
27
28
29
30
 * will be useful, but WITHOUT ANY WARRANTY; without even the implied
 *                 ************************
 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
31
32
 * along with GNU CC; see the file COPYING.  If not, see
 * <http://www.gnu.org/licenses/>.
Linus Torvalds's avatar
Linus Torvalds committed
33
34
35
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
36
 *    lksctp developers <linux-sctp@vger.kernel.org>
Linus Torvalds's avatar
Linus Torvalds committed
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
 *
 * Written or modified by:
 *    La Monte H.P. Yarroll <piggy@acm.org>
 *    Narasimha Budihal     <narsi@refcode.org>
 *    Karl Knutson          <karl@athena.chicago.il.us>
 *    Jon Grimm             <jgrimm@us.ibm.com>
 *    Xingang Guo           <xingang.guo@intel.com>
 *    Daisy Chang           <daisyc@us.ibm.com>
 *    Sridhar Samudrala     <samudrala@us.ibm.com>
 *    Inaky Perez-Gonzalez  <inaky.gonzalez@intel.com>
 *    Ardelle Fan	    <ardelle.fan@intel.com>
 *    Ryan Layer	    <rmlayer@us.ibm.com>
 *    Anup Pemmaiah         <pemmaiah@cc.usu.edu>
 *    Kevin Gao             <kevin.gao@intel.com>
 */

53
54
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

Herbert Xu's avatar
Herbert Xu committed
55
#include <crypto/hash.h>
Linus Torvalds's avatar
Linus Torvalds committed
56
57
58
59
60
#include <linux/types.h>
#include <linux/kernel.h>
#include <linux/wait.h>
#include <linux/time.h>
#include <linux/ip.h>
61
#include <linux/capability.h>
Linus Torvalds's avatar
Linus Torvalds committed
62
63
64
#include <linux/fcntl.h>
#include <linux/poll.h>
#include <linux/init.h>
65
#include <linux/slab.h>
66
#include <linux/file.h>
67
#include <linux/compat.h>
Linus Torvalds's avatar
Linus Torvalds committed
68
69
70
71
72
73

#include <net/ip.h>
#include <net/icmp.h>
#include <net/route.h>
#include <net/ipv6.h>
#include <net/inet_common.h>
74
#include <net/busy_poll.h>
Linus Torvalds's avatar
Linus Torvalds committed
75
76

#include <linux/socket.h> /* for sa_family_t */
77
#include <linux/export.h>
Linus Torvalds's avatar
Linus Torvalds committed
78
79
80
81
82
83
84
85
86
#include <net/sock.h>
#include <net/sctp/sctp.h>
#include <net/sctp/sm.h>

/* Forward declarations for internal helper functions. */
static int sctp_writeable(struct sock *sk);
static void sctp_wfree(struct sk_buff *skb);
static int sctp_wait_for_sndbuf(struct sctp_association *, long *timeo_p,
				size_t msg_len);
87
static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p);
Linus Torvalds's avatar
Linus Torvalds committed
88
89
90
static int sctp_wait_for_connect(struct sctp_association *, long *timeo_p);
static int sctp_wait_for_accept(struct sock *sk, long timeo);
static void sctp_wait_for_close(struct sock *sk, long timeo);
91
static void sctp_destruct_sock(struct sock *sk);
Linus Torvalds's avatar
Linus Torvalds committed
92
93
94
95
96
97
98
99
100
101
102
103
104
static struct sctp_af *sctp_sockaddr_af(struct sctp_sock *opt,
					union sctp_addr *addr, int len);
static int sctp_bindx_add(struct sock *, struct sockaddr *, int);
static int sctp_bindx_rem(struct sock *, struct sockaddr *, int);
static int sctp_send_asconf_add_ip(struct sock *, struct sockaddr *, int);
static int sctp_send_asconf_del_ip(struct sock *, struct sockaddr *, int);
static int sctp_send_asconf(struct sctp_association *asoc,
			    struct sctp_chunk *chunk);
static int sctp_do_bind(struct sock *, union sctp_addr *, int);
static int sctp_autobind(struct sock *sk);
static void sctp_sock_migrate(struct sock *, struct sock *,
			      struct sctp_association *, sctp_socket_type_t);

105
static int sctp_memory_pressure;
Eric Dumazet's avatar
Eric Dumazet committed
106
static atomic_long_t sctp_memory_allocated;
107
struct percpu_counter sctp_sockets_allocated;
108

109
static void sctp_enter_memory_pressure(struct sock *sk)
110
111
112
113
114
{
	sctp_memory_pressure = 1;
}


Linus Torvalds's avatar
Linus Torvalds committed
115
116
117
/* Get the sndbuf space available at the time on the association.  */
static inline int sctp_wspace(struct sctp_association *asoc)
{
118
	int amt;
Linus Torvalds's avatar
Linus Torvalds committed
119

120
121
122
	if (asoc->ep->sndbuf_policy)
		amt = asoc->sndbuf_used;
	else
123
		amt = sk_wmem_alloc_get(asoc->base.sk);
124
125
126
127
128
129
130
131
132

	if (amt >= asoc->base.sk->sk_sndbuf) {
		if (asoc->base.sk->sk_userlocks & SOCK_SNDBUF_LOCK)
			amt = 0;
		else {
			amt = sk_stream_wspace(asoc->base.sk);
			if (amt < 0)
				amt = 0;
		}
133
	} else {
134
		amt = asoc->base.sk->sk_sndbuf - amt;
135
	}
Linus Torvalds's avatar
Linus Torvalds committed
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
	return amt;
}

/* Increment the used sndbuf space count of the corresponding association by
 * the size of the outgoing data chunk.
 * Also, set the skb destructor for sndbuf accounting later.
 *
 * Since it is always 1-1 between chunk and skb, and also a new skb is always
 * allocated for chunk bundling in sctp_packet_transmit(), we can use the
 * destructor in the data chunk skb for the purpose of the sndbuf space
 * tracking.
 */
static inline void sctp_set_owner_w(struct sctp_chunk *chunk)
{
	struct sctp_association *asoc = chunk->asoc;
	struct sock *sk = asoc->base.sk;

	/* The sndbuf space is tracked per association.  */
	sctp_association_hold(asoc);

156
157
	skb_set_owner_w(chunk->skb, sk);

Linus Torvalds's avatar
Linus Torvalds committed
158
159
	chunk->skb->destructor = sctp_wfree;
	/* Save the chunk pointer in skb for sctp_wfree to use later.  */
160
	skb_shinfo(chunk->skb)->destructor_arg = chunk;
Linus Torvalds's avatar
Linus Torvalds committed
161

162
163
164
165
166
	asoc->sndbuf_used += SCTP_DATA_SNDSIZE(chunk) +
				sizeof(struct sk_buff) +
				sizeof(struct sctp_chunk);

	atomic_add(sizeof(struct sctp_chunk), &sk->sk_wmem_alloc);
167
168
	sk->sk_wmem_queued += chunk->skb->truesize;
	sk_mem_charge(sk, chunk->skb->truesize);
Linus Torvalds's avatar
Linus Torvalds committed
169
170
171
172
173
174
175
176
177
178
179
180
181
182
}

/* Verify that this is a valid address. */
static inline int sctp_verify_addr(struct sock *sk, union sctp_addr *addr,
				   int len)
{
	struct sctp_af *af;

	/* Verify basic sockaddr. */
	af = sctp_sockaddr_af(sctp_sk(sk), addr, len);
	if (!af)
		return -EINVAL;

	/* Is this a valid SCTP address?  */
183
	if (!af->addr_valid(addr, sctp_sk(sk), NULL))
Linus Torvalds's avatar
Linus Torvalds committed
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
		return -EINVAL;

	if (!sctp_sk(sk)->pf->send_verify(sctp_sk(sk), (addr)))
		return -EINVAL;

	return 0;
}

/* Look up the association by its id.  If this is not a UDP-style
 * socket, the ID field is always ignored.
 */
struct sctp_association *sctp_id2assoc(struct sock *sk, sctp_assoc_t id)
{
	struct sctp_association *asoc = NULL;

	/* If this is not a UDP-style socket, assoc id should be ignored. */
	if (!sctp_style(sk, UDP)) {
		/* Return NULL if the socket state is not ESTABLISHED. It
		 * could be a TCP-style listening socket or a socket which
		 * hasn't yet called connect() to establish an association.
		 */
205
		if (!sctp_sstate(sk, ESTABLISHED) && !sctp_sstate(sk, CLOSING))
Linus Torvalds's avatar
Linus Torvalds committed
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
			return NULL;

		/* Get the first and the only association from the list. */
		if (!list_empty(&sctp_sk(sk)->ep->asocs))
			asoc = list_entry(sctp_sk(sk)->ep->asocs.next,
					  struct sctp_association, asocs);
		return asoc;
	}

	/* Otherwise this is a UDP-style socket. */
	if (!id || (id == (sctp_assoc_t)-1))
		return NULL;

	spin_lock_bh(&sctp_assocs_id_lock);
	asoc = (struct sctp_association *)idr_find(&sctp_assocs_id, (int)id);
	spin_unlock_bh(&sctp_assocs_id_lock);

	if (!asoc || (asoc->base.sk != sk) || asoc->base.dead)
		return NULL;

	return asoc;
}

/* Look up the transport from an address and an assoc id. If both address and
 * id are specified, the associations matching the address and the id should be
 * the same.
 */
static struct sctp_transport *sctp_addr_id2transport(struct sock *sk,
					      struct sockaddr_storage *addr,
					      sctp_assoc_t id)
{
	struct sctp_association *addr_asoc = NULL, *id_asoc = NULL;
	struct sctp_transport *transport;
	union sctp_addr *laddr = (union sctp_addr *)addr;

	addr_asoc = sctp_endpoint_lookup_assoc(sctp_sk(sk)->ep,
242
					       laddr,
Linus Torvalds's avatar
Linus Torvalds committed
243
244
245
246
247
248
249
250
251
					       &transport);

	if (!addr_asoc)
		return NULL;

	id_asoc = sctp_id2assoc(sk, id);
	if (id_asoc && (id_asoc != addr_asoc))
		return NULL;

252
	sctp_get_pf_specific(sk->sk_family)->addr_to_user(sctp_sk(sk),
Linus Torvalds's avatar
Linus Torvalds committed
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
						(union sctp_addr *)addr);

	return transport;
}

/* API 3.1.2 bind() - UDP Style Syntax
 * The syntax of bind() is,
 *
 *   ret = bind(int sd, struct sockaddr *addr, int addrlen);
 *
 *   sd      - the socket descriptor returned by socket().
 *   addr    - the address structure (struct sockaddr_in or struct
 *             sockaddr_in6 [RFC 2553]),
 *   addr_len - the size of the address structure.
 */
268
static int sctp_bind(struct sock *sk, struct sockaddr *addr, int addr_len)
Linus Torvalds's avatar
Linus Torvalds committed
269
270
271
{
	int retval = 0;

272
	lock_sock(sk);
Linus Torvalds's avatar
Linus Torvalds committed
273

274
275
	pr_debug("%s: sk:%p, addr:%p, addr_len:%d\n", __func__, sk,
		 addr, addr_len);
Linus Torvalds's avatar
Linus Torvalds committed
276
277
278

	/* Disallow binding twice. */
	if (!sctp_sk(sk)->ep->base.bind_addr.port)
279
		retval = sctp_do_bind(sk, (union sctp_addr *)addr,
Linus Torvalds's avatar
Linus Torvalds committed
280
281
282
283
				      addr_len);
	else
		retval = -EINVAL;

284
	release_sock(sk);
Linus Torvalds's avatar
Linus Torvalds committed
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300

	return retval;
}

static long sctp_get_port_local(struct sock *, union sctp_addr *);

/* Verify this is a valid sockaddr. */
static struct sctp_af *sctp_sockaddr_af(struct sctp_sock *opt,
					union sctp_addr *addr, int len)
{
	struct sctp_af *af;

	/* Check minimum size.  */
	if (len < sizeof (struct sockaddr))
		return NULL;

301
302
303
304
305
306
307
308
309
310
	/* V4 mapped address are really of AF_INET family */
	if (addr->sa.sa_family == AF_INET6 &&
	    ipv6_addr_v4mapped(&addr->v6.sin6_addr)) {
		if (!opt->pf->af_supported(AF_INET, opt))
			return NULL;
	} else {
		/* Does this PF support this AF? */
		if (!opt->pf->af_supported(addr->sa.sa_family, opt))
			return NULL;
	}
Linus Torvalds's avatar
Linus Torvalds committed
311
312
313
314
315
316
317
318
319
320
321

	/* If we get this far, af is valid. */
	af = sctp_get_af_specific(addr->sa.sa_family);

	if (len < af->sockaddr_len)
		return NULL;

	return af;
}

/* Bind a local address either to an endpoint or to an association.  */
322
static int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)
Linus Torvalds's avatar
Linus Torvalds committed
323
{
324
	struct net *net = sock_net(sk);
Linus Torvalds's avatar
Linus Torvalds committed
325
326
327
328
329
330
331
332
333
	struct sctp_sock *sp = sctp_sk(sk);
	struct sctp_endpoint *ep = sp->ep;
	struct sctp_bind_addr *bp = &ep->base.bind_addr;
	struct sctp_af *af;
	unsigned short snum;
	int ret = 0;

	/* Common sockaddr verification. */
	af = sctp_sockaddr_af(sp, addr, len);
334
	if (!af) {
335
336
		pr_debug("%s: sk:%p, newaddr:%p, len:%d EINVAL\n",
			 __func__, sk, addr, len);
Linus Torvalds's avatar
Linus Torvalds committed
337
		return -EINVAL;
338
339
340
341
	}

	snum = ntohs(addr->v4.sin_port);

342
343
	pr_debug("%s: sk:%p, new addr:%pISc, port:%d, new port:%d, len:%d\n",
		 __func__, sk, &addr->sa, bp->port, snum, len);
Linus Torvalds's avatar
Linus Torvalds committed
344
345
346
347
348

	/* PF specific bind() address verification. */
	if (!sp->pf->bind_verify(sp, addr))
		return -EADDRNOTAVAIL;

349
350
351
352
353
354
355
356
	/* We must either be unbound, or bind to the same port.
	 * It's OK to allow 0 ports if we are already bound.
	 * We'll just inhert an already bound port in this case
	 */
	if (bp->port) {
		if (!snum)
			snum = bp->port;
		else if (snum != bp->port) {
357
358
			pr_debug("%s: new port %d doesn't match existing port "
				 "%d\n", __func__, snum, bp->port);
359
360
			return -EINVAL;
		}
Linus Torvalds's avatar
Linus Torvalds committed
361
362
	}

363
364
	if (snum && snum < PROT_SOCK &&
	    !ns_capable(net->user_ns, CAP_NET_BIND_SERVICE))
Linus Torvalds's avatar
Linus Torvalds committed
365
366
		return -EACCES;

367
368
369
370
371
372
	/* See if the address matches any of the addresses we may have
	 * already bound before checking against other endpoints.
	 */
	if (sctp_bind_addr_match(bp, addr, sp))
		return -EINVAL;

Linus Torvalds's avatar
Linus Torvalds committed
373
374
375
376
	/* Make sure we are allowed to bind here.
	 * The function sctp_get_port_local() does duplicate address
	 * detection.
	 */
377
	addr->v4.sin_port = htons(snum);
Linus Torvalds's avatar
Linus Torvalds committed
378
	if ((ret = sctp_get_port_local(sk, addr))) {
379
		return -EADDRINUSE;
Linus Torvalds's avatar
Linus Torvalds committed
380
381
382
383
	}

	/* Refresh ephemeral port.  */
	if (!bp->port)
384
		bp->port = inet_sk(sk)->inet_num;
Linus Torvalds's avatar
Linus Torvalds committed
385

386
387
388
	/* Add the address to the bind address list.
	 * Use GFP_ATOMIC since BHs will be disabled.
	 */
389
390
	ret = sctp_add_bind_addr(bp, addr, af->sockaddr_len,
				 SCTP_ADDR_SRC, GFP_ATOMIC);
Linus Torvalds's avatar
Linus Torvalds committed
391
392
393

	/* Copy back into socket for getsockname() use. */
	if (!ret) {
394
		inet_sk(sk)->inet_sport = htons(inet_sk(sk)->inet_num);
395
		sp->pf->to_sk_saddr(addr, sk);
Linus Torvalds's avatar
Linus Torvalds committed
396
397
398
399
400
401
402
	}

	return ret;
}

 /* ADDIP Section 4.1.1 Congestion Control of ASCONF Chunks
 *
403
 * R1) One and only one ASCONF Chunk MAY be in transit and unacknowledged
Linus Torvalds's avatar
Linus Torvalds committed
404
 * at any one time.  If a sender, after sending an ASCONF chunk, decides
405
 * it needs to transfer another ASCONF Chunk, it MUST wait until the
Linus Torvalds's avatar
Linus Torvalds committed
406
 * ASCONF-ACK Chunk returns from the previous ASCONF Chunk before sending a
407
408
 * subsequent ASCONF. Note this restriction binds each side, so at any
 * time two ASCONF may be in-transit on any given association (one sent
Linus Torvalds's avatar
Linus Torvalds committed
409
410
411
412
413
 * from each endpoint).
 */
static int sctp_send_asconf(struct sctp_association *asoc,
			    struct sctp_chunk *chunk)
{
414
	struct net 	*net = sock_net(asoc->base.sk);
Linus Torvalds's avatar
Linus Torvalds committed
415
416
417
418
	int		retval = 0;

	/* If there is an outstanding ASCONF chunk, queue it for later
	 * transmission.
419
	 */
Linus Torvalds's avatar
Linus Torvalds committed
420
	if (asoc->addip_last_asconf) {
421
		list_add_tail(&chunk->list, &asoc->addip_chunk_list);
422
		goto out;
Linus Torvalds's avatar
Linus Torvalds committed
423
424
425
426
	}

	/* Hold the chunk until an ASCONF_ACK is received. */
	sctp_chunk_hold(chunk);
427
	retval = sctp_primitive_ASCONF(net, asoc, chunk);
Linus Torvalds's avatar
Linus Torvalds committed
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
	if (retval)
		sctp_chunk_free(chunk);
	else
		asoc->addip_last_asconf = chunk;

out:
	return retval;
}

/* Add a list of addresses as bind addresses to local endpoint or
 * association.
 *
 * Basically run through each address specified in the addrs/addrcnt
 * array/length pair, determine if it is IPv6 or IPv4 and call
 * sctp_do_bind() on it.
 *
 * If any of them fails, then the operation will be reversed and the
 * ones that were added will be removed.
 *
 * Only sctp_setsockopt_bindx() is supposed to call this function.
 */
449
static int sctp_bindx_add(struct sock *sk, struct sockaddr *addrs, int addrcnt)
Linus Torvalds's avatar
Linus Torvalds committed
450
451
452
453
454
455
456
{
	int cnt;
	int retval = 0;
	void *addr_buf;
	struct sockaddr *sa_addr;
	struct sctp_af *af;

457
458
	pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n", __func__, sk,
		 addrs, addrcnt);
Linus Torvalds's avatar
Linus Torvalds committed
459
460
461
462
463
464

	addr_buf = addrs;
	for (cnt = 0; cnt < addrcnt; cnt++) {
		/* The list may contain either IPv4 or IPv6 address;
		 * determine the address length for walking thru the list.
		 */
Joe Perches's avatar
Joe Perches committed
465
		sa_addr = addr_buf;
Linus Torvalds's avatar
Linus Torvalds committed
466
467
468
469
470
471
		af = sctp_get_af_specific(sa_addr->sa_family);
		if (!af) {
			retval = -EINVAL;
			goto err_bindx_add;
		}

472
		retval = sctp_do_bind(sk, (union sctp_addr *)sa_addr,
Linus Torvalds's avatar
Linus Torvalds committed
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
				      af->sockaddr_len);

		addr_buf += af->sockaddr_len;

err_bindx_add:
		if (retval < 0) {
			/* Failed. Cleanup the ones that have been added */
			if (cnt > 0)
				sctp_bindx_rem(sk, addrs, cnt);
			return retval;
		}
	}

	return retval;
}

/* Send an ASCONF chunk with Add IP address parameters to all the peers of the
 * associations that are part of the endpoint indicating that a list of local
 * addresses are added to the endpoint.
 *
493
 * If any of the addresses is already in the bind address list of the
Linus Torvalds's avatar
Linus Torvalds committed
494
495
496
497
498
 * association, we do not send the chunk for that association.  But it will not
 * affect other associations.
 *
 * Only sctp_setsockopt_bindx() is supposed to call this function.
 */
499
static int sctp_send_asconf_add_ip(struct sock		*sk,
Linus Torvalds's avatar
Linus Torvalds committed
500
501
502
				   struct sockaddr	*addrs,
				   int 			addrcnt)
{
503
	struct net *net = sock_net(sk);
Linus Torvalds's avatar
Linus Torvalds committed
504
505
506
507
508
509
510
	struct sctp_sock		*sp;
	struct sctp_endpoint		*ep;
	struct sctp_association		*asoc;
	struct sctp_bind_addr		*bp;
	struct sctp_chunk		*chunk;
	struct sctp_sockaddr_entry	*laddr;
	union sctp_addr			*addr;
511
	union sctp_addr			saveaddr;
Linus Torvalds's avatar
Linus Torvalds committed
512
513
514
515
516
517
	void				*addr_buf;
	struct sctp_af			*af;
	struct list_head		*p;
	int 				i;
	int 				retval = 0;

518
	if (!net->sctp.addip_enable)
Linus Torvalds's avatar
Linus Torvalds committed
519
520
521
522
523
		return retval;

	sp = sctp_sk(sk);
	ep = sp->ep;

524
525
	pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n",
		 __func__, sk, addrs, addrcnt);
Linus Torvalds's avatar
Linus Torvalds committed
526

527
	list_for_each_entry(asoc, &ep->asocs, asocs) {
Linus Torvalds's avatar
Linus Torvalds committed
528
529
530
531
532
533
534
535
536
537
		if (!asoc->peer.asconf_capable)
			continue;

		if (asoc->peer.addip_disabled_mask & SCTP_PARAM_ADD_IP)
			continue;

		if (!sctp_state(asoc, ESTABLISHED))
			continue;

		/* Check if any address in the packed array of addresses is
538
539
		 * in the bind address list of the association. If so,
		 * do not send the asconf chunk to its peer, but continue with
Linus Torvalds's avatar
Linus Torvalds committed
540
541
542
543
		 * other associations.
		 */
		addr_buf = addrs;
		for (i = 0; i < addrcnt; i++) {
Joe Perches's avatar
Joe Perches committed
544
			addr = addr_buf;
Linus Torvalds's avatar
Linus Torvalds committed
545
546
547
548
549
550
551
552
553
554
555
556
557
558
			af = sctp_get_af_specific(addr->v4.sin_family);
			if (!af) {
				retval = -EINVAL;
				goto out;
			}

			if (sctp_assoc_lookup_laddr(asoc, addr))
				break;

			addr_buf += af->sockaddr_len;
		}
		if (i < addrcnt)
			continue;

559
560
		/* Use the first valid address in bind addr list of
		 * association as Address Parameter of ASCONF CHUNK.
Linus Torvalds's avatar
Linus Torvalds committed
561
562
563
564
		 */
		bp = &asoc->base.bind_addr;
		p = bp->address_list.next;
		laddr = list_entry(p, struct sctp_sockaddr_entry, list);
565
		chunk = sctp_make_asconf_update_ip(asoc, &laddr->a, addrs,
Linus Torvalds's avatar
Linus Torvalds committed
566
567
568
569
570
571
						   addrcnt, SCTP_PARAM_ADD_IP);
		if (!chunk) {
			retval = -ENOMEM;
			goto out;
		}

572
573
		/* Add the new addresses to the bind address list with
		 * use_as_src set to 0.
Linus Torvalds's avatar
Linus Torvalds committed
574
		 */
575
576
		addr_buf = addrs;
		for (i = 0; i < addrcnt; i++) {
Joe Perches's avatar
Joe Perches committed
577
			addr = addr_buf;
578
579
			af = sctp_get_af_specific(addr->v4.sin_family);
			memcpy(&saveaddr, addr, af->sockaddr_len);
580
			retval = sctp_add_bind_addr(bp, &saveaddr,
581
						    sizeof(saveaddr),
582
						    SCTP_ADDR_NEW, GFP_ATOMIC);
583
584
			addr_buf += af->sockaddr_len;
		}
585
586
587
588
589
590
591
592
593
594
595
		if (asoc->src_out_of_asoc_ok) {
			struct sctp_transport *trans;

			list_for_each_entry(trans,
			    &asoc->peer.transport_addr_list, transports) {
				/* Clear the source and route cache */
				dst_release(trans->dst);
				trans->cwnd = min(4*asoc->pathmtu, max_t(__u32,
				    2*asoc->pathmtu, 4380));
				trans->ssthresh = asoc->peer.i.a_rwnd;
				trans->rto = asoc->rto_initial;
596
				sctp_max_rto(asoc, trans);
597
598
599
600
601
602
				trans->rtt = trans->srtt = trans->rttvar = 0;
				sctp_transport_route(trans, NULL,
				    sctp_sk(asoc->base.sk));
			}
		}
		retval = sctp_send_asconf(asoc, chunk);
Linus Torvalds's avatar
Linus Torvalds committed
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
	}

out:
	return retval;
}

/* Remove a list of addresses from bind addresses list.  Do not remove the
 * last address.
 *
 * Basically run through each address specified in the addrs/addrcnt
 * array/length pair, determine if it is IPv6 or IPv4 and call
 * sctp_del_bind() on it.
 *
 * If any of them fails, then the operation will be reversed and the
 * ones that were removed will be added back.
 *
 * At least one address has to be left; if only one address is
 * available, the operation will return -EBUSY.
 *
 * Only sctp_setsockopt_bindx() is supposed to call this function.
 */
624
static int sctp_bindx_rem(struct sock *sk, struct sockaddr *addrs, int addrcnt)
Linus Torvalds's avatar
Linus Torvalds committed
625
626
627
628
629
630
631
{
	struct sctp_sock *sp = sctp_sk(sk);
	struct sctp_endpoint *ep = sp->ep;
	int cnt;
	struct sctp_bind_addr *bp = &ep->base.bind_addr;
	int retval = 0;
	void *addr_buf;
632
	union sctp_addr *sa_addr;
Linus Torvalds's avatar
Linus Torvalds committed
633
634
	struct sctp_af *af;

635
636
	pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n",
		 __func__, sk, addrs, addrcnt);
Linus Torvalds's avatar
Linus Torvalds committed
637
638
639
640
641
642
643
644
645
646
647
648
649

	addr_buf = addrs;
	for (cnt = 0; cnt < addrcnt; cnt++) {
		/* If the bind address list is empty or if there is only one
		 * bind address, there is nothing more to be removed (we need
		 * at least one address here).
		 */
		if (list_empty(&bp->address_list) ||
		    (sctp_list_single_entry(&bp->address_list))) {
			retval = -EBUSY;
			goto err_bindx_rem;
		}

Joe Perches's avatar
Joe Perches committed
650
		sa_addr = addr_buf;
651
		af = sctp_get_af_specific(sa_addr->sa.sa_family);
Linus Torvalds's avatar
Linus Torvalds committed
652
653
654
655
		if (!af) {
			retval = -EINVAL;
			goto err_bindx_rem;
		}
656
657
658
659
660
661

		if (!af->addr_valid(sa_addr, sp, NULL)) {
			retval = -EADDRNOTAVAIL;
			goto err_bindx_rem;
		}

662
663
		if (sa_addr->v4.sin_port &&
		    sa_addr->v4.sin_port != htons(bp->port)) {
Linus Torvalds's avatar
Linus Torvalds committed
664
665
666
667
			retval = -EINVAL;
			goto err_bindx_rem;
		}

668
669
670
		if (!sa_addr->v4.sin_port)
			sa_addr->v4.sin_port = htons(bp->port);

Linus Torvalds's avatar
Linus Torvalds committed
671
672
673
674
675
676
677
		/* FIXME - There is probably a need to check if sk->sk_saddr and
		 * sk->sk_rcv_addr are currently set to one of the addresses to
		 * be removed. This is something which needs to be looked into
		 * when we are fixing the outstanding issues with multi-homing
		 * socket routing and failover schemes. Refer to comments in
		 * sctp_do_bind(). -daisy
		 */
678
		retval = sctp_del_bind_addr(bp, sa_addr);
Linus Torvalds's avatar
Linus Torvalds committed
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696

		addr_buf += af->sockaddr_len;
err_bindx_rem:
		if (retval < 0) {
			/* Failed. Add the ones that has been removed back */
			if (cnt > 0)
				sctp_bindx_add(sk, addrs, cnt);
			return retval;
		}
	}

	return retval;
}

/* Send an ASCONF chunk with Delete IP address parameters to all the peers of
 * the associations that are part of the endpoint indicating that a list of
 * local addresses are removed from the endpoint.
 *
697
 * If any of the addresses is already in the bind address list of the
Linus Torvalds's avatar
Linus Torvalds committed
698
699
700
701
702
703
704
705
706
 * association, we do not send the chunk for that association.  But it will not
 * affect other associations.
 *
 * Only sctp_setsockopt_bindx() is supposed to call this function.
 */
static int sctp_send_asconf_del_ip(struct sock		*sk,
				   struct sockaddr	*addrs,
				   int			addrcnt)
{
707
	struct net *net = sock_net(sk);
Linus Torvalds's avatar
Linus Torvalds committed
708
709
710
	struct sctp_sock	*sp;
	struct sctp_endpoint	*ep;
	struct sctp_association	*asoc;
711
	struct sctp_transport	*transport;
Linus Torvalds's avatar
Linus Torvalds committed
712
713
714
715
716
	struct sctp_bind_addr	*bp;
	struct sctp_chunk	*chunk;
	union sctp_addr		*laddr;
	void			*addr_buf;
	struct sctp_af		*af;
717
	struct sctp_sockaddr_entry *saddr;
Linus Torvalds's avatar
Linus Torvalds committed
718
719
	int 			i;
	int 			retval = 0;
720
	int			stored = 0;
Linus Torvalds's avatar
Linus Torvalds committed
721

722
	chunk = NULL;
723
	if (!net->sctp.addip_enable)
Linus Torvalds's avatar
Linus Torvalds committed
724
725
726
727
728
		return retval;

	sp = sctp_sk(sk);
	ep = sp->ep;

729
730
	pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n",
		 __func__, sk, addrs, addrcnt);
Linus Torvalds's avatar
Linus Torvalds committed
731

732
	list_for_each_entry(asoc, &ep->asocs, asocs) {
Linus Torvalds's avatar
Linus Torvalds committed
733
734
735
736
737
738
739
740
741
742
743

		if (!asoc->peer.asconf_capable)
			continue;

		if (asoc->peer.addip_disabled_mask & SCTP_PARAM_DEL_IP)
			continue;

		if (!sctp_state(asoc, ESTABLISHED))
			continue;

		/* Check if any address in the packed array of addresses is
744
		 * not present in the bind address list of the association.
Linus Torvalds's avatar
Linus Torvalds committed
745
746
747
748
749
		 * If so, do not send the asconf chunk to its peer, but
		 * continue with other associations.
		 */
		addr_buf = addrs;
		for (i = 0; i < addrcnt; i++) {
Joe Perches's avatar
Joe Perches committed
750
			laddr = addr_buf;
Linus Torvalds's avatar
Linus Torvalds committed
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
			af = sctp_get_af_specific(laddr->v4.sin_family);
			if (!af) {
				retval = -EINVAL;
				goto out;
			}

			if (!sctp_assoc_lookup_laddr(asoc, laddr))
				break;

			addr_buf += af->sockaddr_len;
		}
		if (i < addrcnt)
			continue;

		/* Find one address in the association's bind address list
		 * that is not in the packed array of addresses. This is to
		 * make sure that we do not delete all the addresses in the
		 * association.
		 */
		bp = &asoc->base.bind_addr;
		laddr = sctp_find_unmatch_addr(bp, (union sctp_addr *)addrs,
					       addrcnt, sp);
773
774
775
776
777
		if ((laddr == NULL) && (addrcnt == 1)) {
			if (asoc->asconf_addr_del_pending)
				continue;
			asoc->asconf_addr_del_pending =
			    kzalloc(sizeof(union sctp_addr), GFP_ATOMIC);
778
779
780
781
			if (asoc->asconf_addr_del_pending == NULL) {
				retval = -ENOMEM;
				goto out;
			}
782
783
784
785
786
787
788
789
790
791
792
793
794
			asoc->asconf_addr_del_pending->sa.sa_family =
				    addrs->sa_family;
			asoc->asconf_addr_del_pending->v4.sin_port =
				    htons(bp->port);
			if (addrs->sa_family == AF_INET) {
				struct sockaddr_in *sin;

				sin = (struct sockaddr_in *)addrs;
				asoc->asconf_addr_del_pending->v4.sin_addr.s_addr = sin->sin_addr.s_addr;
			} else if (addrs->sa_family == AF_INET6) {
				struct sockaddr_in6 *sin6;

				sin6 = (struct sockaddr_in6 *)addrs;
Alexey Dobriyan's avatar
Alexey Dobriyan committed
795
				asoc->asconf_addr_del_pending->v6.sin6_addr = sin6->sin6_addr;
796
			}
797
798
799
800
801

			pr_debug("%s: keep the last address asoc:%p %pISc at %p\n",
				 __func__, asoc, &asoc->asconf_addr_del_pending->sa,
				 asoc->asconf_addr_del_pending);

802
803
804
805
			asoc->src_out_of_asoc_ok = 1;
			stored = 1;
			goto skip_mkasconf;
		}
Linus Torvalds's avatar
Linus Torvalds committed
806

807
808
809
		if (laddr == NULL)
			return -EINVAL;

810
811
812
813
		/* We do not need RCU protection throughout this loop
		 * because this is done under a socket lock from the
		 * setsockopt call.
		 */
Linus Torvalds's avatar
Linus Torvalds committed
814
815
816
817
818
819
820
		chunk = sctp_make_asconf_update_ip(asoc, laddr, addrs, addrcnt,
						   SCTP_PARAM_DEL_IP);
		if (!chunk) {
			retval = -ENOMEM;
			goto out;
		}

821
skip_mkasconf:
822
823
824
825
826
		/* Reset use_as_src flag for the addresses in the bind address
		 * list that are to be deleted.
		 */
		addr_buf = addrs;
		for (i = 0; i < addrcnt; i++) {
Joe Perches's avatar
Joe Perches committed
827
			laddr = addr_buf;
828
			af = sctp_get_af_specific(laddr->v4.sin_family);
829
			list_for_each_entry(saddr, &bp->address_list, list) {
830
				if (sctp_cmp_addr_exact(&saddr->a, laddr))
831
					saddr->state = SCTP_ADDR_DEL;
832
833
834
			}
			addr_buf += af->sockaddr_len;
		}
Linus Torvalds's avatar
Linus Torvalds committed
835

836
837
838
		/* Update the route and saddr entries for all the transports
		 * as some of the addresses in the bind address list are
		 * about to be deleted and cannot be used as source addresses.
Linus Torvalds's avatar
Linus Torvalds committed
839
		 */
840
841
		list_for_each_entry(transport, &asoc->peer.transport_addr_list,
					transports) {
842
843
844
845
846
			dst_release(transport->dst);
			sctp_transport_route(transport, NULL,
					     sctp_sk(asoc->base.sk));
		}

847
848
849
		if (stored)
			/* We don't need to transmit ASCONF */
			continue;
850
		retval = sctp_send_asconf(asoc, chunk);
Linus Torvalds's avatar
Linus Torvalds committed
851
852
853
854
855
	}
out:
	return retval;
}

856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
/* set addr events to assocs in the endpoint.  ep and addr_wq must be locked */
int sctp_asconf_mgmt(struct sctp_sock *sp, struct sctp_sockaddr_entry *addrw)
{
	struct sock *sk = sctp_opt2sk(sp);
	union sctp_addr *addr;
	struct sctp_af *af;

	/* It is safe to write port space in caller. */
	addr = &addrw->a;
	addr->v4.sin_port = htons(sp->ep->base.bind_addr.port);
	af = sctp_get_af_specific(addr->sa.sa_family);
	if (!af)
		return -EINVAL;
	if (sctp_verify_addr(sk, addr, af->sockaddr_len))
		return -EINVAL;

	if (addrw->state == SCTP_ADDR_NEW)
		return sctp_send_asconf_add_ip(sk, (struct sockaddr *)addr, 1);
	else
		return sctp_send_asconf_del_ip(sk, (struct sockaddr *)addr, 1);
}

Linus Torvalds's avatar
Linus Torvalds committed
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
/* Helper for tunneling sctp_bindx() requests through sctp_setsockopt()
 *
 * API 8.1
 * int sctp_bindx(int sd, struct sockaddr *addrs, int addrcnt,
 *                int flags);
 *
 * If sd is an IPv4 socket, the addresses passed must be IPv4 addresses.
 * If the sd is an IPv6 socket, the addresses passed can either be IPv4
 * or IPv6 addresses.
 *
 * A single address may be specified as INADDR_ANY or IN6ADDR_ANY, see
 * Section 3.1.2 for this usage.
 *
 * addrs is a pointer to an array of one or more socket addresses. Each
 * address is contained in its appropriate structure (i.e. struct
 * sockaddr_in or struct sockaddr_in6) the family of the address type
Ville Nuorvala's avatar
Ville Nuorvala committed
894
 * must be used to distinguish the address length (note that this
Linus Torvalds's avatar
Linus Torvalds committed
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
 * representation is termed a "packed array" of addresses). The caller
 * specifies the number of addresses in the array with addrcnt.
 *
 * On success, sctp_bindx() returns 0. On failure, sctp_bindx() returns
 * -1, and sets errno to the appropriate error code.
 *
 * For SCTP, the port given in each socket address must be the same, or
 * sctp_bindx() will fail, setting errno to EINVAL.
 *
 * The flags parameter is formed from the bitwise OR of zero or more of
 * the following currently defined flags:
 *
 * SCTP_BINDX_ADD_ADDR
 *
 * SCTP_BINDX_REM_ADDR
 *
 * SCTP_BINDX_ADD_ADDR directs SCTP to add the given addresses to the
 * association, and SCTP_BINDX_REM_ADDR directs SCTP to remove the given
 * addresses from the association. The two flags are mutually exclusive;
 * if both are given, sctp_bindx() will fail with EINVAL. A caller may
 * not remove all addresses from an association; sctp_bindx() will
 * reject such an attempt with EINVAL.
 *
 * An application can use sctp_bindx(SCTP_BINDX_ADD_ADDR) to associate
 * additional addresses with an endpoint after calling bind().  Or use
 * sctp_bindx(SCTP_BINDX_REM_ADDR) to remove some addresses a listening
 * socket is associated with so that no new association accepted will be
 * associated with those addresses. If the endpoint supports dynamic
 * address a SCTP_BINDX_REM_ADDR or SCTP_BINDX_ADD_ADDR may cause a
 * endpoint to send the appropriate message to the peer to change the
 * peers address lists.
 *
 * Adding and removing addresses from a connected association is
 * optional functionality. Implementations that do not support this
 * functionality should return EOPNOTSUPP.
 *
 * Basically do nothing but copying the addresses from user to kernel
 * land and invoking either sctp_bindx_add() or sctp_bindx_rem() on the sk.
933
934
 * This is used for tunneling the sctp_bindx() request through sctp_setsockopt()
 * from userspace.
Linus Torvalds's avatar
Linus Torvalds committed
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
 *
 * We don't use copy_from_user() for optimization: we first do the
 * sanity checks (buffer size -fast- and access check-healthy
 * pointer); if all of those succeed, then we can alloc the memory
 * (expensive operation) needed to copy the data to kernel. Then we do
 * the copying without checking the user space area
 * (__copy_from_user()).
 *
 * On exit there is no need to do sockfd_put(), sys_setsockopt() does
 * it.
 *
 * sk        The sk of the socket
 * addrs     The pointer to the addresses in user land
 * addrssize Size of the addrs buffer
 * op        Operation to perform (add or remove, see the flags of
 *           sctp_bindx)
 *
 * Returns 0 if ok, <0 errno code on error.
 */
954
static int sctp_setsockopt_bindx(struct sock *sk,
955
956
				 struct sockaddr __user *addrs,
				 int addrs_size, int op)
Linus Torvalds's avatar
Linus Torvalds committed
957
958
959
960
961
962
963
964
965
{
	struct sockaddr *kaddrs;
	int err;
	int addrcnt = 0;
	int walk_size = 0;
	struct sockaddr *sa_addr;
	void *addr_buf;
	struct sctp_af *af;

966
967
	pr_debug("%s: sk:%p addrs:%p addrs_size:%d opt:%d\n",
		 __func__, sk, addrs, addrs_size, op);
Linus Torvalds's avatar
Linus Torvalds committed
968
969
970
971
972
973
974
975
976

	if (unlikely(addrs_size <= 0))
		return -EINVAL;

	/* Check the user passed a healthy pointer.  */
	if (unlikely(!access_ok(VERIFY_READ, addrs, addrs_size)))
		return -EFAULT;

	/* Alloc space for the address array in kernel memory.  */
977
	kaddrs = kmalloc(addrs_size, GFP_USER | __GFP_NOWARN);
Linus Torvalds's avatar
Linus Torvalds committed
978
979
980
981
982
983
984
985
	if (unlikely(!kaddrs))
		return -ENOMEM;

	if (__copy_from_user(kaddrs, addrs, addrs_size)) {
		kfree(kaddrs);
		return -EFAULT;
	}

986
	/* Walk through the addrs buffer and count the number of addresses. */
Linus Torvalds's avatar
Linus Torvalds committed
987
988
	addr_buf = kaddrs;
	while (walk_size < addrs_size) {
989
990
991
992
993
		if (walk_size + sizeof(sa_family_t) > addrs_size) {
			kfree(kaddrs);
			return -EINVAL;
		}

Joe Perches's avatar
Joe Perches committed
994
		sa_addr = addr_buf;
Linus Torvalds's avatar
Linus Torvalds committed
995
996
997
998
		af = sctp_get_af_specific(sa_addr->sa_family);

		/* If the address family is not supported or if this address
		 * causes the address buffer to overflow return EINVAL.
999
		 */
Linus Torvalds's avatar
Linus Torvalds committed
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
		if (!af || (walk_size + af->sockaddr_len) > addrs_size) {
			kfree(kaddrs);
			return -EINVAL;
		}
		addrcnt++;
		addr_buf += af->sockaddr_len;
		walk_size += af->sockaddr_len;
	}

	/* Do the work. */
	switch (op) {
	case SCTP_BINDX_ADD_ADDR:
		err = sctp_bindx_add(sk, kaddrs, addrcnt);
		if (err)
			goto out;
		err = sctp_send_asconf_add_ip(sk, kaddrs, addrcnt);
		break;

	case SCTP_BINDX_REM_ADDR:
		err = sctp_bindx_rem(sk, kaddrs, addrcnt);
		if (err)
			goto out;
		err = sctp_send_asconf_del_ip(sk, kaddrs, addrcnt);
		break;

	default:
		err = -EINVAL;
		break;
1028
	}
Linus Torvalds's avatar
Linus Torvalds committed
1029
1030
1031
1032
1033
1034
1035

out:
	kfree(kaddrs);

	return err;
}

1036
1037
1038
1039
1040
/* __sctp_connect(struct sock* sk, struct sockaddr *kaddrs, int addrs_size)
 *
 * Common routine for handling connect() and sctp_connectx().
 * Connect will come in with just a single address.
 */
1041
static int __sctp_connect(struct sock *sk,
1042
			  struct sockaddr *kaddrs,
1043
1044
			  int addrs_size,
			  sctp_assoc_t *assoc_id)
1045
{
1046
	struct net *net = sock_net(sk);
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
	struct sctp_sock *sp;
	struct sctp_endpoint *ep;
	struct sctp_association *asoc = NULL;
	struct sctp_association *asoc2;
	struct sctp_transport *transport;
	union sctp_addr to;
	sctp_scope_t scope;
	long timeo;
	int err = 0;
	int addrcnt = 0;
	int walk_size = 0;
1058
	union sctp_addr *sa_addr = NULL;
1059
	void *addr_buf;
1060
	unsigned short port;
1061
	unsigned int f_flags = 0;
1062
1063
1064
1065
1066
1067
1068
1069
1070

	sp = sctp_sk(sk);
	ep = sp->ep;

	/* connect() cannot be done on a socket that is already in ESTABLISHED
	 * state - UDP-style peeled off socket or a TCP-style socket that
	 * is already connected.
	 * It cannot be done even on a TCP-style listening socket.
	 */
1071
	if (sctp_sstate(sk, ESTABLISHED) || sctp_sstate(sk, CLOSING) ||
1072
1073
1074
1075
1076
1077
1078
1079
	    (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING))) {
		err = -EISCONN;
		goto out_free;
	}

	/* Walk through the addrs buffer and count the number of addresses. */
	addr_buf = kaddrs;
	while (walk_size < addrs_size) {
1080
1081
		struct sctp_af *af;

1082
1083
1084
1085
1086
		if (walk_size + sizeof(sa_family_t) > addrs_size) {
			err = -EINVAL;
			goto out_free;
		}

Joe Perches's avatar
Joe Perches committed
1087
		sa_addr = addr_buf;
1088
		af = sctp_get_af_specific(sa_addr->sa.sa_family);
1089
1090
1091
1092
1093
1094
1095
1096
1097

		/* If the address family is not supported or if this address
		 * causes the address buffer to overflow return EINVAL.
		 */
		if (!af || (walk_size + af->sockaddr_len) > addrs_size) {
			err = -EINVAL;
			goto out_free;
		}

1098
1099
		port = ntohs(sa_addr->v4.sin_port);

1100
1101
1102
1103
		/* Save current address so we can work with it */
		memcpy(&to, sa_addr, af->sockaddr_len);

		err = sctp_verify_addr(sk, &to, af->sockaddr_len);
1104
1105
1106
		if (err)
			goto out_free;

1107
1108
1109
		/* Make sure the destination port is correctly set
		 * in all addresses.
		 */
1110
1111
		if (asoc && asoc->peer.port && asoc->peer.port != port) {
			err = -EINVAL;
1112
			goto out_free;
1113
		}
1114
1115
1116
1117

		/* Check if there already is a matching association on the
		 * endpoint (other than the one created here).
		 */
1118
		asoc2 = sctp_endpoint_lookup_assoc(ep, &to, &transport);
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
		if (asoc2 && asoc2 != asoc) {
			if (asoc2->state >= SCTP_STATE_ESTABLISHED)
				err = -EISCONN;
			else
				err = -EALREADY;
			goto out_free;
		}

		/* If we could not find a matching association on the endpoint,
		 * make sure that there is no peeled-off association matching
		 * the peer address even on another socket.
		 */
1131
		if (sctp_endpoint_is_peeled_off(ep, &to)) {
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
			err = -EADDRNOTAVAIL;
			goto out_free;
		}

		if (!asoc) {
			/* If a bind() or sctp_bindx() is not called prior to
			 * an sctp_connectx() call, the system picks an
			 * ephemeral port and will choose an address set
			 * equivalent to binding with a wildcard address.
			 */
			if (!ep->base.bind_addr.port) {
				if (sctp_autobind(sk)) {
					err = -EAGAIN;
					goto out_free;
				}
1147
1148
			} else {
				/*
1149
1150
1151
1152
				 * If an unprivileged user inherits a 1-many
				 * style socket with open associations on a
				 * privileged port, it MAY be permitted to
				 * accept new associations, but it SHOULD NOT
1153
1154
1155
				 * be permitted to open new associations.
				 */
				if (ep->base.bind_addr.port < PROT_SOCK &&
1156
				    !ns_capable(net->user_ns, CAP_NET_BIND_SERVICE)) {
1157
1158
1159
					err = -EACCES;
					goto out_free;
				}
1160
1161
			}

1162
			scope = sctp_scope(&to);
1163
1164
1165
1166
1167
			asoc = sctp_association_new(ep, sk, scope, GFP_KERNEL);
			if (!asoc) {
				err = -ENOMEM;
				goto out_free;
			}
1168
1169
1170
1171
1172
1173
1174

			err = sctp_assoc_set_bind_addr_from_ep(asoc, scope,
							      GFP_KERNEL);
			if (err < 0) {
				goto out_free;
			}

1175
1176
1177
		}

		/* Prime the peer's transport structures.  */
1178
		transport = sctp_assoc_add_peer(asoc, &to, GFP_KERNEL,
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
						SCTP_UNKNOWN);
		if (!transport) {
			err = -ENOMEM;
			goto out_free;
		}

		addrcnt++;
		addr_buf += af->sockaddr_len;
		walk_size += af->sockaddr_len;
	}

1190
1191
1192
1193
1194
1195
1196
1197
1198
	/* In case the user of sctp_connectx() wants an association
	 * id back, assign one now.
	 */
	if (assoc_id) {
		err = sctp_assoc_set_id(asoc, GFP_KERNEL);
		if (err < 0)
			goto out_free;
	}

1199
	err = sctp_primitive_ASSOCIATE(net, asoc, NULL);
1200
1201
1202
1203
1204
	if (err < 0) {
		goto out_free;
	}

	/* Initialize sk's dport and daddr for getpeername() */
1205
	inet_sk(sk)->inet_dport = htons(asoc->peer.port);
1206
	sp->pf->to_sk_daddr(sa_addr, sk);
1207
	sk->sk_err = 0;
1208

1209
1210
1211
1212
1213
1214
1215
1216
	/* in-kernel sockets don't generally have a file allocated to them
	 * if all they do is call sock_create_kern().
	 */
	if (sk->sk_socket->file)
		f_flags = sk->sk_socket->file->f_flags;

	timeo = sock_sndtimeo(sk, f_flags & O_NONBLOCK);

1217
	err = sctp_wait_for_connect(asoc, &timeo);
1218
	if ((err == 0 || err == -EINPROGRESS) && assoc_id)
1219
		*assoc_id = asoc->assoc_id;
1220
1221
1222
1223
1224

	/* Don't free association on exit. */
	asoc = NULL;

out_free:
1225
1226
	pr_debug("%s: took out_free path with asoc:%p kaddrs:%p err:%d\n",
		 __func__, asoc, kaddrs, err);
1227

1228
1229
1230
1231
1232
	if (asoc) {
		/* sctp_primitive_ASSOCIATE may have added this association
		 * To the hash table, try to unhash it, just in case, its a noop
		 * if it wasn't hashed so we're safe
		 */
1233
		sctp_association_free(asoc);
1234
	}
1235
1236
1237
1238
1239
1240
	return err;
}

/* Helper for tunneling sctp_connectx() requests through sctp_setsockopt()
 *
 * API 8.9
1241
1242
 * int sctp_connectx(int sd, struct sockaddr *addrs, int addrcnt,
 * 			sctp_assoc_t *asoc);
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
 *
 * If sd is an IPv4 socket, the addresses passed must be IPv4 addresses.
 * If the sd is an IPv6 socket, the addresses passed can either be IPv4
 * or IPv6 addresses.
 *
 * A single address may be specified as INADDR_ANY or IN6ADDR_ANY, see
 * Section 3.1.2 for this usage.
 *
 * addrs is a pointer to an array of one or more socket addresses. Each
 * address is contained in its appropriate structure (i.e. struct
 * sockaddr_in or struct sockaddr_in6) the family of the address type
 * must be used to distengish the address length (note that this
 * representation is termed a "packed array" of addresses). The caller
 * specifies the number of addresses in the array with addrcnt.
 *
1258
1259
1260
1261
 * On success, sctp_connectx() returns 0. It also sets the assoc_id to
 * the association id of the new association.  On failure, sctp_connectx()
 * returns -1, and sets errno to the appropriate error code.  The assoc_id
 * is not touched by the kernel.
1262
1263
1264
1265
1266
1267
1268
1269
 *
 * For SCTP, the port given in each socket address must be the same, or
 * sctp_connectx() will fail, setting errno to EINVAL.
 *
 * An application can use sctp_connectx to initiate an association with
 * an endpoint that is multi-homed.  Much like sctp_bindx() this call
 * allows a caller to specify multiple addresses at which a peer can be
 * reached.  The way the SCTP stack uses the list of addresses to set up
Lucas De Marchi's avatar
Lucas De Marchi committed
1270
 * the association is implementation dependent.  This function only
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
 * specifies that the stack will try to make use of all the addresses in
 * the list when needed.
 *
 * Note that the list of addresses passed in is only used for setting up
 * the association.  It does not necessarily equal the set of addresses
 * the peer uses for the resulting association.  If the caller wants to
 * find out the set of peer addresses, it must use sctp_getpaddrs() to
 * retrieve them after the association has been set up.
 *
 * Basically do nothing but copying the addresses from user to kernel
 * land and invoking either sctp_connectx(). This is used for tunneling
 * the sctp_connectx() request through sctp_setsockopt() from userspace.
 *
 * We don't use copy_from_user() for optimization: we first do the
 * sanity checks (buffer size -fast- and access check-healthy
 * pointer); if all of those succeed, then we can alloc the memory
 * (expensive operation) needed to copy the data to kernel. Then we do
 * the copying without checking the user space area
 * (__copy_from_user()).
 *
 * On exit there is no need to do sockfd_put(), sys_setsockopt() does
 * it.
 *
 * sk        The sk of the socket
 * addrs     The pointer to the addresses in user land
 * addrssize Size of the addrs buffer
 *
1298
 * Returns >=0 if ok, <0 errno code on error.
1299
 */
1300
static int __sctp_setsockopt_connectx(struct sock *sk,
1301
				      struct sockaddr __user *addrs,
1302
1303
				      int addrs_size,
				      sctp_assoc_t *assoc_id)
1304
1305
{
	struct sockaddr *kaddrs;
1306
1307
	gfp_t gfp = GFP_KERNEL;
	int err = 0;
1308

1309
1310
	pr_debug("%s: sk:%p addrs:%p addrs_size:%d\n",
		 __func__, sk, addrs, addrs_size);
1311
1312
1313
1314
1315
1316
1317
1318
1319

	if (unlikely(addrs_size <= 0))
		return -EINVAL;

	/* Check the user passed a healthy pointer.  */
	if (unlikely(!access_ok(VERIFY_READ, addrs, addrs_size)))
		return -EFAULT;

	/* Alloc space for the address array in kernel memory.  */
1320
1321
1322
	if (sk->sk_socket->file)
		gfp = GFP_USER | __GFP_NOWARN;
	kaddrs = kmalloc(addrs_size, gfp);
1323
1324
1325
1326
1327
1328
	if (unlikely(!kaddrs))
		return -ENOMEM;

	if (__copy_from_user(kaddrs, addrs, addrs_size)) {
		err = -EFAULT;
	} else {
1329
		err = __sctp_connect(sk, kaddrs, addrs_size, assoc_id);
1330
1331
1332
	}

	kfree(kaddrs);
1333

1334
1335
1336
	return err;
}

1337
1338
1339
1340
/*
 * This is an older interface.  It's kept for backward compatibility
 * to the option that doesn't provide association id.
 */
1341
static int sctp_setsockopt_connectx_old(struct sock *sk,
1342
1343
					struct sockaddr __user *addrs,
					int addrs_size)
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
{
	return __sctp_setsockopt_connectx(sk, addrs, addrs_size, NULL);
}

/*
 * New interface for the API.  The since the API is done with a socket
 * option, to make it simple we feed back the association id is as a return
 * indication to the call.  Error is always negative and association id is
 * always positive.
 */
1354
static int sctp_setsockopt_connectx(struct sock *sk,
1355
1356
				    struct sockaddr __user *addrs,
				    int addrs_size)
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
{
	sctp_assoc_t assoc_id = 0;
	int err = 0;

	err = __sctp_setsockopt_connectx(sk, addrs, addrs_size, &assoc_id);

	if (err)
		return err;
	else
		return assoc_id;
}

1369
/*
1370
1371
 * New (hopefully final) interface for the API.
 * We use the sctp_getaddrs_old structure so that use-space library
1372
 * can avoid any unnecessary allocations. The only different part
1373
 * is that we store the actual length of the address buffer into the
1374
 * addrs_num structure member. That way we can re-use the existing
1375
 * code.
1376
 */
1377
1378
1379
1380
1381
1382
1383
1384
#ifdef CONFIG_COMPAT
struct compat_sctp_getaddrs_old {
	sctp_assoc_t	assoc_id;
	s32		addr_num;
	compat_uptr_t	addrs;		/* struct sockaddr * */
};
#endif

1385
static int sctp_getsockopt_connectx3(struct sock *sk, int len,
1386
1387
				     char __user *optval,
				     int __user *optlen)
1388
{
1389
	struct sctp_getaddrs_old param;
1390
1391
1392
	sctp_assoc_t assoc_id = 0;
	int err = 0;

1393
#ifdef CONFIG_COMPAT
1394
	if (in_compat_syscall()) {
1395
		struct compat_sctp_getaddrs_old param32;
1396

1397
1398
1399
1400
		if (len < sizeof(param32))
			return -EINVAL;
		if (copy_from_user(&param32, optval, sizeof(param32)))
			return -EFAULT;
1401

1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
		param.assoc_id = param32.assoc_id;
		param.addr_num = param32.addr_num;
		param.addrs = compat_ptr(param32.addrs);
	} else
#endif
	{
		if (len < sizeof(param))
			return -EINVAL;
		if (copy_from_user(&param, optval, sizeof(param)))
			return -EFAULT;
	}
1413

1414
1415
1416
	err = __sctp_setsockopt_connectx(sk, (struct sockaddr __user *)
					 param.addrs, param.addr_num,
					 &assoc_id);
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
	if (err == 0 || err == -EINPROGRESS) {
		if (copy_to_user(optval, &assoc_id, sizeof(assoc_id)))
			return -EFAULT;
		if (put_user(sizeof(assoc_id), optlen))
			return -EFAULT;
	}

	return err;
}

Linus Torvalds's avatar
Linus Torvalds committed
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
/* API 3.1.4 close() - UDP Style Syntax
 * Applications use close() to perform graceful shutdown (as described in
 * Section 10.1 of [SCTP]) on ALL the associations currently represented
 * by a UDP-style socket.
 *
 * The syntax is
 *
 *   ret = close(int sd);
 *
 *   sd      - the socket descriptor of the associations to be closed.
 *
 * To gracefully shutdown a specific association represented by the
 * UDP-style socket, an application should use the sendmsg() call,
 * passing no user data, but including the appropriate flag in the
 * ancillary data (see Section xxxx).
 *
 * If sd in the close() call is a branched-off socket representing only
 * one association, the shutdown is performed on that association only.
 *
 * 4.1.6 close() - TCP Style Syntax
 *
 * Applications use close() to gracefully close down an association.
 *
 * The syntax is:
 *
 *    int close(int sd);
 *
 *      sd      - the socket descriptor of the association to be closed.
 *
 * After an application calls close() on a socket descriptor, no further
 * socket operations will succeed on that descriptor.
 *
 * API 7.1.4 SO_LINGER
 *
 * An application using the TCP-style socket can use this option to
 * perform the SCTP ABORT primitive.  The linger option structure is:
 *
 *  struct  linger {
 *     int     l_onoff;                // option on/off
 *     int     l_linger;               // linger time
 * };
 *
 * To enable the option, set l_onoff to 1.  If the l_linger value is set
 * to 0, calling close() is the same as the ABORT primitive.  If the
 * value is set to a negative value, the setsockopt() call will return
 * an error.  If the value is set to a positive value linger_time, the
 * close() can be blocked for at most linger_time ms.  If the graceful
 * shutdown phase does not finish during this period, close() will
 * return but the graceful shutdown phase continues in the system.
 */
1477
static void sctp_close(struct sock *sk, long timeout)
Linus Torvalds's avatar
Linus Torvalds committed
1478
{
1479
	struct net *net = sock_net(sk);
Linus Torvalds's avatar
Linus Torvalds committed
1480
1481
1482
	struct sctp_endpoint *ep;
	struct sctp_association *as