input.c 21.7 KB
Newer Older
1
// SPDX-License-Identifier: GPL-2.0-or-later
2 3
/*
 *  net/dccp/input.c
4
 *
5 6 7 8 9 10
 *  An implementation of the DCCP protocol
 *  Arnaldo Carvalho de Melo <acme@conectiva.com.br>
 */

#include <linux/dccp.h>
#include <linux/skbuff.h>
11
#include <linux/slab.h>
12 13 14

#include <net/sock.h>

15
#include "ackvec.h"
16 17 18
#include "ccid.h"
#include "dccp.h"

19 20 21
/* rate-limit for syncs in reply to sequence-invalid packets; RFC 4340, 7.5.4 */
int sysctl_dccp_sync_ratelimit	__read_mostly = HZ / 8;

22
static void dccp_enqueue_skb(struct sock *sk, struct sk_buff *skb)
23 24 25 26
{
	__skb_pull(skb, dccp_hdr(skb)->dccph_doff * 4);
	__skb_queue_tail(&sk->sk_receive_queue, skb);
	skb_set_owner_r(skb, sk);
27
	sk->sk_data_ready(sk);
28 29
}

30 31 32 33 34 35 36 37 38 39 40 41 42
static void dccp_fin(struct sock *sk, struct sk_buff *skb)
{
	/*
	 * On receiving Close/CloseReq, both RD/WR shutdown are performed.
	 * RFC 4340, 8.3 says that we MAY send further Data/DataAcks after
	 * receiving the closing segment, but there is no guarantee that such
	 * data will be processed at all.
	 */
	sk->sk_shutdown = SHUTDOWN_MASK;
	sock_set_flag(sk, SOCK_DONE);
	dccp_enqueue_skb(sk, skb);
}

43
static int dccp_rcv_close(struct sock *sk, struct sk_buff *skb)
44
{
45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86
	int queued = 0;

	switch (sk->sk_state) {
	/*
	 * We ignore Close when received in one of the following states:
	 *  - CLOSED		(may be a late or duplicate packet)
	 *  - PASSIVE_CLOSEREQ	(the peer has sent a CloseReq earlier)
	 *  - RESPOND		(already handled by dccp_check_req)
	 */
	case DCCP_CLOSING:
		/*
		 * Simultaneous-close: receiving a Close after sending one. This
		 * can happen if both client and server perform active-close and
		 * will result in an endless ping-pong of crossing and retrans-
		 * mitted Close packets, which only terminates when one of the
		 * nodes times out (min. 64 seconds). Quicker convergence can be
		 * achieved when one of the nodes acts as tie-breaker.
		 * This is ok as both ends are done with data transfer and each
		 * end is just waiting for the other to acknowledge termination.
		 */
		if (dccp_sk(sk)->dccps_role != DCCP_ROLE_CLIENT)
			break;
		/* fall through */
	case DCCP_REQUESTING:
	case DCCP_ACTIVE_CLOSEREQ:
		dccp_send_reset(sk, DCCP_RESET_CODE_CLOSED);
		dccp_done(sk);
		break;
	case DCCP_OPEN:
	case DCCP_PARTOPEN:
		/* Give waiting application a chance to read pending data */
		queued = 1;
		dccp_fin(sk, skb);
		dccp_set_state(sk, DCCP_PASSIVE_CLOSE);
		/* fall through */
	case DCCP_PASSIVE_CLOSE:
		/*
		 * Retransmitted Close: we have already enqueued the first one.
		 */
		sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_HUP);
	}
	return queued;
87 88
}

89
static int dccp_rcv_closereq(struct sock *sk, struct sk_buff *skb)
90
{
91 92
	int queued = 0;

93 94 95 96 97 98 99
	/*
	 *   Step 7: Check for unexpected packet types
	 *      If (S.is_server and P.type == CloseReq)
	 *	  Send Sync packet acknowledging P.seqno
	 *	  Drop packet and return
	 */
	if (dccp_sk(sk)->dccps_role != DCCP_ROLE_CLIENT) {
100
		dccp_send_sync(sk, DCCP_SKB_CB(skb)->dccpd_seq, DCCP_PKT_SYNC);
101
		return queued;
102 103
	}

104 105 106 107
	/* Step 13: process relevant Client states < CLOSEREQ */
	switch (sk->sk_state) {
	case DCCP_REQUESTING:
		dccp_send_close(sk, 0);
108
		dccp_set_state(sk, DCCP_CLOSING);
109 110 111 112 113 114 115 116 117 118 119 120
		break;
	case DCCP_OPEN:
	case DCCP_PARTOPEN:
		/* Give waiting application a chance to read pending data */
		queued = 1;
		dccp_fin(sk, skb);
		dccp_set_state(sk, DCCP_PASSIVE_CLOSEREQ);
		/* fall through */
	case DCCP_PASSIVE_CLOSEREQ:
		sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_HUP);
	}
	return queued;
121 122
}

123
static u16 dccp_reset_code_convert(const u8 code)
124
{
125
	static const u16 error_code[] = {
126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146
	[DCCP_RESET_CODE_CLOSED]	     = 0,	/* normal termination */
	[DCCP_RESET_CODE_UNSPECIFIED]	     = 0,	/* nothing known */
	[DCCP_RESET_CODE_ABORTED]	     = ECONNRESET,

	[DCCP_RESET_CODE_NO_CONNECTION]	     = ECONNREFUSED,
	[DCCP_RESET_CODE_CONNECTION_REFUSED] = ECONNREFUSED,
	[DCCP_RESET_CODE_TOO_BUSY]	     = EUSERS,
	[DCCP_RESET_CODE_AGGRESSION_PENALTY] = EDQUOT,

	[DCCP_RESET_CODE_PACKET_ERROR]	     = ENOMSG,
	[DCCP_RESET_CODE_BAD_INIT_COOKIE]    = EBADR,
	[DCCP_RESET_CODE_BAD_SERVICE_CODE]   = EBADRQC,
	[DCCP_RESET_CODE_OPTION_ERROR]	     = EILSEQ,
	[DCCP_RESET_CODE_MANDATORY_ERROR]    = EOPNOTSUPP,
	};

	return code >= DCCP_MAX_RESET_CODES ? 0 : error_code[code];
}

static void dccp_rcv_reset(struct sock *sk, struct sk_buff *skb)
{
147
	u16 err = dccp_reset_code_convert(dccp_hdr_reset(skb)->dccph_reset_code);
148 149 150 151 152 153 154

	sk->sk_err = err;

	/* Queue the equivalent of TCP fin so that dccp_recvmsg exits the loop */
	dccp_fin(sk, skb);

	if (err && !sock_flag(sk, SOCK_DEAD))
155
		sk_wake_async(sk, SOCK_WAKE_IO, POLL_ERR);
156 157 158
	dccp_time_wait(sk, DCCP_TIME_WAIT, 0);
}

159
static void dccp_handle_ackvec_processing(struct sock *sk, struct sk_buff *skb)
160
{
161
	struct dccp_ackvec *av = dccp_sk(sk)->dccps_hc_rx_ackvec;
162

163 164 165 166 167
	if (av == NULL)
		return;
	if (DCCP_SKB_CB(skb)->dccpd_ack_seq != DCCP_PKT_WITHOUT_ACK_SEQ)
		dccp_ackvec_clear_state(av, DCCP_SKB_CB(skb)->dccpd_ack_seq);
	dccp_ackvec_input(av, skb);
168 169
}

170 171 172 173 174 175 176 177 178 179 180 181 182 183 184
static void dccp_deliver_input_to_ccids(struct sock *sk, struct sk_buff *skb)
{
	const struct dccp_sock *dp = dccp_sk(sk);

	/* Don't deliver to RX CCID when node has shut down read end. */
	if (!(sk->sk_shutdown & RCV_SHUTDOWN))
		ccid_hc_rx_packet_recv(dp->dccps_hc_rx_ccid, sk, skb);
	/*
	 * Until the TX queue has been drained, we can not honour SHUT_WR, since
	 * we need received feedback as input to adjust congestion control.
	 */
	if (sk->sk_write_queue.qlen > 0 || !(sk->sk_shutdown & SEND_SHUTDOWN))
		ccid_hc_tx_packet_recv(dp->dccps_hc_tx_ccid, sk, skb);
}

185 186 187 188
static int dccp_check_seqno(struct sock *sk, struct sk_buff *skb)
{
	const struct dccp_hdr *dh = dccp_hdr(skb);
	struct dccp_sock *dp = dccp_sk(sk);
189 190
	u64 lswl, lawl, seqno = DCCP_SKB_CB(skb)->dccpd_seq,
			ackno = DCCP_SKB_CB(skb)->dccpd_ack_seq;
191 192 193 194 195 196 197 198 199 200 201 202 203

	/*
	 *   Step 5: Prepare sequence numbers for Sync
	 *     If P.type == Sync or P.type == SyncAck,
	 *	  If S.AWL <= P.ackno <= S.AWH and P.seqno >= S.SWL,
	 *	     / * P is valid, so update sequence number variables
	 *		 accordingly.  After this update, P will pass the tests
	 *		 in Step 6.  A SyncAck is generated if necessary in
	 *		 Step 15 * /
	 *	     Update S.GSR, S.SWL, S.SWH
	 *	  Otherwise,
	 *	     Drop packet and return
	 */
204
	if (dh->dccph_type == DCCP_PKT_SYNC ||
205
	    dh->dccph_type == DCCP_PKT_SYNCACK) {
206 207 208
		if (between48(ackno, dp->dccps_awl, dp->dccps_awh) &&
		    dccp_delta_seqno(dp->dccps_swl, seqno) >= 0)
			dccp_update_gsr(sk, seqno);
209 210
		else
			return -1;
211
	}
212

213 214 215 216 217 218 219 220 221 222 223
	/*
	 *   Step 6: Check sequence numbers
	 *      Let LSWL = S.SWL and LAWL = S.AWL
	 *      If P.type == CloseReq or P.type == Close or P.type == Reset,
	 *	  LSWL := S.GSR + 1, LAWL := S.GAR
	 *      If LSWL <= P.seqno <= S.SWH
	 *	     and (P.ackno does not exist or LAWL <= P.ackno <= S.AWH),
	 *	  Update S.GSR, S.SWL, S.SWH
	 *	  If P.type != Sync,
	 *	     Update S.GAR
	 */
224 225 226 227
	lswl = dp->dccps_swl;
	lawl = dp->dccps_awl;

	if (dh->dccph_type == DCCP_PKT_CLOSEREQ ||
228 229
	    dh->dccph_type == DCCP_PKT_CLOSE ||
	    dh->dccph_type == DCCP_PKT_RESET) {
230
		lswl = ADD48(dp->dccps_gsr, 1);
231 232 233
		lawl = dp->dccps_gar;
	}

234 235 236 237
	if (between48(seqno, lswl, dp->dccps_swh) &&
	    (ackno == DCCP_PKT_WITHOUT_ACK_SEQ ||
	     between48(ackno, lawl, dp->dccps_awh))) {
		dccp_update_gsr(sk, seqno);
238 239

		if (dh->dccph_type != DCCP_PKT_SYNC &&
240 241
		    ackno != DCCP_PKT_WITHOUT_ACK_SEQ &&
		    after48(ackno, dp->dccps_gar))
242
			dp->dccps_gar = ackno;
243
	} else {
244 245 246 247 248 249 250 251 252 253 254 255 256 257 258
		unsigned long now = jiffies;
		/*
		 *   Step 6: Check sequence numbers
		 *      Otherwise,
		 *         If P.type == Reset,
		 *            Send Sync packet acknowledging S.GSR
		 *         Otherwise,
		 *            Send Sync packet acknowledging P.seqno
		 *      Drop packet and return
		 *
		 *   These Syncs are rate-limited as per RFC 4340, 7.5.4:
		 *   at most 1 / (dccp_sync_rate_limit * HZ) Syncs per second.
		 */
		if (time_before(now, (dp->dccps_rate_last +
				      sysctl_dccp_sync_ratelimit)))
259
			return -1;
260

261
		DCCP_WARN("Step 6 failed for %s packet, "
262 263 264
			  "(LSWL(%llu) <= P.seqno(%llu) <= S.SWH(%llu)) and "
			  "(P.ackno %s or LAWL(%llu) <= P.ackno(%llu) <= S.AWH(%llu), "
			  "sending SYNC...\n",  dccp_packet_name(dh->dccph_type),
265
			  (unsigned long long) lswl, (unsigned long long) seqno,
266
			  (unsigned long long) dp->dccps_swh,
267 268 269
			  (ackno == DCCP_PKT_WITHOUT_ACK_SEQ) ? "doesn't exist"
							      : "exists",
			  (unsigned long long) lawl, (unsigned long long) ackno,
270
			  (unsigned long long) dp->dccps_awh);
271 272 273

		dp->dccps_rate_last = now;

274 275
		if (dh->dccph_type == DCCP_PKT_RESET)
			seqno = dp->dccps_gsr;
276
		dccp_send_sync(sk, seqno, DCCP_PKT_SYNC);
277 278 279 280 281 282
		return -1;
	}

	return 0;
}

283
static int __dccp_rcv_established(struct sock *sk, struct sk_buff *skb,
284
				  const struct dccp_hdr *dh, const unsigned int len)
285 286 287 288 289 290 291
{
	struct dccp_sock *dp = dccp_sk(sk);

	switch (dccp_hdr(skb)->dccph_type) {
	case DCCP_PKT_DATAACK:
	case DCCP_PKT_DATA:
		/*
292 293 294
		 * FIXME: schedule DATA_DROPPED (RFC 4340, 11.7.2) if and when
		 * - sk_shutdown == RCV_SHUTDOWN, use Code 1, "Not Listening"
		 * - sk_receive_queue is full, use Code 2, "Receive Buffer"
295
		 */
296
		dccp_enqueue_skb(sk, skb);
297 298 299 300 301 302 303 304 305 306 307
		return 0;
	case DCCP_PKT_ACK:
		goto discard;
	case DCCP_PKT_RESET:
		/*
		 *  Step 9: Process Reset
		 *	If P.type == Reset,
		 *		Tear down connection
		 *		S.state := TIMEWAIT
		 *		Set TIMEWAIT timer
		 *		Drop packet and return
308 309
		 */
		dccp_rcv_reset(sk, skb);
310 311
		return 0;
	case DCCP_PKT_CLOSEREQ:
312 313
		if (dccp_rcv_closereq(sk, skb))
			return 0;
314 315
		goto discard;
	case DCCP_PKT_CLOSE:
316 317 318
		if (dccp_rcv_close(sk, skb))
			return 0;
		goto discard;
319
	case DCCP_PKT_REQUEST:
320 321
		/* Step 7
		 *   or (S.is_server and P.type == Response)
322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337
		 *   or (S.is_client and P.type == Request)
		 *   or (S.state >= OPEN and P.type == Request
		 *	and P.seqno >= S.OSR)
		 *    or (S.state >= OPEN and P.type == Response
		 *	and P.seqno >= S.OSR)
		 *    or (S.state == RESPOND and P.type == Data),
		 *  Send Sync packet acknowledging P.seqno
		 *  Drop packet and return
		 */
		if (dp->dccps_role != DCCP_ROLE_LISTEN)
			goto send_sync;
		goto check_seq;
	case DCCP_PKT_RESPONSE:
		if (dp->dccps_role != DCCP_ROLE_CLIENT)
			goto send_sync;
check_seq:
338 339
		if (dccp_delta_seqno(dp->dccps_osr,
				     DCCP_SKB_CB(skb)->dccpd_seq) >= 0) {
340
send_sync:
341 342
			dccp_send_sync(sk, DCCP_SKB_CB(skb)->dccpd_seq,
				       DCCP_PKT_SYNC);
343 344
		}
		break;
345 346 347 348
	case DCCP_PKT_SYNC:
		dccp_send_sync(sk, DCCP_SKB_CB(skb)->dccpd_seq,
			       DCCP_PKT_SYNCACK);
		/*
349
		 * From RFC 4340, sec. 5.7
350 351 352
		 *
		 * As with DCCP-Ack packets, DCCP-Sync and DCCP-SyncAck packets
		 * MAY have non-zero-length application data areas, whose
353
		 * contents receivers MUST ignore.
354 355
		 */
		goto discard;
356 357
	}

358
	DCCP_INC_STATS(DCCP_MIB_INERRS);
359 360 361 362 363
discard:
	__kfree_skb(skb);
	return 0;
}

364
int dccp_rcv_established(struct sock *sk, struct sk_buff *skb,
365
			 const struct dccp_hdr *dh, const unsigned int len)
366 367 368 369
{
	if (dccp_check_seqno(sk, skb))
		goto discard;

370
	if (dccp_parse_options(sk, NULL, skb))
371
		return 1;
372

373
	dccp_handle_ackvec_processing(sk, skb);
374
	dccp_deliver_input_to_ccids(sk, skb);
375 376 377 378 379 380 381

	return __dccp_rcv_established(sk, skb, dh, len);
discard:
	__kfree_skb(skb);
	return 0;
}

382 383
EXPORT_SYMBOL_GPL(dccp_rcv_established);

384 385 386
static int dccp_rcv_request_sent_state_process(struct sock *sk,
					       struct sk_buff *skb,
					       const struct dccp_hdr *dh,
387
					       const unsigned int len)
388
{
389
	/*
390 391 392 393 394 395 396 397 398 399 400 401 402
	 *  Step 4: Prepare sequence numbers in REQUEST
	 *     If S.state == REQUEST,
	 *	  If (P.type == Response or P.type == Reset)
	 *		and S.AWL <= P.ackno <= S.AWH,
	 *	     / * Set sequence number variables corresponding to the
	 *		other endpoint, so P will pass the tests in Step 6 * /
	 *	     Set S.GSR, S.ISR, S.SWL, S.SWH
	 *	     / * Response processing continues in Step 10; Reset
	 *		processing continues in Step 9 * /
	*/
	if (dh->dccph_type == DCCP_PKT_RESPONSE) {
		const struct inet_connection_sock *icsk = inet_csk(sk);
		struct dccp_sock *dp = dccp_sk(sk);
403
		long tstamp = dccp_timestamp();
404

405 406 407
		if (!between48(DCCP_SKB_CB(skb)->dccpd_ack_seq,
			       dp->dccps_awl, dp->dccps_awh)) {
			dccp_pr_debug("invalid ackno: S.AWL=%llu, "
408
				      "P.ackno=%llu, S.AWH=%llu\n",
409 410 411
				      (unsigned long long)dp->dccps_awl,
			   (unsigned long long)DCCP_SKB_CB(skb)->dccpd_ack_seq,
				      (unsigned long long)dp->dccps_awh);
412 413
			goto out_invalid_packet;
		}
414

415 416 417 418 419
		/*
		 * If option processing (Step 8) failed, return 1 here so that
		 * dccp_v4_do_rcv() sends a Reset. The Reset code depends on
		 * the option type and is set in dccp_parse_options().
		 */
420
		if (dccp_parse_options(sk, NULL, skb))
421
			return 1;
422

423
		/* Obtain usec RTT sample from SYN exchange (used by TFRC). */
424 425 426
		if (likely(dp->dccps_options_received.dccpor_timestamp_echo))
			dp->dccps_syn_rtt = dccp_sample_rtt(sk, 10 * (tstamp -
			    dp->dccps_options_received.dccpor_timestamp_echo));
427

428 429 430 431 432 433
		/* Stop the REQUEST timer */
		inet_csk_clear_xmit_timer(sk, ICSK_TIME_RETRANS);
		WARN_ON(sk->sk_send_head == NULL);
		kfree_skb(sk->sk_send_head);
		sk->sk_send_head = NULL;

434
		/*
435 436 437 438 439
		 * Set ISR, GSR from packet. ISS was set in dccp_v{4,6}_connect
		 * and GSS in dccp_transmit_skb(). Setting AWL/AWH and SWL/SWH
		 * is done as part of activating the feature values below, since
		 * these settings depend on the local/remote Sequence Window
		 * features, which were undefined or not confirmed until now.
440
		 */
441
		dp->dccps_gsr = dp->dccps_isr = DCCP_SKB_CB(skb)->dccpd_seq;
442

443
		dccp_sync_mss(sk, icsk->icsk_pmtu_cookie);
444 445 446 447

		/*
		 *    Step 10: Process REQUEST state (second part)
		 *       If S.state == REQUEST,
448 449 450 451 452 453
		 *	  / * If we get here, P is a valid Response from the
		 *	      server (see Step 4), and we should move to
		 *	      PARTOPEN state. PARTOPEN means send an Ack,
		 *	      don't send Data packets, retransmit Acks
		 *	      periodically, and always include any Init Cookie
		 *	      from the Response * /
454 455
		 *	  S.state := PARTOPEN
		 *	  Set PARTOPEN timer
456
		 *	  Continue with S.state == PARTOPEN
457 458
		 *	  / * Step 12 will send the Ack completing the
		 *	      three-way handshake * /
459 460 461
		 */
		dccp_set_state(sk, DCCP_PARTOPEN);

462 463 464 465 466 467 468 469 470
		/*
		 * If feature negotiation was successful, activate features now;
		 * an activation failure means that this host could not activate
		 * one ore more features (e.g. insufficient memory), which would
		 * leave at least one feature in an undefined state.
		 */
		if (dccp_feat_activate_values(sk, &dp->dccps_featneg))
			goto unable_to_proceed;

471
		/* Make sure socket is routed, for correct metrics. */
472
		icsk->icsk_af_ops->rebuild_header(sk);
473 474 475

		if (!sock_flag(sk, SOCK_DEAD)) {
			sk->sk_state_change(sk);
476
			sk_wake_async(sk, SOCK_WAKE_IO, POLL_OUT);
477 478
		}

Wei Wang's avatar
Wei Wang committed
479
		if (sk->sk_write_pending || inet_csk_in_pingpong_mode(sk) ||
480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495
		    icsk->icsk_accept_queue.rskq_defer_accept) {
			/* Save one ACK. Data will be ready after
			 * several ticks, if write_pending is set.
			 *
			 * It may be deleted, but with this feature tcpdumps
			 * look so _wonderfully_ clever, that I was not able
			 * to stand against the temptation 8)     --ANK
			 */
			/*
			 * OK, in DCCP we can as well do a similar trick, its
			 * even in the draft, but there is no need for us to
			 * schedule an ack here, as dccp_sendmsg does this for
			 * us, also stated in the draft. -acme
			 */
			__kfree_skb(skb);
			return 0;
496
		}
497 498 499 500 501
		dccp_send_ack(sk);
		return -1;
	}

out_invalid_packet:
502 503
	/* dccp_v4_do_rcv will send a reset */
	DCCP_SKB_CB(skb)->dccpd_reset_code = DCCP_RESET_CODE_PACKET_ERROR;
504
	return 1;
505 506 507 508 509 510 511 512 513 514

unable_to_proceed:
	DCCP_SKB_CB(skb)->dccpd_reset_code = DCCP_RESET_CODE_ABORTED;
	/*
	 * We mark this socket as no longer usable, so that the loop in
	 * dccp_sendmsg() terminates and the application gets notified.
	 */
	dccp_set_state(sk, DCCP_CLOSED);
	sk->sk_err = ECOMM;
	return 1;
515 516 517 518 519
}

static int dccp_rcv_respond_partopen_state_process(struct sock *sk,
						   struct sk_buff *skb,
						   const struct dccp_hdr *dh,
520
						   const unsigned int len)
521
{
522 523
	struct dccp_sock *dp = dccp_sk(sk);
	u32 sample = dp->dccps_options_received.dccpor_timestamp_echo;
524 525 526 527 528 529
	int queued = 0;

	switch (dh->dccph_type) {
	case DCCP_PKT_RESET:
		inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK);
		break;
530 531 532
	case DCCP_PKT_DATA:
		if (sk->sk_state == DCCP_RESPOND)
			break;
533
		/* fall through */
534 535 536
	case DCCP_PKT_DATAACK:
	case DCCP_PKT_ACK:
		/*
537
		 * FIXME: we should be resetting the PARTOPEN (DELACK) timer
538 539 540 541 542
		 * here but only if we haven't used the DELACK timer for
		 * something else, like sending a delayed ack for a TIMESTAMP
		 * echo, etc, for now were not clearing it, sending an extra
		 * ACK when there is nothing else to do in DELACK is not a big
		 * deal after all.
543 544 545 546 547 548
		 */

		/* Stop the PARTOPEN timer */
		if (sk->sk_state == DCCP_PARTOPEN)
			inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK);

549 550 551 552 553 554 555 556
		/* Obtain usec RTT sample from SYN exchange (used by TFRC). */
		if (likely(sample)) {
			long delta = dccp_timestamp() - sample;

			dp->dccps_syn_rtt = dccp_sample_rtt(sk, 10 * delta);
		}

		dp->dccps_osr = DCCP_SKB_CB(skb)->dccpd_seq;
557 558
		dccp_set_state(sk, DCCP_OPEN);

559 560
		if (dh->dccph_type == DCCP_PKT_DATAACK ||
		    dh->dccph_type == DCCP_PKT_DATA) {
561
			__dccp_rcv_established(sk, skb, dh, len);
562
			queued = 1; /* packet was queued
563
				       (by __dccp_rcv_established) */
564 565 566 567 568 569 570 571
		}
		break;
	}

	return queued;
}

int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
572
			   struct dccp_hdr *dh, unsigned int len)
573 574
{
	struct dccp_sock *dp = dccp_sk(sk);
575
	struct dccp_skb_cb *dcb = DCCP_SKB_CB(skb);
576
	const int old_state = sk->sk_state;
577
	bool acceptable;
578 579
	int queued = 0;

580 581 582 583
	/*
	 *  Step 3: Process LISTEN state
	 *
	 *     If S.state == LISTEN,
584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600
	 *	 If P.type == Request or P contains a valid Init Cookie option,
	 *	      (* Must scan the packet's options to check for Init
	 *		 Cookies.  Only Init Cookies are processed here,
	 *		 however; other options are processed in Step 8.  This
	 *		 scan need only be performed if the endpoint uses Init
	 *		 Cookies *)
	 *	      (* Generate a new socket and switch to that socket *)
	 *	      Set S := new socket for this port pair
	 *	      S.state = RESPOND
	 *	      Choose S.ISS (initial seqno) or set from Init Cookies
	 *	      Initialize S.GAR := S.ISS
	 *	      Set S.ISR, S.GSR, S.SWL, S.SWH from packet or Init
	 *	      Cookies Continue with S.state == RESPOND
	 *	      (* A Response packet will be generated in Step 11 *)
	 *	 Otherwise,
	 *	      Generate Reset(No Connection) unless P.type == Reset
	 *	      Drop packet and return
601 602 603
	 */
	if (sk->sk_state == DCCP_LISTEN) {
		if (dh->dccph_type == DCCP_PKT_REQUEST) {
604
			/* It is possible that we process SYN packets from backlog,
605
			 * so we need to make sure to disable BH and RCU right there.
606
			 */
607
			rcu_read_lock();
608 609 610
			local_bh_disable();
			acceptable = inet_csk(sk)->icsk_af_ops->conn_request(sk, skb) >= 0;
			local_bh_enable();
611
			rcu_read_unlock();
612
			if (!acceptable)
613
				return 1;
614 615
			consume_skb(skb);
			return 0;
616 617 618 619
		}
		if (dh->dccph_type == DCCP_PKT_RESET)
			goto discard;

620 621
		/* Caller (dccp_v4_do_rcv) will send Reset */
		dcb->dccpd_reset_code = DCCP_RESET_CODE_NO_CONNECTION;
622
		return 1;
623 624 625
	} else if (sk->sk_state == DCCP_CLOSED) {
		dcb->dccpd_reset_code = DCCP_RESET_CODE_NO_CONNECTION;
		return 1;
626 627
	}

628 629 630
	/* Step 6: Check sequence numbers (omitted in LISTEN/REQUEST state) */
	if (sk->sk_state != DCCP_REQUESTING && dccp_check_seqno(sk, skb))
		goto discard;
631

632 633 634 635 636 637 638 639 640 641 642 643 644 645 646
	/*
	 *   Step 7: Check for unexpected packet types
	 *      If (S.is_server and P.type == Response)
	 *	    or (S.is_client and P.type == Request)
	 *	    or (S.state == RESPOND and P.type == Data),
	 *	  Send Sync packet acknowledging P.seqno
	 *	  Drop packet and return
	 */
	if ((dp->dccps_role != DCCP_ROLE_CLIENT &&
	     dh->dccph_type == DCCP_PKT_RESPONSE) ||
	    (dp->dccps_role == DCCP_ROLE_CLIENT &&
	     dh->dccph_type == DCCP_PKT_REQUEST) ||
	    (sk->sk_state == DCCP_RESPOND && dh->dccph_type == DCCP_PKT_DATA)) {
		dccp_send_sync(sk, dcb->dccpd_seq, DCCP_PKT_SYNC);
		goto discard;
647
	}
648

649 650 651 652
	/*  Step 8: Process options */
	if (dccp_parse_options(sk, NULL, skb))
		return 1;

653 654 655 656 657 658 659
	/*
	 *  Step 9: Process Reset
	 *	If P.type == Reset,
	 *		Tear down connection
	 *		S.state := TIMEWAIT
	 *		Set TIMEWAIT timer
	 *		Drop packet and return
660
	 */
661
	if (dh->dccph_type == DCCP_PKT_RESET) {
662
		dccp_rcv_reset(sk, skb);
663
		return 0;
664
	} else if (dh->dccph_type == DCCP_PKT_CLOSEREQ) {	/* Step 13 */
665 666
		if (dccp_rcv_closereq(sk, skb))
			return 0;
667
		goto discard;
668
	} else if (dh->dccph_type == DCCP_PKT_CLOSE) {		/* Step 14 */
669 670 671
		if (dccp_rcv_close(sk, skb))
			return 0;
		goto discard;
672 673 674 675 676 677 678 679 680 681 682
	}

	switch (sk->sk_state) {
	case DCCP_REQUESTING:
		queued = dccp_rcv_request_sent_state_process(sk, skb, dh, len);
		if (queued >= 0)
			return queued;

		__kfree_skb(skb);
		return 0;

683
	case DCCP_PARTOPEN:
684 685 686 687 688
		/* Step 8: if using Ack Vectors, mark packet acknowledgeable */
		dccp_handle_ackvec_processing(sk, skb);
		dccp_deliver_input_to_ccids(sk, skb);
		/* fall through */
	case DCCP_RESPOND:
689 690
		queued = dccp_rcv_respond_partopen_state_process(sk, skb,
								 dh, len);
691 692 693
		break;
	}

694 695
	if (dh->dccph_type == DCCP_PKT_ACK ||
	    dh->dccph_type == DCCP_PKT_DATAACK) {
696 697 698
		switch (old_state) {
		case DCCP_PARTOPEN:
			sk->sk_state_change(sk);
699
			sk_wake_async(sk, SOCK_WAKE_IO, POLL_OUT);
700 701
			break;
		}
702 703 704
	} else if (unlikely(dh->dccph_type == DCCP_PKT_SYNC)) {
		dccp_send_sync(sk, dcb->dccpd_seq, DCCP_PKT_SYNCACK);
		goto discard;
705 706
	}

707
	if (!queued) {
708 709 710 711 712
discard:
		__kfree_skb(skb);
	}
	return 0;
}
713 714

EXPORT_SYMBOL_GPL(dccp_rcv_state_process);
715 716

/**
717 718
 *  dccp_sample_rtt  -  Validate and finalise computation of RTT sample
 *  @delta:	number of microseconds between packet and acknowledgment
719
 *
720 721
 *  The routine is kept generic to work in different contexts. It should be
 *  called immediately when the ACK used for the RTT sample arrives.
722
 */
723
u32 dccp_sample_rtt(struct sock *sk, long delta)
724
{
725 726
	/* dccpor_elapsed_time is either zeroed out or set and > 0 */
	delta -= dccp_sk(sk)->dccps_options_received.dccpor_elapsed_time * 10;
727

728 729 730 731 732 733 734 735 736 737
	if (unlikely(delta <= 0)) {
		DCCP_WARN("unusable RTT sample %ld, using min\n", delta);
		return DCCP_SANE_RTT_MIN;
	}
	if (unlikely(delta > DCCP_SANE_RTT_MAX)) {
		DCCP_WARN("RTT sample %ld too large, using max\n", delta);
		return DCCP_SANE_RTT_MAX;
	}

	return delta;
738
}