1// SPDX-License-Identifier: GPL-2.0-or-later
   2/* SCTP kernel implementation
   3 * Copyright (c) 1999-2000 Cisco, Inc.
   4 * Copyright (c) 1999-2001 Motorola, Inc.
   5 * Copyright (c) 2001-2003 International Business Machines, Corp.
   6 * Copyright (c) 2001 Intel Corp.
   7 * Copyright (c) 2001 Nokia, Inc.
   8 * Copyright (c) 2001 La Monte H.P. Yarroll
   9 *
  10 * This file is part of the SCTP kernel implementation
  11 *
  12 * These functions handle all input from the IP layer into SCTP.
  13 *
  14 * Please send any bug reports or fixes you make to the
  15 * email address(es):
  16 *    lksctp developers <linux-sctp@vger.kernel.org>
  17 *
  18 * Written or modified by:
  19 *    La Monte H.P. Yarroll <piggy@acm.org>
  20 *    Karl Knutson <karl@athena.chicago.il.us>
  21 *    Xingang Guo <xingang.guo@intel.com>
  22 *    Jon Grimm <jgrimm@us.ibm.com>
  23 *    Hui Huang <hui.huang@nokia.com>
  24 *    Daisy Chang <daisyc@us.ibm.com>
  25 *    Sridhar Samudrala <sri@us.ibm.com>
  26 *    Ardelle Fan <ardelle.fan@intel.com>
  27 */
  28
  29#include <linux/types.h>
  30#include <linux/list.h> /* For struct list_head */
  31#include <linux/socket.h>
  32#include <linux/ip.h>
  33#include <linux/time.h> /* For struct timeval */
  34#include <linux/slab.h>
  35#include <net/ip.h>
  36#include <net/icmp.h>
  37#include <net/snmp.h>
  38#include <net/sock.h>
  39#include <net/xfrm.h>
  40#include <net/sctp/sctp.h>
  41#include <net/sctp/sm.h>
  42#include <net/sctp/checksum.h>
  43#include <net/net_namespace.h>
  44#include <linux/rhashtable.h>
  45#include <net/sock_reuseport.h>
  46
  47/* Forward declarations for internal helpers. */
  48static int sctp_rcv_ootb(struct sk_buff *);
  49static struct sctp_association *__sctp_rcv_lookup(struct net *net,
  50				      struct sk_buff *skb,
  51				      const union sctp_addr *paddr,
  52				      const union sctp_addr *laddr,
  53				      struct sctp_transport **transportp);
  54static struct sctp_endpoint *__sctp_rcv_lookup_endpoint(
  55					struct net *net, struct sk_buff *skb,
  56					const union sctp_addr *laddr,
  57					const union sctp_addr *daddr);
  58static struct sctp_association *__sctp_lookup_association(
  59					struct net *net,
  60					const union sctp_addr *local,
  61					const union sctp_addr *peer,
  62					struct sctp_transport **pt);
  63
  64static int sctp_add_backlog(struct sock *sk, struct sk_buff *skb);
  65
  66
  67/* Calculate the SCTP checksum of an SCTP packet.  */
  68static inline int sctp_rcv_checksum(struct net *net, struct sk_buff *skb)
  69{
  70	struct sctphdr *sh = sctp_hdr(skb);
  71	__le32 cmp = sh->checksum;
  72	__le32 val = sctp_compute_cksum(skb, 0);
  73
  74	if (val != cmp) {
  75		/* CRC failure, dump it. */
  76		__SCTP_INC_STATS(net, SCTP_MIB_CHECKSUMERRORS);
  77		return -1;
  78	}
  79	return 0;
  80}
  81
  82/*
  83 * This is the routine which IP calls when receiving an SCTP packet.
  84 */
  85int sctp_rcv(struct sk_buff *skb)
  86{
  87	struct sock *sk;
  88	struct sctp_association *asoc;
  89	struct sctp_endpoint *ep = NULL;
  90	struct sctp_ep_common *rcvr;
  91	struct sctp_transport *transport = NULL;
  92	struct sctp_chunk *chunk;
  93	union sctp_addr src;
  94	union sctp_addr dest;
  95	int family;
  96	struct sctp_af *af;
  97	struct net *net = dev_net(skb->dev);
  98	bool is_gso = skb_is_gso(skb) && skb_is_gso_sctp(skb);
  99
 100	if (skb->pkt_type != PACKET_HOST)
 101		goto discard_it;
 102
 103	__SCTP_INC_STATS(net, SCTP_MIB_INSCTPPACKS);
 104
 105	/* If packet is too small to contain a single chunk, let's not
 106	 * waste time on it anymore.
 107	 */
 108	if (skb->len < sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr) +
 109		       skb_transport_offset(skb))
 110		goto discard_it;
 111
 112	/* If the packet is fragmented and we need to do crc checking,
 113	 * it's better to just linearize it otherwise crc computing
 114	 * takes longer.
 115	 */
 116	if ((!is_gso && skb_linearize(skb)) ||
 117	    !pskb_may_pull(skb, sizeof(struct sctphdr)))
 118		goto discard_it;
 119
 120	/* Pull up the IP header. */
 121	__skb_pull(skb, skb_transport_offset(skb));
 122
 123	skb->csum_valid = 0; /* Previous value not applicable */
 124	if (skb_csum_unnecessary(skb))
 125		__skb_decr_checksum_unnecessary(skb);
 126	else if (!sctp_checksum_disable &&
 127		 !is_gso &&
 128		 sctp_rcv_checksum(net, skb) < 0)
 129		goto discard_it;
 130	skb->csum_valid = 1;
 131
 132	__skb_pull(skb, sizeof(struct sctphdr));
 133
 134	family = ipver2af(ip_hdr(skb)->version);
 135	af = sctp_get_af_specific(family);
 136	if (unlikely(!af))
 137		goto discard_it;
 138	SCTP_INPUT_CB(skb)->af = af;
 139
 140	/* Initialize local addresses for lookups. */
 141	af->from_skb(&src, skb, 1);
 142	af->from_skb(&dest, skb, 0);
 143
 144	/* If the packet is to or from a non-unicast address,
 145	 * silently discard the packet.
 146	 *
 147	 * This is not clearly defined in the RFC except in section
 148	 * 8.4 - OOTB handling.  However, based on the book "Stream Control
 149	 * Transmission Protocol" 2.1, "It is important to note that the
 150	 * IP address of an SCTP transport address must be a routable
 151	 * unicast address.  In other words, IP multicast addresses and
 152	 * IP broadcast addresses cannot be used in an SCTP transport
 153	 * address."
 154	 */
 155	if (!af->addr_valid(&src, NULL, skb) ||
 156	    !af->addr_valid(&dest, NULL, skb))
 157		goto discard_it;
 158
 159	asoc = __sctp_rcv_lookup(net, skb, &src, &dest, &transport);
 160
 161	if (!asoc)
 162		ep = __sctp_rcv_lookup_endpoint(net, skb, &dest, &src);
 163
 164	/* Retrieve the common input handling substructure. */
 165	rcvr = asoc ? &asoc->base : &ep->base;
 166	sk = rcvr->sk;
 167
 168	/*
 169	 * If a frame arrives on an interface and the receiving socket is
 170	 * bound to another interface, via SO_BINDTODEVICE, treat it as OOTB
 171	 */
 172	if (sk->sk_bound_dev_if && (sk->sk_bound_dev_if != af->skb_iif(skb))) {
 173		if (transport) {
 174			sctp_transport_put(transport);
 175			asoc = NULL;
 176			transport = NULL;
 177		} else {
 178			sctp_endpoint_put(ep);
 179			ep = NULL;
 180		}
 181		sk = net->sctp.ctl_sock;
 182		ep = sctp_sk(sk)->ep;
 183		sctp_endpoint_hold(ep);
 184		rcvr = &ep->base;
 185	}
 186
 187	/*
 188	 * RFC 2960, 8.4 - Handle "Out of the blue" Packets.
 189	 * An SCTP packet is called an "out of the blue" (OOTB)
 190	 * packet if it is correctly formed, i.e., passed the
 191	 * receiver's checksum check, but the receiver is not
 192	 * able to identify the association to which this
 193	 * packet belongs.
 194	 */
 195	if (!asoc) {
 196		if (sctp_rcv_ootb(skb)) {
 197			__SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
 198			goto discard_release;
 199		}
 200	}
 201
 202	if (!xfrm_policy_check(sk, XFRM_POLICY_IN, skb, family))
 203		goto discard_release;
 204	nf_reset_ct(skb);
 205
 206	if (sk_filter(sk, skb))
 207		goto discard_release;
 208
 209	/* Create an SCTP packet structure. */
 210	chunk = sctp_chunkify(skb, asoc, sk, GFP_ATOMIC);
 211	if (!chunk)
 212		goto discard_release;
 213	SCTP_INPUT_CB(skb)->chunk = chunk;
 214
 215	/* Remember what endpoint is to handle this packet. */
 216	chunk->rcvr = rcvr;
 217
 218	/* Remember the SCTP header. */
 219	chunk->sctp_hdr = sctp_hdr(skb);
 220
 221	/* Set the source and destination addresses of the incoming chunk.  */
 222	sctp_init_addrs(chunk, &src, &dest);
 223
 224	/* Remember where we came from.  */
 225	chunk->transport = transport;
 226
 227	/* Acquire access to the sock lock. Note: We are safe from other
 228	 * bottom halves on this lock, but a user may be in the lock too,
 229	 * so check if it is busy.
 230	 */
 231	bh_lock_sock(sk);
 232
 233	if (sk != rcvr->sk) {
 234		/* Our cached sk is different from the rcvr->sk.  This is
 235		 * because migrate()/accept() may have moved the association
 236		 * to a new socket and released all the sockets.  So now we
 237		 * are holding a lock on the old socket while the user may
 238		 * be doing something with the new socket.  Switch our veiw
 239		 * of the current sk.
 240		 */
 241		bh_unlock_sock(sk);
 242		sk = rcvr->sk;
 243		bh_lock_sock(sk);
 244	}
 245
 246	if (sock_owned_by_user(sk) || !sctp_newsk_ready(sk)) {
 247		if (sctp_add_backlog(sk, skb)) {
 248			bh_unlock_sock(sk);
 249			sctp_chunk_free(chunk);
 250			skb = NULL; /* sctp_chunk_free already freed the skb */
 251			goto discard_release;
 252		}
 253		__SCTP_INC_STATS(net, SCTP_MIB_IN_PKT_BACKLOG);
 254	} else {
 255		__SCTP_INC_STATS(net, SCTP_MIB_IN_PKT_SOFTIRQ);
 256		sctp_inq_push(&chunk->rcvr->inqueue, chunk);
 257	}
 258
 259	bh_unlock_sock(sk);
 260
 261	/* Release the asoc/ep ref we took in the lookup calls. */
 262	if (transport)
 263		sctp_transport_put(transport);
 264	else
 265		sctp_endpoint_put(ep);
 266
 267	return 0;
 268
 269discard_it:
 270	__SCTP_INC_STATS(net, SCTP_MIB_IN_PKT_DISCARDS);
 271	kfree_skb(skb);
 272	return 0;
 273
 274discard_release:
 275	/* Release the asoc/ep ref we took in the lookup calls. */
 276	if (transport)
 277		sctp_transport_put(transport);
 278	else
 279		sctp_endpoint_put(ep);
 280
 281	goto discard_it;
 282}
 283
 284/* Process the backlog queue of the socket.  Every skb on
 285 * the backlog holds a ref on an association or endpoint.
 286 * We hold this ref throughout the state machine to make
 287 * sure that the structure we need is still around.
 288 */
 289int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
 290{
 291	struct sctp_chunk *chunk = SCTP_INPUT_CB(skb)->chunk;
 292	struct sctp_inq *inqueue = &chunk->rcvr->inqueue;
 293	struct sctp_transport *t = chunk->transport;
 294	struct sctp_ep_common *rcvr = NULL;
 295	int backloged = 0;
 296
 297	rcvr = chunk->rcvr;
 298
 299	/* If the rcvr is dead then the association or endpoint
 300	 * has been deleted and we can safely drop the chunk
 301	 * and refs that we are holding.
 302	 */
 303	if (rcvr->dead) {
 304		sctp_chunk_free(chunk);
 305		goto done;
 306	}
 307
 308	if (unlikely(rcvr->sk != sk)) {
 309		/* In this case, the association moved from one socket to
 310		 * another.  We are currently sitting on the backlog of the
 311		 * old socket, so we need to move.
 312		 * However, since we are here in the process context we
 313		 * need to take make sure that the user doesn't own
 314		 * the new socket when we process the packet.
 315		 * If the new socket is user-owned, queue the chunk to the
 316		 * backlog of the new socket without dropping any refs.
 317		 * Otherwise, we can safely push the chunk on the inqueue.
 318		 */
 319
 320		sk = rcvr->sk;
 321		local_bh_disable();
 322		bh_lock_sock(sk);
 323
 324		if (sock_owned_by_user(sk) || !sctp_newsk_ready(sk)) {
 325			if (sk_add_backlog(sk, skb, READ_ONCE(sk->sk_rcvbuf)))
 326				sctp_chunk_free(chunk);
 327			else
 328				backloged = 1;
 329		} else
 330			sctp_inq_push(inqueue, chunk);
 331
 332		bh_unlock_sock(sk);
 333		local_bh_enable();
 334
 335		/* If the chunk was backloged again, don't drop refs */
 336		if (backloged)
 337			return 0;
 338	} else {
 339		if (!sctp_newsk_ready(sk)) {
 340			if (!sk_add_backlog(sk, skb, READ_ONCE(sk->sk_rcvbuf)))
 341				return 0;
 342			sctp_chunk_free(chunk);
 343		} else {
 344			sctp_inq_push(inqueue, chunk);
 345		}
 346	}
 347
 348done:
 349	/* Release the refs we took in sctp_add_backlog */
 350	if (SCTP_EP_TYPE_ASSOCIATION == rcvr->type)
 351		sctp_transport_put(t);
 352	else if (SCTP_EP_TYPE_SOCKET == rcvr->type)
 353		sctp_endpoint_put(sctp_ep(rcvr));
 354	else
 355		BUG();
 356
 357	return 0;
 358}
 359
 360static int sctp_add_backlog(struct sock *sk, struct sk_buff *skb)
 361{
 362	struct sctp_chunk *chunk = SCTP_INPUT_CB(skb)->chunk;
 363	struct sctp_transport *t = chunk->transport;
 364	struct sctp_ep_common *rcvr = chunk->rcvr;
 365	int ret;
 366
 367	ret = sk_add_backlog(sk, skb, READ_ONCE(sk->sk_rcvbuf));
 368	if (!ret) {
 369		/* Hold the assoc/ep while hanging on the backlog queue.
 370		 * This way, we know structures we need will not disappear
 371		 * from us
 372		 */
 373		if (SCTP_EP_TYPE_ASSOCIATION == rcvr->type)
 374			sctp_transport_hold(t);
 375		else if (SCTP_EP_TYPE_SOCKET == rcvr->type)
 376			sctp_endpoint_hold(sctp_ep(rcvr));
 377		else
 378			BUG();
 379	}
 380	return ret;
 381
 382}
 383
 384/* Handle icmp frag needed error. */
 385void sctp_icmp_frag_needed(struct sock *sk, struct sctp_association *asoc,
 386			   struct sctp_transport *t, __u32 pmtu)
 387{
 388	if (!t ||
 389	    (t->pathmtu <= pmtu &&
 390	     t->pl.probe_size + sctp_transport_pl_hlen(t) <= pmtu))
 391		return;
 392
 393	if (sock_owned_by_user(sk)) {
 394		atomic_set(&t->mtu_info, pmtu);
 395		asoc->pmtu_pending = 1;
 396		t->pmtu_pending = 1;
 397		return;
 398	}
 399
 400	if (!(t->param_flags & SPP_PMTUD_ENABLE))
 401		/* We can't allow retransmitting in such case, as the
 402		 * retransmission would be sized just as before, and thus we
 403		 * would get another icmp, and retransmit again.
 404		 */
 405		return;
 406
 407	/* Update transports view of the MTU. Return if no update was needed.
 408	 * If an update wasn't needed/possible, it also doesn't make sense to
 409	 * try to retransmit now.
 410	 */
 411	if (!sctp_transport_update_pmtu(t, pmtu))
 412		return;
 413
 414	/* Update association pmtu. */
 415	sctp_assoc_sync_pmtu(asoc);
 416
 417	/* Retransmit with the new pmtu setting. */
 418	sctp_retransmit(&asoc->outqueue, t, SCTP_RTXR_PMTUD);
 419}
 420
 421void sctp_icmp_redirect(struct sock *sk, struct sctp_transport *t,
 422			struct sk_buff *skb)
 423{
 424	struct dst_entry *dst;
 425
 426	if (sock_owned_by_user(sk) || !t)
 427		return;
 428	dst = sctp_transport_dst_check(t);
 429	if (dst)
 430		dst->ops->redirect(dst, sk, skb);
 431}
 432
 433/*
 434 * SCTP Implementer's Guide, 2.37 ICMP handling procedures
 435 *
 436 * ICMP8) If the ICMP code is a "Unrecognized next header type encountered"
 437 *        or a "Protocol Unreachable" treat this message as an abort
 438 *        with the T bit set.
 439 *
 440 * This function sends an event to the state machine, which will abort the
 441 * association.
 442 *
 443 */
 444void sctp_icmp_proto_unreachable(struct sock *sk,
 445			   struct sctp_association *asoc,
 446			   struct sctp_transport *t)
 447{
 448	if (sock_owned_by_user(sk)) {
 449		if (timer_pending(&t->proto_unreach_timer))
 450			return;
 451		else {
 452			if (!mod_timer(&t->proto_unreach_timer,
 453						jiffies + (HZ/20)))
 454				sctp_transport_hold(t);
 455		}
 456	} else {
 457		struct net *net = sock_net(sk);
 458
 459		pr_debug("%s: unrecognized next header type "
 460			 "encountered!\n", __func__);
 461
 462		if (del_timer(&t->proto_unreach_timer))
 463			sctp_transport_put(t);
 464
 465		sctp_do_sm(net, SCTP_EVENT_T_OTHER,
 466			   SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
 467			   asoc->state, asoc->ep, asoc, t,
 468			   GFP_ATOMIC);
 469	}
 470}
 471
 472/* Common lookup code for icmp/icmpv6 error handler. */
 473struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb,
 474			     struct sctphdr *sctphdr,
 475			     struct sctp_association **app,
 476			     struct sctp_transport **tpp)
 477{
 478	struct sctp_init_chunk *chunkhdr, _chunkhdr;
 479	union sctp_addr saddr;
 480	union sctp_addr daddr;
 481	struct sctp_af *af;
 482	struct sock *sk = NULL;
 483	struct sctp_association *asoc;
 484	struct sctp_transport *transport = NULL;
 485	__u32 vtag = ntohl(sctphdr->vtag);
 486
 487	*app = NULL; *tpp = NULL;
 488
 489	af = sctp_get_af_specific(family);
 490	if (unlikely(!af)) {
 491		return NULL;
 492	}
 493
 494	/* Initialize local addresses for lookups. */
 495	af->from_skb(&saddr, skb, 1);
 496	af->from_skb(&daddr, skb, 0);
 497
 498	/* Look for an association that matches the incoming ICMP error
 499	 * packet.
 500	 */
 501	asoc = __sctp_lookup_association(net, &saddr, &daddr, &transport);
 502	if (!asoc)
 503		return NULL;
 504
 505	sk = asoc->base.sk;
 506
 507	/* RFC 4960, Appendix C. ICMP Handling
 508	 *
 509	 * ICMP6) An implementation MUST validate that the Verification Tag
 510	 * contained in the ICMP message matches the Verification Tag of
 511	 * the peer.  If the Verification Tag is not 0 and does NOT
 512	 * match, discard the ICMP message.  If it is 0 and the ICMP
 513	 * message contains enough bytes to verify that the chunk type is
 514	 * an INIT chunk and that the Initiate Tag matches the tag of the
 515	 * peer, continue with ICMP7.  If the ICMP message is too short
 516	 * or the chunk type or the Initiate Tag does not match, silently
 517	 * discard the packet.
 518	 */
 519	if (vtag == 0) {
 520		/* chunk header + first 4 octects of init header */
 521		chunkhdr = skb_header_pointer(skb, skb_transport_offset(skb) +
 522					      sizeof(struct sctphdr),
 523					      sizeof(struct sctp_chunkhdr) +
 524					      sizeof(__be32), &_chunkhdr);
 525		if (!chunkhdr ||
 526		    chunkhdr->chunk_hdr.type != SCTP_CID_INIT ||
 527		    ntohl(chunkhdr->init_hdr.init_tag) != asoc->c.my_vtag)
 528			goto out;
 529
 530	} else if (vtag != asoc->c.peer_vtag) {
 531		goto out;
 532	}
 533
 534	bh_lock_sock(sk);
 535
 536	/* If too many ICMPs get dropped on busy
 537	 * servers this needs to be solved differently.
 538	 */
 539	if (sock_owned_by_user(sk))
 540		__NET_INC_STATS(net, LINUX_MIB_LOCKDROPPEDICMPS);
 541
 542	*app = asoc;
 543	*tpp = transport;
 544	return sk;
 545
 546out:
 547	sctp_transport_put(transport);
 548	return NULL;
 549}
 550
 551/* Common cleanup code for icmp/icmpv6 error handler. */
 552void sctp_err_finish(struct sock *sk, struct sctp_transport *t)
 553	__releases(&((__sk)->sk_lock.slock))
 554{
 555	bh_unlock_sock(sk);
 556	sctp_transport_put(t);
 557}
 558
 559static void sctp_v4_err_handle(struct sctp_transport *t, struct sk_buff *skb,
 560			       __u8 type, __u8 code, __u32 info)
 561{
 562	struct sctp_association *asoc = t->asoc;
 563	struct sock *sk = asoc->base.sk;
 564	int err = 0;
 565
 566	switch (type) {
 567	case ICMP_PARAMETERPROB:
 568		err = EPROTO;
 569		break;
 570	case ICMP_DEST_UNREACH:
 571		if (code > NR_ICMP_UNREACH)
 572			return;
 573		if (code == ICMP_FRAG_NEEDED) {
 574			sctp_icmp_frag_needed(sk, asoc, t, SCTP_TRUNC4(info));
 575			return;
 576		}
 577		if (code == ICMP_PROT_UNREACH) {
 578			sctp_icmp_proto_unreachable(sk, asoc, t);
 579			return;
 580		}
 581		err = icmp_err_convert[code].errno;
 582		break;
 583	case ICMP_TIME_EXCEEDED:
 584		if (code == ICMP_EXC_FRAGTIME)
 585			return;
 586
 587		err = EHOSTUNREACH;
 588		break;
 589	case ICMP_REDIRECT:
 590		sctp_icmp_redirect(sk, t, skb);
 591		return;
 592	default:
 593		return;
 594	}
 595	if (!sock_owned_by_user(sk) && inet_sk(sk)->recverr) {
 596		sk->sk_err = err;
 597		sk_error_report(sk);
 598	} else {  /* Only an error on timeout */
 599		sk->sk_err_soft = err;
 600	}
 601}
 602
 603/*
 604 * This routine is called by the ICMP module when it gets some
 605 * sort of error condition.  If err < 0 then the socket should
 606 * be closed and the error returned to the user.  If err > 0
 607 * it's just the icmp type << 8 | icmp code.  After adjustment
 608 * header points to the first 8 bytes of the sctp header.  We need
 609 * to find the appropriate port.
 610 *
 611 * The locking strategy used here is very "optimistic". When
 612 * someone else accesses the socket the ICMP is just dropped
 613 * and for some paths there is no check at all.
 614 * A more general error queue to queue errors for later handling
 615 * is probably better.
 616 *
 617 */
 618int sctp_v4_err(struct sk_buff *skb, __u32 info)
 619{
 620	const struct iphdr *iph = (const struct iphdr *)skb->data;
 
 621	const int type = icmp_hdr(skb)->type;
 622	const int code = icmp_hdr(skb)->code;
 623	struct net *net = dev_net(skb->dev);
 
 624	struct sctp_transport *transport;
 625	struct sctp_association *asoc;
 626	__u16 saveip, savesctp;
 627	struct sock *sk;
 
 628
 629	/* Fix up skb to look at the embedded net header. */
 630	saveip = skb->network_header;
 631	savesctp = skb->transport_header;
 632	skb_reset_network_header(skb);
 633	skb_set_transport_header(skb, iph->ihl * 4);
 634	sk = sctp_err_lookup(net, AF_INET, skb, sctp_hdr(skb), &asoc, &transport);
 635	/* Put back, the original values. */
 636	skb->network_header = saveip;
 637	skb->transport_header = savesctp;
 638	if (!sk) {
 639		__ICMP_INC_STATS(net, ICMP_MIB_INERRORS);
 640		return -ENOENT;
 641	}
 
 
 
 642
 643	sctp_v4_err_handle(transport, skb, type, code, info);
 644	sctp_err_finish(sk, transport);
 645
 646	return 0;
 647}
 
 
 648
 649int sctp_udp_v4_err(struct sock *sk, struct sk_buff *skb)
 650{
 651	struct net *net = dev_net(skb->dev);
 652	struct sctp_association *asoc;
 653	struct sctp_transport *t;
 654	struct icmphdr *hdr;
 655	__u32 info = 0;
 
 
 
 
 
 
 
 
 
 
 
 
 
 656
 657	skb->transport_header += sizeof(struct udphdr);
 658	sk = sctp_err_lookup(net, AF_INET, skb, sctp_hdr(skb), &asoc, &t);
 659	if (!sk) {
 660		__ICMP_INC_STATS(net, ICMP_MIB_INERRORS);
 661		return -ENOENT;
 
 
 662	}
 663
 664	skb->transport_header -= sizeof(struct udphdr);
 665	hdr = (struct icmphdr *)(skb_network_header(skb) - sizeof(struct icmphdr));
 666	if (hdr->type == ICMP_REDIRECT) {
 667		/* can't be handled without outer iphdr known, leave it to udp_err */
 668		sctp_err_finish(sk, t);
 669		return 0;
 670	}
 671	if (hdr->type == ICMP_DEST_UNREACH && hdr->code == ICMP_FRAG_NEEDED)
 672		info = ntohs(hdr->un.frag.mtu);
 673	sctp_v4_err_handle(t, skb, hdr->type, hdr->code, info);
 674
 675	sctp_err_finish(sk, t);
 676	return 1;
 
 677}
 678
 679/*
 680 * RFC 2960, 8.4 - Handle "Out of the blue" Packets.
 681 *
 682 * This function scans all the chunks in the OOTB packet to determine if
 683 * the packet should be discarded right away.  If a response might be needed
 684 * for this packet, or, if further processing is possible, the packet will
 685 * be queued to a proper inqueue for the next phase of handling.
 686 *
 687 * Output:
 688 * Return 0 - If further processing is needed.
 689 * Return 1 - If the packet can be discarded right away.
 690 */
 691static int sctp_rcv_ootb(struct sk_buff *skb)
 692{
 693	struct sctp_chunkhdr *ch, _ch;
 694	int ch_end, offset = 0;
 695
 696	/* Scan through all the chunks in the packet.  */
 697	do {
 698		/* Make sure we have at least the header there */
 699		if (offset + sizeof(_ch) > skb->len)
 700			break;
 701
 702		ch = skb_header_pointer(skb, offset, sizeof(*ch), &_ch);
 703
 704		/* Break out if chunk length is less then minimal. */
 705		if (!ch || ntohs(ch->length) < sizeof(_ch))
 706			break;
 707
 708		ch_end = offset + SCTP_PAD4(ntohs(ch->length));
 709		if (ch_end > skb->len)
 710			break;
 711
 712		/* RFC 8.4, 2) If the OOTB packet contains an ABORT chunk, the
 713		 * receiver MUST silently discard the OOTB packet and take no
 714		 * further action.
 715		 */
 716		if (SCTP_CID_ABORT == ch->type)
 717			goto discard;
 718
 719		/* RFC 8.4, 6) If the packet contains a SHUTDOWN COMPLETE
 720		 * chunk, the receiver should silently discard the packet
 721		 * and take no further action.
 722		 */
 723		if (SCTP_CID_SHUTDOWN_COMPLETE == ch->type)
 724			goto discard;
 725
 726		/* RFC 4460, 2.11.2
 727		 * This will discard packets with INIT chunk bundled as
 728		 * subsequent chunks in the packet.  When INIT is first,
 729		 * the normal INIT processing will discard the chunk.
 730		 */
 731		if (SCTP_CID_INIT == ch->type && (void *)ch != skb->data)
 732			goto discard;
 733
 734		offset = ch_end;
 735	} while (ch_end < skb->len);
 736
 737	return 0;
 738
 739discard:
 740	return 1;
 741}
 742
 743/* Insert endpoint into the hash table.  */
 744static int __sctp_hash_endpoint(struct sctp_endpoint *ep)
 745{
 746	struct sock *sk = ep->base.sk;
 747	struct net *net = sock_net(sk);
 748	struct sctp_hashbucket *head;
 749	struct sctp_ep_common *epb;
 750
 751	epb = &ep->base;
 752	epb->hashent = sctp_ep_hashfn(net, epb->bind_addr.port);
 753	head = &sctp_ep_hashtable[epb->hashent];
 754
 755	if (sk->sk_reuseport) {
 756		bool any = sctp_is_ep_boundall(sk);
 757		struct sctp_ep_common *epb2;
 758		struct list_head *list;
 759		int cnt = 0, err = 1;
 760
 761		list_for_each(list, &ep->base.bind_addr.address_list)
 762			cnt++;
 763
 764		sctp_for_each_hentry(epb2, &head->chain) {
 765			struct sock *sk2 = epb2->sk;
 766
 767			if (!net_eq(sock_net(sk2), net) || sk2 == sk ||
 768			    !uid_eq(sock_i_uid(sk2), sock_i_uid(sk)) ||
 769			    !sk2->sk_reuseport)
 770				continue;
 771
 772			err = sctp_bind_addrs_check(sctp_sk(sk2),
 773						    sctp_sk(sk), cnt);
 774			if (!err) {
 775				err = reuseport_add_sock(sk, sk2, any);
 776				if (err)
 777					return err;
 778				break;
 779			} else if (err < 0) {
 780				return err;
 781			}
 782		}
 783
 784		if (err) {
 785			err = reuseport_alloc(sk, any);
 786			if (err)
 787				return err;
 788		}
 789	}
 790
 791	write_lock(&head->lock);
 792	hlist_add_head(&epb->node, &head->chain);
 793	write_unlock(&head->lock);
 794	return 0;
 795}
 796
 797/* Add an endpoint to the hash. Local BH-safe. */
 798int sctp_hash_endpoint(struct sctp_endpoint *ep)
 799{
 800	int err;
 801
 802	local_bh_disable();
 803	err = __sctp_hash_endpoint(ep);
 804	local_bh_enable();
 805
 806	return err;
 807}
 808
 809/* Remove endpoint from the hash table.  */
 810static void __sctp_unhash_endpoint(struct sctp_endpoint *ep)
 811{
 812	struct sock *sk = ep->base.sk;
 813	struct sctp_hashbucket *head;
 814	struct sctp_ep_common *epb;
 815
 816	epb = &ep->base;
 817
 818	epb->hashent = sctp_ep_hashfn(sock_net(sk), epb->bind_addr.port);
 819
 820	head = &sctp_ep_hashtable[epb->hashent];
 821
 822	if (rcu_access_pointer(sk->sk_reuseport_cb))
 823		reuseport_detach_sock(sk);
 824
 825	write_lock(&head->lock);
 826	hlist_del_init(&epb->node);
 827	write_unlock(&head->lock);
 828}
 829
 830/* Remove endpoint from the hash.  Local BH-safe. */
 831void sctp_unhash_endpoint(struct sctp_endpoint *ep)
 832{
 833	local_bh_disable();
 834	__sctp_unhash_endpoint(ep);
 835	local_bh_enable();
 836}
 837
 838static inline __u32 sctp_hashfn(const struct net *net, __be16 lport,
 839				const union sctp_addr *paddr, __u32 seed)
 840{
 841	__u32 addr;
 842
 843	if (paddr->sa.sa_family == AF_INET6)
 844		addr = jhash(&paddr->v6.sin6_addr, 16, seed);
 845	else
 846		addr = (__force __u32)paddr->v4.sin_addr.s_addr;
 847
 848	return  jhash_3words(addr, ((__force __u32)paddr->v4.sin_port) << 16 |
 849			     (__force __u32)lport, net_hash_mix(net), seed);
 850}
 851
 852/* Look up an endpoint. */
 853static struct sctp_endpoint *__sctp_rcv_lookup_endpoint(
 854					struct net *net, struct sk_buff *skb,
 855					const union sctp_addr *laddr,
 856					const union sctp_addr *paddr)
 857{
 858	struct sctp_hashbucket *head;
 859	struct sctp_ep_common *epb;
 860	struct sctp_endpoint *ep;
 861	struct sock *sk;
 862	__be16 lport;
 863	int hash;
 864
 865	lport = laddr->v4.sin_port;
 866	hash = sctp_ep_hashfn(net, ntohs(lport));
 867	head = &sctp_ep_hashtable[hash];
 868	read_lock(&head->lock);
 869	sctp_for_each_hentry(epb, &head->chain) {
 870		ep = sctp_ep(epb);
 871		if (sctp_endpoint_is_match(ep, net, laddr))
 872			goto hit;
 873	}
 874
 875	ep = sctp_sk(net->sctp.ctl_sock)->ep;
 876
 877hit:
 878	sk = ep->base.sk;
 879	if (sk->sk_reuseport) {
 880		__u32 phash = sctp_hashfn(net, lport, paddr, 0);
 881
 882		sk = reuseport_select_sock(sk, phash, skb,
 883					   sizeof(struct sctphdr));
 884		if (sk)
 885			ep = sctp_sk(sk)->ep;
 886	}
 887	sctp_endpoint_hold(ep);
 888	read_unlock(&head->lock);
 889	return ep;
 890}
 891
 892/* rhashtable for transport */
 893struct sctp_hash_cmp_arg {
 894	const union sctp_addr	*paddr;
 895	const struct net	*net;
 896	__be16			lport;
 897};
 898
 899static inline int sctp_hash_cmp(struct rhashtable_compare_arg *arg,
 900				const void *ptr)
 901{
 902	struct sctp_transport *t = (struct sctp_transport *)ptr;
 903	const struct sctp_hash_cmp_arg *x = arg->key;
 904	int err = 1;
 905
 906	if (!sctp_cmp_addr_exact(&t->ipaddr, x->paddr))
 907		return err;
 908	if (!sctp_transport_hold(t))
 909		return err;
 910
 911	if (!net_eq(t->asoc->base.net, x->net))
 912		goto out;
 913	if (x->lport != htons(t->asoc->base.bind_addr.port))
 914		goto out;
 915
 916	err = 0;
 917out:
 918	sctp_transport_put(t);
 919	return err;
 920}
 921
 922static inline __u32 sctp_hash_obj(const void *data, u32 len, u32 seed)
 923{
 924	const struct sctp_transport *t = data;
 925
 926	return sctp_hashfn(t->asoc->base.net,
 927			   htons(t->asoc->base.bind_addr.port),
 928			   &t->ipaddr, seed);
 929}
 930
 931static inline __u32 sctp_hash_key(const void *data, u32 len, u32 seed)
 932{
 933	const struct sctp_hash_cmp_arg *x = data;
 934
 935	return sctp_hashfn(x->net, x->lport, x->paddr, seed);
 936}
 937
 938static const struct rhashtable_params sctp_hash_params = {
 939	.head_offset		= offsetof(struct sctp_transport, node),
 940	.hashfn			= sctp_hash_key,
 941	.obj_hashfn		= sctp_hash_obj,
 942	.obj_cmpfn		= sctp_hash_cmp,
 943	.automatic_shrinking	= true,
 944};
 945
 946int sctp_transport_hashtable_init(void)
 947{
 948	return rhltable_init(&sctp_transport_hashtable, &sctp_hash_params);
 949}
 950
 951void sctp_transport_hashtable_destroy(void)
 952{
 953	rhltable_destroy(&sctp_transport_hashtable);
 954}
 955
 956int sctp_hash_transport(struct sctp_transport *t)
 957{
 958	struct sctp_transport *transport;
 959	struct rhlist_head *tmp, *list;
 960	struct sctp_hash_cmp_arg arg;
 961	int err;
 962
 963	if (t->asoc->temp)
 964		return 0;
 965
 966	arg.net   = t->asoc->base.net;
 967	arg.paddr = &t->ipaddr;
 968	arg.lport = htons(t->asoc->base.bind_addr.port);
 969
 970	rcu_read_lock();
 971	list = rhltable_lookup(&sctp_transport_hashtable, &arg,
 972			       sctp_hash_params);
 973
 974	rhl_for_each_entry_rcu(transport, tmp, list, node)
 975		if (transport->asoc->ep == t->asoc->ep) {
 976			rcu_read_unlock();
 977			return -EEXIST;
 978		}
 979	rcu_read_unlock();
 980
 981	err = rhltable_insert_key(&sctp_transport_hashtable, &arg,
 982				  &t->node, sctp_hash_params);
 983	if (err)
 984		pr_err_once("insert transport fail, errno %d\n", err);
 985
 986	return err;
 987}
 988
 989void sctp_unhash_transport(struct sctp_transport *t)
 990{
 991	if (t->asoc->temp)
 992		return;
 993
 994	rhltable_remove(&sctp_transport_hashtable, &t->node,
 995			sctp_hash_params);
 996}
 997
 998/* return a transport with holding it */
 999struct sctp_transport *sctp_addrs_lookup_transport(
1000				struct net *net,
1001				const union sctp_addr *laddr,
1002				const union sctp_addr *paddr)
1003{
1004	struct rhlist_head *tmp, *list;
1005	struct sctp_transport *t;
1006	struct sctp_hash_cmp_arg arg = {
1007		.paddr = paddr,
1008		.net   = net,
1009		.lport = laddr->v4.sin_port,
1010	};
1011
1012	list = rhltable_lookup(&sctp_transport_hashtable, &arg,
1013			       sctp_hash_params);
1014
1015	rhl_for_each_entry_rcu(t, tmp, list, node) {
1016		if (!sctp_transport_hold(t))
1017			continue;
1018
1019		if (sctp_bind_addr_match(&t->asoc->base.bind_addr,
1020					 laddr, sctp_sk(t->asoc->base.sk)))
1021			return t;
1022		sctp_transport_put(t);
1023	}
1024
1025	return NULL;
1026}
1027
1028/* return a transport without holding it, as it's only used under sock lock */
1029struct sctp_transport *sctp_epaddr_lookup_transport(
1030				const struct sctp_endpoint *ep,
1031				const union sctp_addr *paddr)
1032{
1033	struct rhlist_head *tmp, *list;
1034	struct sctp_transport *t;
1035	struct sctp_hash_cmp_arg arg = {
1036		.paddr = paddr,
1037		.net   = ep->base.net,
1038		.lport = htons(ep->base.bind_addr.port),
1039	};
1040
1041	list = rhltable_lookup(&sctp_transport_hashtable, &arg,
1042			       sctp_hash_params);
1043
1044	rhl_for_each_entry_rcu(t, tmp, list, node)
1045		if (ep == t->asoc->ep)
1046			return t;
1047
1048	return NULL;
1049}
1050
1051/* Look up an association. */
1052static struct sctp_association *__sctp_lookup_association(
1053					struct net *net,
1054					const union sctp_addr *local,
1055					const union sctp_addr *peer,
1056					struct sctp_transport **pt)
1057{
1058	struct sctp_transport *t;
1059	struct sctp_association *asoc = NULL;
1060
1061	t = sctp_addrs_lookup_transport(net, local, peer);
1062	if (!t)
1063		goto out;
1064
1065	asoc = t->asoc;
1066	*pt = t;
1067
1068out:
1069	return asoc;
1070}
1071
1072/* Look up an association. protected by RCU read lock */
1073static
1074struct sctp_association *sctp_lookup_association(struct net *net,
1075						 const union sctp_addr *laddr,
1076						 const union sctp_addr *paddr,
1077						 struct sctp_transport **transportp)
1078{
1079	struct sctp_association *asoc;
1080
1081	rcu_read_lock();
1082	asoc = __sctp_lookup_association(net, laddr, paddr, transportp);
1083	rcu_read_unlock();
1084
1085	return asoc;
1086}
1087
1088/* Is there an association matching the given local and peer addresses? */
1089bool sctp_has_association(struct net *net,
1090			  const union sctp_addr *laddr,
1091			  const union sctp_addr *paddr)
1092{
1093	struct sctp_transport *transport;
1094
1095	if (sctp_lookup_association(net, laddr, paddr, &transport)) {
1096		sctp_transport_put(transport);
1097		return true;
1098	}
1099
1100	return false;
1101}
1102
1103/*
1104 * SCTP Implementors Guide, 2.18 Handling of address
1105 * parameters within the INIT or INIT-ACK.
1106 *
1107 * D) When searching for a matching TCB upon reception of an INIT
1108 *    or INIT-ACK chunk the receiver SHOULD use not only the
1109 *    source address of the packet (containing the INIT or
1110 *    INIT-ACK) but the receiver SHOULD also use all valid
1111 *    address parameters contained within the chunk.
1112 *
1113 * 2.18.3 Solution description
1114 *
1115 * This new text clearly specifies to an implementor the need
1116 * to look within the INIT or INIT-ACK. Any implementation that
1117 * does not do this, may not be able to establish associations
1118 * in certain circumstances.
1119 *
1120 */
1121static struct sctp_association *__sctp_rcv_init_lookup(struct net *net,
1122	struct sk_buff *skb,
1123	const union sctp_addr *laddr, struct sctp_transport **transportp)
1124{
1125	struct sctp_association *asoc;
1126	union sctp_addr addr;
1127	union sctp_addr *paddr = &addr;
1128	struct sctphdr *sh = sctp_hdr(skb);
1129	union sctp_params params;
1130	struct sctp_init_chunk *init;
1131	struct sctp_af *af;
1132
1133	/*
1134	 * This code will NOT touch anything inside the chunk--it is
1135	 * strictly READ-ONLY.
1136	 *
1137	 * RFC 2960 3  SCTP packet Format
1138	 *
1139	 * Multiple chunks can be bundled into one SCTP packet up to
1140	 * the MTU size, except for the INIT, INIT ACK, and SHUTDOWN
1141	 * COMPLETE chunks.  These chunks MUST NOT be bundled with any
1142	 * other chunk in a packet.  See Section 6.10 for more details
1143	 * on chunk bundling.
1144	 */
1145
1146	/* Find the start of the TLVs and the end of the chunk.  This is
1147	 * the region we search for address parameters.
1148	 */
1149	init = (struct sctp_init_chunk *)skb->data;
1150
1151	/* Walk the parameters looking for embedded addresses. */
1152	sctp_walk_params(params, init, init_hdr.params) {
1153
1154		/* Note: Ignoring hostname addresses. */
1155		af = sctp_get_af_specific(param_type2af(params.p->type));
1156		if (!af)
1157			continue;
1158
1159		if (!af->from_addr_param(paddr, params.addr, sh->source, 0))
1160			continue;
1161
1162		asoc = __sctp_lookup_association(net, laddr, paddr, transportp);
1163		if (asoc)
1164			return asoc;
1165	}
1166
1167	return NULL;
1168}
1169
1170/* ADD-IP, Section 5.2
1171 * When an endpoint receives an ASCONF Chunk from the remote peer
1172 * special procedures may be needed to identify the association the
1173 * ASCONF Chunk is associated with. To properly find the association
1174 * the following procedures SHOULD be followed:
1175 *
1176 * D2) If the association is not found, use the address found in the
1177 * Address Parameter TLV combined with the port number found in the
1178 * SCTP common header. If found proceed to rule D4.
1179 *
1180 * D2-ext) If more than one ASCONF Chunks are packed together, use the
1181 * address found in the ASCONF Address Parameter TLV of each of the
1182 * subsequent ASCONF Chunks. If found, proceed to rule D4.
1183 */
1184static struct sctp_association *__sctp_rcv_asconf_lookup(
1185					struct net *net,
1186					struct sctp_chunkhdr *ch,
1187					const union sctp_addr *laddr,
1188					__be16 peer_port,
1189					struct sctp_transport **transportp)
1190{
1191	struct sctp_addip_chunk *asconf = (struct sctp_addip_chunk *)ch;
1192	struct sctp_af *af;
1193	union sctp_addr_param *param;
1194	union sctp_addr paddr;
1195
1196	if (ntohs(ch->length) < sizeof(*asconf) + sizeof(struct sctp_paramhdr))
1197		return NULL;
1198
1199	/* Skip over the ADDIP header and find the Address parameter */
1200	param = (union sctp_addr_param *)(asconf + 1);
1201
1202	af = sctp_get_af_specific(param_type2af(param->p.type));
1203	if (unlikely(!af))
1204		return NULL;
1205
1206	if (!af->from_addr_param(&paddr, param, peer_port, 0))
1207		return NULL;
1208
1209	return __sctp_lookup_association(net, laddr, &paddr, transportp);
1210}
1211
1212
1213/* SCTP-AUTH, Section 6.3:
1214*    If the receiver does not find a STCB for a packet containing an AUTH
1215*    chunk as the first chunk and not a COOKIE-ECHO chunk as the second
1216*    chunk, it MUST use the chunks after the AUTH chunk to look up an existing
1217*    association.
1218*
1219* This means that any chunks that can help us identify the association need
1220* to be looked at to find this association.
1221*/
1222static struct sctp_association *__sctp_rcv_walk_lookup(struct net *net,
1223				      struct sk_buff *skb,
1224				      const union sctp_addr *laddr,
1225				      struct sctp_transport **transportp)
1226{
1227	struct sctp_association *asoc = NULL;
1228	struct sctp_chunkhdr *ch;
1229	int have_auth = 0;
1230	unsigned int chunk_num = 1;
1231	__u8 *ch_end;
1232
1233	/* Walk through the chunks looking for AUTH or ASCONF chunks
1234	 * to help us find the association.
1235	 */
1236	ch = (struct sctp_chunkhdr *)skb->data;
1237	do {
1238		/* Break out if chunk length is less then minimal. */
1239		if (ntohs(ch->length) < sizeof(*ch))
1240			break;
1241
1242		ch_end = ((__u8 *)ch) + SCTP_PAD4(ntohs(ch->length));
1243		if (ch_end > skb_tail_pointer(skb))
1244			break;
1245
1246		switch (ch->type) {
1247		case SCTP_CID_AUTH:
1248			have_auth = chunk_num;
1249			break;
1250
1251		case SCTP_CID_COOKIE_ECHO:
1252			/* If a packet arrives containing an AUTH chunk as
1253			 * a first chunk, a COOKIE-ECHO chunk as the second
1254			 * chunk, and possibly more chunks after them, and
1255			 * the receiver does not have an STCB for that
1256			 * packet, then authentication is based on
1257			 * the contents of the COOKIE- ECHO chunk.
1258			 */
1259			if (have_auth == 1 && chunk_num == 2)
1260				return NULL;
1261			break;
1262
1263		case SCTP_CID_ASCONF:
1264			if (have_auth || net->sctp.addip_noauth)
1265				asoc = __sctp_rcv_asconf_lookup(
1266						net, ch, laddr,
1267						sctp_hdr(skb)->source,
1268						transportp);
1269			break;
1270		default:
1271			break;
1272		}
1273
1274		if (asoc)
1275			break;
1276
1277		ch = (struct sctp_chunkhdr *)ch_end;
1278		chunk_num++;
1279	} while (ch_end + sizeof(*ch) < skb_tail_pointer(skb));
1280
1281	return asoc;
1282}
1283
1284/*
1285 * There are circumstances when we need to look inside the SCTP packet
1286 * for information to help us find the association.   Examples
1287 * include looking inside of INIT/INIT-ACK chunks or after the AUTH
1288 * chunks.
1289 */
1290static struct sctp_association *__sctp_rcv_lookup_harder(struct net *net,
1291				      struct sk_buff *skb,
1292				      const union sctp_addr *laddr,
1293				      struct sctp_transport **transportp)
1294{
1295	struct sctp_chunkhdr *ch;
1296
1297	/* We do not allow GSO frames here as we need to linearize and
1298	 * then cannot guarantee frame boundaries. This shouldn't be an
1299	 * issue as packets hitting this are mostly INIT or INIT-ACK and
1300	 * those cannot be on GSO-style anyway.
1301	 */
1302	if (skb_is_gso(skb) && skb_is_gso_sctp(skb))
1303		return NULL;
1304
1305	ch = (struct sctp_chunkhdr *)skb->data;
1306
1307	/* The code below will attempt to walk the chunk and extract
1308	 * parameter information.  Before we do that, we need to verify
1309	 * that the chunk length doesn't cause overflow.  Otherwise, we'll
1310	 * walk off the end.
1311	 */
1312	if (SCTP_PAD4(ntohs(ch->length)) > skb->len)
1313		return NULL;
1314
1315	/* If this is INIT/INIT-ACK look inside the chunk too. */
1316	if (ch->type == SCTP_CID_INIT || ch->type == SCTP_CID_INIT_ACK)
1317		return __sctp_rcv_init_lookup(net, skb, laddr, transportp);
1318
1319	return __sctp_rcv_walk_lookup(net, skb, laddr, transportp);
1320}
1321
1322/* Lookup an association for an inbound skb. */
1323static struct sctp_association *__sctp_rcv_lookup(struct net *net,
1324				      struct sk_buff *skb,
1325				      const union sctp_addr *paddr,
1326				      const union sctp_addr *laddr,
1327				      struct sctp_transport **transportp)
1328{
1329	struct sctp_association *asoc;
1330
1331	asoc = __sctp_lookup_association(net, laddr, paddr, transportp);
1332	if (asoc)
1333		goto out;
1334
1335	/* Further lookup for INIT/INIT-ACK packets.
1336	 * SCTP Implementors Guide, 2.18 Handling of address
1337	 * parameters within the INIT or INIT-ACK.
1338	 */
1339	asoc = __sctp_rcv_lookup_harder(net, skb, laddr, transportp);
1340	if (asoc)
1341		goto out;
1342
1343	if (paddr->sa.sa_family == AF_INET)
1344		pr_debug("sctp: asoc not found for src:%pI4:%d dst:%pI4:%d\n",
1345			 &laddr->v4.sin_addr, ntohs(laddr->v4.sin_port),
1346			 &paddr->v4.sin_addr, ntohs(paddr->v4.sin_port));
1347	else
1348		pr_debug("sctp: asoc not found for src:%pI6:%d dst:%pI6:%d\n",
1349			 &laddr->v6.sin6_addr, ntohs(laddr->v6.sin6_port),
1350			 &paddr->v6.sin6_addr, ntohs(paddr->v6.sin6_port));
1351
1352out:
1353	return asoc;
1354}