dccp: Silently ignore options with nonsensical lengths
[safe/jmp/linux-2.6] / net / dccp / options.c
1 /*
2  *  net/dccp/options.c
3  *
4  *  An implementation of the DCCP protocol
5  *  Copyright (c) 2005 Aristeu Sergio Rozanski Filho <aris@cathedrallabs.org>
6  *  Copyright (c) 2005 Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
7  *  Copyright (c) 2005 Ian McDonald <ian.mcdonald@jandi.co.nz>
8  *
9  *      This program is free software; you can redistribute it and/or
10  *      modify it under the terms of the GNU General Public License
11  *      as published by the Free Software Foundation; either version
12  *      2 of the License, or (at your option) any later version.
13  */
14 #include <linux/dccp.h>
15 #include <linux/module.h>
16 #include <linux/types.h>
17 #include <asm/unaligned.h>
18 #include <linux/kernel.h>
19 #include <linux/skbuff.h>
20
21 #include "ackvec.h"
22 #include "ccid.h"
23 #include "dccp.h"
24 #include "feat.h"
25
26 int sysctl_dccp_feat_sequence_window = DCCPF_INITIAL_SEQUENCE_WINDOW;
27 int sysctl_dccp_feat_rx_ccid          = DCCPF_INITIAL_CCID;
28 int sysctl_dccp_feat_tx_ccid          = DCCPF_INITIAL_CCID;
29 int sysctl_dccp_feat_ack_ratio        = DCCPF_INITIAL_ACK_RATIO;
30 int sysctl_dccp_feat_send_ack_vector = DCCPF_INITIAL_SEND_ACK_VECTOR;
31 int sysctl_dccp_feat_send_ndp_count  = DCCPF_INITIAL_SEND_NDP_COUNT;
32
33 static u32 dccp_decode_value_var(const unsigned char *bf, const u8 len)
34 {
35         u32 value = 0;
36
37         if (len > 3)
38                 value += *bf++ << 24;
39         if (len > 2)
40                 value += *bf++ << 16;
41         if (len > 1)
42                 value += *bf++ << 8;
43         if (len > 0)
44                 value += *bf;
45
46         return value;
47 }
48
49 /**
50  * dccp_parse_options  -  Parse DCCP options present in @skb
51  * @sk: client|server|listening dccp socket (when @dreq != NULL)
52  * @dreq: request socket to use during connection setup, or NULL
53  */
54 int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq,
55                        struct sk_buff *skb)
56 {
57         struct dccp_sock *dp = dccp_sk(sk);
58         const struct dccp_hdr *dh = dccp_hdr(skb);
59         const u8 pkt_type = DCCP_SKB_CB(skb)->dccpd_type;
60         u64 ackno = DCCP_SKB_CB(skb)->dccpd_ack_seq;
61         unsigned char *options = (unsigned char *)dh + dccp_hdr_len(skb);
62         unsigned char *opt_ptr = options;
63         const unsigned char *opt_end = (unsigned char *)dh +
64                                         (dh->dccph_doff * 4);
65         struct dccp_options_received *opt_recv = &dp->dccps_options_received;
66         unsigned char opt, len;
67         unsigned char *value;
68         u32 elapsed_time;
69         __be32 opt_val;
70         int rc;
71         int mandatory = 0;
72
73         memset(opt_recv, 0, sizeof(*opt_recv));
74
75         opt = len = 0;
76         while (opt_ptr != opt_end) {
77                 opt   = *opt_ptr++;
78                 len   = 0;
79                 value = NULL;
80
81                 /* Check if this isn't a single byte option */
82                 if (opt > DCCPO_MAX_RESERVED) {
83                         if (opt_ptr == opt_end)
84                                 goto out_nonsensical_length;
85
86                         len = *opt_ptr++;
87                         if (len < 2)
88                                 goto out_nonsensical_length;
89                         /*
90                          * Remove the type and len fields, leaving
91                          * just the value size
92                          */
93                         len     -= 2;
94                         value   = opt_ptr;
95                         opt_ptr += len;
96
97                         if (opt_ptr > opt_end)
98                                 goto out_nonsensical_length;
99                 }
100
101                 /*
102                  * CCID-Specific Options (from RFC 4340, sec. 10.3):
103                  *
104                  * Option numbers 128 through 191 are for options sent from the
105                  * HC-Sender to the HC-Receiver; option numbers 192 through 255
106                  * are for options sent from the HC-Receiver to the HC-Sender.
107                  *
108                  * CCID-specific options are ignored during connection setup, as
109                  * negotiation may still be in progress (see RFC 4340, 10.3).
110                  * The same applies to Ack Vectors, as these depend on the CCID.
111                  *
112                  */
113                 if (dreq != NULL && (opt >= 128 ||
114                     opt == DCCPO_ACK_VECTOR_0 || opt == DCCPO_ACK_VECTOR_1))
115                         goto ignore_option;
116
117                 switch (opt) {
118                 case DCCPO_PADDING:
119                         break;
120                 case DCCPO_MANDATORY:
121                         if (mandatory)
122                                 goto out_invalid_option;
123                         if (pkt_type != DCCP_PKT_DATA)
124                                 mandatory = 1;
125                         break;
126                 case DCCPO_NDP_COUNT:
127                         if (len > 6)
128                                 goto out_invalid_option;
129
130                         opt_recv->dccpor_ndp = dccp_decode_value_var(value, len);
131                         dccp_pr_debug("%s opt: NDP count=%llu\n", dccp_role(sk),
132                                       (unsigned long long)opt_recv->dccpor_ndp);
133                         break;
134                 case DCCPO_CHANGE_L:
135                         /* fall through */
136                 case DCCPO_CHANGE_R:
137                         if (pkt_type == DCCP_PKT_DATA)
138                                 break;
139                         if (len < 2)
140                                 goto out_invalid_option;
141                         rc = dccp_feat_change_recv(sk, opt, *value, value + 1,
142                                                    len - 1);
143                         /*
144                          * When there is a change error, change_recv is
145                          * responsible for dealing with it.  i.e. reply with an
146                          * empty confirm.
147                          * If the change was mandatory, then we need to die.
148                          */
149                         if (rc && mandatory)
150                                 goto out_invalid_option;
151                         break;
152                 case DCCPO_CONFIRM_L:
153                         /* fall through */
154                 case DCCPO_CONFIRM_R:
155                         if (pkt_type == DCCP_PKT_DATA)
156                                 break;
157                         if (len < 2)    /* FIXME this disallows empty confirm */
158                                 goto out_invalid_option;
159                         if (dccp_feat_confirm_recv(sk, opt, *value,
160                                                    value + 1, len - 1))
161                                 goto out_invalid_option;
162                         break;
163                 case DCCPO_ACK_VECTOR_0:
164                 case DCCPO_ACK_VECTOR_1:
165                         if (dccp_packet_without_ack(skb))   /* RFC 4340, 11.4 */
166                                 break;
167
168                         if (dccp_msk(sk)->dccpms_send_ack_vector &&
169                             dccp_ackvec_parse(sk, skb, &ackno, opt, value, len))
170                                 goto out_invalid_option;
171                         break;
172                 case DCCPO_TIMESTAMP:
173                         if (len != 4)
174                                 goto out_invalid_option;
175                         /*
176                          * RFC 4340 13.1: "The precise time corresponding to
177                          * Timestamp Value zero is not specified". We use
178                          * zero to indicate absence of a meaningful timestamp.
179                          */
180                         opt_val = get_unaligned((__be32 *)value);
181                         if (unlikely(opt_val == 0)) {
182                                 DCCP_WARN("Timestamp with zero value\n");
183                                 break;
184                         }
185
186                         if (dreq != NULL) {
187                                 dreq->dreq_timestamp_echo = ntohl(opt_val);
188                                 dreq->dreq_timestamp_time = dccp_timestamp();
189                         } else {
190                                 opt_recv->dccpor_timestamp =
191                                         dp->dccps_timestamp_echo = ntohl(opt_val);
192                                 dp->dccps_timestamp_time = dccp_timestamp();
193                         }
194                         dccp_pr_debug("%s rx opt: TIMESTAMP=%u, ackno=%llu\n",
195                                       dccp_role(sk), ntohl(opt_val),
196                                       (unsigned long long)
197                                       DCCP_SKB_CB(skb)->dccpd_ack_seq);
198                         break;
199                 case DCCPO_TIMESTAMP_ECHO:
200                         if (len != 4 && len != 6 && len != 8)
201                                 goto out_invalid_option;
202
203                         opt_val = get_unaligned((__be32 *)value);
204                         opt_recv->dccpor_timestamp_echo = ntohl(opt_val);
205
206                         dccp_pr_debug("%s rx opt: TIMESTAMP_ECHO=%u, len=%d, "
207                                       "ackno=%llu", dccp_role(sk),
208                                       opt_recv->dccpor_timestamp_echo,
209                                       len + 2,
210                                       (unsigned long long)
211                                       DCCP_SKB_CB(skb)->dccpd_ack_seq);
212
213                         value += 4;
214
215                         if (len == 4) {         /* no elapsed time included */
216                                 dccp_pr_debug_cat("\n");
217                                 break;
218                         }
219
220                         if (len == 6) {         /* 2-byte elapsed time */
221                                 __be16 opt_val2 = get_unaligned((__be16 *)value);
222                                 elapsed_time = ntohs(opt_val2);
223                         } else {                /* 4-byte elapsed time */
224                                 opt_val = get_unaligned((__be32 *)value);
225                                 elapsed_time = ntohl(opt_val);
226                         }
227
228                         dccp_pr_debug_cat(", ELAPSED_TIME=%u\n", elapsed_time);
229
230                         /* Give precedence to the biggest ELAPSED_TIME */
231                         if (elapsed_time > opt_recv->dccpor_elapsed_time)
232                                 opt_recv->dccpor_elapsed_time = elapsed_time;
233                         break;
234                 case DCCPO_ELAPSED_TIME:
235                         if (dccp_packet_without_ack(skb))   /* RFC 4340, 13.2 */
236                                 break;
237
238                         if (len == 2) {
239                                 __be16 opt_val2 = get_unaligned((__be16 *)value);
240                                 elapsed_time = ntohs(opt_val2);
241                         } else if (len == 4) {
242                                 opt_val = get_unaligned((__be32 *)value);
243                                 elapsed_time = ntohl(opt_val);
244                         } else {
245                                 goto out_invalid_option;
246                         }
247
248                         if (elapsed_time > opt_recv->dccpor_elapsed_time)
249                                 opt_recv->dccpor_elapsed_time = elapsed_time;
250
251                         dccp_pr_debug("%s rx opt: ELAPSED_TIME=%d\n",
252                                       dccp_role(sk), elapsed_time);
253                         break;
254                 case 128 ... 191: {
255                         const u16 idx = value - options;
256
257                         if (ccid_hc_rx_parse_options(dp->dccps_hc_rx_ccid, sk,
258                                                      opt, len, idx,
259                                                      value) != 0)
260                                 goto out_invalid_option;
261                 }
262                         break;
263                 case 192 ... 255: {
264                         const u16 idx = value - options;
265
266                         if (ccid_hc_tx_parse_options(dp->dccps_hc_tx_ccid, sk,
267                                                      opt, len, idx,
268                                                      value) != 0)
269                                 goto out_invalid_option;
270                 }
271                         break;
272                 default:
273                         DCCP_CRIT("DCCP(%p): option %d(len=%d) not "
274                                   "implemented, ignoring", sk, opt, len);
275                         break;
276                 }
277 ignore_option:
278                 if (opt != DCCPO_MANDATORY)
279                         mandatory = 0;
280         }
281
282         /* mandatory was the last byte in option list -> reset connection */
283         if (mandatory)
284                 goto out_invalid_option;
285
286 out_nonsensical_length:
287         /* RFC 4340, 5.8: ignore option and all remaining option space */
288         return 0;
289
290 out_invalid_option:
291         DCCP_INC_STATS_BH(DCCP_MIB_INVALIDOPT);
292         DCCP_SKB_CB(skb)->dccpd_reset_code = DCCP_RESET_CODE_OPTION_ERROR;
293         DCCP_WARN("DCCP(%p): invalid option %d, len=%d", sk, opt, len);
294         return -1;
295 }
296
297 EXPORT_SYMBOL_GPL(dccp_parse_options);
298
299 static void dccp_encode_value_var(const u32 value, unsigned char *to,
300                                   const unsigned int len)
301 {
302         if (len > 3)
303                 *to++ = (value & 0xFF000000) >> 24;
304         if (len > 2)
305                 *to++ = (value & 0xFF0000) >> 16;
306         if (len > 1)
307                 *to++ = (value & 0xFF00) >> 8;
308         if (len > 0)
309                 *to++ = (value & 0xFF);
310 }
311
312 static inline u8 dccp_ndp_len(const u64 ndp)
313 {
314         if (likely(ndp <= 0xFF))
315                 return 1;
316         return likely(ndp <= USHORT_MAX) ? 2 : (ndp <= UINT_MAX ? 4 : 6);
317 }
318
319 int dccp_insert_option(struct sock *sk, struct sk_buff *skb,
320                         const unsigned char option,
321                         const void *value, const unsigned char len)
322 {
323         unsigned char *to;
324
325         if (DCCP_SKB_CB(skb)->dccpd_opt_len + len + 2 > DCCP_MAX_OPT_LEN)
326                 return -1;
327
328         DCCP_SKB_CB(skb)->dccpd_opt_len += len + 2;
329
330         to    = skb_push(skb, len + 2);
331         *to++ = option;
332         *to++ = len + 2;
333
334         memcpy(to, value, len);
335         return 0;
336 }
337
338 EXPORT_SYMBOL_GPL(dccp_insert_option);
339
340 static int dccp_insert_option_ndp(struct sock *sk, struct sk_buff *skb)
341 {
342         struct dccp_sock *dp = dccp_sk(sk);
343         u64 ndp = dp->dccps_ndp_count;
344
345         if (dccp_non_data_packet(skb))
346                 ++dp->dccps_ndp_count;
347         else
348                 dp->dccps_ndp_count = 0;
349
350         if (ndp > 0) {
351                 unsigned char *ptr;
352                 const int ndp_len = dccp_ndp_len(ndp);
353                 const int len = ndp_len + 2;
354
355                 if (DCCP_SKB_CB(skb)->dccpd_opt_len + len > DCCP_MAX_OPT_LEN)
356                         return -1;
357
358                 DCCP_SKB_CB(skb)->dccpd_opt_len += len;
359
360                 ptr = skb_push(skb, len);
361                 *ptr++ = DCCPO_NDP_COUNT;
362                 *ptr++ = len;
363                 dccp_encode_value_var(ndp, ptr, ndp_len);
364         }
365
366         return 0;
367 }
368
369 static inline int dccp_elapsed_time_len(const u32 elapsed_time)
370 {
371         return elapsed_time == 0 ? 0 : elapsed_time <= 0xFFFF ? 2 : 4;
372 }
373
374 int dccp_insert_option_elapsed_time(struct sock *sk, struct sk_buff *skb,
375                                     u32 elapsed_time)
376 {
377         const int elapsed_time_len = dccp_elapsed_time_len(elapsed_time);
378         const int len = 2 + elapsed_time_len;
379         unsigned char *to;
380
381         if (elapsed_time_len == 0)
382                 return 0;
383
384         if (DCCP_SKB_CB(skb)->dccpd_opt_len + len > DCCP_MAX_OPT_LEN)
385                 return -1;
386
387         DCCP_SKB_CB(skb)->dccpd_opt_len += len;
388
389         to    = skb_push(skb, len);
390         *to++ = DCCPO_ELAPSED_TIME;
391         *to++ = len;
392
393         if (elapsed_time_len == 2) {
394                 const __be16 var16 = htons((u16)elapsed_time);
395                 memcpy(to, &var16, 2);
396         } else {
397                 const __be32 var32 = htonl(elapsed_time);
398                 memcpy(to, &var32, 4);
399         }
400
401         return 0;
402 }
403
404 EXPORT_SYMBOL_GPL(dccp_insert_option_elapsed_time);
405
406 int dccp_insert_option_timestamp(struct sock *sk, struct sk_buff *skb)
407 {
408         __be32 now = htonl(dccp_timestamp());
409         /* yes this will overflow but that is the point as we want a
410          * 10 usec 32 bit timer which mean it wraps every 11.9 hours */
411
412         return dccp_insert_option(sk, skb, DCCPO_TIMESTAMP, &now, sizeof(now));
413 }
414
415 EXPORT_SYMBOL_GPL(dccp_insert_option_timestamp);
416
417 static int dccp_insert_option_timestamp_echo(struct dccp_sock *dp,
418                                              struct dccp_request_sock *dreq,
419                                              struct sk_buff *skb)
420 {
421         __be32 tstamp_echo;
422         unsigned char *to;
423         u32 elapsed_time, elapsed_time_len, len;
424
425         if (dreq != NULL) {
426                 elapsed_time = dccp_timestamp() - dreq->dreq_timestamp_time;
427                 tstamp_echo  = htonl(dreq->dreq_timestamp_echo);
428                 dreq->dreq_timestamp_echo = 0;
429         } else {
430                 elapsed_time = dccp_timestamp() - dp->dccps_timestamp_time;
431                 tstamp_echo  = htonl(dp->dccps_timestamp_echo);
432                 dp->dccps_timestamp_echo = 0;
433         }
434
435         elapsed_time_len = dccp_elapsed_time_len(elapsed_time);
436         len = 6 + elapsed_time_len;
437
438         if (DCCP_SKB_CB(skb)->dccpd_opt_len + len > DCCP_MAX_OPT_LEN)
439                 return -1;
440
441         DCCP_SKB_CB(skb)->dccpd_opt_len += len;
442
443         to    = skb_push(skb, len);
444         *to++ = DCCPO_TIMESTAMP_ECHO;
445         *to++ = len;
446
447         memcpy(to, &tstamp_echo, 4);
448         to += 4;
449
450         if (elapsed_time_len == 2) {
451                 const __be16 var16 = htons((u16)elapsed_time);
452                 memcpy(to, &var16, 2);
453         } else if (elapsed_time_len == 4) {
454                 const __be32 var32 = htonl(elapsed_time);
455                 memcpy(to, &var32, 4);
456         }
457
458         return 0;
459 }
460
461 static int dccp_insert_feat_opt(struct sk_buff *skb, u8 type, u8 feat,
462                                 u8 *val, u8 len)
463 {
464         u8 *to;
465
466         if (DCCP_SKB_CB(skb)->dccpd_opt_len + len + 3 > DCCP_MAX_OPT_LEN) {
467                 DCCP_WARN("packet too small for feature %d option!\n", feat);
468                 return -1;
469         }
470
471         DCCP_SKB_CB(skb)->dccpd_opt_len += len + 3;
472
473         to    = skb_push(skb, len + 3);
474         *to++ = type;
475         *to++ = len + 3;
476         *to++ = feat;
477
478         if (len)
479                 memcpy(to, val, len);
480
481         dccp_pr_debug("%s(%s (%d), ...), length %d\n",
482                       dccp_feat_typename(type),
483                       dccp_feat_name(feat), feat, len);
484         return 0;
485 }
486
487 static int dccp_insert_options_feat(struct sock *sk, struct sk_buff *skb)
488 {
489         struct dccp_sock *dp = dccp_sk(sk);
490         struct dccp_minisock *dmsk = dccp_msk(sk);
491         struct dccp_opt_pend *opt, *next;
492         int change = 0;
493
494         /* confirm any options [NN opts] */
495         list_for_each_entry_safe(opt, next, &dmsk->dccpms_conf, dccpop_node) {
496                 dccp_insert_feat_opt(skb, opt->dccpop_type,
497                                      opt->dccpop_feat, opt->dccpop_val,
498                                      opt->dccpop_len);
499                 /* fear empty confirms */
500                 if (opt->dccpop_val)
501                         kfree(opt->dccpop_val);
502                 kfree(opt);
503         }
504         INIT_LIST_HEAD(&dmsk->dccpms_conf);
505
506         /* see which features we need to send */
507         list_for_each_entry(opt, &dmsk->dccpms_pending, dccpop_node) {
508                 /* see if we need to send any confirm */
509                 if (opt->dccpop_sc) {
510                         dccp_insert_feat_opt(skb, opt->dccpop_type + 1,
511                                              opt->dccpop_feat,
512                                              opt->dccpop_sc->dccpoc_val,
513                                              opt->dccpop_sc->dccpoc_len);
514
515                         BUG_ON(!opt->dccpop_sc->dccpoc_val);
516                         kfree(opt->dccpop_sc->dccpoc_val);
517                         kfree(opt->dccpop_sc);
518                         opt->dccpop_sc = NULL;
519                 }
520
521                 /* any option not confirmed, re-send it */
522                 if (!opt->dccpop_conf) {
523                         dccp_insert_feat_opt(skb, opt->dccpop_type,
524                                              opt->dccpop_feat, opt->dccpop_val,
525                                              opt->dccpop_len);
526                         change++;
527                 }
528         }
529
530         /* Retransmit timer.
531          * If this is the master listening sock, we don't set a timer on it.  It
532          * should be fine because if the dude doesn't receive our RESPONSE
533          * [which will contain the CHANGE] he will send another REQUEST which
534          * will "retrnasmit" the change.
535          */
536         if (change && dp->dccps_role != DCCP_ROLE_LISTEN) {
537                 dccp_pr_debug("reset feat negotiation timer %p\n", sk);
538
539                 /* XXX don't reset the timer on re-transmissions.  I.e. reset it
540                  * only when sending new stuff i guess.  Currently the timer
541                  * never backs off because on re-transmission it just resets it!
542                  */
543                 inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
544                                           inet_csk(sk)->icsk_rto, DCCP_RTO_MAX);
545         }
546
547         return 0;
548 }
549
550 /* The length of all options needs to be a multiple of 4 (5.8) */
551 static void dccp_insert_option_padding(struct sk_buff *skb)
552 {
553         int padding = DCCP_SKB_CB(skb)->dccpd_opt_len % 4;
554
555         if (padding != 0) {
556                 padding = 4 - padding;
557                 memset(skb_push(skb, padding), 0, padding);
558                 DCCP_SKB_CB(skb)->dccpd_opt_len += padding;
559         }
560 }
561
562 int dccp_insert_options(struct sock *sk, struct sk_buff *skb)
563 {
564         struct dccp_sock *dp = dccp_sk(sk);
565         struct dccp_minisock *dmsk = dccp_msk(sk);
566
567         DCCP_SKB_CB(skb)->dccpd_opt_len = 0;
568
569         if (dmsk->dccpms_send_ndp_count &&
570             dccp_insert_option_ndp(sk, skb))
571                 return -1;
572
573         if (!dccp_packet_without_ack(skb)) {
574                 if (dmsk->dccpms_send_ack_vector &&
575                     dccp_ackvec_pending(dp->dccps_hc_rx_ackvec) &&
576                     dccp_insert_option_ackvec(sk, skb))
577                         return -1;
578         }
579
580         if (dp->dccps_hc_rx_insert_options) {
581                 if (ccid_hc_rx_insert_options(dp->dccps_hc_rx_ccid, sk, skb))
582                         return -1;
583                 dp->dccps_hc_rx_insert_options = 0;
584         }
585
586         /* Feature negotiation */
587         /* Data packets can't do feat negotiation */
588         if (DCCP_SKB_CB(skb)->dccpd_type != DCCP_PKT_DATA &&
589             DCCP_SKB_CB(skb)->dccpd_type != DCCP_PKT_DATAACK &&
590             dccp_insert_options_feat(sk, skb))
591                 return -1;
592
593         /*
594          * Obtain RTT sample from Request/Response exchange.
595          * This is currently used in CCID 3 initialisation.
596          */
597         if (DCCP_SKB_CB(skb)->dccpd_type == DCCP_PKT_REQUEST &&
598             dccp_insert_option_timestamp(sk, skb))
599                 return -1;
600
601         if (dp->dccps_timestamp_echo != 0 &&
602             dccp_insert_option_timestamp_echo(dp, NULL, skb))
603                 return -1;
604
605         dccp_insert_option_padding(skb);
606         return 0;
607 }
608
609 int dccp_insert_options_rsk(struct dccp_request_sock *dreq, struct sk_buff *skb)
610 {
611         DCCP_SKB_CB(skb)->dccpd_opt_len = 0;
612
613         if (dreq->dreq_timestamp_echo != 0 &&
614             dccp_insert_option_timestamp_echo(NULL, dreq, skb))
615                 return -1;
616
617         dccp_insert_option_padding(skb);
618         return 0;
619 }