ipv6: sctp: clone options to avoid use after free
[pandora-kernel.git] / net / sctp / ipv6.c
1 /* SCTP kernel implementation
2  * (C) Copyright IBM Corp. 2002, 2004
3  * Copyright (c) 2001 Nokia, Inc.
4  * Copyright (c) 2001 La Monte H.P. Yarroll
5  * Copyright (c) 2002-2003 Intel Corp.
6  *
7  * This file is part of the SCTP kernel implementation
8  *
9  * SCTP over IPv6.
10  *
11  * This SCTP implementation is free software;
12  * you can redistribute it and/or modify it under the terms of
13  * the GNU General Public License as published by
14  * the Free Software Foundation; either version 2, or (at your option)
15  * any later version.
16  *
17  * This SCTP implementation is distributed in the hope that it
18  * will be useful, but WITHOUT ANY WARRANTY; without even the implied
19  *                 ************************
20  * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
21  * See the GNU General Public License for more details.
22  *
23  * You should have received a copy of the GNU General Public License
24  * along with GNU CC; see the file COPYING.  If not, write to
25  * the Free Software Foundation, 59 Temple Place - Suite 330,
26  * Boston, MA 02111-1307, USA.
27  *
28  * Please send any bug reports or fixes you make to the
29  * email address(es):
30  *    lksctp developers <lksctp-developers@lists.sourceforge.net>
31  *
32  * Or submit a bug report through the following website:
33  *    http://www.sf.net/projects/lksctp
34  *
35  * Written or modified by:
36  *    Le Yanqun             <yanqun.le@nokia.com>
37  *    Hui Huang             <hui.huang@nokia.com>
38  *    La Monte H.P. Yarroll <piggy@acm.org>
39  *    Sridhar Samudrala     <sri@us.ibm.com>
40  *    Jon Grimm             <jgrimm@us.ibm.com>
41  *    Ardelle Fan           <ardelle.fan@intel.com>
42  *
43  * Based on:
44  *      linux/net/ipv6/tcp_ipv6.c
45  *
46  * Any bugs reported given to us we will try to fix... any fixes shared will
47  * be incorporated into the next SCTP release.
48  */
49
50 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
51
52 #include <linux/module.h>
53 #include <linux/errno.h>
54 #include <linux/types.h>
55 #include <linux/socket.h>
56 #include <linux/sockios.h>
57 #include <linux/net.h>
58 #include <linux/in.h>
59 #include <linux/in6.h>
60 #include <linux/netdevice.h>
61 #include <linux/init.h>
62 #include <linux/ipsec.h>
63 #include <linux/slab.h>
64
65 #include <linux/ipv6.h>
66 #include <linux/icmpv6.h>
67 #include <linux/random.h>
68 #include <linux/seq_file.h>
69
70 #include <net/protocol.h>
71 #include <net/ndisc.h>
72 #include <net/ip.h>
73 #include <net/ipv6.h>
74 #include <net/transp_v6.h>
75 #include <net/addrconf.h>
76 #include <net/ip6_route.h>
77 #include <net/inet_common.h>
78 #include <net/inet_ecn.h>
79 #include <net/sctp/sctp.h>
80
81 #include <asm/uaccess.h>
82
83 static inline int sctp_v6_addr_match_len(union sctp_addr *s1,
84                                          union sctp_addr *s2);
85 static void sctp_v6_to_addr(union sctp_addr *addr, struct in6_addr *saddr,
86                               __be16 port);
87 static int sctp_v6_cmp_addr(const union sctp_addr *addr1,
88                             const union sctp_addr *addr2);
89
90 /* Event handler for inet6 address addition/deletion events.
91  * The sctp_local_addr_list needs to be protocted by a spin lock since
92  * multiple notifiers (say IPv4 and IPv6) may be running at the same
93  * time and thus corrupt the list.
94  * The reader side is protected with RCU.
95  */
96 static int sctp_inet6addr_event(struct notifier_block *this, unsigned long ev,
97                                 void *ptr)
98 {
99         struct inet6_ifaddr *ifa = (struct inet6_ifaddr *)ptr;
100         struct sctp_sockaddr_entry *addr = NULL;
101         struct sctp_sockaddr_entry *temp;
102         int found = 0;
103
104         switch (ev) {
105         case NETDEV_UP:
106                 addr = kmalloc(sizeof(struct sctp_sockaddr_entry), GFP_ATOMIC);
107                 if (addr) {
108                         addr->a.v6.sin6_family = AF_INET6;
109                         addr->a.v6.sin6_port = 0;
110                         ipv6_addr_copy(&addr->a.v6.sin6_addr, &ifa->addr);
111                         addr->a.v6.sin6_scope_id = ifa->idev->dev->ifindex;
112                         addr->valid = 1;
113                         spin_lock_bh(&sctp_local_addr_lock);
114                         list_add_tail_rcu(&addr->list, &sctp_local_addr_list);
115                         sctp_addr_wq_mgmt(addr, SCTP_ADDR_NEW);
116                         spin_unlock_bh(&sctp_local_addr_lock);
117                 }
118                 break;
119         case NETDEV_DOWN:
120                 spin_lock_bh(&sctp_local_addr_lock);
121                 list_for_each_entry_safe(addr, temp,
122                                         &sctp_local_addr_list, list) {
123                         if (addr->a.sa.sa_family == AF_INET6 &&
124                                         ipv6_addr_equal(&addr->a.v6.sin6_addr,
125                                                 &ifa->addr)) {
126                                 sctp_addr_wq_mgmt(addr, SCTP_ADDR_DEL);
127                                 found = 1;
128                                 addr->valid = 0;
129                                 list_del_rcu(&addr->list);
130                                 break;
131                         }
132                 }
133                 spin_unlock_bh(&sctp_local_addr_lock);
134                 if (found)
135                         kfree_rcu(addr, rcu);
136                 break;
137         }
138
139         return NOTIFY_DONE;
140 }
141
142 static struct notifier_block sctp_inet6addr_notifier = {
143         .notifier_call = sctp_inet6addr_event,
144 };
145
146 /* ICMP error handler. */
147 SCTP_STATIC void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
148                              u8 type, u8 code, int offset, __be32 info)
149 {
150         struct inet6_dev *idev;
151         struct sock *sk;
152         struct sctp_association *asoc;
153         struct sctp_transport *transport;
154         struct ipv6_pinfo *np;
155         sk_buff_data_t saveip, savesctp;
156         int err;
157
158         idev = in6_dev_get(skb->dev);
159
160         /* Fix up skb to look at the embedded net header. */
161         saveip   = skb->network_header;
162         savesctp = skb->transport_header;
163         skb_reset_network_header(skb);
164         skb_set_transport_header(skb, offset);
165         sk = sctp_err_lookup(AF_INET6, skb, sctp_hdr(skb), &asoc, &transport);
166         /* Put back, the original pointers. */
167         skb->network_header   = saveip;
168         skb->transport_header = savesctp;
169         if (!sk) {
170                 ICMP6_INC_STATS_BH(dev_net(skb->dev), idev, ICMP6_MIB_INERRORS);
171                 goto out;
172         }
173
174         /* Warning:  The sock lock is held.  Remember to call
175          * sctp_err_finish!
176          */
177
178         switch (type) {
179         case ICMPV6_PKT_TOOBIG:
180                 sctp_icmp_frag_needed(sk, asoc, transport, ntohl(info));
181                 goto out_unlock;
182         case ICMPV6_PARAMPROB:
183                 if (ICMPV6_UNK_NEXTHDR == code) {
184                         sctp_icmp_proto_unreachable(sk, asoc, transport);
185                         goto out_unlock;
186                 }
187                 break;
188         default:
189                 break;
190         }
191
192         np = inet6_sk(sk);
193         icmpv6_err_convert(type, code, &err);
194         if (!sock_owned_by_user(sk) && np->recverr) {
195                 sk->sk_err = err;
196                 sk->sk_error_report(sk);
197         } else {  /* Only an error on timeout */
198                 sk->sk_err_soft = err;
199         }
200
201 out_unlock:
202         sctp_err_finish(sk, asoc);
203 out:
204         if (likely(idev != NULL))
205                 in6_dev_put(idev);
206 }
207
208 static int sctp_v6_xmit(struct sk_buff *skb, struct sctp_transport *transport)
209 {
210         struct sock *sk = skb->sk;
211         struct ipv6_pinfo *np = inet6_sk(sk);
212         struct flowi6 *fl6 = &transport->fl.u.ip6;
213
214         SCTP_DEBUG_PRINTK("%s: skb:%p, len:%d, src:%pI6 dst:%pI6\n",
215                           __func__, skb, skb->len,
216                           &fl6->saddr, &fl6->daddr);
217
218         IP6_ECN_flow_xmit(sk, fl6->flowlabel);
219
220         if (!(transport->param_flags & SPP_PMTUD_ENABLE))
221                 skb->local_df = 1;
222
223         SCTP_INC_STATS(SCTP_MIB_OUTSCTPPACKS);
224
225         return ip6_xmit(sk, skb, fl6, np->opt, np->tclass);
226 }
227
228 /* Returns the dst cache entry for the given source and destination ip
229  * addresses.
230  */
231 static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
232                             struct flowi *fl, struct sock *sk)
233 {
234         struct sctp_association *asoc = t->asoc;
235         struct dst_entry *dst = NULL;
236         struct flowi6 *fl6 = &fl->u.ip6;
237         struct sctp_bind_addr *bp;
238         struct ipv6_pinfo *np = inet6_sk(sk);
239         struct sctp_sockaddr_entry *laddr;
240         union sctp_addr *baddr = NULL;
241         union sctp_addr *daddr = &t->ipaddr;
242         union sctp_addr dst_saddr;
243         struct in6_addr *final_p, final;
244         __u8 matchlen = 0;
245         __u8 bmatchlen;
246         sctp_scope_t scope;
247
248         memset(fl6, 0, sizeof(struct flowi6));
249         ipv6_addr_copy(&fl6->daddr, &daddr->v6.sin6_addr);
250         fl6->fl6_dport = daddr->v6.sin6_port;
251         fl6->flowi6_proto = IPPROTO_SCTP;
252         if (ipv6_addr_type(&daddr->v6.sin6_addr) & IPV6_ADDR_LINKLOCAL)
253                 fl6->flowi6_oif = daddr->v6.sin6_scope_id;
254
255         SCTP_DEBUG_PRINTK("%s: DST=%pI6 ", __func__, &fl6->daddr);
256
257         if (asoc)
258                 fl6->fl6_sport = htons(asoc->base.bind_addr.port);
259
260         if (saddr) {
261                 ipv6_addr_copy(&fl6->saddr, &saddr->v6.sin6_addr);
262                 fl6->fl6_sport = saddr->v6.sin6_port;
263                 SCTP_DEBUG_PRINTK("SRC=%pI6 - ", &fl6->saddr);
264         }
265
266         final_p = fl6_update_dst(fl6, np->opt, &final);
267         dst = ip6_dst_lookup_flow(sk, fl6, final_p, false);
268         if (!asoc || saddr)
269                 goto out;
270
271         bp = &asoc->base.bind_addr;
272         scope = sctp_scope(daddr);
273         /* ip6_dst_lookup has filled in the fl6->saddr for us.  Check
274          * to see if we can use it.
275          */
276         if (!IS_ERR(dst)) {
277                 /* Walk through the bind address list and look for a bind
278                  * address that matches the source address of the returned dst.
279                  */
280                 sctp_v6_to_addr(&dst_saddr, &fl6->saddr, htons(bp->port));
281                 rcu_read_lock();
282                 list_for_each_entry_rcu(laddr, &bp->address_list, list) {
283                         if (!laddr->valid || (laddr->state != SCTP_ADDR_SRC))
284                                 continue;
285
286                         /* Do not compare against v4 addrs */
287                         if ((laddr->a.sa.sa_family == AF_INET6) &&
288                             (sctp_v6_cmp_addr(&dst_saddr, &laddr->a))) {
289                                 rcu_read_unlock();
290                                 goto out;
291                         }
292                 }
293                 rcu_read_unlock();
294                 /* None of the bound addresses match the source address of the
295                  * dst. So release it.
296                  */
297                 dst_release(dst);
298                 dst = NULL;
299         }
300
301         /* Walk through the bind address list and try to get the
302          * best source address for a given destination.
303          */
304         rcu_read_lock();
305         list_for_each_entry_rcu(laddr, &bp->address_list, list) {
306                 if (!laddr->valid && laddr->state != SCTP_ADDR_SRC)
307                         continue;
308                 if ((laddr->a.sa.sa_family == AF_INET6) &&
309                     (scope <= sctp_scope(&laddr->a))) {
310                         bmatchlen = sctp_v6_addr_match_len(daddr, &laddr->a);
311                         if (!baddr || (matchlen < bmatchlen)) {
312                                 baddr = &laddr->a;
313                                 matchlen = bmatchlen;
314                         }
315                 }
316         }
317         rcu_read_unlock();
318
319         if (baddr) {
320                 ipv6_addr_copy(&fl6->saddr, &baddr->v6.sin6_addr);
321                 fl6->fl6_sport = baddr->v6.sin6_port;
322                 final_p = fl6_update_dst(fl6, np->opt, &final);
323                 dst = ip6_dst_lookup_flow(sk, fl6, final_p, false);
324         }
325
326 out:
327         if (!IS_ERR(dst)) {
328                 struct rt6_info *rt;
329                 rt = (struct rt6_info *)dst;
330                 t->dst = dst;
331                 SCTP_DEBUG_PRINTK("rt6_dst:%pI6 rt6_src:%pI6\n",
332                         &rt->rt6i_dst.addr, &fl6->saddr);
333         } else {
334                 t->dst = NULL;
335                 SCTP_DEBUG_PRINTK("NO ROUTE\n");
336         }
337 }
338
339 /* Returns the number of consecutive initial bits that match in the 2 ipv6
340  * addresses.
341  */
342 static inline int sctp_v6_addr_match_len(union sctp_addr *s1,
343                                          union sctp_addr *s2)
344 {
345         return ipv6_addr_diff(&s1->v6.sin6_addr, &s2->v6.sin6_addr);
346 }
347
348 /* Fills in the source address(saddr) based on the destination address(daddr)
349  * and asoc's bind address list.
350  */
351 static void sctp_v6_get_saddr(struct sctp_sock *sk,
352                               struct sctp_transport *t,
353                               struct flowi *fl)
354 {
355         struct flowi6 *fl6 = &fl->u.ip6;
356         union sctp_addr *saddr = &t->saddr;
357
358         SCTP_DEBUG_PRINTK("%s: asoc:%p dst:%p\n", __func__, t->asoc, t->dst);
359
360         if (t->dst) {
361                 saddr->v6.sin6_family = AF_INET6;
362                 ipv6_addr_copy(&saddr->v6.sin6_addr, &fl6->saddr);
363         }
364 }
365
366 /* Make a copy of all potential local addresses. */
367 static void sctp_v6_copy_addrlist(struct list_head *addrlist,
368                                   struct net_device *dev)
369 {
370         struct inet6_dev *in6_dev;
371         struct inet6_ifaddr *ifp;
372         struct sctp_sockaddr_entry *addr;
373
374         rcu_read_lock();
375         if ((in6_dev = __in6_dev_get(dev)) == NULL) {
376                 rcu_read_unlock();
377                 return;
378         }
379
380         read_lock_bh(&in6_dev->lock);
381         list_for_each_entry(ifp, &in6_dev->addr_list, if_list) {
382                 /* Add the address to the local list.  */
383                 addr = t_new(struct sctp_sockaddr_entry, GFP_ATOMIC);
384                 if (addr) {
385                         addr->a.v6.sin6_family = AF_INET6;
386                         addr->a.v6.sin6_port = 0;
387                         ipv6_addr_copy(&addr->a.v6.sin6_addr, &ifp->addr);
388                         addr->a.v6.sin6_scope_id = dev->ifindex;
389                         addr->valid = 1;
390                         INIT_LIST_HEAD(&addr->list);
391                         list_add_tail(&addr->list, addrlist);
392                 }
393         }
394
395         read_unlock_bh(&in6_dev->lock);
396         rcu_read_unlock();
397 }
398
399 /* Initialize a sockaddr_storage from in incoming skb. */
400 static void sctp_v6_from_skb(union sctp_addr *addr,struct sk_buff *skb,
401                              int is_saddr)
402 {
403         void *from;
404         __be16 *port;
405         struct sctphdr *sh;
406
407         port = &addr->v6.sin6_port;
408         addr->v6.sin6_family = AF_INET6;
409         addr->v6.sin6_flowinfo = 0; /* FIXME */
410         addr->v6.sin6_scope_id = ((struct inet6_skb_parm *)skb->cb)->iif;
411
412         sh = sctp_hdr(skb);
413         if (is_saddr) {
414                 *port  = sh->source;
415                 from = &ipv6_hdr(skb)->saddr;
416         } else {
417                 *port = sh->dest;
418                 from = &ipv6_hdr(skb)->daddr;
419         }
420         ipv6_addr_copy(&addr->v6.sin6_addr, from);
421 }
422
423 /* Initialize an sctp_addr from a socket. */
424 static void sctp_v6_from_sk(union sctp_addr *addr, struct sock *sk)
425 {
426         addr->v6.sin6_family = AF_INET6;
427         addr->v6.sin6_port = 0;
428         ipv6_addr_copy(&addr->v6.sin6_addr, &inet6_sk(sk)->rcv_saddr);
429 }
430
431 /* Initialize sk->sk_rcv_saddr from sctp_addr. */
432 static void sctp_v6_to_sk_saddr(union sctp_addr *addr, struct sock *sk)
433 {
434         if (addr->sa.sa_family == AF_INET && sctp_sk(sk)->v4mapped) {
435                 inet6_sk(sk)->rcv_saddr.s6_addr32[0] = 0;
436                 inet6_sk(sk)->rcv_saddr.s6_addr32[1] = 0;
437                 inet6_sk(sk)->rcv_saddr.s6_addr32[2] = htonl(0x0000ffff);
438                 inet6_sk(sk)->rcv_saddr.s6_addr32[3] =
439                         addr->v4.sin_addr.s_addr;
440         } else {
441                 ipv6_addr_copy(&inet6_sk(sk)->rcv_saddr, &addr->v6.sin6_addr);
442         }
443 }
444
445 /* Initialize sk->sk_daddr from sctp_addr. */
446 static void sctp_v6_to_sk_daddr(union sctp_addr *addr, struct sock *sk)
447 {
448         if (addr->sa.sa_family == AF_INET && sctp_sk(sk)->v4mapped) {
449                 inet6_sk(sk)->daddr.s6_addr32[0] = 0;
450                 inet6_sk(sk)->daddr.s6_addr32[1] = 0;
451                 inet6_sk(sk)->daddr.s6_addr32[2] = htonl(0x0000ffff);
452                 inet6_sk(sk)->daddr.s6_addr32[3] = addr->v4.sin_addr.s_addr;
453         } else {
454                 ipv6_addr_copy(&inet6_sk(sk)->daddr, &addr->v6.sin6_addr);
455         }
456 }
457
458 /* Initialize a sctp_addr from an address parameter. */
459 static void sctp_v6_from_addr_param(union sctp_addr *addr,
460                                     union sctp_addr_param *param,
461                                     __be16 port, int iif)
462 {
463         addr->v6.sin6_family = AF_INET6;
464         addr->v6.sin6_port = port;
465         addr->v6.sin6_flowinfo = 0; /* BUG */
466         ipv6_addr_copy(&addr->v6.sin6_addr, &param->v6.addr);
467         addr->v6.sin6_scope_id = iif;
468 }
469
470 /* Initialize an address parameter from a sctp_addr and return the length
471  * of the address parameter.
472  */
473 static int sctp_v6_to_addr_param(const union sctp_addr *addr,
474                                  union sctp_addr_param *param)
475 {
476         int length = sizeof(sctp_ipv6addr_param_t);
477
478         param->v6.param_hdr.type = SCTP_PARAM_IPV6_ADDRESS;
479         param->v6.param_hdr.length = htons(length);
480         ipv6_addr_copy(&param->v6.addr, &addr->v6.sin6_addr);
481
482         return length;
483 }
484
485 /* Initialize a sctp_addr from struct in6_addr. */
486 static void sctp_v6_to_addr(union sctp_addr *addr, struct in6_addr *saddr,
487                               __be16 port)
488 {
489         addr->sa.sa_family = AF_INET6;
490         addr->v6.sin6_port = port;
491         ipv6_addr_copy(&addr->v6.sin6_addr, saddr);
492 }
493
494 /* Compare addresses exactly.
495  * v4-mapped-v6 is also in consideration.
496  */
497 static int sctp_v6_cmp_addr(const union sctp_addr *addr1,
498                             const union sctp_addr *addr2)
499 {
500         if (addr1->sa.sa_family != addr2->sa.sa_family) {
501                 if (addr1->sa.sa_family == AF_INET &&
502                     addr2->sa.sa_family == AF_INET6 &&
503                     ipv6_addr_v4mapped(&addr2->v6.sin6_addr)) {
504                         if (addr2->v6.sin6_port == addr1->v4.sin_port &&
505                             addr2->v6.sin6_addr.s6_addr32[3] ==
506                             addr1->v4.sin_addr.s_addr)
507                                 return 1;
508                 }
509                 if (addr2->sa.sa_family == AF_INET &&
510                     addr1->sa.sa_family == AF_INET6 &&
511                     ipv6_addr_v4mapped(&addr1->v6.sin6_addr)) {
512                         if (addr1->v6.sin6_port == addr2->v4.sin_port &&
513                             addr1->v6.sin6_addr.s6_addr32[3] ==
514                             addr2->v4.sin_addr.s_addr)
515                                 return 1;
516                 }
517                 return 0;
518         }
519         if (!ipv6_addr_equal(&addr1->v6.sin6_addr, &addr2->v6.sin6_addr))
520                 return 0;
521         /* If this is a linklocal address, compare the scope_id. */
522         if (ipv6_addr_type(&addr1->v6.sin6_addr) & IPV6_ADDR_LINKLOCAL) {
523                 if (addr1->v6.sin6_scope_id && addr2->v6.sin6_scope_id &&
524                     (addr1->v6.sin6_scope_id != addr2->v6.sin6_scope_id)) {
525                         return 0;
526                 }
527         }
528
529         return 1;
530 }
531
532 /* Initialize addr struct to INADDR_ANY. */
533 static void sctp_v6_inaddr_any(union sctp_addr *addr, __be16 port)
534 {
535         memset(addr, 0x00, sizeof(union sctp_addr));
536         addr->v6.sin6_family = AF_INET6;
537         addr->v6.sin6_port = port;
538 }
539
540 /* Is this a wildcard address? */
541 static int sctp_v6_is_any(const union sctp_addr *addr)
542 {
543         return ipv6_addr_any(&addr->v6.sin6_addr);
544 }
545
546 /* Should this be available for binding?   */
547 static int sctp_v6_available(union sctp_addr *addr, struct sctp_sock *sp)
548 {
549         int type;
550         const struct in6_addr *in6 = (const struct in6_addr *)&addr->v6.sin6_addr;
551
552         type = ipv6_addr_type(in6);
553         if (IPV6_ADDR_ANY == type)
554                 return 1;
555         if (type == IPV6_ADDR_MAPPED) {
556                 if (sp && !sp->v4mapped)
557                         return 0;
558                 if (sp && ipv6_only_sock(sctp_opt2sk(sp)))
559                         return 0;
560                 sctp_v6_map_v4(addr);
561                 return sctp_get_af_specific(AF_INET)->available(addr, sp);
562         }
563         if (!(type & IPV6_ADDR_UNICAST))
564                 return 0;
565
566         return ipv6_chk_addr(&init_net, in6, NULL, 0);
567 }
568
569 /* This function checks if the address is a valid address to be used for
570  * SCTP.
571  *
572  * Output:
573  * Return 0 - If the address is a non-unicast or an illegal address.
574  * Return 1 - If the address is a unicast.
575  */
576 static int sctp_v6_addr_valid(union sctp_addr *addr,
577                               struct sctp_sock *sp,
578                               const struct sk_buff *skb)
579 {
580         int ret = ipv6_addr_type(&addr->v6.sin6_addr);
581
582         /* Support v4-mapped-v6 address. */
583         if (ret == IPV6_ADDR_MAPPED) {
584                 /* Note: This routine is used in input, so v4-mapped-v6
585                  * are disallowed here when there is no sctp_sock.
586                  */
587                 if (!sp || !sp->v4mapped)
588                         return 0;
589                 if (sp && ipv6_only_sock(sctp_opt2sk(sp)))
590                         return 0;
591                 sctp_v6_map_v4(addr);
592                 return sctp_get_af_specific(AF_INET)->addr_valid(addr, sp, skb);
593         }
594
595         /* Is this a non-unicast address */
596         if (!(ret & IPV6_ADDR_UNICAST))
597                 return 0;
598
599         return 1;
600 }
601
602 /* What is the scope of 'addr'?  */
603 static sctp_scope_t sctp_v6_scope(union sctp_addr *addr)
604 {
605         int v6scope;
606         sctp_scope_t retval;
607
608         /* The IPv6 scope is really a set of bit fields.
609          * See IFA_* in <net/if_inet6.h>.  Map to a generic SCTP scope.
610          */
611
612         v6scope = ipv6_addr_scope(&addr->v6.sin6_addr);
613         switch (v6scope) {
614         case IFA_HOST:
615                 retval = SCTP_SCOPE_LOOPBACK;
616                 break;
617         case IFA_LINK:
618                 retval = SCTP_SCOPE_LINK;
619                 break;
620         case IFA_SITE:
621                 retval = SCTP_SCOPE_PRIVATE;
622                 break;
623         default:
624                 retval = SCTP_SCOPE_GLOBAL;
625                 break;
626         }
627
628         return retval;
629 }
630
631 /* Create and initialize a new sk for the socket to be returned by accept(). */
632 static struct sock *sctp_v6_create_accept_sk(struct sock *sk,
633                                              struct sctp_association *asoc)
634 {
635         struct sock *newsk;
636         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
637         struct sctp6_sock *newsctp6sk;
638         struct ipv6_txoptions *opt;
639
640         newsk = sk_alloc(sock_net(sk), PF_INET6, GFP_KERNEL, sk->sk_prot);
641         if (!newsk)
642                 goto out;
643
644         sock_init_data(NULL, newsk);
645
646         sctp_copy_sock(newsk, sk, asoc);
647         sock_reset_flag(sk, SOCK_ZAPPED);
648
649         newsctp6sk = (struct sctp6_sock *)newsk;
650         inet_sk(newsk)->pinet6 = &newsctp6sk->inet6;
651
652         sctp_sk(newsk)->v4mapped = sctp_sk(sk)->v4mapped;
653
654         newnp = inet6_sk(newsk);
655
656         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
657
658         rcu_read_lock();
659         opt = rcu_dereference(np->opt);
660         if (opt)
661                 opt = ipv6_dup_options(newsk, opt);
662         RCU_INIT_POINTER(newnp->opt, opt);
663         rcu_read_unlock();
664
665         /* Initialize sk's sport, dport, rcv_saddr and daddr for getsockname()
666          * and getpeername().
667          */
668         sctp_v6_to_sk_daddr(&asoc->peer.primary_addr, newsk);
669
670         sk_refcnt_debug_inc(newsk);
671
672         if (newsk->sk_prot->init(newsk)) {
673                 sk_common_release(newsk);
674                 newsk = NULL;
675         }
676
677 out:
678         return newsk;
679 }
680
681 /* Map v4 address to mapped v6 address */
682 static void sctp_v6_addr_v4map(struct sctp_sock *sp, union sctp_addr *addr)
683 {
684         if (sp->v4mapped && AF_INET == addr->sa.sa_family)
685                 sctp_v4_map_v6(addr);
686 }
687
688 /* Where did this skb come from?  */
689 static int sctp_v6_skb_iif(const struct sk_buff *skb)
690 {
691         struct inet6_skb_parm *opt = (struct inet6_skb_parm *) skb->cb;
692         return opt->iif;
693 }
694
695 /* Was this packet marked by Explicit Congestion Notification? */
696 static int sctp_v6_is_ce(const struct sk_buff *skb)
697 {
698         return *((__u32 *)(ipv6_hdr(skb))) & htonl(1 << 20);
699 }
700
701 /* Dump the v6 addr to the seq file. */
702 static void sctp_v6_seq_dump_addr(struct seq_file *seq, union sctp_addr *addr)
703 {
704         seq_printf(seq, "%pI6 ", &addr->v6.sin6_addr);
705 }
706
707 static void sctp_v6_ecn_capable(struct sock *sk)
708 {
709         inet6_sk(sk)->tclass |= INET_ECN_ECT_0;
710 }
711
712 /* Initialize a PF_INET6 socket msg_name. */
713 static void sctp_inet6_msgname(char *msgname, int *addr_len)
714 {
715         struct sockaddr_in6 *sin6;
716
717         sin6 = (struct sockaddr_in6 *)msgname;
718         sin6->sin6_family = AF_INET6;
719         sin6->sin6_flowinfo = 0;
720         sin6->sin6_scope_id = 0; /*FIXME */
721         *addr_len = sizeof(struct sockaddr_in6);
722 }
723
724 /* Initialize a PF_INET msgname from a ulpevent. */
725 static void sctp_inet6_event_msgname(struct sctp_ulpevent *event,
726                                      char *msgname, int *addrlen)
727 {
728         struct sockaddr_in6 *sin6, *sin6from;
729
730         if (msgname) {
731                 union sctp_addr *addr;
732                 struct sctp_association *asoc;
733
734                 asoc = event->asoc;
735                 sctp_inet6_msgname(msgname, addrlen);
736                 sin6 = (struct sockaddr_in6 *)msgname;
737                 sin6->sin6_port = htons(asoc->peer.port);
738                 addr = &asoc->peer.primary_addr;
739
740                 /* Note: If we go to a common v6 format, this code
741                  * will change.
742                  */
743
744                 /* Map ipv4 address into v4-mapped-on-v6 address.  */
745                 if (sctp_sk(asoc->base.sk)->v4mapped &&
746                     AF_INET == addr->sa.sa_family) {
747                         sctp_v4_map_v6((union sctp_addr *)sin6);
748                         sin6->sin6_addr.s6_addr32[3] =
749                                 addr->v4.sin_addr.s_addr;
750                         return;
751                 }
752
753                 sin6from = &asoc->peer.primary_addr.v6;
754                 ipv6_addr_copy(&sin6->sin6_addr, &sin6from->sin6_addr);
755                 if (ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_LINKLOCAL)
756                         sin6->sin6_scope_id = sin6from->sin6_scope_id;
757         }
758 }
759
760 /* Initialize a msg_name from an inbound skb. */
761 static void sctp_inet6_skb_msgname(struct sk_buff *skb, char *msgname,
762                                    int *addr_len)
763 {
764         struct sctphdr *sh;
765         struct sockaddr_in6 *sin6;
766
767         if (msgname) {
768                 sctp_inet6_msgname(msgname, addr_len);
769                 sin6 = (struct sockaddr_in6 *)msgname;
770                 sh = sctp_hdr(skb);
771                 sin6->sin6_port = sh->source;
772
773                 /* Map ipv4 address into v4-mapped-on-v6 address. */
774                 if (sctp_sk(skb->sk)->v4mapped &&
775                     ip_hdr(skb)->version == 4) {
776                         sctp_v4_map_v6((union sctp_addr *)sin6);
777                         sin6->sin6_addr.s6_addr32[3] = ip_hdr(skb)->saddr;
778                         return;
779                 }
780
781                 /* Otherwise, just copy the v6 address. */
782                 ipv6_addr_copy(&sin6->sin6_addr, &ipv6_hdr(skb)->saddr);
783                 if (ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_LINKLOCAL) {
784                         struct sctp_ulpevent *ev = sctp_skb2event(skb);
785                         sin6->sin6_scope_id = ev->iif;
786                 }
787         }
788 }
789
790 /* Do we support this AF? */
791 static int sctp_inet6_af_supported(sa_family_t family, struct sctp_sock *sp)
792 {
793         switch (family) {
794         case AF_INET6:
795                 return 1;
796         /* v4-mapped-v6 addresses */
797         case AF_INET:
798                 if (!__ipv6_only_sock(sctp_opt2sk(sp)))
799                         return 1;
800         default:
801                 return 0;
802         }
803 }
804
805 /* Address matching with wildcards allowed.  This extra level
806  * of indirection lets us choose whether a PF_INET6 should
807  * disallow any v4 addresses if we so choose.
808  */
809 static int sctp_inet6_cmp_addr(const union sctp_addr *addr1,
810                                const union sctp_addr *addr2,
811                                struct sctp_sock *opt)
812 {
813         struct sctp_af *af1, *af2;
814         struct sock *sk = sctp_opt2sk(opt);
815
816         af1 = sctp_get_af_specific(addr1->sa.sa_family);
817         af2 = sctp_get_af_specific(addr2->sa.sa_family);
818
819         if (!af1 || !af2)
820                 return 0;
821
822         /* If the socket is IPv6 only, v4 addrs will not match */
823         if (__ipv6_only_sock(sk) && af1 != af2)
824                 return 0;
825
826         /* Today, wildcard AF_INET/AF_INET6. */
827         if (sctp_is_any(sk, addr1) || sctp_is_any(sk, addr2))
828                 return 1;
829
830         if (addr1->sa.sa_family != addr2->sa.sa_family)
831                 return 0;
832
833         return af1->cmp_addr(addr1, addr2);
834 }
835
836 /* Verify that the provided sockaddr looks bindable.   Common verification,
837  * has already been taken care of.
838  */
839 static int sctp_inet6_bind_verify(struct sctp_sock *opt, union sctp_addr *addr)
840 {
841         struct sctp_af *af;
842
843         /* ASSERT: address family has already been verified. */
844         if (addr->sa.sa_family != AF_INET6)
845                 af = sctp_get_af_specific(addr->sa.sa_family);
846         else {
847                 int type = ipv6_addr_type(&addr->v6.sin6_addr);
848                 struct net_device *dev;
849
850                 if (type & IPV6_ADDR_LINKLOCAL) {
851                         if (!addr->v6.sin6_scope_id)
852                                 return 0;
853                         rcu_read_lock();
854                         dev = dev_get_by_index_rcu(&init_net,
855                                                    addr->v6.sin6_scope_id);
856                         if (!dev ||
857                             !ipv6_chk_addr(&init_net, &addr->v6.sin6_addr,
858                                            dev, 0)) {
859                                 rcu_read_unlock();
860                                 return 0;
861                         }
862                         rcu_read_unlock();
863                 } else if (type == IPV6_ADDR_MAPPED) {
864                         if (!opt->v4mapped)
865                                 return 0;
866                 }
867
868                 af = opt->pf->af;
869         }
870         return af->available(addr, opt);
871 }
872
873 /* Verify that the provided sockaddr looks sendable.   Common verification,
874  * has already been taken care of.
875  */
876 static int sctp_inet6_send_verify(struct sctp_sock *opt, union sctp_addr *addr)
877 {
878         struct sctp_af *af = NULL;
879
880         /* ASSERT: address family has already been verified. */
881         if (addr->sa.sa_family != AF_INET6)
882                 af = sctp_get_af_specific(addr->sa.sa_family);
883         else {
884                 int type = ipv6_addr_type(&addr->v6.sin6_addr);
885                 struct net_device *dev;
886
887                 if (type & IPV6_ADDR_LINKLOCAL) {
888                         if (!addr->v6.sin6_scope_id)
889                                 return 0;
890                         rcu_read_lock();
891                         dev = dev_get_by_index_rcu(&init_net,
892                                                    addr->v6.sin6_scope_id);
893                         rcu_read_unlock();
894                         if (!dev)
895                                 return 0;
896                 }
897                 af = opt->pf->af;
898         }
899
900         return af != NULL;
901 }
902
903 /* Fill in Supported Address Type information for INIT and INIT-ACK
904  * chunks.   Note: In the future, we may want to look at sock options
905  * to determine whether a PF_INET6 socket really wants to have IPV4
906  * addresses.
907  * Returns number of addresses supported.
908  */
909 static int sctp_inet6_supported_addrs(const struct sctp_sock *opt,
910                                       __be16 *types)
911 {
912         types[0] = SCTP_PARAM_IPV6_ADDRESS;
913         if (!opt || !ipv6_only_sock(sctp_opt2sk(opt))) {
914                 types[1] = SCTP_PARAM_IPV4_ADDRESS;
915                 return 2;
916         }
917         return 1;
918 }
919
920 static const struct proto_ops inet6_seqpacket_ops = {
921         .family            = PF_INET6,
922         .owner             = THIS_MODULE,
923         .release           = inet6_release,
924         .bind              = inet6_bind,
925         .connect           = inet_dgram_connect,
926         .socketpair        = sock_no_socketpair,
927         .accept            = inet_accept,
928         .getname           = inet6_getname,
929         .poll              = sctp_poll,
930         .ioctl             = inet6_ioctl,
931         .listen            = sctp_inet_listen,
932         .shutdown          = inet_shutdown,
933         .setsockopt        = sock_common_setsockopt,
934         .getsockopt        = sock_common_getsockopt,
935         .sendmsg           = inet_sendmsg,
936         .recvmsg           = sock_common_recvmsg,
937         .mmap              = sock_no_mmap,
938 #ifdef CONFIG_COMPAT
939         .compat_setsockopt = compat_sock_common_setsockopt,
940         .compat_getsockopt = compat_sock_common_getsockopt,
941 #endif
942 };
943
944 static struct inet_protosw sctpv6_seqpacket_protosw = {
945         .type          = SOCK_SEQPACKET,
946         .protocol      = IPPROTO_SCTP,
947         .prot          = &sctpv6_prot,
948         .ops           = &inet6_seqpacket_ops,
949         .no_check      = 0,
950         .flags         = SCTP_PROTOSW_FLAG
951 };
952 static struct inet_protosw sctpv6_stream_protosw = {
953         .type          = SOCK_STREAM,
954         .protocol      = IPPROTO_SCTP,
955         .prot          = &sctpv6_prot,
956         .ops           = &inet6_seqpacket_ops,
957         .no_check      = 0,
958         .flags         = SCTP_PROTOSW_FLAG,
959 };
960
961 static int sctp6_rcv(struct sk_buff *skb)
962 {
963         return sctp_rcv(skb) ? -1 : 0;
964 }
965
966 static const struct inet6_protocol sctpv6_protocol = {
967         .handler      = sctp6_rcv,
968         .err_handler  = sctp_v6_err,
969         .flags        = INET6_PROTO_NOPOLICY | INET6_PROTO_FINAL,
970 };
971
972 static struct sctp_af sctp_af_inet6 = {
973         .sa_family         = AF_INET6,
974         .sctp_xmit         = sctp_v6_xmit,
975         .setsockopt        = ipv6_setsockopt,
976         .getsockopt        = ipv6_getsockopt,
977         .get_dst           = sctp_v6_get_dst,
978         .get_saddr         = sctp_v6_get_saddr,
979         .copy_addrlist     = sctp_v6_copy_addrlist,
980         .from_skb          = sctp_v6_from_skb,
981         .from_sk           = sctp_v6_from_sk,
982         .to_sk_saddr       = sctp_v6_to_sk_saddr,
983         .to_sk_daddr       = sctp_v6_to_sk_daddr,
984         .from_addr_param   = sctp_v6_from_addr_param,
985         .to_addr_param     = sctp_v6_to_addr_param,
986         .cmp_addr          = sctp_v6_cmp_addr,
987         .scope             = sctp_v6_scope,
988         .addr_valid        = sctp_v6_addr_valid,
989         .inaddr_any        = sctp_v6_inaddr_any,
990         .is_any            = sctp_v6_is_any,
991         .available         = sctp_v6_available,
992         .skb_iif           = sctp_v6_skb_iif,
993         .is_ce             = sctp_v6_is_ce,
994         .seq_dump_addr     = sctp_v6_seq_dump_addr,
995         .ecn_capable       = sctp_v6_ecn_capable,
996         .net_header_len    = sizeof(struct ipv6hdr),
997         .sockaddr_len      = sizeof(struct sockaddr_in6),
998 #ifdef CONFIG_COMPAT
999         .compat_setsockopt = compat_ipv6_setsockopt,
1000         .compat_getsockopt = compat_ipv6_getsockopt,
1001 #endif
1002 };
1003
1004 static struct sctp_pf sctp_pf_inet6 = {
1005         .event_msgname = sctp_inet6_event_msgname,
1006         .skb_msgname   = sctp_inet6_skb_msgname,
1007         .af_supported  = sctp_inet6_af_supported,
1008         .cmp_addr      = sctp_inet6_cmp_addr,
1009         .bind_verify   = sctp_inet6_bind_verify,
1010         .send_verify   = sctp_inet6_send_verify,
1011         .supported_addrs = sctp_inet6_supported_addrs,
1012         .create_accept_sk = sctp_v6_create_accept_sk,
1013         .addr_v4map    = sctp_v6_addr_v4map,
1014         .af            = &sctp_af_inet6,
1015 };
1016
1017 /* Initialize IPv6 support and register with socket layer.  */
1018 void sctp_v6_pf_init(void)
1019 {
1020         /* Register the SCTP specific PF_INET6 functions. */
1021         sctp_register_pf(&sctp_pf_inet6, PF_INET6);
1022
1023         /* Register the SCTP specific AF_INET6 functions. */
1024         sctp_register_af(&sctp_af_inet6);
1025 }
1026
1027 void sctp_v6_pf_exit(void)
1028 {
1029         list_del(&sctp_af_inet6.list);
1030 }
1031
1032 /* Initialize IPv6 support and register with socket layer.  */
1033 int sctp_v6_protosw_init(void)
1034 {
1035         int rc;
1036
1037         rc = proto_register(&sctpv6_prot, 1);
1038         if (rc)
1039                 return rc;
1040
1041         /* Add SCTPv6(UDP and TCP style) to inetsw6 linked list. */
1042         inet6_register_protosw(&sctpv6_seqpacket_protosw);
1043         inet6_register_protosw(&sctpv6_stream_protosw);
1044
1045         return 0;
1046 }
1047
1048 void sctp_v6_protosw_exit(void)
1049 {
1050         inet6_unregister_protosw(&sctpv6_seqpacket_protosw);
1051         inet6_unregister_protosw(&sctpv6_stream_protosw);
1052         proto_unregister(&sctpv6_prot);
1053 }
1054
1055
1056 /* Register with inet6 layer. */
1057 int sctp_v6_add_protocol(void)
1058 {
1059         /* Register notifier for inet6 address additions/deletions. */
1060         register_inet6addr_notifier(&sctp_inet6addr_notifier);
1061
1062         if (inet6_add_protocol(&sctpv6_protocol, IPPROTO_SCTP) < 0)
1063                 return -EAGAIN;
1064
1065         return 0;
1066 }
1067
1068 /* Unregister with inet6 layer. */
1069 void sctp_v6_del_protocol(void)
1070 {
1071         inet6_del_protocol(&sctpv6_protocol, IPPROTO_SCTP);
1072         unregister_inet6addr_notifier(&sctp_inet6addr_notifier);
1073 }