2008-01-11 22:57:09 +08:00
|
|
|
/* SCTP kernel implementation
|
2005-04-17 06:20:36 +08:00
|
|
|
* (C) Copyright IBM Corp. 2002, 2004
|
|
|
|
* Copyright (c) 2001 Nokia, Inc.
|
|
|
|
* Copyright (c) 2001 La Monte H.P. Yarroll
|
|
|
|
* Copyright (c) 2002-2003 Intel Corp.
|
|
|
|
*
|
2008-01-11 22:57:09 +08:00
|
|
|
* This file is part of the SCTP kernel implementation
|
2005-04-17 06:20:36 +08:00
|
|
|
*
|
|
|
|
* SCTP over IPv6.
|
|
|
|
*
|
2008-01-11 22:57:09 +08:00
|
|
|
* This SCTP implementation is free software;
|
2005-04-17 06:20:36 +08:00
|
|
|
* you can redistribute it and/or modify it under the terms of
|
|
|
|
* the GNU General Public License as published by
|
|
|
|
* the Free Software Foundation; either version 2, or (at your option)
|
|
|
|
* any later version.
|
|
|
|
*
|
2008-01-11 22:57:09 +08:00
|
|
|
* This SCTP implementation is distributed in the hope that it
|
2005-04-17 06:20:36 +08:00
|
|
|
* will be useful, but WITHOUT ANY WARRANTY; without even the implied
|
|
|
|
* ************************
|
|
|
|
* warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
|
|
|
|
* See the GNU General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with GNU CC; see the file COPYING. If not, write to
|
|
|
|
* the Free Software Foundation, 59 Temple Place - Suite 330,
|
|
|
|
* Boston, MA 02111-1307, USA.
|
|
|
|
*
|
|
|
|
* Please send any bug reports or fixes you make to the
|
|
|
|
* email address(es):
|
2013-07-23 20:51:47 +08:00
|
|
|
* lksctp developers <linux-sctp@vger.kernel.org>
|
2005-04-17 06:20:36 +08:00
|
|
|
*
|
|
|
|
* Written or modified by:
|
|
|
|
* Le Yanqun <yanqun.le@nokia.com>
|
|
|
|
* Hui Huang <hui.huang@nokia.com>
|
|
|
|
* La Monte H.P. Yarroll <piggy@acm.org>
|
|
|
|
* Sridhar Samudrala <sri@us.ibm.com>
|
|
|
|
* Jon Grimm <jgrimm@us.ibm.com>
|
|
|
|
* Ardelle Fan <ardelle.fan@intel.com>
|
|
|
|
*
|
|
|
|
* Based on:
|
|
|
|
* linux/net/ipv6/tcp_ipv6.c
|
|
|
|
*/
|
|
|
|
|
2010-08-24 21:21:08 +08:00
|
|
|
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
#include <linux/module.h>
|
|
|
|
#include <linux/errno.h>
|
|
|
|
#include <linux/types.h>
|
|
|
|
#include <linux/socket.h>
|
|
|
|
#include <linux/sockios.h>
|
|
|
|
#include <linux/net.h>
|
|
|
|
#include <linux/in.h>
|
|
|
|
#include <linux/in6.h>
|
|
|
|
#include <linux/netdevice.h>
|
|
|
|
#include <linux/init.h>
|
|
|
|
#include <linux/ipsec.h>
|
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
percpu.h is included by sched.h and module.h and thus ends up being
included when building most .c files. percpu.h includes slab.h which
in turn includes gfp.h making everything defined by the two files
universally available and complicating inclusion dependencies.
percpu.h -> slab.h dependency is about to be removed. Prepare for
this change by updating users of gfp and slab facilities include those
headers directly instead of assuming availability. As this conversion
needs to touch large number of source files, the following script is
used as the basis of conversion.
http://userweb.kernel.org/~tj/misc/slabh-sweep.py
The script does the followings.
* Scan files for gfp and slab usages and update includes such that
only the necessary includes are there. ie. if only gfp is used,
gfp.h, if slab is used, slab.h.
* When the script inserts a new include, it looks at the include
blocks and try to put the new include such that its order conforms
to its surrounding. It's put in the include block which contains
core kernel includes, in the same order that the rest are ordered -
alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
doesn't seem to be any matching order.
* If the script can't find a place to put a new include (mostly
because the file doesn't have fitting include block), it prints out
an error message indicating which .h file needs to be added to the
file.
The conversion was done in the following steps.
1. The initial automatic conversion of all .c files updated slightly
over 4000 files, deleting around 700 includes and adding ~480 gfp.h
and ~3000 slab.h inclusions. The script emitted errors for ~400
files.
2. Each error was manually checked. Some didn't need the inclusion,
some needed manual addition while adding it to implementation .h or
embedding .c file was more appropriate for others. This step added
inclusions to around 150 files.
3. The script was run again and the output was compared to the edits
from #2 to make sure no file was left behind.
4. Several build tests were done and a couple of problems were fixed.
e.g. lib/decompress_*.c used malloc/free() wrappers around slab
APIs requiring slab.h to be added manually.
5. The script was run on all .h files but without automatically
editing them as sprinkling gfp.h and slab.h inclusions around .h
files could easily lead to inclusion dependency hell. Most gfp.h
inclusion directives were ignored as stuff from gfp.h was usually
wildly available and often used in preprocessor macros. Each
slab.h inclusion directive was examined and added manually as
necessary.
6. percpu.h was updated not to include slab.h.
7. Build test were done on the following configurations and failures
were fixed. CONFIG_GCOV_KERNEL was turned off for all tests (as my
distributed build env didn't work with gcov compiles) and a few
more options had to be turned off depending on archs to make things
build (like ipr on powerpc/64 which failed due to missing writeq).
* x86 and x86_64 UP and SMP allmodconfig and a custom test config.
* powerpc and powerpc64 SMP allmodconfig
* sparc and sparc64 SMP allmodconfig
* ia64 SMP allmodconfig
* s390 SMP allmodconfig
* alpha SMP allmodconfig
* um on x86_64 SMP allmodconfig
8. percpu.h modifications were reverted so that it could be applied as
a separate patch and serve as bisection point.
Given the fact that I had only a couple of failures from tests on step
6, I'm fairly confident about the coverage of this conversion patch.
If there is a breakage, it's likely to be something in one of the arch
headers which should be easily discoverable easily on most builds of
the specific arch.
Signed-off-by: Tejun Heo <tj@kernel.org>
Guess-its-ok-by: Christoph Lameter <cl@linux-foundation.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
2010-03-24 16:04:11 +08:00
|
|
|
#include <linux/slab.h>
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
#include <linux/ipv6.h>
|
|
|
|
#include <linux/icmpv6.h>
|
|
|
|
#include <linux/random.h>
|
|
|
|
#include <linux/seq_file.h>
|
|
|
|
|
|
|
|
#include <net/protocol.h>
|
|
|
|
#include <net/ndisc.h>
|
2005-08-10 11:08:28 +08:00
|
|
|
#include <net/ip.h>
|
2005-04-17 06:20:36 +08:00
|
|
|
#include <net/ipv6.h>
|
|
|
|
#include <net/transp_v6.h>
|
|
|
|
#include <net/addrconf.h>
|
|
|
|
#include <net/ip6_route.h>
|
|
|
|
#include <net/inet_common.h>
|
|
|
|
#include <net/inet_ecn.h>
|
|
|
|
#include <net/sctp/sctp.h>
|
|
|
|
|
|
|
|
#include <asm/uaccess.h>
|
|
|
|
|
2011-04-27 05:36:32 +08:00
|
|
|
static inline int sctp_v6_addr_match_len(union sctp_addr *s1,
|
|
|
|
union sctp_addr *s2);
|
2011-04-27 05:51:31 +08:00
|
|
|
static void sctp_v6_to_addr(union sctp_addr *addr, struct in6_addr *saddr,
|
|
|
|
__be16 port);
|
|
|
|
static int sctp_v6_cmp_addr(const union sctp_addr *addr1,
|
|
|
|
const union sctp_addr *addr2);
|
2011-04-27 05:36:32 +08:00
|
|
|
|
2007-09-17 07:02:12 +08:00
|
|
|
/* Event handler for inet6 address addition/deletion events.
|
|
|
|
* The sctp_local_addr_list needs to be protocted by a spin lock since
|
|
|
|
* multiple notifiers (say IPv4 and IPv6) may be running at the same
|
|
|
|
* time and thus corrupt the list.
|
|
|
|
* The reader side is protected with RCU.
|
|
|
|
*/
|
2006-12-21 08:08:22 +08:00
|
|
|
static int sctp_inet6addr_event(struct notifier_block *this, unsigned long ev,
|
|
|
|
void *ptr)
|
2006-12-14 08:26:26 +08:00
|
|
|
{
|
|
|
|
struct inet6_ifaddr *ifa = (struct inet6_ifaddr *)ptr;
|
2007-09-17 07:02:12 +08:00
|
|
|
struct sctp_sockaddr_entry *addr = NULL;
|
|
|
|
struct sctp_sockaddr_entry *temp;
|
2012-08-06 16:42:04 +08:00
|
|
|
struct net *net = dev_net(ifa->idev->dev);
|
2008-03-12 09:05:02 +08:00
|
|
|
int found = 0;
|
2006-12-14 08:26:26 +08:00
|
|
|
|
|
|
|
switch (ev) {
|
|
|
|
case NETDEV_UP:
|
|
|
|
addr = kmalloc(sizeof(struct sctp_sockaddr_entry), GFP_ATOMIC);
|
|
|
|
if (addr) {
|
|
|
|
addr->a.v6.sin6_family = AF_INET6;
|
|
|
|
addr->a.v6.sin6_port = 0;
|
2011-11-21 11:39:03 +08:00
|
|
|
addr->a.v6.sin6_addr = ifa->addr;
|
2006-12-14 08:26:26 +08:00
|
|
|
addr->a.v6.sin6_scope_id = ifa->idev->dev->ifindex;
|
2007-09-17 07:02:12 +08:00
|
|
|
addr->valid = 1;
|
2012-08-06 16:42:04 +08:00
|
|
|
spin_lock_bh(&net->sctp.local_addr_lock);
|
|
|
|
list_add_tail_rcu(&addr->list, &net->sctp.local_addr_list);
|
|
|
|
sctp_addr_wq_mgmt(net, addr, SCTP_ADDR_NEW);
|
|
|
|
spin_unlock_bh(&net->sctp.local_addr_lock);
|
2006-12-14 08:26:26 +08:00
|
|
|
}
|
|
|
|
break;
|
|
|
|
case NETDEV_DOWN:
|
2012-08-06 16:42:04 +08:00
|
|
|
spin_lock_bh(&net->sctp.local_addr_lock);
|
2007-09-17 07:02:12 +08:00
|
|
|
list_for_each_entry_safe(addr, temp,
|
2012-08-06 16:42:04 +08:00
|
|
|
&net->sctp.local_addr_list, list) {
|
2008-04-13 09:40:38 +08:00
|
|
|
if (addr->a.sa.sa_family == AF_INET6 &&
|
|
|
|
ipv6_addr_equal(&addr->a.v6.sin6_addr,
|
|
|
|
&ifa->addr)) {
|
2012-08-06 16:42:04 +08:00
|
|
|
sctp_addr_wq_mgmt(net, addr, SCTP_ADDR_DEL);
|
2008-03-12 09:05:02 +08:00
|
|
|
found = 1;
|
2007-09-17 07:02:12 +08:00
|
|
|
addr->valid = 0;
|
|
|
|
list_del_rcu(&addr->list);
|
2006-12-14 08:26:26 +08:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
2012-08-06 16:42:04 +08:00
|
|
|
spin_unlock_bh(&net->sctp.local_addr_lock);
|
2008-03-12 09:05:02 +08:00
|
|
|
if (found)
|
2011-03-15 18:05:02 +08:00
|
|
|
kfree_rcu(addr, rcu);
|
2006-12-14 08:26:26 +08:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
return NOTIFY_DONE;
|
|
|
|
}
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
static struct notifier_block sctp_inet6addr_notifier = {
|
2006-12-14 08:26:26 +08:00
|
|
|
.notifier_call = sctp_inet6addr_event,
|
2005-04-17 06:20:36 +08:00
|
|
|
};
|
|
|
|
|
|
|
|
/* ICMP error handler. */
|
2013-06-17 17:40:05 +08:00
|
|
|
static void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
|
|
|
|
u8 type, u8 code, int offset, __be32 info)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
|
|
|
struct inet6_dev *idev;
|
|
|
|
struct sock *sk;
|
|
|
|
struct sctp_association *asoc;
|
|
|
|
struct sctp_transport *transport;
|
|
|
|
struct ipv6_pinfo *np;
|
2013-06-13 15:04:33 +08:00
|
|
|
__u16 saveip, savesctp;
|
2005-04-17 06:20:36 +08:00
|
|
|
int err;
|
2012-08-06 16:41:13 +08:00
|
|
|
struct net *net = dev_net(skb->dev);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
idev = in6_dev_get(skb->dev);
|
|
|
|
|
|
|
|
/* Fix up skb to look at the embedded net header. */
|
2007-04-11 12:21:55 +08:00
|
|
|
saveip = skb->network_header;
|
|
|
|
savesctp = skb->transport_header;
|
2007-03-11 06:57:15 +08:00
|
|
|
skb_reset_network_header(skb);
|
2007-03-14 04:17:10 +08:00
|
|
|
skb_set_transport_header(skb, offset);
|
2012-08-06 16:41:13 +08:00
|
|
|
sk = sctp_err_lookup(net, AF_INET6, skb, sctp_hdr(skb), &asoc, &transport);
|
2005-04-17 06:20:36 +08:00
|
|
|
/* Put back, the original pointers. */
|
2007-04-11 12:21:55 +08:00
|
|
|
skb->network_header = saveip;
|
|
|
|
skb->transport_header = savesctp;
|
2005-04-17 06:20:36 +08:00
|
|
|
if (!sk) {
|
2012-08-06 16:47:55 +08:00
|
|
|
ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_INERRORS);
|
2005-04-17 06:20:36 +08:00
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Warning: The sock lock is held. Remember to call
|
|
|
|
* sctp_err_finish!
|
|
|
|
*/
|
|
|
|
|
|
|
|
switch (type) {
|
|
|
|
case ICMPV6_PKT_TOOBIG:
|
|
|
|
sctp_icmp_frag_needed(sk, asoc, transport, ntohl(info));
|
|
|
|
goto out_unlock;
|
|
|
|
case ICMPV6_PARAMPROB:
|
|
|
|
if (ICMPV6_UNK_NEXTHDR == code) {
|
2005-07-19 04:44:10 +08:00
|
|
|
sctp_icmp_proto_unreachable(sk, asoc, transport);
|
2005-04-17 06:20:36 +08:00
|
|
|
goto out_unlock;
|
|
|
|
}
|
|
|
|
break;
|
2012-07-12 15:25:15 +08:00
|
|
|
case NDISC_REDIRECT:
|
|
|
|
sctp_icmp_redirect(sk, transport, skb);
|
2013-09-16 18:36:02 +08:00
|
|
|
goto out_unlock;
|
2005-04-17 06:20:36 +08:00
|
|
|
default:
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
np = inet6_sk(sk);
|
|
|
|
icmpv6_err_convert(type, code, &err);
|
|
|
|
if (!sock_owned_by_user(sk) && np->recverr) {
|
|
|
|
sk->sk_err = err;
|
|
|
|
sk->sk_error_report(sk);
|
|
|
|
} else { /* Only an error on timeout */
|
|
|
|
sk->sk_err_soft = err;
|
|
|
|
}
|
|
|
|
|
|
|
|
out_unlock:
|
2005-07-19 04:44:10 +08:00
|
|
|
sctp_err_finish(sk, asoc);
|
2005-04-17 06:20:36 +08:00
|
|
|
out:
|
|
|
|
if (likely(idev != NULL))
|
|
|
|
in6_dev_put(idev);
|
|
|
|
}
|
|
|
|
|
2008-08-04 12:15:08 +08:00
|
|
|
static int sctp_v6_xmit(struct sk_buff *skb, struct sctp_transport *transport)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
|
|
|
struct sock *sk = skb->sk;
|
|
|
|
struct ipv6_pinfo *np = inet6_sk(sk);
|
net: sctp: fix ipv6 ipsec encryption bug in sctp_v6_xmit
Alan Chester reported an issue with IPv6 on SCTP that IPsec traffic is not
being encrypted, whereas on IPv4 it is. Setting up an AH + ESP transport
does not seem to have the desired effect:
SCTP + IPv4:
22:14:20.809645 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 116)
192.168.0.2 > 192.168.0.5: AH(spi=0x00000042,sumlen=16,seq=0x1): ESP(spi=0x00000044,seq=0x1), length 72
22:14:20.813270 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 340)
192.168.0.5 > 192.168.0.2: AH(spi=0x00000043,sumlen=16,seq=0x1):
SCTP + IPv6:
22:31:19.215029 IP6 (class 0x02, hlim 64, next-header SCTP (132) payload length: 364)
fe80::222:15ff:fe87:7fc.3333 > fe80::92e6:baff:fe0d:5a54.36767: sctp
1) [INIT ACK] [init tag: 747759530] [rwnd: 62464] [OS: 10] [MIS: 10]
Moreover, Alan says:
This problem was seen with both Racoon and Racoon2. Other people have seen
this with OpenSwan. When IPsec is configured to encrypt all upper layer
protocols the SCTP connection does not initialize. After using Wireshark to
follow packets, this is because the SCTP packet leaves Box A unencrypted and
Box B believes all upper layer protocols are to be encrypted so it drops
this packet, causing the SCTP connection to fail to initialize. When IPsec
is configured to encrypt just SCTP, the SCTP packets are observed unencrypted.
In fact, using `socat sctp6-listen:3333 -` on one end and transferring "plaintext"
string on the other end, results in cleartext on the wire where SCTP eventually
does not report any errors, thus in the latter case that Alan reports, the
non-paranoid user might think he's communicating over an encrypted transport on
SCTP although he's not (tcpdump ... -X):
...
0x0030: 5d70 8e1a 0003 001a 177d eb6c 0000 0000 ]p.......}.l....
0x0040: 0000 0000 706c 6169 6e74 6578 740a 0000 ....plaintext...
Only in /proc/net/xfrm_stat we can see XfrmInTmplMismatch increasing on the
receiver side. Initial follow-up analysis from Alan's bug report was done by
Alexey Dobriyan. Also thanks to Vlad Yasevich for feedback on this.
SCTP has its own implementation of sctp_v6_xmit() not calling inet6_csk_xmit().
This has the implication that it probably never really got updated along with
changes in inet6_csk_xmit() and therefore does not seem to invoke xfrm handlers.
SCTP's IPv4 xmit however, properly calls ip_queue_xmit() to do the work. Since
a call to inet6_csk_xmit() would solve this problem, but result in unecessary
route lookups, let us just use the cached flowi6 instead that we got through
sctp_v6_get_dst(). Since all SCTP packets are being sent through sctp_packet_transmit(),
we do the route lookup / flow caching in sctp_transport_route(), hold it in
tp->dst and skb_dst_set() right after that. If we would alter fl6->daddr in
sctp_v6_xmit() to np->opt->srcrt, we possibly could run into the same effect
of not having xfrm layer pick it up, hence, use fl6_update_dst() in sctp_v6_get_dst()
instead to get the correct source routed dst entry, which we assign to the skb.
Also source address routing example from 625034113 ("sctp: fix sctp to work with
ipv6 source address routing") still works with this patch! Nevertheless, in RFC5095
it is actually 'recommended' to not use that anyway due to traffic amplification [1].
So it seems we're not supposed to do that anyway in sctp_v6_xmit(). Moreover, if
we overwrite the flow destination here, the lower IPv6 layer will be unable to
put the correct destination address into IP header, as routing header is added in
ipv6_push_nfrag_opts() but then probably with wrong final destination. Things aside,
result of this patch is that we do not have any XfrmInTmplMismatch increase plus on
the wire with this patch it now looks like:
SCTP + IPv6:
08:17:47.074080 IP6 2620:52:0:102f:7a2b:cbff:fe27:1b0a > 2620:52:0:102f:213:72ff:fe32:7eba:
AH(spi=0x00005fb4,seq=0x1): ESP(spi=0x00005fb5,seq=0x1), length 72
08:17:47.074264 IP6 2620:52:0:102f:213:72ff:fe32:7eba > 2620:52:0:102f:7a2b:cbff:fe27:1b0a:
AH(spi=0x00003d54,seq=0x1): ESP(spi=0x00003d55,seq=0x1), length 296
This fixes Kernel Bugzilla 24412. This security issue seems to be present since
2.6.18 kernels. Lets just hope some big passive adversary in the wild didn't have
its fun with that. lksctp-tools IPv6 regression test suite passes as well with
this patch.
[1] http://www.secdev.org/conf/IPv6_RH_security-csw07.pdf
Reported-by: Alan Chester <alan.chester@tekelec.com>
Reported-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-09-11 22:58:36 +08:00
|
|
|
struct flowi6 *fl6 = &transport->fl.u.ip6;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
net: sctp: rework debugging framework to use pr_debug and friends
We should get rid of all own SCTP debug printk macros and use the ones
that the kernel offers anyway instead. This makes the code more readable
and conform to the kernel code, and offers all the features of dynamic
debbuging that pr_debug() et al has, such as only turning on/off portions
of debug messages at runtime through debugfs. The runtime cost of having
CONFIG_DYNAMIC_DEBUG enabled, but none of the debug statements printing,
is negligible [1]. If kernel debugging is completly turned off, then these
statements will also compile into "empty" functions.
While we're at it, we also need to change the Kconfig option as it /now/
only refers to the ifdef'ed code portions in outqueue.c that enable further
debugging/tracing of SCTP transaction fields. Also, since SCTP_ASSERT code
was enabled with this Kconfig option and has now been removed, we
transform those code parts into WARNs resp. where appropriate BUG_ONs so
that those bugs can be more easily detected as probably not many people
have SCTP debugging permanently turned on.
To turn on all SCTP debugging, the following steps are needed:
# mount -t debugfs none /sys/kernel/debug
# echo -n 'module sctp +p' > /sys/kernel/debug/dynamic_debug/control
This can be done more fine-grained on a per file, per line basis and others
as described in [2].
[1] https://www.kernel.org/doc/ols/2009/ols2009-pages-39-46.pdf
[2] Documentation/dynamic-debug-howto.txt
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-06-29 01:49:40 +08:00
|
|
|
pr_debug("%s: skb:%p, len:%d, src:%pI6 dst:%pI6\n", __func__, skb,
|
net: sctp: fix ipv6 ipsec encryption bug in sctp_v6_xmit
Alan Chester reported an issue with IPv6 on SCTP that IPsec traffic is not
being encrypted, whereas on IPv4 it is. Setting up an AH + ESP transport
does not seem to have the desired effect:
SCTP + IPv4:
22:14:20.809645 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 116)
192.168.0.2 > 192.168.0.5: AH(spi=0x00000042,sumlen=16,seq=0x1): ESP(spi=0x00000044,seq=0x1), length 72
22:14:20.813270 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 340)
192.168.0.5 > 192.168.0.2: AH(spi=0x00000043,sumlen=16,seq=0x1):
SCTP + IPv6:
22:31:19.215029 IP6 (class 0x02, hlim 64, next-header SCTP (132) payload length: 364)
fe80::222:15ff:fe87:7fc.3333 > fe80::92e6:baff:fe0d:5a54.36767: sctp
1) [INIT ACK] [init tag: 747759530] [rwnd: 62464] [OS: 10] [MIS: 10]
Moreover, Alan says:
This problem was seen with both Racoon and Racoon2. Other people have seen
this with OpenSwan. When IPsec is configured to encrypt all upper layer
protocols the SCTP connection does not initialize. After using Wireshark to
follow packets, this is because the SCTP packet leaves Box A unencrypted and
Box B believes all upper layer protocols are to be encrypted so it drops
this packet, causing the SCTP connection to fail to initialize. When IPsec
is configured to encrypt just SCTP, the SCTP packets are observed unencrypted.
In fact, using `socat sctp6-listen:3333 -` on one end and transferring "plaintext"
string on the other end, results in cleartext on the wire where SCTP eventually
does not report any errors, thus in the latter case that Alan reports, the
non-paranoid user might think he's communicating over an encrypted transport on
SCTP although he's not (tcpdump ... -X):
...
0x0030: 5d70 8e1a 0003 001a 177d eb6c 0000 0000 ]p.......}.l....
0x0040: 0000 0000 706c 6169 6e74 6578 740a 0000 ....plaintext...
Only in /proc/net/xfrm_stat we can see XfrmInTmplMismatch increasing on the
receiver side. Initial follow-up analysis from Alan's bug report was done by
Alexey Dobriyan. Also thanks to Vlad Yasevich for feedback on this.
SCTP has its own implementation of sctp_v6_xmit() not calling inet6_csk_xmit().
This has the implication that it probably never really got updated along with
changes in inet6_csk_xmit() and therefore does not seem to invoke xfrm handlers.
SCTP's IPv4 xmit however, properly calls ip_queue_xmit() to do the work. Since
a call to inet6_csk_xmit() would solve this problem, but result in unecessary
route lookups, let us just use the cached flowi6 instead that we got through
sctp_v6_get_dst(). Since all SCTP packets are being sent through sctp_packet_transmit(),
we do the route lookup / flow caching in sctp_transport_route(), hold it in
tp->dst and skb_dst_set() right after that. If we would alter fl6->daddr in
sctp_v6_xmit() to np->opt->srcrt, we possibly could run into the same effect
of not having xfrm layer pick it up, hence, use fl6_update_dst() in sctp_v6_get_dst()
instead to get the correct source routed dst entry, which we assign to the skb.
Also source address routing example from 625034113 ("sctp: fix sctp to work with
ipv6 source address routing") still works with this patch! Nevertheless, in RFC5095
it is actually 'recommended' to not use that anyway due to traffic amplification [1].
So it seems we're not supposed to do that anyway in sctp_v6_xmit(). Moreover, if
we overwrite the flow destination here, the lower IPv6 layer will be unable to
put the correct destination address into IP header, as routing header is added in
ipv6_push_nfrag_opts() but then probably with wrong final destination. Things aside,
result of this patch is that we do not have any XfrmInTmplMismatch increase plus on
the wire with this patch it now looks like:
SCTP + IPv6:
08:17:47.074080 IP6 2620:52:0:102f:7a2b:cbff:fe27:1b0a > 2620:52:0:102f:213:72ff:fe32:7eba:
AH(spi=0x00005fb4,seq=0x1): ESP(spi=0x00005fb5,seq=0x1), length 72
08:17:47.074264 IP6 2620:52:0:102f:213:72ff:fe32:7eba > 2620:52:0:102f:7a2b:cbff:fe27:1b0a:
AH(spi=0x00003d54,seq=0x1): ESP(spi=0x00003d55,seq=0x1), length 296
This fixes Kernel Bugzilla 24412. This security issue seems to be present since
2.6.18 kernels. Lets just hope some big passive adversary in the wild didn't have
its fun with that. lksctp-tools IPv6 regression test suite passes as well with
this patch.
[1] http://www.secdev.org/conf/IPv6_RH_security-csw07.pdf
Reported-by: Alan Chester <alan.chester@tekelec.com>
Reported-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-09-11 22:58:36 +08:00
|
|
|
skb->len, &fl6->saddr, &fl6->daddr);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
net: sctp: fix ipv6 ipsec encryption bug in sctp_v6_xmit
Alan Chester reported an issue with IPv6 on SCTP that IPsec traffic is not
being encrypted, whereas on IPv4 it is. Setting up an AH + ESP transport
does not seem to have the desired effect:
SCTP + IPv4:
22:14:20.809645 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 116)
192.168.0.2 > 192.168.0.5: AH(spi=0x00000042,sumlen=16,seq=0x1): ESP(spi=0x00000044,seq=0x1), length 72
22:14:20.813270 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 340)
192.168.0.5 > 192.168.0.2: AH(spi=0x00000043,sumlen=16,seq=0x1):
SCTP + IPv6:
22:31:19.215029 IP6 (class 0x02, hlim 64, next-header SCTP (132) payload length: 364)
fe80::222:15ff:fe87:7fc.3333 > fe80::92e6:baff:fe0d:5a54.36767: sctp
1) [INIT ACK] [init tag: 747759530] [rwnd: 62464] [OS: 10] [MIS: 10]
Moreover, Alan says:
This problem was seen with both Racoon and Racoon2. Other people have seen
this with OpenSwan. When IPsec is configured to encrypt all upper layer
protocols the SCTP connection does not initialize. After using Wireshark to
follow packets, this is because the SCTP packet leaves Box A unencrypted and
Box B believes all upper layer protocols are to be encrypted so it drops
this packet, causing the SCTP connection to fail to initialize. When IPsec
is configured to encrypt just SCTP, the SCTP packets are observed unencrypted.
In fact, using `socat sctp6-listen:3333 -` on one end and transferring "plaintext"
string on the other end, results in cleartext on the wire where SCTP eventually
does not report any errors, thus in the latter case that Alan reports, the
non-paranoid user might think he's communicating over an encrypted transport on
SCTP although he's not (tcpdump ... -X):
...
0x0030: 5d70 8e1a 0003 001a 177d eb6c 0000 0000 ]p.......}.l....
0x0040: 0000 0000 706c 6169 6e74 6578 740a 0000 ....plaintext...
Only in /proc/net/xfrm_stat we can see XfrmInTmplMismatch increasing on the
receiver side. Initial follow-up analysis from Alan's bug report was done by
Alexey Dobriyan. Also thanks to Vlad Yasevich for feedback on this.
SCTP has its own implementation of sctp_v6_xmit() not calling inet6_csk_xmit().
This has the implication that it probably never really got updated along with
changes in inet6_csk_xmit() and therefore does not seem to invoke xfrm handlers.
SCTP's IPv4 xmit however, properly calls ip_queue_xmit() to do the work. Since
a call to inet6_csk_xmit() would solve this problem, but result in unecessary
route lookups, let us just use the cached flowi6 instead that we got through
sctp_v6_get_dst(). Since all SCTP packets are being sent through sctp_packet_transmit(),
we do the route lookup / flow caching in sctp_transport_route(), hold it in
tp->dst and skb_dst_set() right after that. If we would alter fl6->daddr in
sctp_v6_xmit() to np->opt->srcrt, we possibly could run into the same effect
of not having xfrm layer pick it up, hence, use fl6_update_dst() in sctp_v6_get_dst()
instead to get the correct source routed dst entry, which we assign to the skb.
Also source address routing example from 625034113 ("sctp: fix sctp to work with
ipv6 source address routing") still works with this patch! Nevertheless, in RFC5095
it is actually 'recommended' to not use that anyway due to traffic amplification [1].
So it seems we're not supposed to do that anyway in sctp_v6_xmit(). Moreover, if
we overwrite the flow destination here, the lower IPv6 layer will be unable to
put the correct destination address into IP header, as routing header is added in
ipv6_push_nfrag_opts() but then probably with wrong final destination. Things aside,
result of this patch is that we do not have any XfrmInTmplMismatch increase plus on
the wire with this patch it now looks like:
SCTP + IPv6:
08:17:47.074080 IP6 2620:52:0:102f:7a2b:cbff:fe27:1b0a > 2620:52:0:102f:213:72ff:fe32:7eba:
AH(spi=0x00005fb4,seq=0x1): ESP(spi=0x00005fb5,seq=0x1), length 72
08:17:47.074264 IP6 2620:52:0:102f:213:72ff:fe32:7eba > 2620:52:0:102f:7a2b:cbff:fe27:1b0a:
AH(spi=0x00003d54,seq=0x1): ESP(spi=0x00003d55,seq=0x1), length 296
This fixes Kernel Bugzilla 24412. This security issue seems to be present since
2.6.18 kernels. Lets just hope some big passive adversary in the wild didn't have
its fun with that. lksctp-tools IPv6 regression test suite passes as well with
this patch.
[1] http://www.secdev.org/conf/IPv6_RH_security-csw07.pdf
Reported-by: Alan Chester <alan.chester@tekelec.com>
Reported-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-09-11 22:58:36 +08:00
|
|
|
IP6_ECN_flow_xmit(sk, fl6->flowlabel);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2008-08-04 12:15:08 +08:00
|
|
|
if (!(transport->param_flags & SPP_PMTUD_ENABLE))
|
|
|
|
skb->local_df = 1;
|
|
|
|
|
net: sctp: fix ipv6 ipsec encryption bug in sctp_v6_xmit
Alan Chester reported an issue with IPv6 on SCTP that IPsec traffic is not
being encrypted, whereas on IPv4 it is. Setting up an AH + ESP transport
does not seem to have the desired effect:
SCTP + IPv4:
22:14:20.809645 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 116)
192.168.0.2 > 192.168.0.5: AH(spi=0x00000042,sumlen=16,seq=0x1): ESP(spi=0x00000044,seq=0x1), length 72
22:14:20.813270 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 340)
192.168.0.5 > 192.168.0.2: AH(spi=0x00000043,sumlen=16,seq=0x1):
SCTP + IPv6:
22:31:19.215029 IP6 (class 0x02, hlim 64, next-header SCTP (132) payload length: 364)
fe80::222:15ff:fe87:7fc.3333 > fe80::92e6:baff:fe0d:5a54.36767: sctp
1) [INIT ACK] [init tag: 747759530] [rwnd: 62464] [OS: 10] [MIS: 10]
Moreover, Alan says:
This problem was seen with both Racoon and Racoon2. Other people have seen
this with OpenSwan. When IPsec is configured to encrypt all upper layer
protocols the SCTP connection does not initialize. After using Wireshark to
follow packets, this is because the SCTP packet leaves Box A unencrypted and
Box B believes all upper layer protocols are to be encrypted so it drops
this packet, causing the SCTP connection to fail to initialize. When IPsec
is configured to encrypt just SCTP, the SCTP packets are observed unencrypted.
In fact, using `socat sctp6-listen:3333 -` on one end and transferring "plaintext"
string on the other end, results in cleartext on the wire where SCTP eventually
does not report any errors, thus in the latter case that Alan reports, the
non-paranoid user might think he's communicating over an encrypted transport on
SCTP although he's not (tcpdump ... -X):
...
0x0030: 5d70 8e1a 0003 001a 177d eb6c 0000 0000 ]p.......}.l....
0x0040: 0000 0000 706c 6169 6e74 6578 740a 0000 ....plaintext...
Only in /proc/net/xfrm_stat we can see XfrmInTmplMismatch increasing on the
receiver side. Initial follow-up analysis from Alan's bug report was done by
Alexey Dobriyan. Also thanks to Vlad Yasevich for feedback on this.
SCTP has its own implementation of sctp_v6_xmit() not calling inet6_csk_xmit().
This has the implication that it probably never really got updated along with
changes in inet6_csk_xmit() and therefore does not seem to invoke xfrm handlers.
SCTP's IPv4 xmit however, properly calls ip_queue_xmit() to do the work. Since
a call to inet6_csk_xmit() would solve this problem, but result in unecessary
route lookups, let us just use the cached flowi6 instead that we got through
sctp_v6_get_dst(). Since all SCTP packets are being sent through sctp_packet_transmit(),
we do the route lookup / flow caching in sctp_transport_route(), hold it in
tp->dst and skb_dst_set() right after that. If we would alter fl6->daddr in
sctp_v6_xmit() to np->opt->srcrt, we possibly could run into the same effect
of not having xfrm layer pick it up, hence, use fl6_update_dst() in sctp_v6_get_dst()
instead to get the correct source routed dst entry, which we assign to the skb.
Also source address routing example from 625034113 ("sctp: fix sctp to work with
ipv6 source address routing") still works with this patch! Nevertheless, in RFC5095
it is actually 'recommended' to not use that anyway due to traffic amplification [1].
So it seems we're not supposed to do that anyway in sctp_v6_xmit(). Moreover, if
we overwrite the flow destination here, the lower IPv6 layer will be unable to
put the correct destination address into IP header, as routing header is added in
ipv6_push_nfrag_opts() but then probably with wrong final destination. Things aside,
result of this patch is that we do not have any XfrmInTmplMismatch increase plus on
the wire with this patch it now looks like:
SCTP + IPv6:
08:17:47.074080 IP6 2620:52:0:102f:7a2b:cbff:fe27:1b0a > 2620:52:0:102f:213:72ff:fe32:7eba:
AH(spi=0x00005fb4,seq=0x1): ESP(spi=0x00005fb5,seq=0x1), length 72
08:17:47.074264 IP6 2620:52:0:102f:213:72ff:fe32:7eba > 2620:52:0:102f:7a2b:cbff:fe27:1b0a:
AH(spi=0x00003d54,seq=0x1): ESP(spi=0x00003d55,seq=0x1), length 296
This fixes Kernel Bugzilla 24412. This security issue seems to be present since
2.6.18 kernels. Lets just hope some big passive adversary in the wild didn't have
its fun with that. lksctp-tools IPv6 regression test suite passes as well with
this patch.
[1] http://www.secdev.org/conf/IPv6_RH_security-csw07.pdf
Reported-by: Alan Chester <alan.chester@tekelec.com>
Reported-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-09-11 22:58:36 +08:00
|
|
|
SCTP_INC_STATS(sock_net(sk), SCTP_MIB_OUTSCTPPACKS);
|
|
|
|
|
|
|
|
return ip6_xmit(sk, skb, fl6, np->opt, np->tclass);
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Returns the dst cache entry for the given source and destination ip
|
|
|
|
* addresses.
|
|
|
|
*/
|
2011-04-27 05:54:17 +08:00
|
|
|
static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
|
|
|
|
struct flowi *fl, struct sock *sk)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
2011-04-27 05:54:17 +08:00
|
|
|
struct sctp_association *asoc = t->asoc;
|
2011-04-27 05:36:32 +08:00
|
|
|
struct dst_entry *dst = NULL;
|
2011-04-27 05:51:31 +08:00
|
|
|
struct flowi6 *fl6 = &fl->u.ip6;
|
2011-04-27 05:36:32 +08:00
|
|
|
struct sctp_bind_addr *bp;
|
net: sctp: fix ipv6 ipsec encryption bug in sctp_v6_xmit
Alan Chester reported an issue with IPv6 on SCTP that IPsec traffic is not
being encrypted, whereas on IPv4 it is. Setting up an AH + ESP transport
does not seem to have the desired effect:
SCTP + IPv4:
22:14:20.809645 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 116)
192.168.0.2 > 192.168.0.5: AH(spi=0x00000042,sumlen=16,seq=0x1): ESP(spi=0x00000044,seq=0x1), length 72
22:14:20.813270 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 340)
192.168.0.5 > 192.168.0.2: AH(spi=0x00000043,sumlen=16,seq=0x1):
SCTP + IPv6:
22:31:19.215029 IP6 (class 0x02, hlim 64, next-header SCTP (132) payload length: 364)
fe80::222:15ff:fe87:7fc.3333 > fe80::92e6:baff:fe0d:5a54.36767: sctp
1) [INIT ACK] [init tag: 747759530] [rwnd: 62464] [OS: 10] [MIS: 10]
Moreover, Alan says:
This problem was seen with both Racoon and Racoon2. Other people have seen
this with OpenSwan. When IPsec is configured to encrypt all upper layer
protocols the SCTP connection does not initialize. After using Wireshark to
follow packets, this is because the SCTP packet leaves Box A unencrypted and
Box B believes all upper layer protocols are to be encrypted so it drops
this packet, causing the SCTP connection to fail to initialize. When IPsec
is configured to encrypt just SCTP, the SCTP packets are observed unencrypted.
In fact, using `socat sctp6-listen:3333 -` on one end and transferring "plaintext"
string on the other end, results in cleartext on the wire where SCTP eventually
does not report any errors, thus in the latter case that Alan reports, the
non-paranoid user might think he's communicating over an encrypted transport on
SCTP although he's not (tcpdump ... -X):
...
0x0030: 5d70 8e1a 0003 001a 177d eb6c 0000 0000 ]p.......}.l....
0x0040: 0000 0000 706c 6169 6e74 6578 740a 0000 ....plaintext...
Only in /proc/net/xfrm_stat we can see XfrmInTmplMismatch increasing on the
receiver side. Initial follow-up analysis from Alan's bug report was done by
Alexey Dobriyan. Also thanks to Vlad Yasevich for feedback on this.
SCTP has its own implementation of sctp_v6_xmit() not calling inet6_csk_xmit().
This has the implication that it probably never really got updated along with
changes in inet6_csk_xmit() and therefore does not seem to invoke xfrm handlers.
SCTP's IPv4 xmit however, properly calls ip_queue_xmit() to do the work. Since
a call to inet6_csk_xmit() would solve this problem, but result in unecessary
route lookups, let us just use the cached flowi6 instead that we got through
sctp_v6_get_dst(). Since all SCTP packets are being sent through sctp_packet_transmit(),
we do the route lookup / flow caching in sctp_transport_route(), hold it in
tp->dst and skb_dst_set() right after that. If we would alter fl6->daddr in
sctp_v6_xmit() to np->opt->srcrt, we possibly could run into the same effect
of not having xfrm layer pick it up, hence, use fl6_update_dst() in sctp_v6_get_dst()
instead to get the correct source routed dst entry, which we assign to the skb.
Also source address routing example from 625034113 ("sctp: fix sctp to work with
ipv6 source address routing") still works with this patch! Nevertheless, in RFC5095
it is actually 'recommended' to not use that anyway due to traffic amplification [1].
So it seems we're not supposed to do that anyway in sctp_v6_xmit(). Moreover, if
we overwrite the flow destination here, the lower IPv6 layer will be unable to
put the correct destination address into IP header, as routing header is added in
ipv6_push_nfrag_opts() but then probably with wrong final destination. Things aside,
result of this patch is that we do not have any XfrmInTmplMismatch increase plus on
the wire with this patch it now looks like:
SCTP + IPv6:
08:17:47.074080 IP6 2620:52:0:102f:7a2b:cbff:fe27:1b0a > 2620:52:0:102f:213:72ff:fe32:7eba:
AH(spi=0x00005fb4,seq=0x1): ESP(spi=0x00005fb5,seq=0x1), length 72
08:17:47.074264 IP6 2620:52:0:102f:213:72ff:fe32:7eba > 2620:52:0:102f:7a2b:cbff:fe27:1b0a:
AH(spi=0x00003d54,seq=0x1): ESP(spi=0x00003d55,seq=0x1), length 296
This fixes Kernel Bugzilla 24412. This security issue seems to be present since
2.6.18 kernels. Lets just hope some big passive adversary in the wild didn't have
its fun with that. lksctp-tools IPv6 regression test suite passes as well with
this patch.
[1] http://www.secdev.org/conf/IPv6_RH_security-csw07.pdf
Reported-by: Alan Chester <alan.chester@tekelec.com>
Reported-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-09-11 22:58:36 +08:00
|
|
|
struct ipv6_pinfo *np = inet6_sk(sk);
|
2011-04-27 05:36:32 +08:00
|
|
|
struct sctp_sockaddr_entry *laddr;
|
|
|
|
union sctp_addr *baddr = NULL;
|
2011-04-27 05:54:17 +08:00
|
|
|
union sctp_addr *daddr = &t->ipaddr;
|
2011-04-27 05:51:31 +08:00
|
|
|
union sctp_addr dst_saddr;
|
net: sctp: fix ipv6 ipsec encryption bug in sctp_v6_xmit
Alan Chester reported an issue with IPv6 on SCTP that IPsec traffic is not
being encrypted, whereas on IPv4 it is. Setting up an AH + ESP transport
does not seem to have the desired effect:
SCTP + IPv4:
22:14:20.809645 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 116)
192.168.0.2 > 192.168.0.5: AH(spi=0x00000042,sumlen=16,seq=0x1): ESP(spi=0x00000044,seq=0x1), length 72
22:14:20.813270 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 340)
192.168.0.5 > 192.168.0.2: AH(spi=0x00000043,sumlen=16,seq=0x1):
SCTP + IPv6:
22:31:19.215029 IP6 (class 0x02, hlim 64, next-header SCTP (132) payload length: 364)
fe80::222:15ff:fe87:7fc.3333 > fe80::92e6:baff:fe0d:5a54.36767: sctp
1) [INIT ACK] [init tag: 747759530] [rwnd: 62464] [OS: 10] [MIS: 10]
Moreover, Alan says:
This problem was seen with both Racoon and Racoon2. Other people have seen
this with OpenSwan. When IPsec is configured to encrypt all upper layer
protocols the SCTP connection does not initialize. After using Wireshark to
follow packets, this is because the SCTP packet leaves Box A unencrypted and
Box B believes all upper layer protocols are to be encrypted so it drops
this packet, causing the SCTP connection to fail to initialize. When IPsec
is configured to encrypt just SCTP, the SCTP packets are observed unencrypted.
In fact, using `socat sctp6-listen:3333 -` on one end and transferring "plaintext"
string on the other end, results in cleartext on the wire where SCTP eventually
does not report any errors, thus in the latter case that Alan reports, the
non-paranoid user might think he's communicating over an encrypted transport on
SCTP although he's not (tcpdump ... -X):
...
0x0030: 5d70 8e1a 0003 001a 177d eb6c 0000 0000 ]p.......}.l....
0x0040: 0000 0000 706c 6169 6e74 6578 740a 0000 ....plaintext...
Only in /proc/net/xfrm_stat we can see XfrmInTmplMismatch increasing on the
receiver side. Initial follow-up analysis from Alan's bug report was done by
Alexey Dobriyan. Also thanks to Vlad Yasevich for feedback on this.
SCTP has its own implementation of sctp_v6_xmit() not calling inet6_csk_xmit().
This has the implication that it probably never really got updated along with
changes in inet6_csk_xmit() and therefore does not seem to invoke xfrm handlers.
SCTP's IPv4 xmit however, properly calls ip_queue_xmit() to do the work. Since
a call to inet6_csk_xmit() would solve this problem, but result in unecessary
route lookups, let us just use the cached flowi6 instead that we got through
sctp_v6_get_dst(). Since all SCTP packets are being sent through sctp_packet_transmit(),
we do the route lookup / flow caching in sctp_transport_route(), hold it in
tp->dst and skb_dst_set() right after that. If we would alter fl6->daddr in
sctp_v6_xmit() to np->opt->srcrt, we possibly could run into the same effect
of not having xfrm layer pick it up, hence, use fl6_update_dst() in sctp_v6_get_dst()
instead to get the correct source routed dst entry, which we assign to the skb.
Also source address routing example from 625034113 ("sctp: fix sctp to work with
ipv6 source address routing") still works with this patch! Nevertheless, in RFC5095
it is actually 'recommended' to not use that anyway due to traffic amplification [1].
So it seems we're not supposed to do that anyway in sctp_v6_xmit(). Moreover, if
we overwrite the flow destination here, the lower IPv6 layer will be unable to
put the correct destination address into IP header, as routing header is added in
ipv6_push_nfrag_opts() but then probably with wrong final destination. Things aside,
result of this patch is that we do not have any XfrmInTmplMismatch increase plus on
the wire with this patch it now looks like:
SCTP + IPv6:
08:17:47.074080 IP6 2620:52:0:102f:7a2b:cbff:fe27:1b0a > 2620:52:0:102f:213:72ff:fe32:7eba:
AH(spi=0x00005fb4,seq=0x1): ESP(spi=0x00005fb5,seq=0x1), length 72
08:17:47.074264 IP6 2620:52:0:102f:213:72ff:fe32:7eba > 2620:52:0:102f:7a2b:cbff:fe27:1b0a:
AH(spi=0x00003d54,seq=0x1): ESP(spi=0x00003d55,seq=0x1), length 296
This fixes Kernel Bugzilla 24412. This security issue seems to be present since
2.6.18 kernels. Lets just hope some big passive adversary in the wild didn't have
its fun with that. lksctp-tools IPv6 regression test suite passes as well with
this patch.
[1] http://www.secdev.org/conf/IPv6_RH_security-csw07.pdf
Reported-by: Alan Chester <alan.chester@tekelec.com>
Reported-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-09-11 22:58:36 +08:00
|
|
|
struct in6_addr *final_p, final;
|
2011-04-27 05:36:32 +08:00
|
|
|
__u8 matchlen = 0;
|
|
|
|
__u8 bmatchlen;
|
|
|
|
sctp_scope_t scope;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2011-04-27 05:51:31 +08:00
|
|
|
memset(fl6, 0, sizeof(struct flowi6));
|
2011-11-21 11:39:03 +08:00
|
|
|
fl6->daddr = daddr->v6.sin6_addr;
|
2011-04-27 05:52:27 +08:00
|
|
|
fl6->fl6_dport = daddr->v6.sin6_port;
|
|
|
|
fl6->flowi6_proto = IPPROTO_SCTP;
|
2005-04-17 06:20:36 +08:00
|
|
|
if (ipv6_addr_type(&daddr->v6.sin6_addr) & IPV6_ADDR_LINKLOCAL)
|
2011-04-27 05:51:31 +08:00
|
|
|
fl6->flowi6_oif = daddr->v6.sin6_scope_id;
|
2007-02-09 22:25:18 +08:00
|
|
|
|
net: sctp: rework debugging framework to use pr_debug and friends
We should get rid of all own SCTP debug printk macros and use the ones
that the kernel offers anyway instead. This makes the code more readable
and conform to the kernel code, and offers all the features of dynamic
debbuging that pr_debug() et al has, such as only turning on/off portions
of debug messages at runtime through debugfs. The runtime cost of having
CONFIG_DYNAMIC_DEBUG enabled, but none of the debug statements printing,
is negligible [1]. If kernel debugging is completly turned off, then these
statements will also compile into "empty" functions.
While we're at it, we also need to change the Kconfig option as it /now/
only refers to the ifdef'ed code portions in outqueue.c that enable further
debugging/tracing of SCTP transaction fields. Also, since SCTP_ASSERT code
was enabled with this Kconfig option and has now been removed, we
transform those code parts into WARNs resp. where appropriate BUG_ONs so
that those bugs can be more easily detected as probably not many people
have SCTP debugging permanently turned on.
To turn on all SCTP debugging, the following steps are needed:
# mount -t debugfs none /sys/kernel/debug
# echo -n 'module sctp +p' > /sys/kernel/debug/dynamic_debug/control
This can be done more fine-grained on a per file, per line basis and others
as described in [2].
[1] https://www.kernel.org/doc/ols/2009/ols2009-pages-39-46.pdf
[2] Documentation/dynamic-debug-howto.txt
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-06-29 01:49:40 +08:00
|
|
|
pr_debug("%s: dst=%pI6 ", __func__, &fl6->daddr);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2011-04-27 05:52:27 +08:00
|
|
|
if (asoc)
|
|
|
|
fl6->fl6_sport = htons(asoc->base.bind_addr.port);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
if (saddr) {
|
2011-11-21 11:39:03 +08:00
|
|
|
fl6->saddr = saddr->v6.sin6_addr;
|
2011-04-27 05:52:27 +08:00
|
|
|
fl6->fl6_sport = saddr->v6.sin6_port;
|
net: sctp: rework debugging framework to use pr_debug and friends
We should get rid of all own SCTP debug printk macros and use the ones
that the kernel offers anyway instead. This makes the code more readable
and conform to the kernel code, and offers all the features of dynamic
debbuging that pr_debug() et al has, such as only turning on/off portions
of debug messages at runtime through debugfs. The runtime cost of having
CONFIG_DYNAMIC_DEBUG enabled, but none of the debug statements printing,
is negligible [1]. If kernel debugging is completly turned off, then these
statements will also compile into "empty" functions.
While we're at it, we also need to change the Kconfig option as it /now/
only refers to the ifdef'ed code portions in outqueue.c that enable further
debugging/tracing of SCTP transaction fields. Also, since SCTP_ASSERT code
was enabled with this Kconfig option and has now been removed, we
transform those code parts into WARNs resp. where appropriate BUG_ONs so
that those bugs can be more easily detected as probably not many people
have SCTP debugging permanently turned on.
To turn on all SCTP debugging, the following steps are needed:
# mount -t debugfs none /sys/kernel/debug
# echo -n 'module sctp +p' > /sys/kernel/debug/dynamic_debug/control
This can be done more fine-grained on a per file, per line basis and others
as described in [2].
[1] https://www.kernel.org/doc/ols/2009/ols2009-pages-39-46.pdf
[2] Documentation/dynamic-debug-howto.txt
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-06-29 01:49:40 +08:00
|
|
|
|
|
|
|
pr_debug("src=%pI6 - ", &fl6->saddr);
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
net: sctp: fix ipv6 ipsec encryption bug in sctp_v6_xmit
Alan Chester reported an issue with IPv6 on SCTP that IPsec traffic is not
being encrypted, whereas on IPv4 it is. Setting up an AH + ESP transport
does not seem to have the desired effect:
SCTP + IPv4:
22:14:20.809645 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 116)
192.168.0.2 > 192.168.0.5: AH(spi=0x00000042,sumlen=16,seq=0x1): ESP(spi=0x00000044,seq=0x1), length 72
22:14:20.813270 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 340)
192.168.0.5 > 192.168.0.2: AH(spi=0x00000043,sumlen=16,seq=0x1):
SCTP + IPv6:
22:31:19.215029 IP6 (class 0x02, hlim 64, next-header SCTP (132) payload length: 364)
fe80::222:15ff:fe87:7fc.3333 > fe80::92e6:baff:fe0d:5a54.36767: sctp
1) [INIT ACK] [init tag: 747759530] [rwnd: 62464] [OS: 10] [MIS: 10]
Moreover, Alan says:
This problem was seen with both Racoon and Racoon2. Other people have seen
this with OpenSwan. When IPsec is configured to encrypt all upper layer
protocols the SCTP connection does not initialize. After using Wireshark to
follow packets, this is because the SCTP packet leaves Box A unencrypted and
Box B believes all upper layer protocols are to be encrypted so it drops
this packet, causing the SCTP connection to fail to initialize. When IPsec
is configured to encrypt just SCTP, the SCTP packets are observed unencrypted.
In fact, using `socat sctp6-listen:3333 -` on one end and transferring "plaintext"
string on the other end, results in cleartext on the wire where SCTP eventually
does not report any errors, thus in the latter case that Alan reports, the
non-paranoid user might think he's communicating over an encrypted transport on
SCTP although he's not (tcpdump ... -X):
...
0x0030: 5d70 8e1a 0003 001a 177d eb6c 0000 0000 ]p.......}.l....
0x0040: 0000 0000 706c 6169 6e74 6578 740a 0000 ....plaintext...
Only in /proc/net/xfrm_stat we can see XfrmInTmplMismatch increasing on the
receiver side. Initial follow-up analysis from Alan's bug report was done by
Alexey Dobriyan. Also thanks to Vlad Yasevich for feedback on this.
SCTP has its own implementation of sctp_v6_xmit() not calling inet6_csk_xmit().
This has the implication that it probably never really got updated along with
changes in inet6_csk_xmit() and therefore does not seem to invoke xfrm handlers.
SCTP's IPv4 xmit however, properly calls ip_queue_xmit() to do the work. Since
a call to inet6_csk_xmit() would solve this problem, but result in unecessary
route lookups, let us just use the cached flowi6 instead that we got through
sctp_v6_get_dst(). Since all SCTP packets are being sent through sctp_packet_transmit(),
we do the route lookup / flow caching in sctp_transport_route(), hold it in
tp->dst and skb_dst_set() right after that. If we would alter fl6->daddr in
sctp_v6_xmit() to np->opt->srcrt, we possibly could run into the same effect
of not having xfrm layer pick it up, hence, use fl6_update_dst() in sctp_v6_get_dst()
instead to get the correct source routed dst entry, which we assign to the skb.
Also source address routing example from 625034113 ("sctp: fix sctp to work with
ipv6 source address routing") still works with this patch! Nevertheless, in RFC5095
it is actually 'recommended' to not use that anyway due to traffic amplification [1].
So it seems we're not supposed to do that anyway in sctp_v6_xmit(). Moreover, if
we overwrite the flow destination here, the lower IPv6 layer will be unable to
put the correct destination address into IP header, as routing header is added in
ipv6_push_nfrag_opts() but then probably with wrong final destination. Things aside,
result of this patch is that we do not have any XfrmInTmplMismatch increase plus on
the wire with this patch it now looks like:
SCTP + IPv6:
08:17:47.074080 IP6 2620:52:0:102f:7a2b:cbff:fe27:1b0a > 2620:52:0:102f:213:72ff:fe32:7eba:
AH(spi=0x00005fb4,seq=0x1): ESP(spi=0x00005fb5,seq=0x1), length 72
08:17:47.074264 IP6 2620:52:0:102f:213:72ff:fe32:7eba > 2620:52:0:102f:7a2b:cbff:fe27:1b0a:
AH(spi=0x00003d54,seq=0x1): ESP(spi=0x00003d55,seq=0x1), length 296
This fixes Kernel Bugzilla 24412. This security issue seems to be present since
2.6.18 kernels. Lets just hope some big passive adversary in the wild didn't have
its fun with that. lksctp-tools IPv6 regression test suite passes as well with
this patch.
[1] http://www.secdev.org/conf/IPv6_RH_security-csw07.pdf
Reported-by: Alan Chester <alan.chester@tekelec.com>
Reported-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-09-11 22:58:36 +08:00
|
|
|
final_p = fl6_update_dst(fl6, np->opt, &final);
|
|
|
|
dst = ip6_dst_lookup_flow(sk, fl6, final_p, false);
|
2011-04-27 05:36:32 +08:00
|
|
|
if (!asoc || saddr)
|
|
|
|
goto out;
|
|
|
|
|
2011-04-27 05:51:31 +08:00
|
|
|
bp = &asoc->base.bind_addr;
|
|
|
|
scope = sctp_scope(daddr);
|
|
|
|
/* ip6_dst_lookup has filled in the fl6->saddr for us. Check
|
|
|
|
* to see if we can use it.
|
|
|
|
*/
|
2011-04-27 05:52:27 +08:00
|
|
|
if (!IS_ERR(dst)) {
|
2011-04-27 05:51:31 +08:00
|
|
|
/* Walk through the bind address list and look for a bind
|
|
|
|
* address that matches the source address of the returned dst.
|
2011-04-27 05:36:32 +08:00
|
|
|
*/
|
2011-04-27 05:51:31 +08:00
|
|
|
sctp_v6_to_addr(&dst_saddr, &fl6->saddr, htons(bp->port));
|
2011-04-27 05:36:32 +08:00
|
|
|
rcu_read_lock();
|
|
|
|
list_for_each_entry_rcu(laddr, &bp->address_list, list) {
|
2013-10-23 00:34:56 +08:00
|
|
|
if (!laddr->valid || laddr->state == SCTP_ADDR_DEL ||
|
|
|
|
(laddr->state != SCTP_ADDR_SRC &&
|
|
|
|
!asoc->src_out_of_asoc_ok))
|
2011-04-27 05:36:32 +08:00
|
|
|
continue;
|
2011-04-27 05:51:31 +08:00
|
|
|
|
|
|
|
/* Do not compare against v4 addrs */
|
|
|
|
if ((laddr->a.sa.sa_family == AF_INET6) &&
|
|
|
|
(sctp_v6_cmp_addr(&dst_saddr, &laddr->a))) {
|
|
|
|
rcu_read_unlock();
|
|
|
|
goto out;
|
2011-04-27 05:36:32 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
rcu_read_unlock();
|
2011-04-27 05:51:31 +08:00
|
|
|
/* None of the bound addresses match the source address of the
|
|
|
|
* dst. So release it.
|
|
|
|
*/
|
|
|
|
dst_release(dst);
|
|
|
|
dst = NULL;
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
2011-04-27 05:51:31 +08:00
|
|
|
/* Walk through the bind address list and try to get the
|
|
|
|
* best source address for a given destination.
|
|
|
|
*/
|
|
|
|
rcu_read_lock();
|
|
|
|
list_for_each_entry_rcu(laddr, &bp->address_list, list) {
|
2013-02-12 21:30:16 +08:00
|
|
|
if (!laddr->valid)
|
2011-04-27 05:51:31 +08:00
|
|
|
continue;
|
2013-02-12 21:30:16 +08:00
|
|
|
if ((laddr->state == SCTP_ADDR_SRC) &&
|
|
|
|
(laddr->a.sa.sa_family == AF_INET6) &&
|
2011-04-27 05:51:31 +08:00
|
|
|
(scope <= sctp_scope(&laddr->a))) {
|
|
|
|
bmatchlen = sctp_v6_addr_match_len(daddr, &laddr->a);
|
|
|
|
if (!baddr || (matchlen < bmatchlen)) {
|
|
|
|
baddr = &laddr->a;
|
|
|
|
matchlen = bmatchlen;
|
|
|
|
}
|
2011-04-27 05:36:32 +08:00
|
|
|
}
|
|
|
|
}
|
2011-04-27 05:51:31 +08:00
|
|
|
rcu_read_unlock();
|
net: sctp: fix ipv6 ipsec encryption bug in sctp_v6_xmit
Alan Chester reported an issue with IPv6 on SCTP that IPsec traffic is not
being encrypted, whereas on IPv4 it is. Setting up an AH + ESP transport
does not seem to have the desired effect:
SCTP + IPv4:
22:14:20.809645 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 116)
192.168.0.2 > 192.168.0.5: AH(spi=0x00000042,sumlen=16,seq=0x1): ESP(spi=0x00000044,seq=0x1), length 72
22:14:20.813270 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 340)
192.168.0.5 > 192.168.0.2: AH(spi=0x00000043,sumlen=16,seq=0x1):
SCTP + IPv6:
22:31:19.215029 IP6 (class 0x02, hlim 64, next-header SCTP (132) payload length: 364)
fe80::222:15ff:fe87:7fc.3333 > fe80::92e6:baff:fe0d:5a54.36767: sctp
1) [INIT ACK] [init tag: 747759530] [rwnd: 62464] [OS: 10] [MIS: 10]
Moreover, Alan says:
This problem was seen with both Racoon and Racoon2. Other people have seen
this with OpenSwan. When IPsec is configured to encrypt all upper layer
protocols the SCTP connection does not initialize. After using Wireshark to
follow packets, this is because the SCTP packet leaves Box A unencrypted and
Box B believes all upper layer protocols are to be encrypted so it drops
this packet, causing the SCTP connection to fail to initialize. When IPsec
is configured to encrypt just SCTP, the SCTP packets are observed unencrypted.
In fact, using `socat sctp6-listen:3333 -` on one end and transferring "plaintext"
string on the other end, results in cleartext on the wire where SCTP eventually
does not report any errors, thus in the latter case that Alan reports, the
non-paranoid user might think he's communicating over an encrypted transport on
SCTP although he's not (tcpdump ... -X):
...
0x0030: 5d70 8e1a 0003 001a 177d eb6c 0000 0000 ]p.......}.l....
0x0040: 0000 0000 706c 6169 6e74 6578 740a 0000 ....plaintext...
Only in /proc/net/xfrm_stat we can see XfrmInTmplMismatch increasing on the
receiver side. Initial follow-up analysis from Alan's bug report was done by
Alexey Dobriyan. Also thanks to Vlad Yasevich for feedback on this.
SCTP has its own implementation of sctp_v6_xmit() not calling inet6_csk_xmit().
This has the implication that it probably never really got updated along with
changes in inet6_csk_xmit() and therefore does not seem to invoke xfrm handlers.
SCTP's IPv4 xmit however, properly calls ip_queue_xmit() to do the work. Since
a call to inet6_csk_xmit() would solve this problem, but result in unecessary
route lookups, let us just use the cached flowi6 instead that we got through
sctp_v6_get_dst(). Since all SCTP packets are being sent through sctp_packet_transmit(),
we do the route lookup / flow caching in sctp_transport_route(), hold it in
tp->dst and skb_dst_set() right after that. If we would alter fl6->daddr in
sctp_v6_xmit() to np->opt->srcrt, we possibly could run into the same effect
of not having xfrm layer pick it up, hence, use fl6_update_dst() in sctp_v6_get_dst()
instead to get the correct source routed dst entry, which we assign to the skb.
Also source address routing example from 625034113 ("sctp: fix sctp to work with
ipv6 source address routing") still works with this patch! Nevertheless, in RFC5095
it is actually 'recommended' to not use that anyway due to traffic amplification [1].
So it seems we're not supposed to do that anyway in sctp_v6_xmit(). Moreover, if
we overwrite the flow destination here, the lower IPv6 layer will be unable to
put the correct destination address into IP header, as routing header is added in
ipv6_push_nfrag_opts() but then probably with wrong final destination. Things aside,
result of this patch is that we do not have any XfrmInTmplMismatch increase plus on
the wire with this patch it now looks like:
SCTP + IPv6:
08:17:47.074080 IP6 2620:52:0:102f:7a2b:cbff:fe27:1b0a > 2620:52:0:102f:213:72ff:fe32:7eba:
AH(spi=0x00005fb4,seq=0x1): ESP(spi=0x00005fb5,seq=0x1), length 72
08:17:47.074264 IP6 2620:52:0:102f:213:72ff:fe32:7eba > 2620:52:0:102f:7a2b:cbff:fe27:1b0a:
AH(spi=0x00003d54,seq=0x1): ESP(spi=0x00003d55,seq=0x1), length 296
This fixes Kernel Bugzilla 24412. This security issue seems to be present since
2.6.18 kernels. Lets just hope some big passive adversary in the wild didn't have
its fun with that. lksctp-tools IPv6 regression test suite passes as well with
this patch.
[1] http://www.secdev.org/conf/IPv6_RH_security-csw07.pdf
Reported-by: Alan Chester <alan.chester@tekelec.com>
Reported-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-09-11 22:58:36 +08:00
|
|
|
|
2011-04-27 05:51:31 +08:00
|
|
|
if (baddr) {
|
2011-11-21 11:39:03 +08:00
|
|
|
fl6->saddr = baddr->v6.sin6_addr;
|
2011-04-27 05:52:27 +08:00
|
|
|
fl6->fl6_sport = baddr->v6.sin6_port;
|
net: sctp: fix ipv6 ipsec encryption bug in sctp_v6_xmit
Alan Chester reported an issue with IPv6 on SCTP that IPsec traffic is not
being encrypted, whereas on IPv4 it is. Setting up an AH + ESP transport
does not seem to have the desired effect:
SCTP + IPv4:
22:14:20.809645 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 116)
192.168.0.2 > 192.168.0.5: AH(spi=0x00000042,sumlen=16,seq=0x1): ESP(spi=0x00000044,seq=0x1), length 72
22:14:20.813270 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 340)
192.168.0.5 > 192.168.0.2: AH(spi=0x00000043,sumlen=16,seq=0x1):
SCTP + IPv6:
22:31:19.215029 IP6 (class 0x02, hlim 64, next-header SCTP (132) payload length: 364)
fe80::222:15ff:fe87:7fc.3333 > fe80::92e6:baff:fe0d:5a54.36767: sctp
1) [INIT ACK] [init tag: 747759530] [rwnd: 62464] [OS: 10] [MIS: 10]
Moreover, Alan says:
This problem was seen with both Racoon and Racoon2. Other people have seen
this with OpenSwan. When IPsec is configured to encrypt all upper layer
protocols the SCTP connection does not initialize. After using Wireshark to
follow packets, this is because the SCTP packet leaves Box A unencrypted and
Box B believes all upper layer protocols are to be encrypted so it drops
this packet, causing the SCTP connection to fail to initialize. When IPsec
is configured to encrypt just SCTP, the SCTP packets are observed unencrypted.
In fact, using `socat sctp6-listen:3333 -` on one end and transferring "plaintext"
string on the other end, results in cleartext on the wire where SCTP eventually
does not report any errors, thus in the latter case that Alan reports, the
non-paranoid user might think he's communicating over an encrypted transport on
SCTP although he's not (tcpdump ... -X):
...
0x0030: 5d70 8e1a 0003 001a 177d eb6c 0000 0000 ]p.......}.l....
0x0040: 0000 0000 706c 6169 6e74 6578 740a 0000 ....plaintext...
Only in /proc/net/xfrm_stat we can see XfrmInTmplMismatch increasing on the
receiver side. Initial follow-up analysis from Alan's bug report was done by
Alexey Dobriyan. Also thanks to Vlad Yasevich for feedback on this.
SCTP has its own implementation of sctp_v6_xmit() not calling inet6_csk_xmit().
This has the implication that it probably never really got updated along with
changes in inet6_csk_xmit() and therefore does not seem to invoke xfrm handlers.
SCTP's IPv4 xmit however, properly calls ip_queue_xmit() to do the work. Since
a call to inet6_csk_xmit() would solve this problem, but result in unecessary
route lookups, let us just use the cached flowi6 instead that we got through
sctp_v6_get_dst(). Since all SCTP packets are being sent through sctp_packet_transmit(),
we do the route lookup / flow caching in sctp_transport_route(), hold it in
tp->dst and skb_dst_set() right after that. If we would alter fl6->daddr in
sctp_v6_xmit() to np->opt->srcrt, we possibly could run into the same effect
of not having xfrm layer pick it up, hence, use fl6_update_dst() in sctp_v6_get_dst()
instead to get the correct source routed dst entry, which we assign to the skb.
Also source address routing example from 625034113 ("sctp: fix sctp to work with
ipv6 source address routing") still works with this patch! Nevertheless, in RFC5095
it is actually 'recommended' to not use that anyway due to traffic amplification [1].
So it seems we're not supposed to do that anyway in sctp_v6_xmit(). Moreover, if
we overwrite the flow destination here, the lower IPv6 layer will be unable to
put the correct destination address into IP header, as routing header is added in
ipv6_push_nfrag_opts() but then probably with wrong final destination. Things aside,
result of this patch is that we do not have any XfrmInTmplMismatch increase plus on
the wire with this patch it now looks like:
SCTP + IPv6:
08:17:47.074080 IP6 2620:52:0:102f:7a2b:cbff:fe27:1b0a > 2620:52:0:102f:213:72ff:fe32:7eba:
AH(spi=0x00005fb4,seq=0x1): ESP(spi=0x00005fb5,seq=0x1), length 72
08:17:47.074264 IP6 2620:52:0:102f:213:72ff:fe32:7eba > 2620:52:0:102f:7a2b:cbff:fe27:1b0a:
AH(spi=0x00003d54,seq=0x1): ESP(spi=0x00003d55,seq=0x1), length 296
This fixes Kernel Bugzilla 24412. This security issue seems to be present since
2.6.18 kernels. Lets just hope some big passive adversary in the wild didn't have
its fun with that. lksctp-tools IPv6 regression test suite passes as well with
this patch.
[1] http://www.secdev.org/conf/IPv6_RH_security-csw07.pdf
Reported-by: Alan Chester <alan.chester@tekelec.com>
Reported-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-09-11 22:58:36 +08:00
|
|
|
final_p = fl6_update_dst(fl6, np->opt, &final);
|
|
|
|
dst = ip6_dst_lookup_flow(sk, fl6, final_p, false);
|
2011-04-27 05:51:31 +08:00
|
|
|
}
|
|
|
|
|
2011-04-27 05:36:32 +08:00
|
|
|
out:
|
2012-11-30 07:17:42 +08:00
|
|
|
if (!IS_ERR_OR_NULL(dst)) {
|
2005-04-17 06:20:36 +08:00
|
|
|
struct rt6_info *rt;
|
net: sctp: rework debugging framework to use pr_debug and friends
We should get rid of all own SCTP debug printk macros and use the ones
that the kernel offers anyway instead. This makes the code more readable
and conform to the kernel code, and offers all the features of dynamic
debbuging that pr_debug() et al has, such as only turning on/off portions
of debug messages at runtime through debugfs. The runtime cost of having
CONFIG_DYNAMIC_DEBUG enabled, but none of the debug statements printing,
is negligible [1]. If kernel debugging is completly turned off, then these
statements will also compile into "empty" functions.
While we're at it, we also need to change the Kconfig option as it /now/
only refers to the ifdef'ed code portions in outqueue.c that enable further
debugging/tracing of SCTP transaction fields. Also, since SCTP_ASSERT code
was enabled with this Kconfig option and has now been removed, we
transform those code parts into WARNs resp. where appropriate BUG_ONs so
that those bugs can be more easily detected as probably not many people
have SCTP debugging permanently turned on.
To turn on all SCTP debugging, the following steps are needed:
# mount -t debugfs none /sys/kernel/debug
# echo -n 'module sctp +p' > /sys/kernel/debug/dynamic_debug/control
This can be done more fine-grained on a per file, per line basis and others
as described in [2].
[1] https://www.kernel.org/doc/ols/2009/ols2009-pages-39-46.pdf
[2] Documentation/dynamic-debug-howto.txt
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-06-29 01:49:40 +08:00
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
rt = (struct rt6_info *)dst;
|
2011-04-27 05:54:17 +08:00
|
|
|
t->dst = dst;
|
2013-08-02 10:45:13 +08:00
|
|
|
t->dst_cookie = rt->rt6i_node ? rt->rt6i_node->fn_sernum : 0;
|
net: sctp: rework debugging framework to use pr_debug and friends
We should get rid of all own SCTP debug printk macros and use the ones
that the kernel offers anyway instead. This makes the code more readable
and conform to the kernel code, and offers all the features of dynamic
debbuging that pr_debug() et al has, such as only turning on/off portions
of debug messages at runtime through debugfs. The runtime cost of having
CONFIG_DYNAMIC_DEBUG enabled, but none of the debug statements printing,
is negligible [1]. If kernel debugging is completly turned off, then these
statements will also compile into "empty" functions.
While we're at it, we also need to change the Kconfig option as it /now/
only refers to the ifdef'ed code portions in outqueue.c that enable further
debugging/tracing of SCTP transaction fields. Also, since SCTP_ASSERT code
was enabled with this Kconfig option and has now been removed, we
transform those code parts into WARNs resp. where appropriate BUG_ONs so
that those bugs can be more easily detected as probably not many people
have SCTP debugging permanently turned on.
To turn on all SCTP debugging, the following steps are needed:
# mount -t debugfs none /sys/kernel/debug
# echo -n 'module sctp +p' > /sys/kernel/debug/dynamic_debug/control
This can be done more fine-grained on a per file, per line basis and others
as described in [2].
[1] https://www.kernel.org/doc/ols/2009/ols2009-pages-39-46.pdf
[2] Documentation/dynamic-debug-howto.txt
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-06-29 01:49:40 +08:00
|
|
|
pr_debug("rt6_dst:%pI6 rt6_src:%pI6\n", &rt->rt6i_dst.addr,
|
|
|
|
&fl6->saddr);
|
2011-04-27 05:54:17 +08:00
|
|
|
} else {
|
|
|
|
t->dst = NULL;
|
net: sctp: rework debugging framework to use pr_debug and friends
We should get rid of all own SCTP debug printk macros and use the ones
that the kernel offers anyway instead. This makes the code more readable
and conform to the kernel code, and offers all the features of dynamic
debbuging that pr_debug() et al has, such as only turning on/off portions
of debug messages at runtime through debugfs. The runtime cost of having
CONFIG_DYNAMIC_DEBUG enabled, but none of the debug statements printing,
is negligible [1]. If kernel debugging is completly turned off, then these
statements will also compile into "empty" functions.
While we're at it, we also need to change the Kconfig option as it /now/
only refers to the ifdef'ed code portions in outqueue.c that enable further
debugging/tracing of SCTP transaction fields. Also, since SCTP_ASSERT code
was enabled with this Kconfig option and has now been removed, we
transform those code parts into WARNs resp. where appropriate BUG_ONs so
that those bugs can be more easily detected as probably not many people
have SCTP debugging permanently turned on.
To turn on all SCTP debugging, the following steps are needed:
# mount -t debugfs none /sys/kernel/debug
# echo -n 'module sctp +p' > /sys/kernel/debug/dynamic_debug/control
This can be done more fine-grained on a per file, per line basis and others
as described in [2].
[1] https://www.kernel.org/doc/ols/2009/ols2009-pages-39-46.pdf
[2] Documentation/dynamic-debug-howto.txt
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-06-29 01:49:40 +08:00
|
|
|
|
|
|
|
pr_debug("no route\n");
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Returns the number of consecutive initial bits that match in the 2 ipv6
|
|
|
|
* addresses.
|
|
|
|
*/
|
|
|
|
static inline int sctp_v6_addr_match_len(union sctp_addr *s1,
|
|
|
|
union sctp_addr *s2)
|
|
|
|
{
|
2010-03-26 16:34:30 +08:00
|
|
|
return ipv6_addr_diff(&s1->v6.sin6_addr, &s2->v6.sin6_addr);
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Fills in the source address(saddr) based on the destination address(daddr)
|
|
|
|
* and asoc's bind address list.
|
|
|
|
*/
|
2008-05-29 18:55:05 +08:00
|
|
|
static void sctp_v6_get_saddr(struct sctp_sock *sk,
|
2011-04-27 05:51:31 +08:00
|
|
|
struct sctp_transport *t,
|
|
|
|
struct flowi *fl)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
2011-04-27 05:51:31 +08:00
|
|
|
struct flowi6 *fl6 = &fl->u.ip6;
|
|
|
|
union sctp_addr *saddr = &t->saddr;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
net: sctp: rework debugging framework to use pr_debug and friends
We should get rid of all own SCTP debug printk macros and use the ones
that the kernel offers anyway instead. This makes the code more readable
and conform to the kernel code, and offers all the features of dynamic
debbuging that pr_debug() et al has, such as only turning on/off portions
of debug messages at runtime through debugfs. The runtime cost of having
CONFIG_DYNAMIC_DEBUG enabled, but none of the debug statements printing,
is negligible [1]. If kernel debugging is completly turned off, then these
statements will also compile into "empty" functions.
While we're at it, we also need to change the Kconfig option as it /now/
only refers to the ifdef'ed code portions in outqueue.c that enable further
debugging/tracing of SCTP transaction fields. Also, since SCTP_ASSERT code
was enabled with this Kconfig option and has now been removed, we
transform those code parts into WARNs resp. where appropriate BUG_ONs so
that those bugs can be more easily detected as probably not many people
have SCTP debugging permanently turned on.
To turn on all SCTP debugging, the following steps are needed:
# mount -t debugfs none /sys/kernel/debug
# echo -n 'module sctp +p' > /sys/kernel/debug/dynamic_debug/control
This can be done more fine-grained on a per file, per line basis and others
as described in [2].
[1] https://www.kernel.org/doc/ols/2009/ols2009-pages-39-46.pdf
[2] Documentation/dynamic-debug-howto.txt
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-06-29 01:49:40 +08:00
|
|
|
pr_debug("%s: asoc:%p dst:%p\n", __func__, t->asoc, t->dst);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2011-04-27 05:51:31 +08:00
|
|
|
if (t->dst) {
|
|
|
|
saddr->v6.sin6_family = AF_INET6;
|
2011-11-21 11:39:03 +08:00
|
|
|
saddr->v6.sin6_addr = fl6->saddr;
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Make a copy of all potential local addresses. */
|
|
|
|
static void sctp_v6_copy_addrlist(struct list_head *addrlist,
|
|
|
|
struct net_device *dev)
|
|
|
|
{
|
|
|
|
struct inet6_dev *in6_dev;
|
|
|
|
struct inet6_ifaddr *ifp;
|
|
|
|
struct sctp_sockaddr_entry *addr;
|
|
|
|
|
2006-09-23 05:44:24 +08:00
|
|
|
rcu_read_lock();
|
2005-04-17 06:20:36 +08:00
|
|
|
if ((in6_dev = __in6_dev_get(dev)) == NULL) {
|
2006-09-23 05:44:24 +08:00
|
|
|
rcu_read_unlock();
|
2005-04-17 06:20:36 +08:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2007-03-09 06:43:41 +08:00
|
|
|
read_lock_bh(&in6_dev->lock);
|
2010-03-18 04:31:13 +08:00
|
|
|
list_for_each_entry(ifp, &in6_dev->addr_list, if_list) {
|
2005-04-17 06:20:36 +08:00
|
|
|
/* Add the address to the local list. */
|
2013-06-17 17:40:04 +08:00
|
|
|
addr = kzalloc(sizeof(*addr), GFP_ATOMIC);
|
2005-04-17 06:20:36 +08:00
|
|
|
if (addr) {
|
2006-11-21 09:04:42 +08:00
|
|
|
addr->a.v6.sin6_family = AF_INET6;
|
|
|
|
addr->a.v6.sin6_port = 0;
|
2011-11-21 11:39:03 +08:00
|
|
|
addr->a.v6.sin6_addr = ifp->addr;
|
2006-11-21 09:04:42 +08:00
|
|
|
addr->a.v6.sin6_scope_id = dev->ifindex;
|
2007-09-17 07:02:12 +08:00
|
|
|
addr->valid = 1;
|
2005-04-17 06:20:36 +08:00
|
|
|
INIT_LIST_HEAD(&addr->list);
|
|
|
|
list_add_tail(&addr->list, addrlist);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2007-03-09 06:43:41 +08:00
|
|
|
read_unlock_bh(&in6_dev->lock);
|
2006-09-23 05:44:24 +08:00
|
|
|
rcu_read_unlock();
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Initialize a sockaddr_storage from in incoming skb. */
|
|
|
|
static void sctp_v6_from_skb(union sctp_addr *addr,struct sk_buff *skb,
|
|
|
|
int is_saddr)
|
|
|
|
{
|
2006-11-21 09:09:40 +08:00
|
|
|
__be16 *port;
|
2005-04-17 06:20:36 +08:00
|
|
|
struct sctphdr *sh;
|
|
|
|
|
|
|
|
port = &addr->v6.sin6_port;
|
|
|
|
addr->v6.sin6_family = AF_INET6;
|
|
|
|
addr->v6.sin6_flowinfo = 0; /* FIXME */
|
|
|
|
addr->v6.sin6_scope_id = ((struct inet6_skb_parm *)skb->cb)->iif;
|
|
|
|
|
2007-03-14 00:59:32 +08:00
|
|
|
sh = sctp_hdr(skb);
|
2005-04-17 06:20:36 +08:00
|
|
|
if (is_saddr) {
|
2006-11-21 09:09:40 +08:00
|
|
|
*port = sh->source;
|
2011-11-21 11:39:03 +08:00
|
|
|
addr->v6.sin6_addr = ipv6_hdr(skb)->saddr;
|
2005-04-17 06:20:36 +08:00
|
|
|
} else {
|
2006-11-21 09:09:40 +08:00
|
|
|
*port = sh->dest;
|
2011-11-21 11:39:03 +08:00
|
|
|
addr->v6.sin6_addr = ipv6_hdr(skb)->daddr;
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Initialize an sctp_addr from a socket. */
|
|
|
|
static void sctp_v6_from_sk(union sctp_addr *addr, struct sock *sk)
|
|
|
|
{
|
|
|
|
addr->v6.sin6_family = AF_INET6;
|
2006-11-21 09:24:21 +08:00
|
|
|
addr->v6.sin6_port = 0;
|
ipv6: make lookups simpler and faster
TCP listener refactoring, part 4 :
To speed up inet lookups, we moved IPv4 addresses from inet to struct
sock_common
Now is time to do the same for IPv6, because it permits us to have fast
lookups for all kind of sockets, including upcoming SYN_RECV.
Getting IPv6 addresses in TCP lookups currently requires two extra cache
lines, plus a dereference (and memory stall).
inet6_sk(sk) does the dereference of inet_sk(__sk)->pinet6
This patch is way bigger than its IPv4 counter part, because for IPv4,
we could add aliases (inet_daddr, inet_rcv_saddr), while on IPv6,
it's not doable easily.
inet6_sk(sk)->daddr becomes sk->sk_v6_daddr
inet6_sk(sk)->rcv_saddr becomes sk->sk_v6_rcv_saddr
And timewait socket also have tw->tw_v6_daddr & tw->tw_v6_rcv_saddr
at the same offset.
We get rid of INET6_TW_MATCH() as INET6_MATCH() is now the generic
macro.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-10-04 06:42:29 +08:00
|
|
|
addr->v6.sin6_addr = sk->sk_v6_rcv_saddr;
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Initialize sk->sk_rcv_saddr from sctp_addr. */
|
|
|
|
static void sctp_v6_to_sk_saddr(union sctp_addr *addr, struct sock *sk)
|
|
|
|
{
|
|
|
|
if (addr->sa.sa_family == AF_INET && sctp_sk(sk)->v4mapped) {
|
ipv6: make lookups simpler and faster
TCP listener refactoring, part 4 :
To speed up inet lookups, we moved IPv4 addresses from inet to struct
sock_common
Now is time to do the same for IPv6, because it permits us to have fast
lookups for all kind of sockets, including upcoming SYN_RECV.
Getting IPv6 addresses in TCP lookups currently requires two extra cache
lines, plus a dereference (and memory stall).
inet6_sk(sk) does the dereference of inet_sk(__sk)->pinet6
This patch is way bigger than its IPv4 counter part, because for IPv4,
we could add aliases (inet_daddr, inet_rcv_saddr), while on IPv6,
it's not doable easily.
inet6_sk(sk)->daddr becomes sk->sk_v6_daddr
inet6_sk(sk)->rcv_saddr becomes sk->sk_v6_rcv_saddr
And timewait socket also have tw->tw_v6_daddr & tw->tw_v6_rcv_saddr
at the same offset.
We get rid of INET6_TW_MATCH() as INET6_MATCH() is now the generic
macro.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-10-04 06:42:29 +08:00
|
|
|
sk->sk_v6_rcv_saddr.s6_addr32[0] = 0;
|
|
|
|
sk->sk_v6_rcv_saddr.s6_addr32[1] = 0;
|
|
|
|
sk->sk_v6_rcv_saddr.s6_addr32[2] = htonl(0x0000ffff);
|
|
|
|
sk->sk_v6_rcv_saddr.s6_addr32[3] =
|
2005-04-17 06:20:36 +08:00
|
|
|
addr->v4.sin_addr.s_addr;
|
|
|
|
} else {
|
ipv6: make lookups simpler and faster
TCP listener refactoring, part 4 :
To speed up inet lookups, we moved IPv4 addresses from inet to struct
sock_common
Now is time to do the same for IPv6, because it permits us to have fast
lookups for all kind of sockets, including upcoming SYN_RECV.
Getting IPv6 addresses in TCP lookups currently requires two extra cache
lines, plus a dereference (and memory stall).
inet6_sk(sk) does the dereference of inet_sk(__sk)->pinet6
This patch is way bigger than its IPv4 counter part, because for IPv4,
we could add aliases (inet_daddr, inet_rcv_saddr), while on IPv6,
it's not doable easily.
inet6_sk(sk)->daddr becomes sk->sk_v6_daddr
inet6_sk(sk)->rcv_saddr becomes sk->sk_v6_rcv_saddr
And timewait socket also have tw->tw_v6_daddr & tw->tw_v6_rcv_saddr
at the same offset.
We get rid of INET6_TW_MATCH() as INET6_MATCH() is now the generic
macro.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-10-04 06:42:29 +08:00
|
|
|
sk->sk_v6_rcv_saddr = addr->v6.sin6_addr;
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Initialize sk->sk_daddr from sctp_addr. */
|
|
|
|
static void sctp_v6_to_sk_daddr(union sctp_addr *addr, struct sock *sk)
|
|
|
|
{
|
|
|
|
if (addr->sa.sa_family == AF_INET && sctp_sk(sk)->v4mapped) {
|
ipv6: make lookups simpler and faster
TCP listener refactoring, part 4 :
To speed up inet lookups, we moved IPv4 addresses from inet to struct
sock_common
Now is time to do the same for IPv6, because it permits us to have fast
lookups for all kind of sockets, including upcoming SYN_RECV.
Getting IPv6 addresses in TCP lookups currently requires two extra cache
lines, plus a dereference (and memory stall).
inet6_sk(sk) does the dereference of inet_sk(__sk)->pinet6
This patch is way bigger than its IPv4 counter part, because for IPv4,
we could add aliases (inet_daddr, inet_rcv_saddr), while on IPv6,
it's not doable easily.
inet6_sk(sk)->daddr becomes sk->sk_v6_daddr
inet6_sk(sk)->rcv_saddr becomes sk->sk_v6_rcv_saddr
And timewait socket also have tw->tw_v6_daddr & tw->tw_v6_rcv_saddr
at the same offset.
We get rid of INET6_TW_MATCH() as INET6_MATCH() is now the generic
macro.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-10-04 06:42:29 +08:00
|
|
|
sk->sk_v6_daddr.s6_addr32[0] = 0;
|
|
|
|
sk->sk_v6_daddr.s6_addr32[1] = 0;
|
|
|
|
sk->sk_v6_daddr.s6_addr32[2] = htonl(0x0000ffff);
|
|
|
|
sk->sk_v6_daddr.s6_addr32[3] = addr->v4.sin_addr.s_addr;
|
2005-04-17 06:20:36 +08:00
|
|
|
} else {
|
ipv6: make lookups simpler and faster
TCP listener refactoring, part 4 :
To speed up inet lookups, we moved IPv4 addresses from inet to struct
sock_common
Now is time to do the same for IPv6, because it permits us to have fast
lookups for all kind of sockets, including upcoming SYN_RECV.
Getting IPv6 addresses in TCP lookups currently requires two extra cache
lines, plus a dereference (and memory stall).
inet6_sk(sk) does the dereference of inet_sk(__sk)->pinet6
This patch is way bigger than its IPv4 counter part, because for IPv4,
we could add aliases (inet_daddr, inet_rcv_saddr), while on IPv6,
it's not doable easily.
inet6_sk(sk)->daddr becomes sk->sk_v6_daddr
inet6_sk(sk)->rcv_saddr becomes sk->sk_v6_rcv_saddr
And timewait socket also have tw->tw_v6_daddr & tw->tw_v6_rcv_saddr
at the same offset.
We get rid of INET6_TW_MATCH() as INET6_MATCH() is now the generic
macro.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-10-04 06:42:29 +08:00
|
|
|
sk->sk_v6_daddr = addr->v6.sin6_addr;
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Initialize a sctp_addr from an address parameter. */
|
|
|
|
static void sctp_v6_from_addr_param(union sctp_addr *addr,
|
|
|
|
union sctp_addr_param *param,
|
2006-11-21 09:11:13 +08:00
|
|
|
__be16 port, int iif)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
|
|
|
addr->v6.sin6_family = AF_INET6;
|
|
|
|
addr->v6.sin6_port = port;
|
|
|
|
addr->v6.sin6_flowinfo = 0; /* BUG */
|
2011-11-21 11:39:03 +08:00
|
|
|
addr->v6.sin6_addr = param->v6.addr;
|
2005-04-17 06:20:36 +08:00
|
|
|
addr->v6.sin6_scope_id = iif;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Initialize an address parameter from a sctp_addr and return the length
|
|
|
|
* of the address parameter.
|
|
|
|
*/
|
|
|
|
static int sctp_v6_to_addr_param(const union sctp_addr *addr,
|
|
|
|
union sctp_addr_param *param)
|
|
|
|
{
|
|
|
|
int length = sizeof(sctp_ipv6addr_param_t);
|
|
|
|
|
|
|
|
param->v6.param_hdr.type = SCTP_PARAM_IPV6_ADDRESS;
|
2006-11-21 09:01:42 +08:00
|
|
|
param->v6.param_hdr.length = htons(length);
|
2011-11-21 11:39:03 +08:00
|
|
|
param->v6.addr = addr->v6.sin6_addr;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
return length;
|
|
|
|
}
|
|
|
|
|
2011-04-27 05:51:31 +08:00
|
|
|
/* Initialize a sctp_addr from struct in6_addr. */
|
|
|
|
static void sctp_v6_to_addr(union sctp_addr *addr, struct in6_addr *saddr,
|
2006-11-21 09:06:24 +08:00
|
|
|
__be16 port)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
|
|
|
addr->sa.sa_family = AF_INET6;
|
|
|
|
addr->v6.sin6_port = port;
|
2011-11-21 11:39:03 +08:00
|
|
|
addr->v6.sin6_addr = *saddr;
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Compare addresses exactly.
|
|
|
|
* v4-mapped-v6 is also in consideration.
|
|
|
|
*/
|
|
|
|
static int sctp_v6_cmp_addr(const union sctp_addr *addr1,
|
|
|
|
const union sctp_addr *addr2)
|
|
|
|
{
|
|
|
|
if (addr1->sa.sa_family != addr2->sa.sa_family) {
|
|
|
|
if (addr1->sa.sa_family == AF_INET &&
|
|
|
|
addr2->sa.sa_family == AF_INET6 &&
|
2007-08-25 14:16:08 +08:00
|
|
|
ipv6_addr_v4mapped(&addr2->v6.sin6_addr)) {
|
2005-04-17 06:20:36 +08:00
|
|
|
if (addr2->v6.sin6_port == addr1->v4.sin_port &&
|
|
|
|
addr2->v6.sin6_addr.s6_addr32[3] ==
|
|
|
|
addr1->v4.sin_addr.s_addr)
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
if (addr2->sa.sa_family == AF_INET &&
|
|
|
|
addr1->sa.sa_family == AF_INET6 &&
|
2007-08-25 14:16:08 +08:00
|
|
|
ipv6_addr_v4mapped(&addr1->v6.sin6_addr)) {
|
2005-04-17 06:20:36 +08:00
|
|
|
if (addr1->v6.sin6_port == addr2->v4.sin_port &&
|
|
|
|
addr1->v6.sin6_addr.s6_addr32[3] ==
|
|
|
|
addr2->v4.sin_addr.s_addr)
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (!ipv6_addr_equal(&addr1->v6.sin6_addr, &addr2->v6.sin6_addr))
|
|
|
|
return 0;
|
|
|
|
/* If this is a linklocal address, compare the scope_id. */
|
|
|
|
if (ipv6_addr_type(&addr1->v6.sin6_addr) & IPV6_ADDR_LINKLOCAL) {
|
|
|
|
if (addr1->v6.sin6_scope_id && addr2->v6.sin6_scope_id &&
|
|
|
|
(addr1->v6.sin6_scope_id != addr2->v6.sin6_scope_id)) {
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Initialize addr struct to INADDR_ANY. */
|
2006-11-21 09:24:53 +08:00
|
|
|
static void sctp_v6_inaddr_any(union sctp_addr *addr, __be16 port)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
|
|
|
memset(addr, 0x00, sizeof(union sctp_addr));
|
|
|
|
addr->v6.sin6_family = AF_INET6;
|
|
|
|
addr->v6.sin6_port = port;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Is this a wildcard address? */
|
|
|
|
static int sctp_v6_is_any(const union sctp_addr *addr)
|
|
|
|
{
|
2005-04-29 02:59:16 +08:00
|
|
|
return ipv6_addr_any(&addr->v6.sin6_addr);
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Should this be available for binding? */
|
|
|
|
static int sctp_v6_available(union sctp_addr *addr, struct sctp_sock *sp)
|
|
|
|
{
|
|
|
|
int type;
|
2011-04-22 12:53:02 +08:00
|
|
|
const struct in6_addr *in6 = (const struct in6_addr *)&addr->v6.sin6_addr;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
type = ipv6_addr_type(in6);
|
|
|
|
if (IPV6_ADDR_ANY == type)
|
|
|
|
return 1;
|
|
|
|
if (type == IPV6_ADDR_MAPPED) {
|
|
|
|
if (sp && !sp->v4mapped)
|
|
|
|
return 0;
|
|
|
|
if (sp && ipv6_only_sock(sctp_opt2sk(sp)))
|
|
|
|
return 0;
|
|
|
|
sctp_v6_map_v4(addr);
|
|
|
|
return sctp_get_af_specific(AF_INET)->available(addr, sp);
|
|
|
|
}
|
|
|
|
if (!(type & IPV6_ADDR_UNICAST))
|
|
|
|
return 0;
|
|
|
|
|
2012-08-06 16:46:26 +08:00
|
|
|
return ipv6_chk_addr(sock_net(&sp->inet.sk), in6, NULL, 0);
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
/* This function checks if the address is a valid address to be used for
|
|
|
|
* SCTP.
|
|
|
|
*
|
|
|
|
* Output:
|
|
|
|
* Return 0 - If the address is a non-unicast or an illegal address.
|
|
|
|
* Return 1 - If the address is a unicast.
|
|
|
|
*/
|
2006-06-18 13:55:35 +08:00
|
|
|
static int sctp_v6_addr_valid(union sctp_addr *addr,
|
|
|
|
struct sctp_sock *sp,
|
|
|
|
const struct sk_buff *skb)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
|
|
|
int ret = ipv6_addr_type(&addr->v6.sin6_addr);
|
|
|
|
|
|
|
|
/* Support v4-mapped-v6 address. */
|
|
|
|
if (ret == IPV6_ADDR_MAPPED) {
|
|
|
|
/* Note: This routine is used in input, so v4-mapped-v6
|
|
|
|
* are disallowed here when there is no sctp_sock.
|
|
|
|
*/
|
|
|
|
if (!sp || !sp->v4mapped)
|
|
|
|
return 0;
|
|
|
|
if (sp && ipv6_only_sock(sctp_opt2sk(sp)))
|
|
|
|
return 0;
|
|
|
|
sctp_v6_map_v4(addr);
|
2006-06-18 13:55:35 +08:00
|
|
|
return sctp_get_af_specific(AF_INET)->addr_valid(addr, sp, skb);
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Is this a non-unicast address */
|
|
|
|
if (!(ret & IPV6_ADDR_UNICAST))
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* What is the scope of 'addr'? */
|
|
|
|
static sctp_scope_t sctp_v6_scope(union sctp_addr *addr)
|
|
|
|
{
|
|
|
|
int v6scope;
|
|
|
|
sctp_scope_t retval;
|
|
|
|
|
|
|
|
/* The IPv6 scope is really a set of bit fields.
|
|
|
|
* See IFA_* in <net/if_inet6.h>. Map to a generic SCTP scope.
|
|
|
|
*/
|
|
|
|
|
|
|
|
v6scope = ipv6_addr_scope(&addr->v6.sin6_addr);
|
|
|
|
switch (v6scope) {
|
|
|
|
case IFA_HOST:
|
|
|
|
retval = SCTP_SCOPE_LOOPBACK;
|
|
|
|
break;
|
|
|
|
case IFA_LINK:
|
|
|
|
retval = SCTP_SCOPE_LINK;
|
|
|
|
break;
|
|
|
|
case IFA_SITE:
|
|
|
|
retval = SCTP_SCOPE_PRIVATE;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
retval = SCTP_SCOPE_GLOBAL;
|
|
|
|
break;
|
2007-04-21 08:09:22 +08:00
|
|
|
}
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
return retval;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Create and initialize a new sk for the socket to be returned by accept(). */
|
|
|
|
static struct sock *sctp_v6_create_accept_sk(struct sock *sk,
|
|
|
|
struct sctp_association *asoc)
|
|
|
|
{
|
|
|
|
struct sock *newsk;
|
|
|
|
struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
|
|
|
|
struct sctp6_sock *newsctp6sk;
|
|
|
|
|
2008-03-26 01:26:21 +08:00
|
|
|
newsk = sk_alloc(sock_net(sk), PF_INET6, GFP_KERNEL, sk->sk_prot);
|
2005-04-17 06:20:36 +08:00
|
|
|
if (!newsk)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
sock_init_data(NULL, newsk);
|
|
|
|
|
2009-02-13 16:33:44 +08:00
|
|
|
sctp_copy_sock(newsk, sk, asoc);
|
2005-04-17 06:20:36 +08:00
|
|
|
sock_reset_flag(sk, SOCK_ZAPPED);
|
|
|
|
|
|
|
|
newsctp6sk = (struct sctp6_sock *)newsk;
|
|
|
|
inet_sk(newsk)->pinet6 = &newsctp6sk->inet6;
|
|
|
|
|
2007-07-26 07:49:29 +08:00
|
|
|
sctp_sk(newsk)->v4mapped = sctp_sk(sk)->v4mapped;
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
newnp = inet6_sk(newsk);
|
|
|
|
|
|
|
|
memcpy(newnp, np, sizeof(struct ipv6_pinfo));
|
|
|
|
|
|
|
|
/* Initialize sk's sport, dport, rcv_saddr and daddr for getsockname()
|
|
|
|
* and getpeername().
|
|
|
|
*/
|
|
|
|
sctp_v6_to_sk_daddr(&asoc->peer.primary_addr, newsk);
|
|
|
|
|
2005-08-10 10:45:38 +08:00
|
|
|
sk_refcnt_debug_inc(newsk);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
if (newsk->sk_prot->init(newsk)) {
|
|
|
|
sk_common_release(newsk);
|
|
|
|
newsk = NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
out:
|
|
|
|
return newsk;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Map v4 address to mapped v6 address */
|
|
|
|
static void sctp_v6_addr_v4map(struct sctp_sock *sp, union sctp_addr *addr)
|
|
|
|
{
|
|
|
|
if (sp->v4mapped && AF_INET == addr->sa.sa_family)
|
|
|
|
sctp_v4_map_v6(addr);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Where did this skb come from? */
|
|
|
|
static int sctp_v6_skb_iif(const struct sk_buff *skb)
|
|
|
|
{
|
|
|
|
struct inet6_skb_parm *opt = (struct inet6_skb_parm *) skb->cb;
|
|
|
|
return opt->iif;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Was this packet marked by Explicit Congestion Notification? */
|
|
|
|
static int sctp_v6_is_ce(const struct sk_buff *skb)
|
|
|
|
{
|
2007-04-26 08:54:47 +08:00
|
|
|
return *((__u32 *)(ipv6_hdr(skb))) & htonl(1 << 20);
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Dump the v6 addr to the seq file. */
|
|
|
|
static void sctp_v6_seq_dump_addr(struct seq_file *seq, union sctp_addr *addr)
|
|
|
|
{
|
2008-10-30 03:52:50 +08:00
|
|
|
seq_printf(seq, "%pI6 ", &addr->v6.sin6_addr);
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
2008-06-05 03:40:15 +08:00
|
|
|
static void sctp_v6_ecn_capable(struct sock *sk)
|
|
|
|
{
|
|
|
|
inet6_sk(sk)->tclass |= INET_ECN_ECT_0;
|
|
|
|
}
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
/* Initialize a PF_INET6 socket msg_name. */
|
|
|
|
static void sctp_inet6_msgname(char *msgname, int *addr_len)
|
|
|
|
{
|
|
|
|
struct sockaddr_in6 *sin6;
|
|
|
|
|
|
|
|
sin6 = (struct sockaddr_in6 *)msgname;
|
|
|
|
sin6->sin6_family = AF_INET6;
|
|
|
|
sin6->sin6_flowinfo = 0;
|
|
|
|
sin6->sin6_scope_id = 0; /*FIXME */
|
|
|
|
*addr_len = sizeof(struct sockaddr_in6);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Initialize a PF_INET msgname from a ulpevent. */
|
|
|
|
static void sctp_inet6_event_msgname(struct sctp_ulpevent *event,
|
|
|
|
char *msgname, int *addrlen)
|
|
|
|
{
|
|
|
|
struct sockaddr_in6 *sin6, *sin6from;
|
|
|
|
|
|
|
|
if (msgname) {
|
|
|
|
union sctp_addr *addr;
|
|
|
|
struct sctp_association *asoc;
|
|
|
|
|
|
|
|
asoc = event->asoc;
|
|
|
|
sctp_inet6_msgname(msgname, addrlen);
|
|
|
|
sin6 = (struct sockaddr_in6 *)msgname;
|
|
|
|
sin6->sin6_port = htons(asoc->peer.port);
|
|
|
|
addr = &asoc->peer.primary_addr;
|
|
|
|
|
|
|
|
/* Note: If we go to a common v6 format, this code
|
|
|
|
* will change.
|
|
|
|
*/
|
|
|
|
|
|
|
|
/* Map ipv4 address into v4-mapped-on-v6 address. */
|
|
|
|
if (sctp_sk(asoc->base.sk)->v4mapped &&
|
|
|
|
AF_INET == addr->sa.sa_family) {
|
|
|
|
sctp_v4_map_v6((union sctp_addr *)sin6);
|
|
|
|
sin6->sin6_addr.s6_addr32[3] =
|
|
|
|
addr->v4.sin_addr.s_addr;
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
sin6from = &asoc->peer.primary_addr.v6;
|
2011-11-21 11:39:03 +08:00
|
|
|
sin6->sin6_addr = sin6from->sin6_addr;
|
2005-04-17 06:20:36 +08:00
|
|
|
if (ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_LINKLOCAL)
|
|
|
|
sin6->sin6_scope_id = sin6from->sin6_scope_id;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Initialize a msg_name from an inbound skb. */
|
|
|
|
static void sctp_inet6_skb_msgname(struct sk_buff *skb, char *msgname,
|
|
|
|
int *addr_len)
|
|
|
|
{
|
|
|
|
struct sctphdr *sh;
|
|
|
|
struct sockaddr_in6 *sin6;
|
|
|
|
|
|
|
|
if (msgname) {
|
|
|
|
sctp_inet6_msgname(msgname, addr_len);
|
|
|
|
sin6 = (struct sockaddr_in6 *)msgname;
|
2007-03-14 00:59:32 +08:00
|
|
|
sh = sctp_hdr(skb);
|
2005-04-17 06:20:36 +08:00
|
|
|
sin6->sin6_port = sh->source;
|
|
|
|
|
|
|
|
/* Map ipv4 address into v4-mapped-on-v6 address. */
|
|
|
|
if (sctp_sk(skb->sk)->v4mapped &&
|
2007-04-21 13:47:35 +08:00
|
|
|
ip_hdr(skb)->version == 4) {
|
2005-04-17 06:20:36 +08:00
|
|
|
sctp_v4_map_v6((union sctp_addr *)sin6);
|
2007-04-21 13:47:35 +08:00
|
|
|
sin6->sin6_addr.s6_addr32[3] = ip_hdr(skb)->saddr;
|
2005-04-17 06:20:36 +08:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Otherwise, just copy the v6 address. */
|
2011-11-21 11:39:03 +08:00
|
|
|
sin6->sin6_addr = ipv6_hdr(skb)->saddr;
|
2005-04-17 06:20:36 +08:00
|
|
|
if (ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_LINKLOCAL) {
|
|
|
|
struct sctp_ulpevent *ev = sctp_skb2event(skb);
|
|
|
|
sin6->sin6_scope_id = ev->iif;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Do we support this AF? */
|
|
|
|
static int sctp_inet6_af_supported(sa_family_t family, struct sctp_sock *sp)
|
|
|
|
{
|
|
|
|
switch (family) {
|
|
|
|
case AF_INET6:
|
|
|
|
return 1;
|
|
|
|
/* v4-mapped-v6 addresses */
|
|
|
|
case AF_INET:
|
2008-07-19 14:05:40 +08:00
|
|
|
if (!__ipv6_only_sock(sctp_opt2sk(sp)))
|
2005-04-17 06:20:36 +08:00
|
|
|
return 1;
|
|
|
|
default:
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Address matching with wildcards allowed. This extra level
|
|
|
|
* of indirection lets us choose whether a PF_INET6 should
|
|
|
|
* disallow any v4 addresses if we so choose.
|
|
|
|
*/
|
|
|
|
static int sctp_inet6_cmp_addr(const union sctp_addr *addr1,
|
|
|
|
const union sctp_addr *addr2,
|
|
|
|
struct sctp_sock *opt)
|
|
|
|
{
|
|
|
|
struct sctp_af *af1, *af2;
|
2008-08-18 22:34:34 +08:00
|
|
|
struct sock *sk = sctp_opt2sk(opt);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
af1 = sctp_get_af_specific(addr1->sa.sa_family);
|
|
|
|
af2 = sctp_get_af_specific(addr2->sa.sa_family);
|
|
|
|
|
|
|
|
if (!af1 || !af2)
|
|
|
|
return 0;
|
2008-07-19 14:05:40 +08:00
|
|
|
|
|
|
|
/* If the socket is IPv6 only, v4 addrs will not match */
|
2008-08-18 22:34:34 +08:00
|
|
|
if (__ipv6_only_sock(sk) && af1 != af2)
|
2008-07-19 14:05:40 +08:00
|
|
|
return 0;
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
/* Today, wildcard AF_INET/AF_INET6. */
|
2008-08-18 22:34:34 +08:00
|
|
|
if (sctp_is_any(sk, addr1) || sctp_is_any(sk, addr2))
|
2005-04-17 06:20:36 +08:00
|
|
|
return 1;
|
|
|
|
|
|
|
|
if (addr1->sa.sa_family != addr2->sa.sa_family)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
return af1->cmp_addr(addr1, addr2);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Verify that the provided sockaddr looks bindable. Common verification,
|
|
|
|
* has already been taken care of.
|
|
|
|
*/
|
|
|
|
static int sctp_inet6_bind_verify(struct sctp_sock *opt, union sctp_addr *addr)
|
|
|
|
{
|
|
|
|
struct sctp_af *af;
|
|
|
|
|
|
|
|
/* ASSERT: address family has already been verified. */
|
|
|
|
if (addr->sa.sa_family != AF_INET6)
|
|
|
|
af = sctp_get_af_specific(addr->sa.sa_family);
|
|
|
|
else {
|
|
|
|
int type = ipv6_addr_type(&addr->v6.sin6_addr);
|
2005-06-14 06:13:05 +08:00
|
|
|
struct net_device *dev;
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
if (type & IPV6_ADDR_LINKLOCAL) {
|
2012-08-06 16:46:26 +08:00
|
|
|
struct net *net;
|
2005-06-14 06:13:05 +08:00
|
|
|
if (!addr->v6.sin6_scope_id)
|
|
|
|
return 0;
|
2012-08-06 16:46:26 +08:00
|
|
|
net = sock_net(&opt->inet.sk);
|
2009-11-06 12:56:46 +08:00
|
|
|
rcu_read_lock();
|
2012-08-06 16:46:26 +08:00
|
|
|
dev = dev_get_by_index_rcu(net, addr->v6.sin6_scope_id);
|
2009-11-06 12:56:46 +08:00
|
|
|
if (!dev ||
|
2012-08-06 16:46:26 +08:00
|
|
|
!ipv6_chk_addr(net, &addr->v6.sin6_addr, dev, 0)) {
|
2009-11-06 12:56:46 +08:00
|
|
|
rcu_read_unlock();
|
2007-07-04 02:29:23 +08:00
|
|
|
return 0;
|
|
|
|
}
|
2009-11-06 12:56:46 +08:00
|
|
|
rcu_read_unlock();
|
2008-07-19 14:05:40 +08:00
|
|
|
} else if (type == IPV6_ADDR_MAPPED) {
|
|
|
|
if (!opt->v4mapped)
|
|
|
|
return 0;
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
2008-07-19 14:05:40 +08:00
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
af = opt->pf->af;
|
|
|
|
}
|
|
|
|
return af->available(addr, opt);
|
|
|
|
}
|
|
|
|
|
2005-06-14 06:13:05 +08:00
|
|
|
/* Verify that the provided sockaddr looks sendable. Common verification,
|
2005-04-17 06:20:36 +08:00
|
|
|
* has already been taken care of.
|
|
|
|
*/
|
|
|
|
static int sctp_inet6_send_verify(struct sctp_sock *opt, union sctp_addr *addr)
|
|
|
|
{
|
|
|
|
struct sctp_af *af = NULL;
|
|
|
|
|
|
|
|
/* ASSERT: address family has already been verified. */
|
|
|
|
if (addr->sa.sa_family != AF_INET6)
|
|
|
|
af = sctp_get_af_specific(addr->sa.sa_family);
|
|
|
|
else {
|
|
|
|
int type = ipv6_addr_type(&addr->v6.sin6_addr);
|
2005-06-14 06:13:05 +08:00
|
|
|
struct net_device *dev;
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
if (type & IPV6_ADDR_LINKLOCAL) {
|
2005-06-14 06:13:05 +08:00
|
|
|
if (!addr->v6.sin6_scope_id)
|
|
|
|
return 0;
|
2009-11-06 12:56:46 +08:00
|
|
|
rcu_read_lock();
|
2012-08-06 16:46:26 +08:00
|
|
|
dev = dev_get_by_index_rcu(sock_net(&opt->inet.sk),
|
2009-11-06 12:56:46 +08:00
|
|
|
addr->v6.sin6_scope_id);
|
|
|
|
rcu_read_unlock();
|
2005-06-14 06:13:05 +08:00
|
|
|
if (!dev)
|
2005-04-17 06:20:36 +08:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
af = opt->pf->af;
|
|
|
|
}
|
|
|
|
|
|
|
|
return af != NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Fill in Supported Address Type information for INIT and INIT-ACK
|
|
|
|
* chunks. Note: In the future, we may want to look at sock options
|
|
|
|
* to determine whether a PF_INET6 socket really wants to have IPV4
|
|
|
|
* addresses.
|
|
|
|
* Returns number of addresses supported.
|
|
|
|
*/
|
|
|
|
static int sctp_inet6_supported_addrs(const struct sctp_sock *opt,
|
2006-11-21 09:25:49 +08:00
|
|
|
__be16 *types)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
2008-07-19 14:05:40 +08:00
|
|
|
types[0] = SCTP_PARAM_IPV6_ADDRESS;
|
|
|
|
if (!opt || !ipv6_only_sock(sctp_opt2sk(opt))) {
|
|
|
|
types[1] = SCTP_PARAM_IPV4_ADDRESS;
|
|
|
|
return 2;
|
|
|
|
}
|
|
|
|
return 1;
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
2005-12-23 04:49:22 +08:00
|
|
|
static const struct proto_ops inet6_seqpacket_ops = {
|
2006-03-21 14:48:35 +08:00
|
|
|
.family = PF_INET6,
|
|
|
|
.owner = THIS_MODULE,
|
|
|
|
.release = inet6_release,
|
|
|
|
.bind = inet6_bind,
|
|
|
|
.connect = inet_dgram_connect,
|
|
|
|
.socketpair = sock_no_socketpair,
|
|
|
|
.accept = inet_accept,
|
|
|
|
.getname = inet6_getname,
|
|
|
|
.poll = sctp_poll,
|
|
|
|
.ioctl = inet6_ioctl,
|
|
|
|
.listen = sctp_inet_listen,
|
|
|
|
.shutdown = inet_shutdown,
|
|
|
|
.setsockopt = sock_common_setsockopt,
|
|
|
|
.getsockopt = sock_common_getsockopt,
|
|
|
|
.sendmsg = inet_sendmsg,
|
|
|
|
.recvmsg = sock_common_recvmsg,
|
|
|
|
.mmap = sock_no_mmap,
|
2006-03-21 14:45:21 +08:00
|
|
|
#ifdef CONFIG_COMPAT
|
2006-03-21 14:48:35 +08:00
|
|
|
.compat_setsockopt = compat_sock_common_setsockopt,
|
|
|
|
.compat_getsockopt = compat_sock_common_getsockopt,
|
2006-03-21 14:45:21 +08:00
|
|
|
#endif
|
2005-04-17 06:20:36 +08:00
|
|
|
};
|
|
|
|
|
|
|
|
static struct inet_protosw sctpv6_seqpacket_protosw = {
|
|
|
|
.type = SOCK_SEQPACKET,
|
|
|
|
.protocol = IPPROTO_SCTP,
|
|
|
|
.prot = &sctpv6_prot,
|
|
|
|
.ops = &inet6_seqpacket_ops,
|
|
|
|
.no_check = 0,
|
|
|
|
.flags = SCTP_PROTOSW_FLAG
|
|
|
|
};
|
|
|
|
static struct inet_protosw sctpv6_stream_protosw = {
|
|
|
|
.type = SOCK_STREAM,
|
|
|
|
.protocol = IPPROTO_SCTP,
|
|
|
|
.prot = &sctpv6_prot,
|
|
|
|
.ops = &inet6_seqpacket_ops,
|
|
|
|
.no_check = 0,
|
|
|
|
.flags = SCTP_PROTOSW_FLAG,
|
|
|
|
};
|
|
|
|
|
2007-10-16 03:50:28 +08:00
|
|
|
static int sctp6_rcv(struct sk_buff *skb)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
2007-10-16 03:50:28 +08:00
|
|
|
return sctp_rcv(skb) ? -1 : 0;
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
2009-09-14 20:22:28 +08:00
|
|
|
static const struct inet6_protocol sctpv6_protocol = {
|
2005-04-17 06:20:36 +08:00
|
|
|
.handler = sctp6_rcv,
|
|
|
|
.err_handler = sctp_v6_err,
|
|
|
|
.flags = INET6_PROTO_NOPOLICY | INET6_PROTO_FINAL,
|
|
|
|
};
|
|
|
|
|
2008-02-15 22:53:59 +08:00
|
|
|
static struct sctp_af sctp_af_inet6 = {
|
2006-03-21 14:48:35 +08:00
|
|
|
.sa_family = AF_INET6,
|
|
|
|
.sctp_xmit = sctp_v6_xmit,
|
|
|
|
.setsockopt = ipv6_setsockopt,
|
|
|
|
.getsockopt = ipv6_getsockopt,
|
|
|
|
.get_dst = sctp_v6_get_dst,
|
|
|
|
.get_saddr = sctp_v6_get_saddr,
|
|
|
|
.copy_addrlist = sctp_v6_copy_addrlist,
|
|
|
|
.from_skb = sctp_v6_from_skb,
|
|
|
|
.from_sk = sctp_v6_from_sk,
|
|
|
|
.to_sk_saddr = sctp_v6_to_sk_saddr,
|
|
|
|
.to_sk_daddr = sctp_v6_to_sk_daddr,
|
|
|
|
.from_addr_param = sctp_v6_from_addr_param,
|
|
|
|
.to_addr_param = sctp_v6_to_addr_param,
|
|
|
|
.cmp_addr = sctp_v6_cmp_addr,
|
|
|
|
.scope = sctp_v6_scope,
|
|
|
|
.addr_valid = sctp_v6_addr_valid,
|
|
|
|
.inaddr_any = sctp_v6_inaddr_any,
|
|
|
|
.is_any = sctp_v6_is_any,
|
|
|
|
.available = sctp_v6_available,
|
|
|
|
.skb_iif = sctp_v6_skb_iif,
|
|
|
|
.is_ce = sctp_v6_is_ce,
|
|
|
|
.seq_dump_addr = sctp_v6_seq_dump_addr,
|
2008-06-05 03:40:15 +08:00
|
|
|
.ecn_capable = sctp_v6_ecn_capable,
|
2006-03-21 14:48:35 +08:00
|
|
|
.net_header_len = sizeof(struct ipv6hdr),
|
|
|
|
.sockaddr_len = sizeof(struct sockaddr_in6),
|
2006-03-21 14:45:21 +08:00
|
|
|
#ifdef CONFIG_COMPAT
|
2006-03-21 14:48:35 +08:00
|
|
|
.compat_setsockopt = compat_ipv6_setsockopt,
|
|
|
|
.compat_getsockopt = compat_ipv6_getsockopt,
|
2006-03-21 14:45:21 +08:00
|
|
|
#endif
|
2005-04-17 06:20:36 +08:00
|
|
|
};
|
|
|
|
|
2008-02-15 22:53:59 +08:00
|
|
|
static struct sctp_pf sctp_pf_inet6 = {
|
2005-04-17 06:20:36 +08:00
|
|
|
.event_msgname = sctp_inet6_event_msgname,
|
|
|
|
.skb_msgname = sctp_inet6_skb_msgname,
|
|
|
|
.af_supported = sctp_inet6_af_supported,
|
|
|
|
.cmp_addr = sctp_inet6_cmp_addr,
|
|
|
|
.bind_verify = sctp_inet6_bind_verify,
|
|
|
|
.send_verify = sctp_inet6_send_verify,
|
|
|
|
.supported_addrs = sctp_inet6_supported_addrs,
|
|
|
|
.create_accept_sk = sctp_v6_create_accept_sk,
|
|
|
|
.addr_v4map = sctp_v6_addr_v4map,
|
2008-02-15 22:53:59 +08:00
|
|
|
.af = &sctp_af_inet6,
|
2005-04-17 06:20:36 +08:00
|
|
|
};
|
|
|
|
|
2007-05-05 04:36:30 +08:00
|
|
|
/* Initialize IPv6 support and register with socket layer. */
|
2008-03-21 06:17:14 +08:00
|
|
|
void sctp_v6_pf_init(void)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
2007-05-05 04:36:30 +08:00
|
|
|
/* Register the SCTP specific PF_INET6 functions. */
|
2008-02-15 22:53:59 +08:00
|
|
|
sctp_register_pf(&sctp_pf_inet6, PF_INET6);
|
2007-05-05 04:36:30 +08:00
|
|
|
|
|
|
|
/* Register the SCTP specific AF_INET6 functions. */
|
2008-02-15 22:53:59 +08:00
|
|
|
sctp_register_af(&sctp_af_inet6);
|
2008-03-21 06:17:14 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
void sctp_v6_pf_exit(void)
|
|
|
|
{
|
|
|
|
list_del(&sctp_af_inet6.list);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Initialize IPv6 support and register with socket layer. */
|
|
|
|
int sctp_v6_protosw_init(void)
|
|
|
|
{
|
|
|
|
int rc;
|
2007-05-05 04:36:30 +08:00
|
|
|
|
|
|
|
rc = proto_register(&sctpv6_prot, 1);
|
2005-04-17 06:20:36 +08:00
|
|
|
if (rc)
|
2007-05-05 04:36:30 +08:00
|
|
|
return rc;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
/* Add SCTPv6(UDP and TCP style) to inetsw6 linked list. */
|
|
|
|
inet6_register_protosw(&sctpv6_seqpacket_protosw);
|
|
|
|
inet6_register_protosw(&sctpv6_stream_protosw);
|
|
|
|
|
2007-05-05 04:36:30 +08:00
|
|
|
return 0;
|
|
|
|
}
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2008-03-21 06:17:14 +08:00
|
|
|
void sctp_v6_protosw_exit(void)
|
|
|
|
{
|
|
|
|
inet6_unregister_protosw(&sctpv6_seqpacket_protosw);
|
|
|
|
inet6_unregister_protosw(&sctpv6_stream_protosw);
|
|
|
|
proto_unregister(&sctpv6_prot);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2007-05-05 04:36:30 +08:00
|
|
|
/* Register with inet6 layer. */
|
|
|
|
int sctp_v6_add_protocol(void)
|
|
|
|
{
|
2005-04-17 06:20:36 +08:00
|
|
|
/* Register notifier for inet6 address additions/deletions. */
|
|
|
|
register_inet6addr_notifier(&sctp_inet6addr_notifier);
|
2007-05-05 04:36:30 +08:00
|
|
|
|
|
|
|
if (inet6_add_protocol(&sctpv6_protocol, IPPROTO_SCTP) < 0)
|
|
|
|
return -EAGAIN;
|
|
|
|
|
|
|
|
return 0;
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
2007-05-05 04:36:30 +08:00
|
|
|
/* Unregister with inet6 layer. */
|
|
|
|
void sctp_v6_del_protocol(void)
|
|
|
|
{
|
|
|
|
inet6_del_protocol(&sctpv6_protocol, IPPROTO_SCTP);
|
|
|
|
unregister_inet6addr_notifier(&sctp_inet6addr_notifier);
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|