net/dccp/proto.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  *  net/dccp/proto.c
   4  *
   5  *  An implementation of the DCCP protocol
   6  *  Arnaldo Carvalho de Melo <acme@conectiva.com.br>
   7  */
   8
   9 #include <linux/dccp.h>
  10 #include <linux/module.h>
  11 #include <linux/types.h>
  12 #include <linux/sched.h>
  13 #include <linux/kernel.h>
  14 #include <linux/skbuff.h>
  15 #include <linux/netdevice.h>
  16 #include <linux/in.h>
  17 #include <linux/if_arp.h>
  18 #include <linux/init.h>
  19 #include <linux/random.h>
  20 #include <linux/slab.h>
  21 #include <net/checksum.h>
  22
  23 #include <net/inet_sock.h>
  24 #include <net/inet_common.h>
  25 #include <net/sock.h>
  26 #include <net/xfrm.h>
  27
  28 #include <asm/ioctls.h>
  29 #include <linux/spinlock.h>
  30 #include <linux/timer.h>
  31 #include <linux/delay.h>
  32 #include <linux/poll.h>
  33
  34 #include "ccid.h"
  35 #include "dccp.h"
  36 #include "feat.h"
  37
  38 #define CREATE_TRACE_POINTS
  39 #include "trace.h"
  40
  41 DEFINE_SNMP_STAT(struct dccp_mib, dccp_statistics) __read_mostly;
  42
  43 EXPORT_SYMBOL_GPL(dccp_statistics);
  44
  45 DEFINE_PER_CPU(unsigned int, dccp_orphan_count);
  46 EXPORT_PER_CPU_SYMBOL_GPL(dccp_orphan_count);
  47
  48 struct inet_hashinfo dccp_hashinfo;
  49 EXPORT_SYMBOL_GPL(dccp_hashinfo);
  50
  51 /* the maximum queue length for tx in packets. 0 is no limit */
  52 int sysctl_dccp_tx_qlen __read_mostly = 5;
  53
  54 #ifdef CONFIG_IP_DCCP_DEBUG
  55 static const char *dccp_state_name(const int state)
  56 {
  57         static const char *const dccp_state_names[] = {
  58         [DCCP_OPEN]             = "OPEN",
  59         [DCCP_REQUESTING]       = "REQUESTING",
  60         [DCCP_PARTOPEN]         = "PARTOPEN",
  61         [DCCP_LISTEN]           = "LISTEN",
  62         [DCCP_RESPOND]          = "RESPOND",
  63         [DCCP_CLOSING]          = "CLOSING",
  64         [DCCP_ACTIVE_CLOSEREQ]  = "CLOSEREQ",
  65         [DCCP_PASSIVE_CLOSE]    = "PASSIVE_CLOSE",
  66         [DCCP_PASSIVE_CLOSEREQ] = "PASSIVE_CLOSEREQ",
  67         [DCCP_TIME_WAIT]        = "TIME_WAIT",
  68         [DCCP_CLOSED]           = "CLOSED",
  69         };
  70
  71         if (state >= DCCP_MAX_STATES)
  72                 return "INVALID STATE!";
  73         else
  74                 return dccp_state_names[state];
  75 }
  76 #endif
  77
  78 void dccp_set_state(struct sock *sk, const int state)
  79 {
  80         const int oldstate = sk->sk_state;
  81
  82         dccp_pr_debug("%s(%p)  %s  -->  %s\n", dccp_role(sk), sk,
  83                       dccp_state_name(oldstate), dccp_state_name(state));
  84         WARN_ON(state == oldstate);
  85
  86         switch (state) {
  87         case DCCP_OPEN:
  88                 if (oldstate != DCCP_OPEN)
  89                         DCCP_INC_STATS(DCCP_MIB_CURRESTAB);
  90                 /* Client retransmits all Confirm options until entering OPEN */
  91                 if (oldstate == DCCP_PARTOPEN)
  92                         dccp_feat_list_purge(&dccp_sk(sk)->dccps_featneg);
  93                 break;
  94
  95         case DCCP_CLOSED:
  96                 if (oldstate == DCCP_OPEN || oldstate == DCCP_ACTIVE_CLOSEREQ ||
  97                     oldstate == DCCP_CLOSING)
  98                         DCCP_INC_STATS(DCCP_MIB_ESTABRESETS);
  99
 100                 sk->sk_prot->unhash(sk);
 101                 if (inet_csk(sk)->icsk_bind_hash != NULL &&
 102                     !(sk->sk_userlocks & SOCK_BINDPORT_LOCK))
 103                         inet_put_port(sk);
 104                 fallthrough;
 105         default:
 106                 if (oldstate == DCCP_OPEN)
 107                         DCCP_DEC_STATS(DCCP_MIB_CURRESTAB);
 108         }
 109
 110         /* Change state AFTER socket is unhashed to avoid closed
 111          * socket sitting in hash tables.
 112          */
 113         inet_sk_set_state(sk, state);
 114 }
 115
 116 EXPORT_SYMBOL_GPL(dccp_set_state);
 117
 118 static void dccp_finish_passive_close(struct sock *sk)
 119 {
 120         switch (sk->sk_state) {
 121         case DCCP_PASSIVE_CLOSE:
 122                 /* Node (client or server) has received Close packet. */
 123                 dccp_send_reset(sk, DCCP_RESET_CODE_CLOSED);
 124                 dccp_set_state(sk, DCCP_CLOSED);
 125                 break;
 126         case DCCP_PASSIVE_CLOSEREQ:
 127                 /*
 128                  * Client received CloseReq. We set the `active' flag so that
 129                  * dccp_send_close() retransmits the Close as per RFC 4340, 8.3.
 130                  */
 131                 dccp_send_close(sk, 1);
 132                 dccp_set_state(sk, DCCP_CLOSING);
 133         }
 134 }
 135
 136 void dccp_done(struct sock *sk)
 137 {
 138         dccp_set_state(sk, DCCP_CLOSED);
 139         dccp_clear_xmit_timers(sk);
 140
 141         sk->sk_shutdown = SHUTDOWN_MASK;
 142
 143         if (!sock_flag(sk, SOCK_DEAD))
 144                 sk->sk_state_change(sk);
 145         else
 146                 inet_csk_destroy_sock(sk);
 147 }
 148
 149 EXPORT_SYMBOL_GPL(dccp_done);
 150
 151 const char *dccp_packet_name(const int type)
 152 {
 153         static const char *const dccp_packet_names[] = {
 154                 [DCCP_PKT_REQUEST]  = "REQUEST",
 155                 [DCCP_PKT_RESPONSE] = "RESPONSE",
 156                 [DCCP_PKT_DATA]     = "DATA",
 157                 [DCCP_PKT_ACK]      = "ACK",
 158                 [DCCP_PKT_DATAACK]  = "DATAACK",
 159                 [DCCP_PKT_CLOSEREQ] = "CLOSEREQ",
 160                 [DCCP_PKT_CLOSE]    = "CLOSE",
 161                 [DCCP_PKT_RESET]    = "RESET",
 162                 [DCCP_PKT_SYNC]     = "SYNC",
 163                 [DCCP_PKT_SYNCACK]  = "SYNCACK",
 164         };
 165
 166         if (type >= DCCP_NR_PKT_TYPES)
 167                 return "INVALID";
 168         else
 169                 return dccp_packet_names[type];
 170 }
 171
 172 EXPORT_SYMBOL_GPL(dccp_packet_name);
 173
 174 static void dccp_sk_destruct(struct sock *sk)
 175 {
 176         struct dccp_sock *dp = dccp_sk(sk);
 177
 178         ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
 179         dp->dccps_hc_tx_ccid = NULL;
 180         inet_sock_destruct(sk);
 181 }
 182
 183 int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized)
 184 {
 185         struct dccp_sock *dp = dccp_sk(sk);
 186         struct inet_connection_sock *icsk = inet_csk(sk);
 187
 188         icsk->icsk_rto          = DCCP_TIMEOUT_INIT;
 189         icsk->icsk_syn_retries  = sysctl_dccp_request_retries;
 190         sk->sk_state            = DCCP_CLOSED;
 191         sk->sk_write_space      = dccp_write_space;
 192         sk->sk_destruct         = dccp_sk_destruct;
 193         icsk->icsk_sync_mss     = dccp_sync_mss;
 194         dp->dccps_mss_cache     = 536;
 195         dp->dccps_rate_last     = jiffies;
 196         dp->dccps_role          = DCCP_ROLE_UNDEFINED;
 197         dp->dccps_service       = DCCP_SERVICE_CODE_IS_ABSENT;
 198         dp->dccps_tx_qlen       = sysctl_dccp_tx_qlen;
 199
 200         dccp_init_xmit_timers(sk);
 201
 202         INIT_LIST_HEAD(&dp->dccps_featneg);
 203         /* control socket doesn't need feat nego */
 204         if (likely(ctl_sock_initialized))
 205                 return dccp_feat_init(sk);
 206         return 0;
 207 }
 208
 209 EXPORT_SYMBOL_GPL(dccp_init_sock);
 210
 211 void dccp_destroy_sock(struct sock *sk)
 212 {
 213         struct dccp_sock *dp = dccp_sk(sk);
 214
 215         __skb_queue_purge(&sk->sk_write_queue);
 216         if (sk->sk_send_head != NULL) {
 217                 kfree_skb(sk->sk_send_head);
 218                 sk->sk_send_head = NULL;
 219         }
 220
 221         /* Clean up a referenced DCCP bind bucket. */
 222         if (inet_csk(sk)->icsk_bind_hash != NULL)
 223                 inet_put_port(sk);
 224
 225         kfree(dp->dccps_service_list);
 226         dp->dccps_service_list = NULL;
 227
 228         if (dp->dccps_hc_rx_ackvec != NULL) {
 229                 dccp_ackvec_free(dp->dccps_hc_rx_ackvec);
 230                 dp->dccps_hc_rx_ackvec = NULL;
 231         }
 232         ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
 233         dp->dccps_hc_rx_ccid = NULL;
 234
 235         /* clean up feature negotiation state */
 236         dccp_feat_list_purge(&dp->dccps_featneg);
 237 }
 238
 239 EXPORT_SYMBOL_GPL(dccp_destroy_sock);
 240
 241 static inline int dccp_need_reset(int state)
 242 {
 243         return state != DCCP_CLOSED && state != DCCP_LISTEN &&
 244                state != DCCP_REQUESTING;
 245 }
 246
 247 int dccp_disconnect(struct sock *sk, int flags)
 248 {
 249         struct inet_connection_sock *icsk = inet_csk(sk);
 250         struct inet_sock *inet = inet_sk(sk);
 251         struct dccp_sock *dp = dccp_sk(sk);
 252         const int old_state = sk->sk_state;
 253
 254         if (old_state != DCCP_CLOSED)
 255                 dccp_set_state(sk, DCCP_CLOSED);
 256
 257         /*
 258          * This corresponds to the ABORT function of RFC793, sec. 3.8
 259          * TCP uses a RST segment, DCCP a Reset packet with Code 2, "Aborted".
 260          */
 261         if (old_state == DCCP_LISTEN) {
 262                 inet_csk_listen_stop(sk);
 263         } else if (dccp_need_reset(old_state)) {
 264                 dccp_send_reset(sk, DCCP_RESET_CODE_ABORTED);
 265                 sk->sk_err = ECONNRESET;
 266         } else if (old_state == DCCP_REQUESTING)
 267                 sk->sk_err = ECONNRESET;
 268
 269         dccp_clear_xmit_timers(sk);
 270         ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
 271         dp->dccps_hc_rx_ccid = NULL;
 272
 273         __skb_queue_purge(&sk->sk_receive_queue);
 274         __skb_queue_purge(&sk->sk_write_queue);
 275         if (sk->sk_send_head != NULL) {
 276                 __kfree_skb(sk->sk_send_head);
 277                 sk->sk_send_head = NULL;
 278         }
 279
 280         inet->inet_dport = 0;
 281
 282         if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
 283                 inet_reset_saddr(sk);
 284
 285         sk->sk_shutdown = 0;
 286         sock_reset_flag(sk, SOCK_DONE);
 287
 288         icsk->icsk_backoff = 0;
 289         inet_csk_delack_init(sk);
 290         __sk_dst_reset(sk);
 291
 292         WARN_ON(inet->inet_num && !icsk->icsk_bind_hash);
 293
 294         sk_error_report(sk);
 295         return 0;
 296 }
 297
 298 EXPORT_SYMBOL_GPL(dccp_disconnect);
 299
 300 /*
 301  *      Wait for a DCCP event.
 302  *
 303  *      Note that we don't need to lock the socket, as the upper poll layers
 304  *      take care of normal races (between the test and the event) and we don't
 305  *      go look at any of the socket buffers directly.
 306  */
 307 __poll_t dccp_poll(struct file *file, struct socket *sock,
 308                        poll_table *wait)
 309 {
 310         __poll_t mask;
 311         struct sock *sk = sock->sk;
 312
 313         sock_poll_wait(file, sock, wait);
 314         if (sk->sk_state == DCCP_LISTEN)
 315                 return inet_csk_listen_poll(sk);
 316
 317         /* Socket is not locked. We are protected from async events
 318            by poll logic and correct handling of state changes
 319            made by another threads is impossible in any case.
 320          */
 321
 322         mask = 0;
 323         if (sk->sk_err)
 324                 mask = EPOLLERR;
 325
 326         if (sk->sk_shutdown == SHUTDOWN_MASK || sk->sk_state == DCCP_CLOSED)
 327                 mask |= EPOLLHUP;
 328         if (sk->sk_shutdown & RCV_SHUTDOWN)
 329                 mask |= EPOLLIN | EPOLLRDNORM | EPOLLRDHUP;
 330
 331         /* Connected? */
 332         if ((1 << sk->sk_state) & ~(DCCPF_REQUESTING | DCCPF_RESPOND)) {
 333                 if (atomic_read(&sk->sk_rmem_alloc) > 0)
 334                         mask |= EPOLLIN | EPOLLRDNORM;
 335
 336                 if (!(sk->sk_shutdown & SEND_SHUTDOWN)) {
 337                         if (sk_stream_is_writeable(sk)) {
 338                                 mask |= EPOLLOUT | EPOLLWRNORM;
 339                         } else {  /* send SIGIO later */
 340                                 sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk);
 341                                 set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 342
 343                                 /* Race breaker. If space is freed after
 344                                  * wspace test but before the flags are set,
 345                                  * IO signal will be lost.
 346                                  */
 347                                 if (sk_stream_is_writeable(sk))
 348                                         mask |= EPOLLOUT | EPOLLWRNORM;
 349                         }
 350                 }
 351         }
 352         return mask;
 353 }
 354
 355 EXPORT_SYMBOL_GPL(dccp_poll);
 356
 357 int dccp_ioctl(struct sock *sk, int cmd, unsigned long arg)
 358 {
 359         int rc = -ENOTCONN;
 360
 361         lock_sock(sk);
 362
 363         if (sk->sk_state == DCCP_LISTEN)
 364                 goto out;
 365
 366         switch (cmd) {
 367         case SIOCOUTQ: {
 368                 int amount = sk_wmem_alloc_get(sk);
 369                 /* Using sk_wmem_alloc here because sk_wmem_queued is not used by DCCP and
 370                  * always 0, comparably to UDP.
 371                  */
 372
 373                 rc = put_user(amount, (int __user *)arg);
 374         }
 375                 break;
 376         case SIOCINQ: {
 377                 struct sk_buff *skb;
 378                 unsigned long amount = 0;
 379
 380                 skb = skb_peek(&sk->sk_receive_queue);
 381                 if (skb != NULL) {
 382                         /*
 383                          * We will only return the amount of this packet since
 384                          * that is all that will be read.
 385                          */
 386                         amount = skb->len;
 387                 }
 388                 rc = put_user(amount, (int __user *)arg);
 389         }
 390                 break;
 391         default:
 392                 rc = -ENOIOCTLCMD;
 393                 break;
 394         }
 395 out:
 396         release_sock(sk);
 397         return rc;
 398 }
 399
 400 EXPORT_SYMBOL_GPL(dccp_ioctl);
 401
 402 static int dccp_setsockopt_service(struct sock *sk, const __be32 service,
 403                                    sockptr_t optval, unsigned int optlen)
 404 {
 405         struct dccp_sock *dp = dccp_sk(sk);
 406         struct dccp_service_list *sl = NULL;
 407
 408         if (service == DCCP_SERVICE_INVALID_VALUE ||
 409             optlen > DCCP_SERVICE_LIST_MAX_LEN * sizeof(u32))
 410                 return -EINVAL;
 411
 412         if (optlen > sizeof(service)) {
 413                 sl = kmalloc(optlen, GFP_KERNEL);
 414                 if (sl == NULL)
 415                         return -ENOMEM;
 416
 417                 sl->dccpsl_nr = optlen / sizeof(u32) - 1;
 418                 if (copy_from_sockptr_offset(sl->dccpsl_list, optval,
 419                                 sizeof(service), optlen - sizeof(service)) ||
 420                     dccp_list_has_service(sl, DCCP_SERVICE_INVALID_VALUE)) {
 421                         kfree(sl);
 422                         return -EFAULT;
 423                 }
 424         }
 425
 426         lock_sock(sk);
 427         dp->dccps_service = service;
 428
 429         kfree(dp->dccps_service_list);
 430
 431         dp->dccps_service_list = sl;
 432         release_sock(sk);
 433         return 0;
 434 }
 435
 436 static int dccp_setsockopt_cscov(struct sock *sk, int cscov, bool rx)
 437 {
 438         u8 *list, len;
 439         int i, rc;
 440
 441         if (cscov < 0 || cscov > 15)
 442                 return -EINVAL;
 443         /*
 444          * Populate a list of permissible values, in the range cscov...15. This
 445          * is necessary since feature negotiation of single values only works if
 446          * both sides incidentally choose the same value. Since the list starts
 447          * lowest-value first, negotiation will pick the smallest shared value.
 448          */
 449         if (cscov == 0)
 450                 return 0;
 451         len = 16 - cscov;
 452
 453         list = kmalloc(len, GFP_KERNEL);
 454         if (list == NULL)
 455                 return -ENOBUFS;
 456
 457         for (i = 0; i < len; i++)
 458                 list[i] = cscov++;
 459
 460         rc = dccp_feat_register_sp(sk, DCCPF_MIN_CSUM_COVER, rx, list, len);
 461
 462         if (rc == 0) {
 463                 if (rx)
 464                         dccp_sk(sk)->dccps_pcrlen = cscov;
 465                 else
 466                         dccp_sk(sk)->dccps_pcslen = cscov;
 467         }
 468         kfree(list);
 469         return rc;
 470 }
 471
 472 static int dccp_setsockopt_ccid(struct sock *sk, int type,
 473                                 sockptr_t optval, unsigned int optlen)
 474 {
 475         u8 *val;
 476         int rc = 0;
 477
 478         if (optlen < 1 || optlen > DCCP_FEAT_MAX_SP_VALS)
 479                 return -EINVAL;
 480
 481         val = memdup_sockptr(optval, optlen);
 482         if (IS_ERR(val))
 483                 return PTR_ERR(val);
 484
 485         lock_sock(sk);
 486         if (type == DCCP_SOCKOPT_TX_CCID || type == DCCP_SOCKOPT_CCID)
 487                 rc = dccp_feat_register_sp(sk, DCCPF_CCID, 1, val, optlen);
 488
 489         if (!rc && (type == DCCP_SOCKOPT_RX_CCID || type == DCCP_SOCKOPT_CCID))
 490                 rc = dccp_feat_register_sp(sk, DCCPF_CCID, 0, val, optlen);
 491         release_sock(sk);
 492
 493         kfree(val);
 494         return rc;
 495 }
 496
 497 static int do_dccp_setsockopt(struct sock *sk, int level, int optname,
 498                 sockptr_t optval, unsigned int optlen)
 499 {
 500         struct dccp_sock *dp = dccp_sk(sk);
 501         int val, err = 0;
 502
 503         switch (optname) {
 504         case DCCP_SOCKOPT_PACKET_SIZE:
 505                 DCCP_WARN("sockopt(PACKET_SIZE) is deprecated: fix your app\n");
 506                 return 0;
 507         case DCCP_SOCKOPT_CHANGE_L:
 508         case DCCP_SOCKOPT_CHANGE_R:
 509                 DCCP_WARN("sockopt(CHANGE_L/R) is deprecated: fix your app\n");
 510                 return 0;
 511         case DCCP_SOCKOPT_CCID:
 512         case DCCP_SOCKOPT_RX_CCID:
 513         case DCCP_SOCKOPT_TX_CCID:
 514                 return dccp_setsockopt_ccid(sk, optname, optval, optlen);
 515         }
 516
 517         if (optlen < (int)sizeof(int))
 518                 return -EINVAL;
 519
 520         if (copy_from_sockptr(&val, optval, sizeof(int)))
 521                 return -EFAULT;
 522
 523         if (optname == DCCP_SOCKOPT_SERVICE)
 524                 return dccp_setsockopt_service(sk, val, optval, optlen);
 525
 526         lock_sock(sk);
 527         switch (optname) {
 528         case DCCP_SOCKOPT_SERVER_TIMEWAIT:
 529                 if (dp->dccps_role != DCCP_ROLE_SERVER)
 530                         err = -EOPNOTSUPP;
 531                 else
 532                         dp->dccps_server_timewait = (val != 0);
 533                 break;
 534         case DCCP_SOCKOPT_SEND_CSCOV:
 535                 err = dccp_setsockopt_cscov(sk, val, false);
 536                 break;
 537         case DCCP_SOCKOPT_RECV_CSCOV:
 538                 err = dccp_setsockopt_cscov(sk, val, true);
 539                 break;
 540         case DCCP_SOCKOPT_QPOLICY_ID:
 541                 if (sk->sk_state != DCCP_CLOSED)
 542                         err = -EISCONN;
 543                 else if (val < 0 || val >= DCCPQ_POLICY_MAX)
 544                         err = -EINVAL;
 545                 else
 546                         dp->dccps_qpolicy = val;
 547                 break;
 548         case DCCP_SOCKOPT_QPOLICY_TXQLEN:
 549                 if (val < 0)
 550                         err = -EINVAL;
 551                 else
 552                         dp->dccps_tx_qlen = val;
 553                 break;
 554         default:
 555                 err = -ENOPROTOOPT;
 556                 break;
 557         }
 558         release_sock(sk);
 559
 560         return err;
 561 }
 562
 563 int dccp_setsockopt(struct sock *sk, int level, int optname, sockptr_t optval,
 564                     unsigned int optlen)
 565 {
 566         if (level != SOL_DCCP)
 567                 return inet_csk(sk)->icsk_af_ops->setsockopt(sk, level,
 568                                                              optname, optval,
 569                                                              optlen);
 570         return do_dccp_setsockopt(sk, level, optname, optval, optlen);
 571 }
 572
 573 EXPORT_SYMBOL_GPL(dccp_setsockopt);
 574
 575 static int dccp_getsockopt_service(struct sock *sk, int len,
 576                                    __be32 __user *optval,
 577                                    int __user *optlen)
 578 {
 579         const struct dccp_sock *dp = dccp_sk(sk);
 580         const struct dccp_service_list *sl;
 581         int err = -ENOENT, slen = 0, total_len = sizeof(u32);
 582
 583         lock_sock(sk);
 584         if ((sl = dp->dccps_service_list) != NULL) {
 585                 slen = sl->dccpsl_nr * sizeof(u32);
 586                 total_len += slen;
 587         }
 588
 589         err = -EINVAL;
 590         if (total_len > len)
 591                 goto out;
 592
 593         err = 0;
 594         if (put_user(total_len, optlen) ||
 595             put_user(dp->dccps_service, optval) ||
 596             (sl != NULL && copy_to_user(optval + 1, sl->dccpsl_list, slen)))
 597                 err = -EFAULT;
 598 out:
 599         release_sock(sk);
 600         return err;
 601 }
 602
 603 static int do_dccp_getsockopt(struct sock *sk, int level, int optname,
 604                     char __user *optval, int __user *optlen)
 605 {
 606         struct dccp_sock *dp;
 607         int val, len;
 608
 609         if (get_user(len, optlen))
 610                 return -EFAULT;
 611
 612         if (len < (int)sizeof(int))
 613                 return -EINVAL;
 614
 615         dp = dccp_sk(sk);
 616
 617         switch (optname) {
 618         case DCCP_SOCKOPT_PACKET_SIZE:
 619                 DCCP_WARN("sockopt(PACKET_SIZE) is deprecated: fix your app\n");
 620                 return 0;
 621         case DCCP_SOCKOPT_SERVICE:
 622                 return dccp_getsockopt_service(sk, len,
 623                                                (__be32 __user *)optval, optlen);
 624         case DCCP_SOCKOPT_GET_CUR_MPS:
 625                 val = dp->dccps_mss_cache;
 626                 break;
 627         case DCCP_SOCKOPT_AVAILABLE_CCIDS:
 628                 return ccid_getsockopt_builtin_ccids(sk, len, optval, optlen);
 629         case DCCP_SOCKOPT_TX_CCID:
 630                 val = ccid_get_current_tx_ccid(dp);
 631                 if (val < 0)
 632                         return -ENOPROTOOPT;
 633                 break;
 634         case DCCP_SOCKOPT_RX_CCID:
 635                 val = ccid_get_current_rx_ccid(dp);
 636                 if (val < 0)
 637                         return -ENOPROTOOPT;
 638                 break;
 639         case DCCP_SOCKOPT_SERVER_TIMEWAIT:
 640                 val = dp->dccps_server_timewait;
 641                 break;
 642         case DCCP_SOCKOPT_SEND_CSCOV:
 643                 val = dp->dccps_pcslen;
 644                 break;
 645         case DCCP_SOCKOPT_RECV_CSCOV:
 646                 val = dp->dccps_pcrlen;
 647                 break;
 648         case DCCP_SOCKOPT_QPOLICY_ID:
 649                 val = dp->dccps_qpolicy;
 650                 break;
 651         case DCCP_SOCKOPT_QPOLICY_TXQLEN:
 652                 val = dp->dccps_tx_qlen;
 653                 break;
 654         case 128 ... 191:
 655                 return ccid_hc_rx_getsockopt(dp->dccps_hc_rx_ccid, sk, optname,
 656                                              len, (u32 __user *)optval, optlen);
 657         case 192 ... 255:
 658                 return ccid_hc_tx_getsockopt(dp->dccps_hc_tx_ccid, sk, optname,
 659                                              len, (u32 __user *)optval, optlen);
 660         default:
 661                 return -ENOPROTOOPT;
 662         }
 663
 664         len = sizeof(val);
 665         if (put_user(len, optlen) || copy_to_user(optval, &val, len))
 666                 return -EFAULT;
 667
 668         return 0;
 669 }
 670
 671 int dccp_getsockopt(struct sock *sk, int level, int optname,
 672                     char __user *optval, int __user *optlen)
 673 {
 674         if (level != SOL_DCCP)
 675                 return inet_csk(sk)->icsk_af_ops->getsockopt(sk, level,
 676                                                              optname, optval,
 677                                                              optlen);
 678         return do_dccp_getsockopt(sk, level, optname, optval, optlen);
 679 }
 680
 681 EXPORT_SYMBOL_GPL(dccp_getsockopt);
 682
 683 static int dccp_msghdr_parse(struct msghdr *msg, struct sk_buff *skb)
 684 {
 685         struct cmsghdr *cmsg;
 686
 687         /*
 688          * Assign an (opaque) qpolicy priority value to skb->priority.
 689          *
 690          * We are overloading this skb field for use with the qpolicy subystem.
 691          * The skb->priority is normally used for the SO_PRIORITY option, which
 692          * is initialised from sk_priority. Since the assignment of sk_priority
 693          * to skb->priority happens later (on layer 3), we overload this field
 694          * for use with queueing priorities as long as the skb is on layer 4.
 695          * The default priority value (if nothing is set) is 0.
 696          */
 697         skb->priority = 0;
 698
 699         for_each_cmsghdr(cmsg, msg) {
 700                 if (!CMSG_OK(msg, cmsg))
 701                         return -EINVAL;
 702
 703                 if (cmsg->cmsg_level != SOL_DCCP)
 704                         continue;
 705
 706                 if (cmsg->cmsg_type <= DCCP_SCM_QPOLICY_MAX &&
 707                     !dccp_qpolicy_param_ok(skb->sk, cmsg->cmsg_type))
 708                         return -EINVAL;
 709
 710                 switch (cmsg->cmsg_type) {
 711                 case DCCP_SCM_PRIORITY:
 712                         if (cmsg->cmsg_len != CMSG_LEN(sizeof(__u32)))
 713                                 return -EINVAL;
 714                         skb->priority = *(__u32 *)CMSG_DATA(cmsg);
 715                         break;
 716                 default:
 717                         return -EINVAL;
 718                 }
 719         }
 720         return 0;
 721 }
 722
 723 int dccp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
 724 {
 725         const struct dccp_sock *dp = dccp_sk(sk);
 726         const int flags = msg->msg_flags;
 727         const int noblock = flags & MSG_DONTWAIT;
 728         struct sk_buff *skb;
 729         int rc, size;
 730         long timeo;
 731
 732         trace_dccp_probe(sk, len);
 733
 734         if (len > dp->dccps_mss_cache)
 735                 return -EMSGSIZE;
 736
 737         lock_sock(sk);
 738
 739         timeo = sock_sndtimeo(sk, noblock);
 740
 741         /*
 742          * We have to use sk_stream_wait_connect here to set sk_write_pending,
 743          * so that the trick in dccp_rcv_request_sent_state_process.
 744          */
 745         /* Wait for a connection to finish. */
 746         if ((1 << sk->sk_state) & ~(DCCPF_OPEN | DCCPF_PARTOPEN))
 747                 if ((rc = sk_stream_wait_connect(sk, &timeo)) != 0)
 748                         goto out_release;
 749
 750         size = sk->sk_prot->max_header + len;
 751         release_sock(sk);
 752         skb = sock_alloc_send_skb(sk, size, noblock, &rc);
 753         lock_sock(sk);
 754         if (skb == NULL)
 755                 goto out_release;
 756
 757         if (dccp_qpolicy_full(sk)) {
 758                 rc = -EAGAIN;
 759                 goto out_discard;
 760         }
 761
 762         if (sk->sk_state == DCCP_CLOSED) {
 763                 rc = -ENOTCONN;
 764                 goto out_discard;
 765         }
 766
 767         skb_reserve(skb, sk->sk_prot->max_header);
 768         rc = memcpy_from_msg(skb_put(skb, len), msg, len);
 769         if (rc != 0)
 770                 goto out_discard;
 771
 772         rc = dccp_msghdr_parse(msg, skb);
 773         if (rc != 0)
 774                 goto out_discard;
 775
 776         dccp_qpolicy_push(sk, skb);
 777         /*
 778          * The xmit_timer is set if the TX CCID is rate-based and will expire
 779          * when congestion control permits to release further packets into the
 780          * network. Window-based CCIDs do not use this timer.
 781          */
 782         if (!timer_pending(&dp->dccps_xmit_timer))
 783                 dccp_write_xmit(sk);
 784 out_release:
 785         release_sock(sk);
 786         return rc ? : len;
 787 out_discard:
 788         kfree_skb(skb);
 789         goto out_release;
 790 }
 791
 792 EXPORT_SYMBOL_GPL(dccp_sendmsg);
 793
 794 int dccp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int flags,
 795                  int *addr_len)
 796 {
 797         const struct dccp_hdr *dh;
 798         long timeo;
 799
 800         lock_sock(sk);
 801
 802         if (sk->sk_state == DCCP_LISTEN) {
 803                 len = -ENOTCONN;
 804                 goto out;
 805         }
 806
 807         timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
 808
 809         do {
 810                 struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);
 811
 812                 if (skb == NULL)
 813                         goto verify_sock_status;
 814
 815                 dh = dccp_hdr(skb);
 816
 817                 switch (dh->dccph_type) {
 818                 case DCCP_PKT_DATA:
 819                 case DCCP_PKT_DATAACK:
 820                         goto found_ok_skb;
 821
 822                 case DCCP_PKT_CLOSE:
 823                 case DCCP_PKT_CLOSEREQ:
 824                         if (!(flags & MSG_PEEK))
 825                                 dccp_finish_passive_close(sk);
 826                         fallthrough;
 827                 case DCCP_PKT_RESET:
 828                         dccp_pr_debug("found fin (%s) ok!\n",
 829                                       dccp_packet_name(dh->dccph_type));
 830                         len = 0;
 831                         goto found_fin_ok;
 832                 default:
 833                         dccp_pr_debug("packet_type=%s\n",
 834                                       dccp_packet_name(dh->dccph_type));
 835                         sk_eat_skb(sk, skb);
 836                 }
 837 verify_sock_status:
 838                 if (sock_flag(sk, SOCK_DONE)) {
 839                         len = 0;
 840                         break;
 841                 }
 842
 843                 if (sk->sk_err) {
 844                         len = sock_error(sk);
 845                         break;
 846                 }
 847
 848                 if (sk->sk_shutdown & RCV_SHUTDOWN) {
 849                         len = 0;
 850                         break;
 851                 }
 852
 853                 if (sk->sk_state == DCCP_CLOSED) {
 854                         if (!sock_flag(sk, SOCK_DONE)) {
 855                                 /* This occurs when user tries to read
 856                                  * from never connected socket.
 857                                  */
 858                                 len = -ENOTCONN;
 859                                 break;
 860                         }
 861                         len = 0;
 862                         break;
 863                 }
 864
 865                 if (!timeo) {
 866                         len = -EAGAIN;
 867                         break;
 868                 }
 869
 870                 if (signal_pending(current)) {
 871                         len = sock_intr_errno(timeo);
 872                         break;
 873                 }
 874
 875                 sk_wait_data(sk, &timeo, NULL);
 876                 continue;
 877         found_ok_skb:
 878                 if (len > skb->len)
 879                         len = skb->len;
 880                 else if (len < skb->len)
 881                         msg->msg_flags |= MSG_TRUNC;
 882
 883                 if (skb_copy_datagram_msg(skb, 0, msg, len)) {
 884                         /* Exception. Bailout! */
 885                         len = -EFAULT;
 886                         break;
 887                 }
 888                 if (flags & MSG_TRUNC)
 889                         len = skb->len;
 890         found_fin_ok:
 891                 if (!(flags & MSG_PEEK))
 892                         sk_eat_skb(sk, skb);
 893                 break;
 894         } while (1);
 895 out:
 896         release_sock(sk);
 897         return len;
 898 }
 899
 900 EXPORT_SYMBOL_GPL(dccp_recvmsg);
 901
 902 int inet_dccp_listen(struct socket *sock, int backlog)
 903 {
 904         struct sock *sk = sock->sk;
 905         unsigned char old_state;
 906         int err;
 907
 908         lock_sock(sk);
 909
 910         err = -EINVAL;
 911         if (sock->state != SS_UNCONNECTED || sock->type != SOCK_DCCP)
 912                 goto out;
 913
 914         old_state = sk->sk_state;
 915         if (!((1 << old_state) & (DCCPF_CLOSED | DCCPF_LISTEN)))
 916                 goto out;
 917
 918         WRITE_ONCE(sk->sk_max_ack_backlog, backlog);
 919         /* Really, if the socket is already in listen state
 920          * we can only allow the backlog to be adjusted.
 921          */
 922         if (old_state != DCCP_LISTEN) {
 923                 struct dccp_sock *dp = dccp_sk(sk);
 924
 925                 dp->dccps_role = DCCP_ROLE_LISTEN;
 926
 927                 /* do not start to listen if feature negotiation setup fails */
 928                 if (dccp_feat_finalise_settings(dp)) {
 929                         err = -EPROTO;
 930                         goto out;
 931                 }
 932
 933                 err = inet_csk_listen_start(sk);
 934                 if (err)
 935                         goto out;
 936         }
 937         err = 0;
 938
 939 out:
 940         release_sock(sk);
 941         return err;
 942 }
 943
 944 EXPORT_SYMBOL_GPL(inet_dccp_listen);
 945
 946 static void dccp_terminate_connection(struct sock *sk)
 947 {
 948         u8 next_state = DCCP_CLOSED;
 949
 950         switch (sk->sk_state) {
 951         case DCCP_PASSIVE_CLOSE:
 952         case DCCP_PASSIVE_CLOSEREQ:
 953                 dccp_finish_passive_close(sk);
 954                 break;
 955         case DCCP_PARTOPEN:
 956                 dccp_pr_debug("Stop PARTOPEN timer (%p)\n", sk);
 957                 inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK);
 958                 fallthrough;
 959         case DCCP_OPEN:
 960                 dccp_send_close(sk, 1);
 961
 962                 if (dccp_sk(sk)->dccps_role == DCCP_ROLE_SERVER &&
 963                     !dccp_sk(sk)->dccps_server_timewait)
 964                         next_state = DCCP_ACTIVE_CLOSEREQ;
 965                 else
 966                         next_state = DCCP_CLOSING;
 967                 fallthrough;
 968         default:
 969                 dccp_set_state(sk, next_state);
 970         }
 971 }
 972
 973 void dccp_close(struct sock *sk, long timeout)
 974 {
 975         struct dccp_sock *dp = dccp_sk(sk);
 976         struct sk_buff *skb;
 977         u32 data_was_unread = 0;
 978         int state;
 979
 980         lock_sock(sk);
 981
 982         sk->sk_shutdown = SHUTDOWN_MASK;
 983
 984         if (sk->sk_state == DCCP_LISTEN) {
 985                 dccp_set_state(sk, DCCP_CLOSED);
 986
 987                 /* Special case. */
 988                 inet_csk_listen_stop(sk);
 989
 990                 goto adjudge_to_death;
 991         }
 992
 993         sk_stop_timer(sk, &dp->dccps_xmit_timer);
 994
 995         /*
 996          * We need to flush the recv. buffs.  We do this only on the
 997          * descriptor close, not protocol-sourced closes, because the
 998           *reader process may not have drained the data yet!
 999          */
1000         while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) {
1001                 data_was_unread += skb->len;
1002                 __kfree_skb(skb);
1003         }
1004
1005         /* If socket has been already reset kill it. */
1006         if (sk->sk_state == DCCP_CLOSED)
1007                 goto adjudge_to_death;
1008
1009         if (data_was_unread) {
1010                 /* Unread data was tossed, send an appropriate Reset Code */
1011                 DCCP_WARN("ABORT with %u bytes unread\n", data_was_unread);
1012                 dccp_send_reset(sk, DCCP_RESET_CODE_ABORTED);
1013                 dccp_set_state(sk, DCCP_CLOSED);
1014         } else if (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime) {
1015                 /* Check zero linger _after_ checking for unread data. */
1016                 sk->sk_prot->disconnect(sk, 0);
1017         } else if (sk->sk_state != DCCP_CLOSED) {
1018                 /*
1019                  * Normal connection termination. May need to wait if there are
1020                  * still packets in the TX queue that are delayed by the CCID.
1021                  */
1022                 dccp_flush_write_queue(sk, &timeout);
1023                 dccp_terminate_connection(sk);
1024         }
1025
1026         /*
1027          * Flush write queue. This may be necessary in several cases:
1028          * - we have been closed by the peer but still have application data;
1029          * - abortive termination (unread data or zero linger time),
1030          * - normal termination but queue could not be flushed within time limit
1031          */
1032         __skb_queue_purge(&sk->sk_write_queue);
1033
1034         sk_stream_wait_close(sk, timeout);
1035
1036 adjudge_to_death:
1037         state = sk->sk_state;
1038         sock_hold(sk);
1039         sock_orphan(sk);
1040
1041         /*
1042          * It is the last release_sock in its life. It will remove backlog.
1043          */
1044         release_sock(sk);
1045         /*
1046          * Now socket is owned by kernel and we acquire BH lock
1047          * to finish close. No need to check for user refs.
1048          */
1049         local_bh_disable();
1050         bh_lock_sock(sk);
1051         WARN_ON(sock_owned_by_user(sk));
1052
1053         this_cpu_inc(dccp_orphan_count);
1054
1055         /* Have we already been destroyed by a softirq or backlog? */
1056         if (state != DCCP_CLOSED && sk->sk_state == DCCP_CLOSED)
1057                 goto out;
1058
1059         if (sk->sk_state == DCCP_CLOSED)
1060                 inet_csk_destroy_sock(sk);
1061
1062         /* Otherwise, socket is reprieved until protocol close. */
1063
1064 out:
1065         bh_unlock_sock(sk);
1066         local_bh_enable();
1067         sock_put(sk);
1068 }
1069
1070 EXPORT_SYMBOL_GPL(dccp_close);
1071
1072 void dccp_shutdown(struct sock *sk, int how)
1073 {
1074         dccp_pr_debug("called shutdown(%x)\n", how);
1075 }
1076
1077 EXPORT_SYMBOL_GPL(dccp_shutdown);
1078
1079 static inline int __init dccp_mib_init(void)
1080 {
1081         dccp_statistics = alloc_percpu(struct dccp_mib);
1082         if (!dccp_statistics)
1083                 return -ENOMEM;
1084         return 0;
1085 }
1086
1087 static inline void dccp_mib_exit(void)
1088 {
1089         free_percpu(dccp_statistics);
1090 }
1091
1092 static int thash_entries;
1093 module_param(thash_entries, int, 0444);
1094 MODULE_PARM_DESC(thash_entries, "Number of ehash buckets");
1095
1096 #ifdef CONFIG_IP_DCCP_DEBUG
1097 bool dccp_debug;
1098 module_param(dccp_debug, bool, 0644);
1099 MODULE_PARM_DESC(dccp_debug, "Enable debug messages");
1100
1101 EXPORT_SYMBOL_GPL(dccp_debug);
1102 #endif
1103
1104 static int __init dccp_init(void)
1105 {
1106         unsigned long goal;
1107         unsigned long nr_pages = totalram_pages();
1108         int ehash_order, bhash_order, i;
1109         int rc;
1110
1111         BUILD_BUG_ON(sizeof(struct dccp_skb_cb) >
1112                      sizeof_field(struct sk_buff, cb));
1113         rc = inet_hashinfo2_init_mod(&dccp_hashinfo);
1114         if (rc)
1115                 goto out_fail;
1116         rc = -ENOBUFS;
1117         dccp_hashinfo.bind_bucket_cachep =
1118                 kmem_cache_create("dccp_bind_bucket",
1119                                   sizeof(struct inet_bind_bucket), 0,
1120                                   SLAB_HWCACHE_ALIGN | SLAB_ACCOUNT, NULL);
1121         if (!dccp_hashinfo.bind_bucket_cachep)
1122                 goto out_free_hashinfo2;
1123
1124         /*
1125          * Size and allocate the main established and bind bucket
1126          * hash tables.
1127          *
1128          * The methodology is similar to that of the buffer cache.
1129          */
1130         if (nr_pages >= (128 * 1024))
1131                 goal = nr_pages >> (21 - PAGE_SHIFT);
1132         else
1133                 goal = nr_pages >> (23 - PAGE_SHIFT);
1134
1135         if (thash_entries)
1136                 goal = (thash_entries *
1137                         sizeof(struct inet_ehash_bucket)) >> PAGE_SHIFT;
1138         for (ehash_order = 0; (1UL << ehash_order) < goal; ehash_order++)
1139                 ;
1140         do {
1141                 unsigned long hash_size = (1UL << ehash_order) * PAGE_SIZE /
1142                                         sizeof(struct inet_ehash_bucket);
1143
1144                 while (hash_size & (hash_size - 1))
1145                         hash_size--;
1146                 dccp_hashinfo.ehash_mask = hash_size - 1;
1147                 dccp_hashinfo.ehash = (struct inet_ehash_bucket *)
1148                         __get_free_pages(GFP_ATOMIC|__GFP_NOWARN, ehash_order);
1149         } while (!dccp_hashinfo.ehash && --ehash_order > 0);
1150
1151         if (!dccp_hashinfo.ehash) {
1152                 DCCP_CRIT("Failed to allocate DCCP established hash table");
1153                 goto out_free_bind_bucket_cachep;
1154         }
1155
1156         for (i = 0; i <= dccp_hashinfo.ehash_mask; i++)
1157                 INIT_HLIST_NULLS_HEAD(&dccp_hashinfo.ehash[i].chain, i);
1158
1159         if (inet_ehash_locks_alloc(&dccp_hashinfo))
1160                         goto out_free_dccp_ehash;
1161
1162         bhash_order = ehash_order;
1163
1164         do {
1165                 dccp_hashinfo.bhash_size = (1UL << bhash_order) * PAGE_SIZE /
1166                                         sizeof(struct inet_bind_hashbucket);
1167                 if ((dccp_hashinfo.bhash_size > (64 * 1024)) &&
1168                     bhash_order > 0)
1169                         continue;
1170                 dccp_hashinfo.bhash = (struct inet_bind_hashbucket *)
1171                         __get_free_pages(GFP_ATOMIC|__GFP_NOWARN, bhash_order);
1172         } while (!dccp_hashinfo.bhash && --bhash_order >= 0);
1173
1174         if (!dccp_hashinfo.bhash) {
1175                 DCCP_CRIT("Failed to allocate DCCP bind hash table");
1176                 goto out_free_dccp_locks;
1177         }
1178
1179         for (i = 0; i < dccp_hashinfo.bhash_size; i++) {
1180                 spin_lock_init(&dccp_hashinfo.bhash[i].lock);
1181                 INIT_HLIST_HEAD(&dccp_hashinfo.bhash[i].chain);
1182         }
1183
1184         rc = dccp_mib_init();
1185         if (rc)
1186                 goto out_free_dccp_bhash;
1187
1188         rc = dccp_ackvec_init();
1189         if (rc)
1190                 goto out_free_dccp_mib;
1191
1192         rc = dccp_sysctl_init();
1193         if (rc)
1194                 goto out_ackvec_exit;
1195
1196         rc = ccid_initialize_builtins();
1197         if (rc)
1198                 goto out_sysctl_exit;
1199
1200         dccp_timestamping_init();
1201
1202         return 0;
1203
1204 out_sysctl_exit:
1205         dccp_sysctl_exit();
1206 out_ackvec_exit:
1207         dccp_ackvec_exit();
1208 out_free_dccp_mib:
1209         dccp_mib_exit();
1210 out_free_dccp_bhash:
1211         free_pages((unsigned long)dccp_hashinfo.bhash, bhash_order);
1212 out_free_dccp_locks:
1213         inet_ehash_locks_free(&dccp_hashinfo);
1214 out_free_dccp_ehash:
1215         free_pages((unsigned long)dccp_hashinfo.ehash, ehash_order);
1216 out_free_bind_bucket_cachep:
1217         kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
1218 out_free_hashinfo2:
1219         inet_hashinfo2_free_mod(&dccp_hashinfo);
1220 out_fail:
1221         dccp_hashinfo.bhash = NULL;
1222         dccp_hashinfo.ehash = NULL;
1223         dccp_hashinfo.bind_bucket_cachep = NULL;
1224         return rc;
1225 }
1226
1227 static void __exit dccp_fini(void)
1228 {
1229         ccid_cleanup_builtins();
1230         dccp_mib_exit();
1231         free_pages((unsigned long)dccp_hashinfo.bhash,
1232                    get_order(dccp_hashinfo.bhash_size *
1233                              sizeof(struct inet_bind_hashbucket)));
1234         free_pages((unsigned long)dccp_hashinfo.ehash,
1235                    get_order((dccp_hashinfo.ehash_mask + 1) *
1236                              sizeof(struct inet_ehash_bucket)));
1237         inet_ehash_locks_free(&dccp_hashinfo);
1238         kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
1239         dccp_ackvec_exit();
1240         dccp_sysctl_exit();
1241         inet_hashinfo2_free_mod(&dccp_hashinfo);
1242 }
1243
1244 module_init(dccp_init);
1245 module_exit(dccp_fini);
1246
1247 MODULE_LICENSE("GPL");
1248 MODULE_AUTHOR("Arnaldo Carvalho de Melo <acme@conectiva.com.br>");
1249 MODULE_DESCRIPTION("DCCP - Datagram Congestion Controlled Protocol");