mirror of
https://github.com/torvalds/linux.git
synced 2024-11-14 08:02:07 +00:00
720dc34bbb
This fixes a bug in the order of dccp_rcv_state_process() that still permitted reception even after closing the socket. A Reset after close thus causes a NULL pointer dereference by not preventing operations on an already torn-down socket. dccp_v4_do_rcv() | | state other than OPEN v dccp_rcv_state_process() | | DCCP_PKT_RESET v dccp_rcv_reset() | v dccp_time_wait() WARNING: at net/ipv4/inet_timewait_sock.c:141 __inet_twsk_hashdance+0x48/0x128() Modules linked in: arc4 ecb carl9170 rt2870sta(C) mac80211 r8712u(C) crc_ccitt ah [<c0038850>] (unwind_backtrace+0x0/0xec) from [<c0055364>] (warn_slowpath_common) [<c0055364>] (warn_slowpath_common+0x4c/0x64) from [<c0055398>] (warn_slowpath_n) [<c0055398>] (warn_slowpath_null+0x1c/0x24) from [<c02b72d0>] (__inet_twsk_hashd) [<c02b72d0>] (__inet_twsk_hashdance+0x48/0x128) from [<c031caa0>] (dccp_time_wai) [<c031caa0>] (dccp_time_wait+0x40/0xc8) from [<c031c15c>] (dccp_rcv_state_proces) [<c031c15c>] (dccp_rcv_state_process+0x120/0x538) from [<c032609c>] (dccp_v4_do_) [<c032609c>] (dccp_v4_do_rcv+0x11c/0x14c) from [<c0286594>] (release_sock+0xac/0) [<c0286594>] (release_sock+0xac/0x110) from [<c031fd34>] (dccp_close+0x28c/0x380) [<c031fd34>] (dccp_close+0x28c/0x380) from [<c02d9a78>] (inet_release+0x64/0x70) The fix is by testing the socket state first. Receiving a packet in Closed state now also produces the required "No connection" Reset reply of RFC 4340, 8.3.1. Reported-and-tested-by: Johan Hovold <jhovold@gmail.com> Cc: stable@kernel.org Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk> Signed-off-by: David S. Miller <davem@davemloft.net>
733 lines
22 KiB
C
733 lines
22 KiB
C
/*
|
|
* net/dccp/input.c
|
|
*
|
|
* An implementation of the DCCP protocol
|
|
* Arnaldo Carvalho de Melo <acme@conectiva.com.br>
|
|
*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU General Public License
|
|
* as published by the Free Software Foundation; either version
|
|
* 2 of the License, or (at your option) any later version.
|
|
*/
|
|
|
|
#include <linux/dccp.h>
|
|
#include <linux/skbuff.h>
|
|
#include <linux/slab.h>
|
|
|
|
#include <net/sock.h>
|
|
|
|
#include "ackvec.h"
|
|
#include "ccid.h"
|
|
#include "dccp.h"
|
|
|
|
/* rate-limit for syncs in reply to sequence-invalid packets; RFC 4340, 7.5.4 */
|
|
int sysctl_dccp_sync_ratelimit __read_mostly = HZ / 8;
|
|
|
|
static void dccp_enqueue_skb(struct sock *sk, struct sk_buff *skb)
|
|
{
|
|
__skb_pull(skb, dccp_hdr(skb)->dccph_doff * 4);
|
|
__skb_queue_tail(&sk->sk_receive_queue, skb);
|
|
skb_set_owner_r(skb, sk);
|
|
sk->sk_data_ready(sk, 0);
|
|
}
|
|
|
|
static void dccp_fin(struct sock *sk, struct sk_buff *skb)
|
|
{
|
|
/*
|
|
* On receiving Close/CloseReq, both RD/WR shutdown are performed.
|
|
* RFC 4340, 8.3 says that we MAY send further Data/DataAcks after
|
|
* receiving the closing segment, but there is no guarantee that such
|
|
* data will be processed at all.
|
|
*/
|
|
sk->sk_shutdown = SHUTDOWN_MASK;
|
|
sock_set_flag(sk, SOCK_DONE);
|
|
dccp_enqueue_skb(sk, skb);
|
|
}
|
|
|
|
static int dccp_rcv_close(struct sock *sk, struct sk_buff *skb)
|
|
{
|
|
int queued = 0;
|
|
|
|
switch (sk->sk_state) {
|
|
/*
|
|
* We ignore Close when received in one of the following states:
|
|
* - CLOSED (may be a late or duplicate packet)
|
|
* - PASSIVE_CLOSEREQ (the peer has sent a CloseReq earlier)
|
|
* - RESPOND (already handled by dccp_check_req)
|
|
*/
|
|
case DCCP_CLOSING:
|
|
/*
|
|
* Simultaneous-close: receiving a Close after sending one. This
|
|
* can happen if both client and server perform active-close and
|
|
* will result in an endless ping-pong of crossing and retrans-
|
|
* mitted Close packets, which only terminates when one of the
|
|
* nodes times out (min. 64 seconds). Quicker convergence can be
|
|
* achieved when one of the nodes acts as tie-breaker.
|
|
* This is ok as both ends are done with data transfer and each
|
|
* end is just waiting for the other to acknowledge termination.
|
|
*/
|
|
if (dccp_sk(sk)->dccps_role != DCCP_ROLE_CLIENT)
|
|
break;
|
|
/* fall through */
|
|
case DCCP_REQUESTING:
|
|
case DCCP_ACTIVE_CLOSEREQ:
|
|
dccp_send_reset(sk, DCCP_RESET_CODE_CLOSED);
|
|
dccp_done(sk);
|
|
break;
|
|
case DCCP_OPEN:
|
|
case DCCP_PARTOPEN:
|
|
/* Give waiting application a chance to read pending data */
|
|
queued = 1;
|
|
dccp_fin(sk, skb);
|
|
dccp_set_state(sk, DCCP_PASSIVE_CLOSE);
|
|
/* fall through */
|
|
case DCCP_PASSIVE_CLOSE:
|
|
/*
|
|
* Retransmitted Close: we have already enqueued the first one.
|
|
*/
|
|
sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_HUP);
|
|
}
|
|
return queued;
|
|
}
|
|
|
|
static int dccp_rcv_closereq(struct sock *sk, struct sk_buff *skb)
|
|
{
|
|
int queued = 0;
|
|
|
|
/*
|
|
* Step 7: Check for unexpected packet types
|
|
* If (S.is_server and P.type == CloseReq)
|
|
* Send Sync packet acknowledging P.seqno
|
|
* Drop packet and return
|
|
*/
|
|
if (dccp_sk(sk)->dccps_role != DCCP_ROLE_CLIENT) {
|
|
dccp_send_sync(sk, DCCP_SKB_CB(skb)->dccpd_seq, DCCP_PKT_SYNC);
|
|
return queued;
|
|
}
|
|
|
|
/* Step 13: process relevant Client states < CLOSEREQ */
|
|
switch (sk->sk_state) {
|
|
case DCCP_REQUESTING:
|
|
dccp_send_close(sk, 0);
|
|
dccp_set_state(sk, DCCP_CLOSING);
|
|
break;
|
|
case DCCP_OPEN:
|
|
case DCCP_PARTOPEN:
|
|
/* Give waiting application a chance to read pending data */
|
|
queued = 1;
|
|
dccp_fin(sk, skb);
|
|
dccp_set_state(sk, DCCP_PASSIVE_CLOSEREQ);
|
|
/* fall through */
|
|
case DCCP_PASSIVE_CLOSEREQ:
|
|
sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_HUP);
|
|
}
|
|
return queued;
|
|
}
|
|
|
|
static u16 dccp_reset_code_convert(const u8 code)
|
|
{
|
|
const u16 error_code[] = {
|
|
[DCCP_RESET_CODE_CLOSED] = 0, /* normal termination */
|
|
[DCCP_RESET_CODE_UNSPECIFIED] = 0, /* nothing known */
|
|
[DCCP_RESET_CODE_ABORTED] = ECONNRESET,
|
|
|
|
[DCCP_RESET_CODE_NO_CONNECTION] = ECONNREFUSED,
|
|
[DCCP_RESET_CODE_CONNECTION_REFUSED] = ECONNREFUSED,
|
|
[DCCP_RESET_CODE_TOO_BUSY] = EUSERS,
|
|
[DCCP_RESET_CODE_AGGRESSION_PENALTY] = EDQUOT,
|
|
|
|
[DCCP_RESET_CODE_PACKET_ERROR] = ENOMSG,
|
|
[DCCP_RESET_CODE_BAD_INIT_COOKIE] = EBADR,
|
|
[DCCP_RESET_CODE_BAD_SERVICE_CODE] = EBADRQC,
|
|
[DCCP_RESET_CODE_OPTION_ERROR] = EILSEQ,
|
|
[DCCP_RESET_CODE_MANDATORY_ERROR] = EOPNOTSUPP,
|
|
};
|
|
|
|
return code >= DCCP_MAX_RESET_CODES ? 0 : error_code[code];
|
|
}
|
|
|
|
static void dccp_rcv_reset(struct sock *sk, struct sk_buff *skb)
|
|
{
|
|
u16 err = dccp_reset_code_convert(dccp_hdr_reset(skb)->dccph_reset_code);
|
|
|
|
sk->sk_err = err;
|
|
|
|
/* Queue the equivalent of TCP fin so that dccp_recvmsg exits the loop */
|
|
dccp_fin(sk, skb);
|
|
|
|
if (err && !sock_flag(sk, SOCK_DEAD))
|
|
sk_wake_async(sk, SOCK_WAKE_IO, POLL_ERR);
|
|
dccp_time_wait(sk, DCCP_TIME_WAIT, 0);
|
|
}
|
|
|
|
static void dccp_handle_ackvec_processing(struct sock *sk, struct sk_buff *skb)
|
|
{
|
|
struct dccp_ackvec *av = dccp_sk(sk)->dccps_hc_rx_ackvec;
|
|
|
|
if (av == NULL)
|
|
return;
|
|
if (DCCP_SKB_CB(skb)->dccpd_ack_seq != DCCP_PKT_WITHOUT_ACK_SEQ)
|
|
dccp_ackvec_clear_state(av, DCCP_SKB_CB(skb)->dccpd_ack_seq);
|
|
dccp_ackvec_input(av, skb);
|
|
}
|
|
|
|
static void dccp_deliver_input_to_ccids(struct sock *sk, struct sk_buff *skb)
|
|
{
|
|
const struct dccp_sock *dp = dccp_sk(sk);
|
|
|
|
/* Don't deliver to RX CCID when node has shut down read end. */
|
|
if (!(sk->sk_shutdown & RCV_SHUTDOWN))
|
|
ccid_hc_rx_packet_recv(dp->dccps_hc_rx_ccid, sk, skb);
|
|
/*
|
|
* Until the TX queue has been drained, we can not honour SHUT_WR, since
|
|
* we need received feedback as input to adjust congestion control.
|
|
*/
|
|
if (sk->sk_write_queue.qlen > 0 || !(sk->sk_shutdown & SEND_SHUTDOWN))
|
|
ccid_hc_tx_packet_recv(dp->dccps_hc_tx_ccid, sk, skb);
|
|
}
|
|
|
|
static int dccp_check_seqno(struct sock *sk, struct sk_buff *skb)
|
|
{
|
|
const struct dccp_hdr *dh = dccp_hdr(skb);
|
|
struct dccp_sock *dp = dccp_sk(sk);
|
|
u64 lswl, lawl, seqno = DCCP_SKB_CB(skb)->dccpd_seq,
|
|
ackno = DCCP_SKB_CB(skb)->dccpd_ack_seq;
|
|
|
|
/*
|
|
* Step 5: Prepare sequence numbers for Sync
|
|
* If P.type == Sync or P.type == SyncAck,
|
|
* If S.AWL <= P.ackno <= S.AWH and P.seqno >= S.SWL,
|
|
* / * P is valid, so update sequence number variables
|
|
* accordingly. After this update, P will pass the tests
|
|
* in Step 6. A SyncAck is generated if necessary in
|
|
* Step 15 * /
|
|
* Update S.GSR, S.SWL, S.SWH
|
|
* Otherwise,
|
|
* Drop packet and return
|
|
*/
|
|
if (dh->dccph_type == DCCP_PKT_SYNC ||
|
|
dh->dccph_type == DCCP_PKT_SYNCACK) {
|
|
if (between48(ackno, dp->dccps_awl, dp->dccps_awh) &&
|
|
dccp_delta_seqno(dp->dccps_swl, seqno) >= 0)
|
|
dccp_update_gsr(sk, seqno);
|
|
else
|
|
return -1;
|
|
}
|
|
|
|
/*
|
|
* Step 6: Check sequence numbers
|
|
* Let LSWL = S.SWL and LAWL = S.AWL
|
|
* If P.type == CloseReq or P.type == Close or P.type == Reset,
|
|
* LSWL := S.GSR + 1, LAWL := S.GAR
|
|
* If LSWL <= P.seqno <= S.SWH
|
|
* and (P.ackno does not exist or LAWL <= P.ackno <= S.AWH),
|
|
* Update S.GSR, S.SWL, S.SWH
|
|
* If P.type != Sync,
|
|
* Update S.GAR
|
|
*/
|
|
lswl = dp->dccps_swl;
|
|
lawl = dp->dccps_awl;
|
|
|
|
if (dh->dccph_type == DCCP_PKT_CLOSEREQ ||
|
|
dh->dccph_type == DCCP_PKT_CLOSE ||
|
|
dh->dccph_type == DCCP_PKT_RESET) {
|
|
lswl = ADD48(dp->dccps_gsr, 1);
|
|
lawl = dp->dccps_gar;
|
|
}
|
|
|
|
if (between48(seqno, lswl, dp->dccps_swh) &&
|
|
(ackno == DCCP_PKT_WITHOUT_ACK_SEQ ||
|
|
between48(ackno, lawl, dp->dccps_awh))) {
|
|
dccp_update_gsr(sk, seqno);
|
|
|
|
if (dh->dccph_type != DCCP_PKT_SYNC &&
|
|
ackno != DCCP_PKT_WITHOUT_ACK_SEQ &&
|
|
after48(ackno, dp->dccps_gar))
|
|
dp->dccps_gar = ackno;
|
|
} else {
|
|
unsigned long now = jiffies;
|
|
/*
|
|
* Step 6: Check sequence numbers
|
|
* Otherwise,
|
|
* If P.type == Reset,
|
|
* Send Sync packet acknowledging S.GSR
|
|
* Otherwise,
|
|
* Send Sync packet acknowledging P.seqno
|
|
* Drop packet and return
|
|
*
|
|
* These Syncs are rate-limited as per RFC 4340, 7.5.4:
|
|
* at most 1 / (dccp_sync_rate_limit * HZ) Syncs per second.
|
|
*/
|
|
if (time_before(now, (dp->dccps_rate_last +
|
|
sysctl_dccp_sync_ratelimit)))
|
|
return -1;
|
|
|
|
DCCP_WARN("Step 6 failed for %s packet, "
|
|
"(LSWL(%llu) <= P.seqno(%llu) <= S.SWH(%llu)) and "
|
|
"(P.ackno %s or LAWL(%llu) <= P.ackno(%llu) <= S.AWH(%llu), "
|
|
"sending SYNC...\n", dccp_packet_name(dh->dccph_type),
|
|
(unsigned long long) lswl, (unsigned long long) seqno,
|
|
(unsigned long long) dp->dccps_swh,
|
|
(ackno == DCCP_PKT_WITHOUT_ACK_SEQ) ? "doesn't exist"
|
|
: "exists",
|
|
(unsigned long long) lawl, (unsigned long long) ackno,
|
|
(unsigned long long) dp->dccps_awh);
|
|
|
|
dp->dccps_rate_last = now;
|
|
|
|
if (dh->dccph_type == DCCP_PKT_RESET)
|
|
seqno = dp->dccps_gsr;
|
|
dccp_send_sync(sk, seqno, DCCP_PKT_SYNC);
|
|
return -1;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int __dccp_rcv_established(struct sock *sk, struct sk_buff *skb,
|
|
const struct dccp_hdr *dh, const unsigned len)
|
|
{
|
|
struct dccp_sock *dp = dccp_sk(sk);
|
|
|
|
switch (dccp_hdr(skb)->dccph_type) {
|
|
case DCCP_PKT_DATAACK:
|
|
case DCCP_PKT_DATA:
|
|
/*
|
|
* FIXME: schedule DATA_DROPPED (RFC 4340, 11.7.2) if and when
|
|
* - sk_shutdown == RCV_SHUTDOWN, use Code 1, "Not Listening"
|
|
* - sk_receive_queue is full, use Code 2, "Receive Buffer"
|
|
*/
|
|
dccp_enqueue_skb(sk, skb);
|
|
return 0;
|
|
case DCCP_PKT_ACK:
|
|
goto discard;
|
|
case DCCP_PKT_RESET:
|
|
/*
|
|
* Step 9: Process Reset
|
|
* If P.type == Reset,
|
|
* Tear down connection
|
|
* S.state := TIMEWAIT
|
|
* Set TIMEWAIT timer
|
|
* Drop packet and return
|
|
*/
|
|
dccp_rcv_reset(sk, skb);
|
|
return 0;
|
|
case DCCP_PKT_CLOSEREQ:
|
|
if (dccp_rcv_closereq(sk, skb))
|
|
return 0;
|
|
goto discard;
|
|
case DCCP_PKT_CLOSE:
|
|
if (dccp_rcv_close(sk, skb))
|
|
return 0;
|
|
goto discard;
|
|
case DCCP_PKT_REQUEST:
|
|
/* Step 7
|
|
* or (S.is_server and P.type == Response)
|
|
* or (S.is_client and P.type == Request)
|
|
* or (S.state >= OPEN and P.type == Request
|
|
* and P.seqno >= S.OSR)
|
|
* or (S.state >= OPEN and P.type == Response
|
|
* and P.seqno >= S.OSR)
|
|
* or (S.state == RESPOND and P.type == Data),
|
|
* Send Sync packet acknowledging P.seqno
|
|
* Drop packet and return
|
|
*/
|
|
if (dp->dccps_role != DCCP_ROLE_LISTEN)
|
|
goto send_sync;
|
|
goto check_seq;
|
|
case DCCP_PKT_RESPONSE:
|
|
if (dp->dccps_role != DCCP_ROLE_CLIENT)
|
|
goto send_sync;
|
|
check_seq:
|
|
if (dccp_delta_seqno(dp->dccps_osr,
|
|
DCCP_SKB_CB(skb)->dccpd_seq) >= 0) {
|
|
send_sync:
|
|
dccp_send_sync(sk, DCCP_SKB_CB(skb)->dccpd_seq,
|
|
DCCP_PKT_SYNC);
|
|
}
|
|
break;
|
|
case DCCP_PKT_SYNC:
|
|
dccp_send_sync(sk, DCCP_SKB_CB(skb)->dccpd_seq,
|
|
DCCP_PKT_SYNCACK);
|
|
/*
|
|
* From RFC 4340, sec. 5.7
|
|
*
|
|
* As with DCCP-Ack packets, DCCP-Sync and DCCP-SyncAck packets
|
|
* MAY have non-zero-length application data areas, whose
|
|
* contents receivers MUST ignore.
|
|
*/
|
|
goto discard;
|
|
}
|
|
|
|
DCCP_INC_STATS_BH(DCCP_MIB_INERRS);
|
|
discard:
|
|
__kfree_skb(skb);
|
|
return 0;
|
|
}
|
|
|
|
int dccp_rcv_established(struct sock *sk, struct sk_buff *skb,
|
|
const struct dccp_hdr *dh, const unsigned len)
|
|
{
|
|
if (dccp_check_seqno(sk, skb))
|
|
goto discard;
|
|
|
|
if (dccp_parse_options(sk, NULL, skb))
|
|
return 1;
|
|
|
|
dccp_handle_ackvec_processing(sk, skb);
|
|
dccp_deliver_input_to_ccids(sk, skb);
|
|
|
|
return __dccp_rcv_established(sk, skb, dh, len);
|
|
discard:
|
|
__kfree_skb(skb);
|
|
return 0;
|
|
}
|
|
|
|
EXPORT_SYMBOL_GPL(dccp_rcv_established);
|
|
|
|
static int dccp_rcv_request_sent_state_process(struct sock *sk,
|
|
struct sk_buff *skb,
|
|
const struct dccp_hdr *dh,
|
|
const unsigned len)
|
|
{
|
|
/*
|
|
* Step 4: Prepare sequence numbers in REQUEST
|
|
* If S.state == REQUEST,
|
|
* If (P.type == Response or P.type == Reset)
|
|
* and S.AWL <= P.ackno <= S.AWH,
|
|
* / * Set sequence number variables corresponding to the
|
|
* other endpoint, so P will pass the tests in Step 6 * /
|
|
* Set S.GSR, S.ISR, S.SWL, S.SWH
|
|
* / * Response processing continues in Step 10; Reset
|
|
* processing continues in Step 9 * /
|
|
*/
|
|
if (dh->dccph_type == DCCP_PKT_RESPONSE) {
|
|
const struct inet_connection_sock *icsk = inet_csk(sk);
|
|
struct dccp_sock *dp = dccp_sk(sk);
|
|
long tstamp = dccp_timestamp();
|
|
|
|
if (!between48(DCCP_SKB_CB(skb)->dccpd_ack_seq,
|
|
dp->dccps_awl, dp->dccps_awh)) {
|
|
dccp_pr_debug("invalid ackno: S.AWL=%llu, "
|
|
"P.ackno=%llu, S.AWH=%llu\n",
|
|
(unsigned long long)dp->dccps_awl,
|
|
(unsigned long long)DCCP_SKB_CB(skb)->dccpd_ack_seq,
|
|
(unsigned long long)dp->dccps_awh);
|
|
goto out_invalid_packet;
|
|
}
|
|
|
|
/*
|
|
* If option processing (Step 8) failed, return 1 here so that
|
|
* dccp_v4_do_rcv() sends a Reset. The Reset code depends on
|
|
* the option type and is set in dccp_parse_options().
|
|
*/
|
|
if (dccp_parse_options(sk, NULL, skb))
|
|
return 1;
|
|
|
|
/* Obtain usec RTT sample from SYN exchange (used by TFRC). */
|
|
if (likely(dp->dccps_options_received.dccpor_timestamp_echo))
|
|
dp->dccps_syn_rtt = dccp_sample_rtt(sk, 10 * (tstamp -
|
|
dp->dccps_options_received.dccpor_timestamp_echo));
|
|
|
|
/* Stop the REQUEST timer */
|
|
inet_csk_clear_xmit_timer(sk, ICSK_TIME_RETRANS);
|
|
WARN_ON(sk->sk_send_head == NULL);
|
|
kfree_skb(sk->sk_send_head);
|
|
sk->sk_send_head = NULL;
|
|
|
|
/*
|
|
* Set ISR, GSR from packet. ISS was set in dccp_v{4,6}_connect
|
|
* and GSS in dccp_transmit_skb(). Setting AWL/AWH and SWL/SWH
|
|
* is done as part of activating the feature values below, since
|
|
* these settings depend on the local/remote Sequence Window
|
|
* features, which were undefined or not confirmed until now.
|
|
*/
|
|
dp->dccps_gsr = dp->dccps_isr = DCCP_SKB_CB(skb)->dccpd_seq;
|
|
|
|
dccp_sync_mss(sk, icsk->icsk_pmtu_cookie);
|
|
|
|
/*
|
|
* Step 10: Process REQUEST state (second part)
|
|
* If S.state == REQUEST,
|
|
* / * If we get here, P is a valid Response from the
|
|
* server (see Step 4), and we should move to
|
|
* PARTOPEN state. PARTOPEN means send an Ack,
|
|
* don't send Data packets, retransmit Acks
|
|
* periodically, and always include any Init Cookie
|
|
* from the Response * /
|
|
* S.state := PARTOPEN
|
|
* Set PARTOPEN timer
|
|
* Continue with S.state == PARTOPEN
|
|
* / * Step 12 will send the Ack completing the
|
|
* three-way handshake * /
|
|
*/
|
|
dccp_set_state(sk, DCCP_PARTOPEN);
|
|
|
|
/*
|
|
* If feature negotiation was successful, activate features now;
|
|
* an activation failure means that this host could not activate
|
|
* one ore more features (e.g. insufficient memory), which would
|
|
* leave at least one feature in an undefined state.
|
|
*/
|
|
if (dccp_feat_activate_values(sk, &dp->dccps_featneg))
|
|
goto unable_to_proceed;
|
|
|
|
/* Make sure socket is routed, for correct metrics. */
|
|
icsk->icsk_af_ops->rebuild_header(sk);
|
|
|
|
if (!sock_flag(sk, SOCK_DEAD)) {
|
|
sk->sk_state_change(sk);
|
|
sk_wake_async(sk, SOCK_WAKE_IO, POLL_OUT);
|
|
}
|
|
|
|
if (sk->sk_write_pending || icsk->icsk_ack.pingpong ||
|
|
icsk->icsk_accept_queue.rskq_defer_accept) {
|
|
/* Save one ACK. Data will be ready after
|
|
* several ticks, if write_pending is set.
|
|
*
|
|
* It may be deleted, but with this feature tcpdumps
|
|
* look so _wonderfully_ clever, that I was not able
|
|
* to stand against the temptation 8) --ANK
|
|
*/
|
|
/*
|
|
* OK, in DCCP we can as well do a similar trick, its
|
|
* even in the draft, but there is no need for us to
|
|
* schedule an ack here, as dccp_sendmsg does this for
|
|
* us, also stated in the draft. -acme
|
|
*/
|
|
__kfree_skb(skb);
|
|
return 0;
|
|
}
|
|
dccp_send_ack(sk);
|
|
return -1;
|
|
}
|
|
|
|
out_invalid_packet:
|
|
/* dccp_v4_do_rcv will send a reset */
|
|
DCCP_SKB_CB(skb)->dccpd_reset_code = DCCP_RESET_CODE_PACKET_ERROR;
|
|
return 1;
|
|
|
|
unable_to_proceed:
|
|
DCCP_SKB_CB(skb)->dccpd_reset_code = DCCP_RESET_CODE_ABORTED;
|
|
/*
|
|
* We mark this socket as no longer usable, so that the loop in
|
|
* dccp_sendmsg() terminates and the application gets notified.
|
|
*/
|
|
dccp_set_state(sk, DCCP_CLOSED);
|
|
sk->sk_err = ECOMM;
|
|
return 1;
|
|
}
|
|
|
|
static int dccp_rcv_respond_partopen_state_process(struct sock *sk,
|
|
struct sk_buff *skb,
|
|
const struct dccp_hdr *dh,
|
|
const unsigned len)
|
|
{
|
|
struct dccp_sock *dp = dccp_sk(sk);
|
|
u32 sample = dp->dccps_options_received.dccpor_timestamp_echo;
|
|
int queued = 0;
|
|
|
|
switch (dh->dccph_type) {
|
|
case DCCP_PKT_RESET:
|
|
inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK);
|
|
break;
|
|
case DCCP_PKT_DATA:
|
|
if (sk->sk_state == DCCP_RESPOND)
|
|
break;
|
|
case DCCP_PKT_DATAACK:
|
|
case DCCP_PKT_ACK:
|
|
/*
|
|
* FIXME: we should be reseting the PARTOPEN (DELACK) timer
|
|
* here but only if we haven't used the DELACK timer for
|
|
* something else, like sending a delayed ack for a TIMESTAMP
|
|
* echo, etc, for now were not clearing it, sending an extra
|
|
* ACK when there is nothing else to do in DELACK is not a big
|
|
* deal after all.
|
|
*/
|
|
|
|
/* Stop the PARTOPEN timer */
|
|
if (sk->sk_state == DCCP_PARTOPEN)
|
|
inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK);
|
|
|
|
/* Obtain usec RTT sample from SYN exchange (used by TFRC). */
|
|
if (likely(sample)) {
|
|
long delta = dccp_timestamp() - sample;
|
|
|
|
dp->dccps_syn_rtt = dccp_sample_rtt(sk, 10 * delta);
|
|
}
|
|
|
|
dp->dccps_osr = DCCP_SKB_CB(skb)->dccpd_seq;
|
|
dccp_set_state(sk, DCCP_OPEN);
|
|
|
|
if (dh->dccph_type == DCCP_PKT_DATAACK ||
|
|
dh->dccph_type == DCCP_PKT_DATA) {
|
|
__dccp_rcv_established(sk, skb, dh, len);
|
|
queued = 1; /* packet was queued
|
|
(by __dccp_rcv_established) */
|
|
}
|
|
break;
|
|
}
|
|
|
|
return queued;
|
|
}
|
|
|
|
int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
|
|
struct dccp_hdr *dh, unsigned len)
|
|
{
|
|
struct dccp_sock *dp = dccp_sk(sk);
|
|
struct dccp_skb_cb *dcb = DCCP_SKB_CB(skb);
|
|
const int old_state = sk->sk_state;
|
|
int queued = 0;
|
|
|
|
/*
|
|
* Step 3: Process LISTEN state
|
|
*
|
|
* If S.state == LISTEN,
|
|
* If P.type == Request or P contains a valid Init Cookie option,
|
|
* (* Must scan the packet's options to check for Init
|
|
* Cookies. Only Init Cookies are processed here,
|
|
* however; other options are processed in Step 8. This
|
|
* scan need only be performed if the endpoint uses Init
|
|
* Cookies *)
|
|
* (* Generate a new socket and switch to that socket *)
|
|
* Set S := new socket for this port pair
|
|
* S.state = RESPOND
|
|
* Choose S.ISS (initial seqno) or set from Init Cookies
|
|
* Initialize S.GAR := S.ISS
|
|
* Set S.ISR, S.GSR, S.SWL, S.SWH from packet or Init
|
|
* Cookies Continue with S.state == RESPOND
|
|
* (* A Response packet will be generated in Step 11 *)
|
|
* Otherwise,
|
|
* Generate Reset(No Connection) unless P.type == Reset
|
|
* Drop packet and return
|
|
*/
|
|
if (sk->sk_state == DCCP_LISTEN) {
|
|
if (dh->dccph_type == DCCP_PKT_REQUEST) {
|
|
if (inet_csk(sk)->icsk_af_ops->conn_request(sk,
|
|
skb) < 0)
|
|
return 1;
|
|
goto discard;
|
|
}
|
|
if (dh->dccph_type == DCCP_PKT_RESET)
|
|
goto discard;
|
|
|
|
/* Caller (dccp_v4_do_rcv) will send Reset */
|
|
dcb->dccpd_reset_code = DCCP_RESET_CODE_NO_CONNECTION;
|
|
return 1;
|
|
} else if (sk->sk_state == DCCP_CLOSED) {
|
|
dcb->dccpd_reset_code = DCCP_RESET_CODE_NO_CONNECTION;
|
|
return 1;
|
|
}
|
|
|
|
if (sk->sk_state != DCCP_REQUESTING && sk->sk_state != DCCP_RESPOND) {
|
|
if (dccp_check_seqno(sk, skb))
|
|
goto discard;
|
|
|
|
/*
|
|
* Step 8: Process options and mark acknowledgeable
|
|
*/
|
|
if (dccp_parse_options(sk, NULL, skb))
|
|
return 1;
|
|
|
|
dccp_handle_ackvec_processing(sk, skb);
|
|
dccp_deliver_input_to_ccids(sk, skb);
|
|
}
|
|
|
|
/*
|
|
* Step 9: Process Reset
|
|
* If P.type == Reset,
|
|
* Tear down connection
|
|
* S.state := TIMEWAIT
|
|
* Set TIMEWAIT timer
|
|
* Drop packet and return
|
|
*/
|
|
if (dh->dccph_type == DCCP_PKT_RESET) {
|
|
dccp_rcv_reset(sk, skb);
|
|
return 0;
|
|
/*
|
|
* Step 7: Check for unexpected packet types
|
|
* If (S.is_server and P.type == Response)
|
|
* or (S.is_client and P.type == Request)
|
|
* or (S.state == RESPOND and P.type == Data),
|
|
* Send Sync packet acknowledging P.seqno
|
|
* Drop packet and return
|
|
*/
|
|
} else if ((dp->dccps_role != DCCP_ROLE_CLIENT &&
|
|
dh->dccph_type == DCCP_PKT_RESPONSE) ||
|
|
(dp->dccps_role == DCCP_ROLE_CLIENT &&
|
|
dh->dccph_type == DCCP_PKT_REQUEST) ||
|
|
(sk->sk_state == DCCP_RESPOND &&
|
|
dh->dccph_type == DCCP_PKT_DATA)) {
|
|
dccp_send_sync(sk, dcb->dccpd_seq, DCCP_PKT_SYNC);
|
|
goto discard;
|
|
} else if (dh->dccph_type == DCCP_PKT_CLOSEREQ) {
|
|
if (dccp_rcv_closereq(sk, skb))
|
|
return 0;
|
|
goto discard;
|
|
} else if (dh->dccph_type == DCCP_PKT_CLOSE) {
|
|
if (dccp_rcv_close(sk, skb))
|
|
return 0;
|
|
goto discard;
|
|
}
|
|
|
|
switch (sk->sk_state) {
|
|
case DCCP_REQUESTING:
|
|
queued = dccp_rcv_request_sent_state_process(sk, skb, dh, len);
|
|
if (queued >= 0)
|
|
return queued;
|
|
|
|
__kfree_skb(skb);
|
|
return 0;
|
|
|
|
case DCCP_RESPOND:
|
|
case DCCP_PARTOPEN:
|
|
queued = dccp_rcv_respond_partopen_state_process(sk, skb,
|
|
dh, len);
|
|
break;
|
|
}
|
|
|
|
if (dh->dccph_type == DCCP_PKT_ACK ||
|
|
dh->dccph_type == DCCP_PKT_DATAACK) {
|
|
switch (old_state) {
|
|
case DCCP_PARTOPEN:
|
|
sk->sk_state_change(sk);
|
|
sk_wake_async(sk, SOCK_WAKE_IO, POLL_OUT);
|
|
break;
|
|
}
|
|
} else if (unlikely(dh->dccph_type == DCCP_PKT_SYNC)) {
|
|
dccp_send_sync(sk, dcb->dccpd_seq, DCCP_PKT_SYNCACK);
|
|
goto discard;
|
|
}
|
|
|
|
if (!queued) {
|
|
discard:
|
|
__kfree_skb(skb);
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
EXPORT_SYMBOL_GPL(dccp_rcv_state_process);
|
|
|
|
/**
|
|
* dccp_sample_rtt - Validate and finalise computation of RTT sample
|
|
* @delta: number of microseconds between packet and acknowledgment
|
|
* The routine is kept generic to work in different contexts. It should be
|
|
* called immediately when the ACK used for the RTT sample arrives.
|
|
*/
|
|
u32 dccp_sample_rtt(struct sock *sk, long delta)
|
|
{
|
|
/* dccpor_elapsed_time is either zeroed out or set and > 0 */
|
|
delta -= dccp_sk(sk)->dccps_options_received.dccpor_elapsed_time * 10;
|
|
|
|
if (unlikely(delta <= 0)) {
|
|
DCCP_WARN("unusable RTT sample %ld, using min\n", delta);
|
|
return DCCP_SANE_RTT_MIN;
|
|
}
|
|
if (unlikely(delta > DCCP_SANE_RTT_MAX)) {
|
|
DCCP_WARN("RTT sample %ld too large, using max\n", delta);
|
|
return DCCP_SANE_RTT_MAX;
|
|
}
|
|
|
|
return delta;
|
|
}
|