|
@@ -235,7 +235,7 @@ sctp_disposition_t sctp_sf_do_4_C(struct net *net,
|
|
return sctp_sf_violation_chunk(net, ep, asoc, type, arg, commands);
|
|
return sctp_sf_violation_chunk(net, ep, asoc, type, arg, commands);
|
|
|
|
|
|
/* Make sure that the SHUTDOWN_COMPLETE chunk has a valid length. */
|
|
/* Make sure that the SHUTDOWN_COMPLETE chunk has a valid length. */
|
|
- if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
|
|
|
|
|
|
+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
|
|
return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
|
|
return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
|
|
commands);
|
|
commands);
|
|
|
|
|
|
@@ -368,9 +368,9 @@ sctp_disposition_t sctp_sf_do_5_1B_init(struct net *net,
|
|
if (err_chunk) {
|
|
if (err_chunk) {
|
|
packet = sctp_abort_pkt_new(net, ep, asoc, arg,
|
|
packet = sctp_abort_pkt_new(net, ep, asoc, arg,
|
|
(__u8 *)(err_chunk->chunk_hdr) +
|
|
(__u8 *)(err_chunk->chunk_hdr) +
|
|
- sizeof(sctp_chunkhdr_t),
|
|
|
|
|
|
+ sizeof(struct sctp_chunkhdr),
|
|
ntohs(err_chunk->chunk_hdr->length) -
|
|
ntohs(err_chunk->chunk_hdr->length) -
|
|
- sizeof(sctp_chunkhdr_t));
|
|
|
|
|
|
+ sizeof(struct sctp_chunkhdr));
|
|
|
|
|
|
sctp_chunk_free(err_chunk);
|
|
sctp_chunk_free(err_chunk);
|
|
|
|
|
|
@@ -417,7 +417,7 @@ sctp_disposition_t sctp_sf_do_5_1B_init(struct net *net,
|
|
len = 0;
|
|
len = 0;
|
|
if (err_chunk)
|
|
if (err_chunk)
|
|
len = ntohs(err_chunk->chunk_hdr->length) -
|
|
len = ntohs(err_chunk->chunk_hdr->length) -
|
|
- sizeof(sctp_chunkhdr_t);
|
|
|
|
|
|
+ sizeof(struct sctp_chunkhdr);
|
|
|
|
|
|
repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
|
|
repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
|
|
if (!repl)
|
|
if (!repl)
|
|
@@ -437,7 +437,7 @@ sctp_disposition_t sctp_sf_do_5_1B_init(struct net *net,
|
|
*/
|
|
*/
|
|
unk_param = (sctp_unrecognized_param_t *)
|
|
unk_param = (sctp_unrecognized_param_t *)
|
|
((__u8 *)(err_chunk->chunk_hdr) +
|
|
((__u8 *)(err_chunk->chunk_hdr) +
|
|
- sizeof(sctp_chunkhdr_t));
|
|
|
|
|
|
+ sizeof(struct sctp_chunkhdr));
|
|
/* Replace the cause code with the "Unrecognized parameter"
|
|
/* Replace the cause code with the "Unrecognized parameter"
|
|
* parameter type.
|
|
* parameter type.
|
|
*/
|
|
*/
|
|
@@ -540,9 +540,9 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(struct net *net,
|
|
if (err_chunk) {
|
|
if (err_chunk) {
|
|
packet = sctp_abort_pkt_new(net, ep, asoc, arg,
|
|
packet = sctp_abort_pkt_new(net, ep, asoc, arg,
|
|
(__u8 *)(err_chunk->chunk_hdr) +
|
|
(__u8 *)(err_chunk->chunk_hdr) +
|
|
- sizeof(sctp_chunkhdr_t),
|
|
|
|
|
|
+ sizeof(struct sctp_chunkhdr),
|
|
ntohs(err_chunk->chunk_hdr->length) -
|
|
ntohs(err_chunk->chunk_hdr->length) -
|
|
- sizeof(sctp_chunkhdr_t));
|
|
|
|
|
|
+ sizeof(struct sctp_chunkhdr));
|
|
|
|
|
|
sctp_chunk_free(err_chunk);
|
|
sctp_chunk_free(err_chunk);
|
|
|
|
|
|
@@ -673,7 +673,7 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net,
|
|
* chunk header. More detailed verification is done
|
|
* chunk header. More detailed verification is done
|
|
* in sctp_unpack_cookie().
|
|
* in sctp_unpack_cookie().
|
|
*/
|
|
*/
|
|
- if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
|
|
|
|
|
|
+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
|
|
return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
|
|
return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
|
|
|
|
|
|
/* If the endpoint is not listening or if the number of associations
|
|
/* If the endpoint is not listening or if the number of associations
|
|
@@ -691,7 +691,7 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net,
|
|
chunk->subh.cookie_hdr =
|
|
chunk->subh.cookie_hdr =
|
|
(struct sctp_signed_cookie *)chunk->skb->data;
|
|
(struct sctp_signed_cookie *)chunk->skb->data;
|
|
if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
|
|
if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
|
|
- sizeof(sctp_chunkhdr_t)))
|
|
|
|
|
|
+ sizeof(struct sctp_chunkhdr)))
|
|
goto nomem;
|
|
goto nomem;
|
|
|
|
|
|
/* 5.1 D) Upon reception of the COOKIE ECHO chunk, Endpoint
|
|
/* 5.1 D) Upon reception of the COOKIE ECHO chunk, Endpoint
|
|
@@ -770,9 +770,10 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net,
|
|
auth.skb = chunk->auth_chunk;
|
|
auth.skb = chunk->auth_chunk;
|
|
auth.asoc = chunk->asoc;
|
|
auth.asoc = chunk->asoc;
|
|
auth.sctp_hdr = chunk->sctp_hdr;
|
|
auth.sctp_hdr = chunk->sctp_hdr;
|
|
- auth.chunk_hdr = skb_push(chunk->auth_chunk,
|
|
|
|
- sizeof(sctp_chunkhdr_t));
|
|
|
|
- skb_pull(chunk->auth_chunk, sizeof(sctp_chunkhdr_t));
|
|
|
|
|
|
+ auth.chunk_hdr = (struct sctp_chunkhdr *)
|
|
|
|
+ skb_push(chunk->auth_chunk,
|
|
|
|
+ sizeof(struct sctp_chunkhdr));
|
|
|
|
+ skb_pull(chunk->auth_chunk, sizeof(struct sctp_chunkhdr));
|
|
auth.transport = chunk->transport;
|
|
auth.transport = chunk->transport;
|
|
|
|
|
|
ret = sctp_sf_authenticate(net, ep, new_asoc, type, &auth);
|
|
ret = sctp_sf_authenticate(net, ep, new_asoc, type, &auth);
|
|
@@ -886,7 +887,7 @@ sctp_disposition_t sctp_sf_do_5_1E_ca(struct net *net,
|
|
/* Verify that the chunk length for the COOKIE-ACK is OK.
|
|
/* Verify that the chunk length for the COOKIE-ACK is OK.
|
|
* If we don't do this, any bundled chunks may be junked.
|
|
* If we don't do this, any bundled chunks may be junked.
|
|
*/
|
|
*/
|
|
- if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
|
|
|
|
|
|
+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
|
|
return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
|
|
return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
|
|
commands);
|
|
commands);
|
|
|
|
|
|
@@ -1099,7 +1100,7 @@ sctp_disposition_t sctp_sf_beat_8_3(struct net *net,
|
|
*/
|
|
*/
|
|
chunk->subh.hb_hdr = (sctp_heartbeathdr_t *) chunk->skb->data;
|
|
chunk->subh.hb_hdr = (sctp_heartbeathdr_t *) chunk->skb->data;
|
|
param_hdr = (sctp_paramhdr_t *) chunk->subh.hb_hdr;
|
|
param_hdr = (sctp_paramhdr_t *) chunk->subh.hb_hdr;
|
|
- paylen = ntohs(chunk->chunk_hdr->length) - sizeof(sctp_chunkhdr_t);
|
|
|
|
|
|
+ paylen = ntohs(chunk->chunk_hdr->length) - sizeof(struct sctp_chunkhdr);
|
|
|
|
|
|
if (ntohs(param_hdr->length) > paylen)
|
|
if (ntohs(param_hdr->length) > paylen)
|
|
return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
|
|
return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
|
|
@@ -1164,7 +1165,7 @@ sctp_disposition_t sctp_sf_backbeat_8_3(struct net *net,
|
|
return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
|
|
return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
|
|
|
|
|
|
/* Make sure that the HEARTBEAT-ACK chunk has a valid length. */
|
|
/* Make sure that the HEARTBEAT-ACK chunk has a valid length. */
|
|
- if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t) +
|
|
|
|
|
|
+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr) +
|
|
sizeof(sctp_sender_hb_info_t)))
|
|
sizeof(sctp_sender_hb_info_t)))
|
|
return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
|
|
return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
|
|
commands);
|
|
commands);
|
|
@@ -1469,9 +1470,9 @@ static sctp_disposition_t sctp_sf_do_unexpected_init(
|
|
if (err_chunk) {
|
|
if (err_chunk) {
|
|
packet = sctp_abort_pkt_new(net, ep, asoc, arg,
|
|
packet = sctp_abort_pkt_new(net, ep, asoc, arg,
|
|
(__u8 *)(err_chunk->chunk_hdr) +
|
|
(__u8 *)(err_chunk->chunk_hdr) +
|
|
- sizeof(sctp_chunkhdr_t),
|
|
|
|
|
|
+ sizeof(struct sctp_chunkhdr),
|
|
ntohs(err_chunk->chunk_hdr->length) -
|
|
ntohs(err_chunk->chunk_hdr->length) -
|
|
- sizeof(sctp_chunkhdr_t));
|
|
|
|
|
|
+ sizeof(struct sctp_chunkhdr));
|
|
|
|
|
|
if (packet) {
|
|
if (packet) {
|
|
sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
|
|
sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
|
|
@@ -1535,7 +1536,7 @@ static sctp_disposition_t sctp_sf_do_unexpected_init(
|
|
len = 0;
|
|
len = 0;
|
|
if (err_chunk) {
|
|
if (err_chunk) {
|
|
len = ntohs(err_chunk->chunk_hdr->length) -
|
|
len = ntohs(err_chunk->chunk_hdr->length) -
|
|
- sizeof(sctp_chunkhdr_t);
|
|
|
|
|
|
+ sizeof(struct sctp_chunkhdr);
|
|
}
|
|
}
|
|
|
|
|
|
repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
|
|
repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
|
|
@@ -1556,7 +1557,7 @@ static sctp_disposition_t sctp_sf_do_unexpected_init(
|
|
*/
|
|
*/
|
|
unk_param = (sctp_unrecognized_param_t *)
|
|
unk_param = (sctp_unrecognized_param_t *)
|
|
((__u8 *)(err_chunk->chunk_hdr) +
|
|
((__u8 *)(err_chunk->chunk_hdr) +
|
|
- sizeof(sctp_chunkhdr_t));
|
|
|
|
|
|
+ sizeof(struct sctp_chunkhdr));
|
|
/* Replace the cause code with the "Unrecognized parameter"
|
|
/* Replace the cause code with the "Unrecognized parameter"
|
|
* parameter type.
|
|
* parameter type.
|
|
*/
|
|
*/
|
|
@@ -2044,7 +2045,7 @@ sctp_disposition_t sctp_sf_do_5_2_4_dupcook(struct net *net,
|
|
* enough for the chunk header. Cookie length verification is
|
|
* enough for the chunk header. Cookie length verification is
|
|
* done later.
|
|
* done later.
|
|
*/
|
|
*/
|
|
- if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
|
|
|
|
|
|
+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
|
|
return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
|
|
return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
|
|
commands);
|
|
commands);
|
|
|
|
|
|
@@ -2053,7 +2054,7 @@ sctp_disposition_t sctp_sf_do_5_2_4_dupcook(struct net *net,
|
|
*/
|
|
*/
|
|
chunk->subh.cookie_hdr = (struct sctp_signed_cookie *)chunk->skb->data;
|
|
chunk->subh.cookie_hdr = (struct sctp_signed_cookie *)chunk->skb->data;
|
|
if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
|
|
if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
|
|
- sizeof(sctp_chunkhdr_t)))
|
|
|
|
|
|
+ sizeof(struct sctp_chunkhdr)))
|
|
goto nomem;
|
|
goto nomem;
|
|
|
|
|
|
/* In RFC 2960 5.2.4 3, if both Verification Tags in the State Cookie
|
|
/* In RFC 2960 5.2.4 3, if both Verification Tags in the State Cookie
|
|
@@ -2806,7 +2807,7 @@ sctp_disposition_t sctp_sf_do_9_2_reshutack(struct net *net,
|
|
struct sctp_chunk *reply;
|
|
struct sctp_chunk *reply;
|
|
|
|
|
|
/* Make sure that the chunk has a valid length */
|
|
/* Make sure that the chunk has a valid length */
|
|
- if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
|
|
|
|
|
|
+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
|
|
return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
|
|
return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
|
|
commands);
|
|
commands);
|
|
|
|
|
|
@@ -3358,7 +3359,7 @@ sctp_disposition_t sctp_sf_do_9_2_final(struct net *net,
|
|
return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
|
|
return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
|
|
|
|
|
|
/* Make sure that the SHUTDOWN_ACK chunk has a valid length. */
|
|
/* Make sure that the SHUTDOWN_ACK chunk has a valid length. */
|
|
- if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
|
|
|
|
|
|
+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
|
|
return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
|
|
return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
|
|
commands);
|
|
commands);
|
|
/* 10.2 H) SHUTDOWN COMPLETE notification
|
|
/* 10.2 H) SHUTDOWN COMPLETE notification
|
|
@@ -3435,7 +3436,7 @@ sctp_disposition_t sctp_sf_ootb(struct net *net,
|
|
{
|
|
{
|
|
struct sctp_chunk *chunk = arg;
|
|
struct sctp_chunk *chunk = arg;
|
|
struct sk_buff *skb = chunk->skb;
|
|
struct sk_buff *skb = chunk->skb;
|
|
- sctp_chunkhdr_t *ch;
|
|
|
|
|
|
+ struct sctp_chunkhdr *ch;
|
|
sctp_errhdr_t *err;
|
|
sctp_errhdr_t *err;
|
|
__u8 *ch_end;
|
|
__u8 *ch_end;
|
|
int ootb_shut_ack = 0;
|
|
int ootb_shut_ack = 0;
|
|
@@ -3443,10 +3444,10 @@ sctp_disposition_t sctp_sf_ootb(struct net *net,
|
|
|
|
|
|
SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
|
|
SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
|
|
|
|
|
|
- ch = (sctp_chunkhdr_t *) chunk->chunk_hdr;
|
|
|
|
|
|
+ ch = (struct sctp_chunkhdr *)chunk->chunk_hdr;
|
|
do {
|
|
do {
|
|
/* Report violation if the chunk is less then minimal */
|
|
/* Report violation if the chunk is less then minimal */
|
|
- if (ntohs(ch->length) < sizeof(sctp_chunkhdr_t))
|
|
|
|
|
|
+ if (ntohs(ch->length) < sizeof(*ch))
|
|
return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
|
|
return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
|
|
commands);
|
|
commands);
|
|
|
|
|
|
@@ -3487,7 +3488,7 @@ sctp_disposition_t sctp_sf_ootb(struct net *net,
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
- ch = (sctp_chunkhdr_t *) ch_end;
|
|
|
|
|
|
+ ch = (struct sctp_chunkhdr *)ch_end;
|
|
} while (ch_end < skb_tail_pointer(skb));
|
|
} while (ch_end < skb_tail_pointer(skb));
|
|
|
|
|
|
if (ootb_shut_ack)
|
|
if (ootb_shut_ack)
|
|
@@ -3560,7 +3561,7 @@ static sctp_disposition_t sctp_sf_shut_8_4_5(struct net *net,
|
|
/* If the chunk length is invalid, we don't want to process
|
|
/* If the chunk length is invalid, we don't want to process
|
|
* the reset of the packet.
|
|
* the reset of the packet.
|
|
*/
|
|
*/
|
|
- if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
|
|
|
|
|
|
+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
|
|
return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
|
|
return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
|
|
|
|
|
|
/* We need to discard the rest of the packet to prevent
|
|
/* We need to discard the rest of the packet to prevent
|
|
@@ -3591,7 +3592,7 @@ sctp_disposition_t sctp_sf_do_8_5_1_E_sa(struct net *net,
|
|
struct sctp_chunk *chunk = arg;
|
|
struct sctp_chunk *chunk = arg;
|
|
|
|
|
|
/* Make sure that the SHUTDOWN_ACK chunk has a valid length. */
|
|
/* Make sure that the SHUTDOWN_ACK chunk has a valid length. */
|
|
- if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
|
|
|
|
|
|
+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
|
|
return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
|
|
return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
|
|
commands);
|
|
commands);
|
|
|
|
|
|
@@ -4256,7 +4257,7 @@ sctp_disposition_t sctp_sf_unk_chunk(struct net *net,
|
|
{
|
|
{
|
|
struct sctp_chunk *unk_chunk = arg;
|
|
struct sctp_chunk *unk_chunk = arg;
|
|
struct sctp_chunk *err_chunk;
|
|
struct sctp_chunk *err_chunk;
|
|
- sctp_chunkhdr_t *hdr;
|
|
|
|
|
|
+ struct sctp_chunkhdr *hdr;
|
|
|
|
|
|
pr_debug("%s: processing unknown chunk id:%d\n", __func__, type.chunk);
|
|
pr_debug("%s: processing unknown chunk id:%d\n", __func__, type.chunk);
|
|
|
|
|
|
@@ -4267,7 +4268,7 @@ sctp_disposition_t sctp_sf_unk_chunk(struct net *net,
|
|
* Since we don't know the chunk type, we use a general
|
|
* Since we don't know the chunk type, we use a general
|
|
* chunkhdr structure to make a comparison.
|
|
* chunkhdr structure to make a comparison.
|
|
*/
|
|
*/
|
|
- if (!sctp_chunk_length_valid(unk_chunk, sizeof(sctp_chunkhdr_t)))
|
|
|
|
|
|
+ if (!sctp_chunk_length_valid(unk_chunk, sizeof(*hdr)))
|
|
return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
|
|
return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
|
|
commands);
|
|
commands);
|
|
|
|
|
|
@@ -4340,7 +4341,7 @@ sctp_disposition_t sctp_sf_discard_chunk(struct net *net,
|
|
* Since we don't know the chunk type, we use a general
|
|
* Since we don't know the chunk type, we use a general
|
|
* chunkhdr structure to make a comparison.
|
|
* chunkhdr structure to make a comparison.
|
|
*/
|
|
*/
|
|
- if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
|
|
|
|
|
|
+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
|
|
return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
|
|
return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
|
|
commands);
|
|
commands);
|
|
|
|
|
|
@@ -4405,7 +4406,7 @@ sctp_disposition_t sctp_sf_violation(struct net *net,
|
|
struct sctp_chunk *chunk = arg;
|
|
struct sctp_chunk *chunk = arg;
|
|
|
|
|
|
/* Make sure that the chunk has a valid length. */
|
|
/* Make sure that the chunk has a valid length. */
|
|
- if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
|
|
|
|
|
|
+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
|
|
return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
|
|
return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
|
|
commands);
|
|
commands);
|
|
|
|
|