1	// SPDX-License-Identifier: GPL-2.0-or-later
2	/*
3	* net/dccp/feat.c
4	*
5	* Feature negotiation for the DCCP protocol (RFC 4340, section 6)
6	*
7	* Copyright (c) 2008 Gerrit Renker <gerrit@erg.abdn.ac.uk>
8	* Rewrote from scratch, some bits from earlier code by
9	* Copyright (c) 2005 Andrea Bittau <a.bittau@cs.ucl.ac.uk>
10	*
11	* ASSUMPTIONS
12	* -----------
13	* o Feature negotiation is coordinated with connection setup (as in TCP), wild
14	* changes of parameters of an established connection are not supported.
15	* o Changing non-negotiable (NN) values is supported in state OPEN/PARTOPEN.
16	* o All currently known SP features have 1-byte quantities. If in the future
17	* extensions of RFCs 4340..42 define features with item lengths larger than
18	* one byte, a feature-specific extension of the code will be required.
19	*/
20	#include <linux/module.h>
21	#include <linux/slab.h>
22	#include "ccid.h"
23	#include "feat.h"
24
25	/* feature-specific sysctls - initialised to the defaults from RFC 4340, 6.4 */
26	unsigned long sysctl_dccp_sequence_window __read_mostly = 100;
27	int sysctl_dccp_rx_ccid __read_mostly = 2,
28	sysctl_dccp_tx_ccid __read_mostly = 2;
29
30	/*
31	* Feature activation handlers.
32	*
33	* These all use an u64 argument, to provide enough room for NN/SP features. At
34	* this stage the negotiated values have been checked to be within their range.
35	*/
36	static int dccp_hdlr_ccid(struct sock *sk, u64 ccid, bool rx)
37	{
38	struct dccp_sock *dp = dccp_sk(sk);
39	struct ccid *new_ccid = ccid_new(id: ccid, sk, rx);
40
41	if (new_ccid == NULL)
42	return -ENOMEM;
43
44	if (rx) {
45	ccid_hc_rx_delete(ccid: dp->dccps_hc_rx_ccid, sk);
46	dp->dccps_hc_rx_ccid = new_ccid;
47	} else {
48	ccid_hc_tx_delete(ccid: dp->dccps_hc_tx_ccid, sk);
49	dp->dccps_hc_tx_ccid = new_ccid;
50	}
51	return 0;
52	}
53
54	static int dccp_hdlr_seq_win(struct sock *sk, u64 seq_win, bool rx)
55	{
56	struct dccp_sock *dp = dccp_sk(sk);
57
58	if (rx) {
59	dp->dccps_r_seq_win = seq_win;
60	/* propagate changes to update SWL/SWH */
61	dccp_update_gsr(sk, seq: dp->dccps_gsr);
62	} else {
63	dp->dccps_l_seq_win = seq_win;
64	/* propagate changes to update AWL */
65	dccp_update_gss(sk, seq: dp->dccps_gss);
66	}
67	return 0;
68	}
69
70	static int dccp_hdlr_ack_ratio(struct sock *sk, u64 ratio, bool rx)
71	{
72	if (rx)
73	dccp_sk(sk)->dccps_r_ack_ratio = ratio;
74	else
75	dccp_sk(sk)->dccps_l_ack_ratio = ratio;
76	return 0;
77	}
78
79	static int dccp_hdlr_ackvec(struct sock *sk, u64 enable, bool rx)
80	{
81	struct dccp_sock *dp = dccp_sk(sk);
82
83	if (rx) {
84	if (enable && dp->dccps_hc_rx_ackvec == NULL) {
85	dp->dccps_hc_rx_ackvec = dccp_ackvec_alloc(priority: gfp_any());
86	if (dp->dccps_hc_rx_ackvec == NULL)
87	return -ENOMEM;
88	} else if (!enable) {
89	dccp_ackvec_free(av: dp->dccps_hc_rx_ackvec);
90	dp->dccps_hc_rx_ackvec = NULL;
91	}
92	}
93	return 0;
94	}
95
96	static int dccp_hdlr_ndp(struct sock *sk, u64 enable, bool rx)
97	{
98	if (!rx)
99	dccp_sk(sk)->dccps_send_ndp_count = (enable > 0);
100	return 0;
101	}
102
103	/*
104	* Minimum Checksum Coverage is located at the RX side (9.2.1). This means that
105	* `rx' holds when the sending peer informs about his partial coverage via a
106	* ChangeR() option. In the other case, we are the sender and the receiver
107	* announces its coverage via ChangeL() options. The policy here is to honour
108	* such communication by enabling the corresponding partial coverage - but only
109	* if it has not been set manually before; the warning here means that all
110	* packets will be dropped.
111	*/
112	static int dccp_hdlr_min_cscov(struct sock *sk, u64 cscov, bool rx)
113	{
114	struct dccp_sock *dp = dccp_sk(sk);
115
116	if (rx)
117	dp->dccps_pcrlen = cscov;
118	else {
119	if (dp->dccps_pcslen == 0)
120	dp->dccps_pcslen = cscov;
121	else if (cscov > dp->dccps_pcslen)
122	DCCP_WARN("CsCov %u too small, peer requires >= %u\n",
123	dp->dccps_pcslen, (u8)cscov);
124	}
125	return 0;
126	}
127
128	static const struct {
129	u8 feat_num; /* DCCPF_xxx */
130	enum dccp_feat_type rxtx; /* RX or TX */
131	enum dccp_feat_type reconciliation; /* SP or NN */
132	u8 default_value; /* as in 6.4 */
133	int (*activation_hdlr)(struct sock *sk, u64 val, bool rx);
134	/*
135	* Lookup table for location and type of features (from RFC 4340/4342)
136	* +--------------------------+----+-----+----+----+---------+-----------+
137	* | Feature | Location | Reconc. | Initial | Section |
138	* | | RX | TX | SP | NN | Value | Reference |
139	* +--------------------------+----+-----+----+----+---------+-----------+
140	* | DCCPF_CCID | | X | X | | 2 | 10 |
141	* | DCCPF_SHORT_SEQNOS | | X | X | | 0 | 7.6.1 |
142	* | DCCPF_SEQUENCE_WINDOW | | X | | X | 100 | 7.5.2 |
143	* | DCCPF_ECN_INCAPABLE | X | | X | | 0 | 12.1 |
144	* | DCCPF_ACK_RATIO | | X | | X | 2 | 11.3 |
145	* | DCCPF_SEND_ACK_VECTOR | X | | X | | 0 | 11.5 |
146	* | DCCPF_SEND_NDP_COUNT | | X | X | | 0 | 7.7.2 |
147	* | DCCPF_MIN_CSUM_COVER | X | | X | | 0 | 9.2.1 |
148	* | DCCPF_DATA_CHECKSUM | X | | X | | 0 | 9.3.1 |
149	* | DCCPF_SEND_LEV_RATE | X | | X | | 0 | 4342/8.4 |
150	* +--------------------------+----+-----+----+----+---------+-----------+
151	*/
152	} dccp_feat_table[] = {
153	{ DCCPF_CCID, FEAT_AT_TX, FEAT_SP, 2, dccp_hdlr_ccid },
154	{ DCCPF_SHORT_SEQNOS, FEAT_AT_TX, FEAT_SP, 0, NULL },
155	{ DCCPF_SEQUENCE_WINDOW, FEAT_AT_TX, FEAT_NN, 100, dccp_hdlr_seq_win },
156	{ DCCPF_ECN_INCAPABLE, FEAT_AT_RX, FEAT_SP, 0, NULL },
157	{ DCCPF_ACK_RATIO, FEAT_AT_TX, FEAT_NN, 2, dccp_hdlr_ack_ratio},
158	{ DCCPF_SEND_ACK_VECTOR, FEAT_AT_RX, FEAT_SP, 0, dccp_hdlr_ackvec },
159	{ DCCPF_SEND_NDP_COUNT, FEAT_AT_TX, FEAT_SP, 0, dccp_hdlr_ndp },
160	{ DCCPF_MIN_CSUM_COVER, FEAT_AT_RX, FEAT_SP, 0, dccp_hdlr_min_cscov},
161	{ DCCPF_DATA_CHECKSUM, FEAT_AT_RX, FEAT_SP, 0, NULL },
162	{ DCCPF_SEND_LEV_RATE, FEAT_AT_RX, FEAT_SP, 0, NULL },
163	};
164	#define DCCP_FEAT_SUPPORTED_MAX ARRAY_SIZE(dccp_feat_table)
165
166	/**
167	* dccp_feat_index - Hash function to map feature number into array position
168	* @feat_num: feature to hash, one of %dccp_feature_numbers
169	*
170	* Returns consecutive array index or -1 if the feature is not understood.
171	*/
172	static int dccp_feat_index(u8 feat_num)
173	{
174	/* The first 9 entries are occupied by the types from RFC 4340, 6.4 */
175	if (feat_num > DCCPF_RESERVED && feat_num <= DCCPF_DATA_CHECKSUM)
176	return feat_num - 1;
177
178	/*
179	* Other features: add cases for new feature types here after adding
180	* them to the above table.
181	*/
182	switch (feat_num) {
183	case DCCPF_SEND_LEV_RATE:
184	return DCCP_FEAT_SUPPORTED_MAX - 1;
185	}
186	return -1;
187	}
188
189	static u8 dccp_feat_type(u8 feat_num)
190	{
191	int idx = dccp_feat_index(feat_num);
192
193	if (idx < 0)
194	return FEAT_UNKNOWN;
195	return dccp_feat_table[idx].reconciliation;
196	}
197
198	static int dccp_feat_default_value(u8 feat_num)
199	{
200	int idx = dccp_feat_index(feat_num);
201	/*
202	* There are no default values for unknown features, so encountering a
203	* negative index here indicates a serious problem somewhere else.
204	*/
205	DCCP_BUG_ON(idx < 0);
206
207	return idx < 0 ? 0 : dccp_feat_table[idx].default_value;
208	}
209
210	/*
211	* Debugging and verbose-printing section
212	*/
213	static const char *dccp_feat_fname(const u8 feat)
214	{
215	static const char *const feature_names[] = {
216	[DCCPF_RESERVED] = "Reserved",
217	[DCCPF_CCID] = "CCID",
218	[DCCPF_SHORT_SEQNOS] = "Allow Short Seqnos",
219	[DCCPF_SEQUENCE_WINDOW] = "Sequence Window",
220	[DCCPF_ECN_INCAPABLE] = "ECN Incapable",
221	[DCCPF_ACK_RATIO] = "Ack Ratio",
222	[DCCPF_SEND_ACK_VECTOR] = "Send ACK Vector",
223	[DCCPF_SEND_NDP_COUNT] = "Send NDP Count",
224	[DCCPF_MIN_CSUM_COVER] = "Min. Csum Coverage",
225	[DCCPF_DATA_CHECKSUM] = "Send Data Checksum",
226	};
227	if (feat > DCCPF_DATA_CHECKSUM && feat < DCCPF_MIN_CCID_SPECIFIC)
228	return feature_names[DCCPF_RESERVED];
229
230	if (feat == DCCPF_SEND_LEV_RATE)
231	return "Send Loss Event Rate";
232	if (feat >= DCCPF_MIN_CCID_SPECIFIC)
233	return "CCID-specific";
234
235	return feature_names[feat];
236	}
237
238	static const char *const dccp_feat_sname[] = {
239	"DEFAULT", "INITIALISING", "CHANGING", "UNSTABLE", "STABLE",
240	};
241
242	#ifdef CONFIG_IP_DCCP_DEBUG
243	static const char *dccp_feat_oname(const u8 opt)
244	{
245	switch (opt) {
246	case DCCPO_CHANGE_L: return "Change_L";
247	case DCCPO_CONFIRM_L: return "Confirm_L";
248	case DCCPO_CHANGE_R: return "Change_R";
249	case DCCPO_CONFIRM_R: return "Confirm_R";
250	}
251	return NULL;
252	}
253
254	static void dccp_feat_printval(u8 feat_num, dccp_feat_val const *val)
255	{
256	u8 i, type = dccp_feat_type(feat_num);
257
258	if (val == NULL || (type == FEAT_SP && val->sp.vec == NULL))
259	dccp_pr_debug_cat("(NULL)");
260	else if (type == FEAT_SP)
261	for (i = 0; i < val->sp.len; i++)
262	dccp_pr_debug_cat("%s%u", i ? " " : "", val->sp.vec[i]);
263	else if (type == FEAT_NN)
264	dccp_pr_debug_cat("%llu", (unsigned long long)val->nn);
265	else
266	dccp_pr_debug_cat("unknown type %u", type);
267	}
268
269	static void dccp_feat_printvals(u8 feat_num, u8 *list, u8 len)
270	{
271	u8 type = dccp_feat_type(feat_num);
272	dccp_feat_val fval = { .sp.vec = list, .sp.len = len };
273
274	if (type == FEAT_NN)
275	fval.nn = dccp_decode_value_var(bf: list, len);
276	dccp_feat_printval(feat_num, val: &fval);
277	}
278
279	static void dccp_feat_print_entry(struct dccp_feat_entry const *entry)
280	{
281	dccp_debug(" * %s %s = ", entry->is_local ? "local" : "remote",
282	dccp_feat_fname(entry->feat_num));
283	dccp_feat_printval(feat_num: entry->feat_num, val: &entry->val);
284	dccp_pr_debug_cat(", state=%s %s\n", dccp_feat_sname[entry->state],
285	entry->needs_confirm ? "(Confirm pending)" : "");
286	}
287
288	#define dccp_feat_print_opt(opt, feat, val, len, mandatory) do { \
289	dccp_pr_debug("%s(%s, ", dccp_feat_oname(opt), dccp_feat_fname(feat));\
290	dccp_feat_printvals(feat, val, len); \
291	dccp_pr_debug_cat(") %s\n", mandatory ? "!" : ""); } while (0)
292
293	#define dccp_feat_print_fnlist(fn_list) { \
294	const struct dccp_feat_entry *___entry; \
295	\
296	dccp_pr_debug("List Dump:\n"); \
297	list_for_each_entry(___entry, fn_list, node) \
298	dccp_feat_print_entry(___entry); \
299	}
300	#else /* ! CONFIG_IP_DCCP_DEBUG */
301	#define dccp_feat_print_opt(opt, feat, val, len, mandatory)
302	#define dccp_feat_print_fnlist(fn_list)
303	#endif
304
305	static int __dccp_feat_activate(struct sock *sk, const int idx,
306	const bool is_local, dccp_feat_val const *fval)
307	{
308	bool rx;
309	u64 val;
310
311	if (idx < 0 || idx >= DCCP_FEAT_SUPPORTED_MAX)
312	return -1;
313	if (dccp_feat_table[idx].activation_hdlr == NULL)
314	return 0;
315
316	if (fval == NULL) {
317	val = dccp_feat_table[idx].default_value;
318	} else if (dccp_feat_table[idx].reconciliation == FEAT_SP) {
319	if (fval->sp.vec == NULL) {
320	/*
321	* This can happen when an empty Confirm is sent
322	* for an SP (i.e. known) feature. In this case
323	* we would be using the default anyway.
324	*/
325	DCCP_CRIT("Feature #%d undefined: using default", idx);
326	val = dccp_feat_table[idx].default_value;
327	} else {
328	val = fval->sp.vec[0];
329	}
330	} else {
331	val = fval->nn;
332	}
333
334	/* Location is RX if this is a local-RX or remote-TX feature */
335	rx = (is_local == (dccp_feat_table[idx].rxtx == FEAT_AT_RX));
336
337	dccp_debug(" -> activating %s %s, %sval=%llu\n", rx ? "RX" : "TX",
338	dccp_feat_fname(dccp_feat_table[idx].feat_num),
339	fval ? "" : "default ", (unsigned long long)val);
340
341	return dccp_feat_table[idx].activation_hdlr(sk, val, rx);
342	}
343
344	/**
345	* dccp_feat_activate - Activate feature value on socket
346	* @sk: fully connected DCCP socket (after handshake is complete)
347	* @feat_num: feature to activate, one of %dccp_feature_numbers
348	* @local: whether local (1) or remote (0) @feat_num is meant
349	* @fval: the value (SP or NN) to activate, or NULL to use the default value
350	*
351	* For general use this function is preferable over __dccp_feat_activate().
352	*/
353	static int dccp_feat_activate(struct sock *sk, u8 feat_num, bool local,
354	dccp_feat_val const *fval)
355	{
356	return __dccp_feat_activate(sk, idx: dccp_feat_index(feat_num), is_local: local, fval);
357	}
358
359	/* Test for "Req'd" feature (RFC 4340, 6.4) */
360	static inline int dccp_feat_must_be_understood(u8 feat_num)
361	{
362	return feat_num == DCCPF_CCID || feat_num == DCCPF_SHORT_SEQNOS ||
363	feat_num == DCCPF_SEQUENCE_WINDOW;
364	}
365
366	/* copy constructor, fval must not already contain allocated memory */
367	static int dccp_feat_clone_sp_val(dccp_feat_val *fval, u8 const *val, u8 len)
368	{
369	fval->sp.len = len;
370	if (fval->sp.len > 0) {
371	fval->sp.vec = kmemdup(p: val, size: len, gfp: gfp_any());
372	if (fval->sp.vec == NULL) {
373	fval->sp.len = 0;
374	return -ENOMEM;
375	}
376	}
377	return 0;
378	}
379
380	static void dccp_feat_val_destructor(u8 feat_num, dccp_feat_val *val)
381	{
382	if (unlikely(val == NULL))
383	return;
384	if (dccp_feat_type(feat_num) == FEAT_SP)
385	kfree(objp: val->sp.vec);
386	memset(val, 0, sizeof(*val));
387	}
388
389	static struct dccp_feat_entry *
390	dccp_feat_clone_entry(struct dccp_feat_entry const *original)
391	{
392	struct dccp_feat_entry *new;
393	u8 type = dccp_feat_type(feat_num: original->feat_num);
394
395	if (type == FEAT_UNKNOWN)
396	return NULL;
397
398	new = kmemdup(p: original, size: sizeof(struct dccp_feat_entry), gfp: gfp_any());
399	if (new == NULL)
400	return NULL;
401
402	if (type == FEAT_SP && dccp_feat_clone_sp_val(fval: &new->val,
403	val: original->val.sp.vec,
404	len: original->val.sp.len)) {
405	kfree(objp: new);
406	return NULL;
407	}
408	return new;
409	}
410
411	static void dccp_feat_entry_destructor(struct dccp_feat_entry *entry)
412	{
413	if (entry != NULL) {
414	dccp_feat_val_destructor(feat_num: entry->feat_num, val: &entry->val);
415	kfree(objp: entry);
416	}
417	}
418
419	/*
420	* List management functions
421	*
422	* Feature negotiation lists rely on and maintain the following invariants:
423	* - each feat_num in the list is known, i.e. we know its type and default value
424	* - each feat_num/is_local combination is unique (old entries are overwritten)
425	* - SP values are always freshly allocated
426	* - list is sorted in increasing order of feature number (faster lookup)
427	*/
428	static struct dccp_feat_entry *dccp_feat_list_lookup(struct list_head *fn_list,
429	u8 feat_num, bool is_local)
430	{
431	struct dccp_feat_entry *entry;
432
433	list_for_each_entry(entry, fn_list, node) {
434	if (entry->feat_num == feat_num && entry->is_local == is_local)
435	return entry;
436	else if (entry->feat_num > feat_num)
437	break;
438	}
439	return NULL;
440	}
441
442	/**
443	* dccp_feat_entry_new - Central list update routine (called by all others)
444	* @head: list to add to
445	* @feat: feature number
446	* @local: whether the local (1) or remote feature with number @feat is meant
447	*
448	* This is the only constructor and serves to ensure the above invariants.
449	*/
450	static struct dccp_feat_entry *
451	dccp_feat_entry_new(struct list_head *head, u8 feat, bool local)
452	{
453	struct dccp_feat_entry *entry;
454
455	list_for_each_entry(entry, head, node)
456	if (entry->feat_num == feat && entry->is_local == local) {
457	dccp_feat_val_destructor(feat_num: entry->feat_num, val: &entry->val);
458	return entry;
459	} else if (entry->feat_num > feat) {
460	head = &entry->node;
461	break;
462	}
463
464	entry = kmalloc(size: sizeof(*entry), flags: gfp_any());
465	if (entry != NULL) {
466	entry->feat_num = feat;
467	entry->is_local = local;
468	list_add_tail(new: &entry->node, head);
469	}
470	return entry;
471	}
472
473	/**
474	* dccp_feat_push_change - Add/overwrite a Change option in the list
475	* @fn_list: feature-negotiation list to update
476	* @feat: one of %dccp_feature_numbers
477	* @local: whether local (1) or remote (0) @feat_num is meant
478	* @mandatory: whether to use Mandatory feature negotiation options
479	* @fval: pointer to NN/SP value to be inserted (will be copied)
480	*/
481	static int dccp_feat_push_change(struct list_head *fn_list, u8 feat, u8 local,
482	u8 mandatory, dccp_feat_val *fval)
483	{
484	struct dccp_feat_entry *new = dccp_feat_entry_new(head: fn_list, feat, local);
485
486	if (new == NULL)
487	return -ENOMEM;
488
489	new->feat_num = feat;
490	new->is_local = local;
491	new->state = FEAT_INITIALISING;
492	new->needs_confirm = false;
493	new->empty_confirm = false;
494	new->val = *fval;
495	new->needs_mandatory = mandatory;
496
497	return 0;
498	}
499
500	/**
501	* dccp_feat_push_confirm - Add a Confirm entry to the FN list
502	* @fn_list: feature-negotiation list to add to
503	* @feat: one of %dccp_feature_numbers
504	* @local: whether local (1) or remote (0) @feat_num is being confirmed
505	* @fval: pointer to NN/SP value to be inserted or NULL
506	*
507	* Returns 0 on success, a Reset code for further processing otherwise.
508	*/
509	static int dccp_feat_push_confirm(struct list_head *fn_list, u8 feat, u8 local,
510	dccp_feat_val *fval)
511	{
512	struct dccp_feat_entry *new = dccp_feat_entry_new(head: fn_list, feat, local);
513
514	if (new == NULL)
515	return DCCP_RESET_CODE_TOO_BUSY;
516
517	new->feat_num = feat;
518	new->is_local = local;
519	new->state = FEAT_STABLE; /* transition in 6.6.2 */
520	new->needs_confirm = true;
521	new->empty_confirm = (fval == NULL);
522	new->val.nn = 0; /* zeroes the whole structure */
523	if (!new->empty_confirm)
524	new->val = *fval;
525	new->needs_mandatory = false;
526
527	return 0;
528	}
529
530	static int dccp_push_empty_confirm(struct list_head *fn_list, u8 feat, u8 local)
531	{
532	return dccp_feat_push_confirm(fn_list, feat, local, NULL);
533	}
534
535	static inline void dccp_feat_list_pop(struct dccp_feat_entry *entry)
536	{
537	list_del(entry: &entry->node);
538	dccp_feat_entry_destructor(entry);
539	}
540
541	void dccp_feat_list_purge(struct list_head *fn_list)
542	{
543	struct dccp_feat_entry *entry, *next;
544
545	list_for_each_entry_safe(entry, next, fn_list, node)
546	dccp_feat_entry_destructor(entry);
547	INIT_LIST_HEAD(list: fn_list);
548	}
549	EXPORT_SYMBOL_GPL(dccp_feat_list_purge);
550
551	/* generate @to as full clone of @from - @to must not contain any nodes */
552	int dccp_feat_clone_list(struct list_head const *from, struct list_head *to)
553	{
554	struct dccp_feat_entry *entry, *new;
555
556	INIT_LIST_HEAD(list: to);
557	list_for_each_entry(entry, from, node) {
558	new = dccp_feat_clone_entry(original: entry);
559	if (new == NULL)
560	goto cloning_failed;
561	list_add_tail(new: &new->node, head: to);
562	}
563	return 0;
564
565	cloning_failed:
566	dccp_feat_list_purge(to);
567	return -ENOMEM;
568	}
569
570	/**
571	* dccp_feat_valid_nn_length - Enforce length constraints on NN options
572	* @feat_num: feature to return length of, one of %dccp_feature_numbers
573	*
574	* Length is between 0 and %DCCP_OPTVAL_MAXLEN. Used for outgoing packets only,
575	* incoming options are accepted as long as their values are valid.
576	*/
577	static u8 dccp_feat_valid_nn_length(u8 feat_num)
578	{
579	if (feat_num == DCCPF_ACK_RATIO) /* RFC 4340, 11.3 and 6.6.8 */
580	return 2;
581	if (feat_num == DCCPF_SEQUENCE_WINDOW) /* RFC 4340, 7.5.2 and 6.5 */
582	return 6;
583	return 0;
584	}
585
586	static u8 dccp_feat_is_valid_nn_val(u8 feat_num, u64 val)
587	{
588	switch (feat_num) {
589	case DCCPF_ACK_RATIO:
590	return val <= DCCPF_ACK_RATIO_MAX;
591	case DCCPF_SEQUENCE_WINDOW:
592	return val >= DCCPF_SEQ_WMIN && val <= DCCPF_SEQ_WMAX;
593	}
594	return 0; /* feature unknown - so we can't tell */
595	}
596
597	/* check that SP values are within the ranges defined in RFC 4340 */
598	static u8 dccp_feat_is_valid_sp_val(u8 feat_num, u8 val)
599	{
600	switch (feat_num) {
601	case DCCPF_CCID:
602	return val == DCCPC_CCID2 || val == DCCPC_CCID3;
603	/* Type-check Boolean feature values: */
604	case DCCPF_SHORT_SEQNOS:
605	case DCCPF_ECN_INCAPABLE:
606	case DCCPF_SEND_ACK_VECTOR:
607	case DCCPF_SEND_NDP_COUNT:
608	case DCCPF_DATA_CHECKSUM:
609	case DCCPF_SEND_LEV_RATE:
610	return val < 2;
611	case DCCPF_MIN_CSUM_COVER:
612	return val < 16;
613	}
614	return 0; /* feature unknown */
615	}
616
617	static u8 dccp_feat_sp_list_ok(u8 feat_num, u8 const *sp_list, u8 sp_len)
618	{
619	if (sp_list == NULL || sp_len < 1)
620	return 0;
621	while (sp_len--)
622	if (!dccp_feat_is_valid_sp_val(feat_num, val: *sp_list++))
623	return 0;
624	return 1;
625	}
626
627	/**
628	* dccp_feat_insert_opts - Generate FN options from current list state
629	* @skb: next sk_buff to be sent to the peer
630	* @dp: for client during handshake and general negotiation
631	* @dreq: used by the server only (all Changes/Confirms in LISTEN/RESPOND)
632	*/
633	int dccp_feat_insert_opts(struct dccp_sock *dp, struct dccp_request_sock *dreq,
634	struct sk_buff *skb)
635	{
636	struct list_head *fn = dreq ? &dreq->dreq_featneg : &dp->dccps_featneg;
637	struct dccp_feat_entry *pos, *next;
638	u8 opt, type, len, *ptr, nn_in_nbo[DCCP_OPTVAL_MAXLEN];
639	bool rpt;
640
641	/* put entries into @skb in the order they appear in the list */
642	list_for_each_entry_safe_reverse(pos, next, fn, node) {
643	opt = dccp_feat_genopt(entry: pos);
644	type = dccp_feat_type(feat_num: pos->feat_num);
645	rpt = false;
646
647	if (pos->empty_confirm) {
648	len = 0;
649	ptr = NULL;
650	} else {
651	if (type == FEAT_SP) {
652	len = pos->val.sp.len;
653	ptr = pos->val.sp.vec;
654	rpt = pos->needs_confirm;
655	} else if (type == FEAT_NN) {
656	len = dccp_feat_valid_nn_length(feat_num: pos->feat_num);
657	ptr = nn_in_nbo;
658	dccp_encode_value_var(value: pos->val.nn, to: ptr, len);
659	} else {
660	DCCP_BUG("unknown feature %u", pos->feat_num);
661	return -1;
662	}
663	}
664	dccp_feat_print_opt(opt, pos->feat_num, ptr, len, 0);
665
666	if (dccp_insert_fn_opt(skb, type: opt, feat: pos->feat_num, val: ptr, len, repeat_first: rpt))
667	return -1;
668	if (pos->needs_mandatory && dccp_insert_option_mandatory(skb))
669	return -1;
670
671	if (skb->sk->sk_state == DCCP_OPEN &&
672	(opt == DCCPO_CONFIRM_R || opt == DCCPO_CONFIRM_L)) {
673	/*
674	* Confirms don't get retransmitted (6.6.3) once the
675	* connection is in state OPEN
676	*/
677	dccp_feat_list_pop(entry: pos);
678	} else {
679	/*
680	* Enter CHANGING after transmitting the Change
681	* option (6.6.2).
682	*/
683	if (pos->state == FEAT_INITIALISING)
684	pos->state = FEAT_CHANGING;
685	}
686	}
687	return 0;
688	}
689
690	/**
691	* __feat_register_nn - Register new NN value on socket
692	* @fn: feature-negotiation list to register with
693	* @feat: an NN feature from %dccp_feature_numbers
694	* @mandatory: use Mandatory option if 1
695	* @nn_val: value to register (restricted to 4 bytes)
696	*
697	* Note that NN features are local by definition (RFC 4340, 6.3.2).
698	*/
699	static int __feat_register_nn(struct list_head *fn, u8 feat,
700	u8 mandatory, u64 nn_val)
701	{
702	dccp_feat_val fval = { .nn = nn_val };
703
704	if (dccp_feat_type(feat_num: feat) != FEAT_NN ||
705	!dccp_feat_is_valid_nn_val(feat_num: feat, val: nn_val))
706	return -EINVAL;
707
708	/* Don't bother with default values, they will be activated anyway. */
709	if (nn_val - (u64)dccp_feat_default_value(feat_num: feat) == 0)
710	return 0;
711
712	return dccp_feat_push_change(fn_list: fn, feat, local: 1, mandatory, fval: &fval);
713	}
714
715	/**
716	* __feat_register_sp - Register new SP value/list on socket
717	* @fn: feature-negotiation list to register with
718	* @feat: an SP feature from %dccp_feature_numbers
719	* @is_local: whether the local (1) or the remote (0) @feat is meant
720	* @mandatory: use Mandatory option if 1
721	* @sp_val: SP value followed by optional preference list
722	* @sp_len: length of @sp_val in bytes
723	*/
724	static int __feat_register_sp(struct list_head *fn, u8 feat, u8 is_local,
725	u8 mandatory, u8 const *sp_val, u8 sp_len)
726	{
727	dccp_feat_val fval;
728
729	if (dccp_feat_type(feat_num: feat) != FEAT_SP ||
730	!dccp_feat_sp_list_ok(feat_num: feat, sp_list: sp_val, sp_len))
731	return -EINVAL;
732
733	/* Avoid negotiating alien CCIDs by only advertising supported ones */
734	if (feat == DCCPF_CCID && !ccid_support_check(ccid_array: sp_val, array_len: sp_len))
735	return -EOPNOTSUPP;
736
737	if (dccp_feat_clone_sp_val(fval: &fval, val: sp_val, len: sp_len))
738	return -ENOMEM;
739
740	if (dccp_feat_push_change(fn_list: fn, feat, local: is_local, mandatory, fval: &fval)) {
741	kfree(objp: fval.sp.vec);
742	return -ENOMEM;
743	}
744
745	return 0;
746	}
747
748	/**
749	* dccp_feat_register_sp - Register requests to change SP feature values
750	* @sk: client or listening socket
751	* @feat: one of %dccp_feature_numbers
752	* @is_local: whether the local (1) or remote (0) @feat is meant
753	* @list: array of preferred values, in descending order of preference
754	* @len: length of @list in bytes
755	*/
756	int dccp_feat_register_sp(struct sock *sk, u8 feat, u8 is_local,
757	u8 const *list, u8 len)
758	{ /* any changes must be registered before establishing the connection */
759	if (sk->sk_state != DCCP_CLOSED)
760	return -EISCONN;
761	if (dccp_feat_type(feat_num: feat) != FEAT_SP)
762	return -EINVAL;
763	return __feat_register_sp(fn: &dccp_sk(sk)->dccps_featneg, feat, is_local,
764	mandatory: 0, sp_val: list, sp_len: len);
765	}
766
767	/**
768	* dccp_feat_nn_get - Query current/pending value of NN feature
769	* @sk: DCCP socket of an established connection
770	* @feat: NN feature number from %dccp_feature_numbers
771	*
772	* For a known NN feature, returns value currently being negotiated, or
773	* current (confirmed) value if no negotiation is going on.
774	*/
775	u64 dccp_feat_nn_get(struct sock *sk, u8 feat)
776	{
777	if (dccp_feat_type(feat_num: feat) == FEAT_NN) {
778	struct dccp_sock *dp = dccp_sk(sk);
779	struct dccp_feat_entry *entry;
780
781	entry = dccp_feat_list_lookup(fn_list: &dp->dccps_featneg, feat_num: feat, is_local: 1);
782	if (entry != NULL)
783	return entry->val.nn;
784
785	switch (feat) {
786	case DCCPF_ACK_RATIO:
787	return dp->dccps_l_ack_ratio;
788	case DCCPF_SEQUENCE_WINDOW:
789	return dp->dccps_l_seq_win;
790	}
791	}
792	DCCP_BUG("attempt to look up unsupported feature %u", feat);
793	return 0;
794	}
795	EXPORT_SYMBOL_GPL(dccp_feat_nn_get);
796
797	/**
798	* dccp_feat_signal_nn_change - Update NN values for an established connection
799	* @sk: DCCP socket of an established connection
800	* @feat: NN feature number from %dccp_feature_numbers
801	* @nn_val: the new value to use
802	*
803	* This function is used to communicate NN updates out-of-band.
804	*/
805	int dccp_feat_signal_nn_change(struct sock *sk, u8 feat, u64 nn_val)
806	{
807	struct list_head *fn = &dccp_sk(sk)->dccps_featneg;
808	dccp_feat_val fval = { .nn = nn_val };
809	struct dccp_feat_entry *entry;
810
811	if (sk->sk_state != DCCP_OPEN && sk->sk_state != DCCP_PARTOPEN)
812	return 0;
813
814	if (dccp_feat_type(feat_num: feat) != FEAT_NN ||
815	!dccp_feat_is_valid_nn_val(feat_num: feat, val: nn_val))
816	return -EINVAL;
817
818	if (nn_val == dccp_feat_nn_get(sk, feat))
819	return 0; /* already set or negotiation under way */
820
821	entry = dccp_feat_list_lookup(fn_list: fn, feat_num: feat, is_local: 1);
822	if (entry != NULL) {
823	dccp_pr_debug("Clobbering existing NN entry %llu -> %llu\n",
824	(unsigned long long)entry->val.nn,
825	(unsigned long long)nn_val);
826	dccp_feat_list_pop(entry);
827	}
828
829	inet_csk_schedule_ack(sk);
830	return dccp_feat_push_change(fn_list: fn, feat, local: 1, mandatory: 0, fval: &fval);
831	}
832	EXPORT_SYMBOL_GPL(dccp_feat_signal_nn_change);
833
834	/*
835	* Tracking features whose value depend on the choice of CCID
836	*
837	* This is designed with an extension in mind so that a list walk could be done
838	* before activating any features. However, the existing framework was found to
839	* work satisfactorily up until now, the automatic verification is left open.
840	* When adding new CCIDs, add a corresponding dependency table here.
841	*/
842	static const struct ccid_dependency *dccp_feat_ccid_deps(u8 ccid, bool is_local)
843	{
844	static const struct ccid_dependency ccid2_dependencies[2][2] = {
845	/*
846	* CCID2 mandates Ack Vectors (RFC 4341, 4.): as CCID is a TX
847	* feature and Send Ack Vector is an RX feature, `is_local'
848	* needs to be reversed.
849	*/
850	{ /* Dependencies of the receiver-side (remote) CCID2 */
851	{
852	.dependent_feat = DCCPF_SEND_ACK_VECTOR,
853	.is_local = true,
854	.is_mandatory = true,
855	.val = 1
856	},
857	{ 0, 0, 0, 0 }
858	},
859	{ /* Dependencies of the sender-side (local) CCID2 */
860	{
861	.dependent_feat = DCCPF_SEND_ACK_VECTOR,
862	.is_local = false,
863	.is_mandatory = true,
864	.val = 1
865	},
866	{ 0, 0, 0, 0 }
867	}
868	};
869	static const struct ccid_dependency ccid3_dependencies[2][5] = {
870	{ /*
871	* Dependencies of the receiver-side CCID3
872	*/
873	{ /* locally disable Ack Vectors */
874	.dependent_feat = DCCPF_SEND_ACK_VECTOR,
875	.is_local = true,
876	.is_mandatory = false,
877	.val = 0
878	},
879	{ /* see below why Send Loss Event Rate is on */
880	.dependent_feat = DCCPF_SEND_LEV_RATE,
881	.is_local = true,
882	.is_mandatory = true,
883	.val = 1
884	},
885	{ /* NDP Count is needed as per RFC 4342, 6.1.1 */
886	.dependent_feat = DCCPF_SEND_NDP_COUNT,
887	.is_local = false,
888	.is_mandatory = true,
889	.val = 1
890	},
891	{ 0, 0, 0, 0 },
892	},
893	{ /*
894	* CCID3 at the TX side: we request that the HC-receiver
895	* will not send Ack Vectors (they will be ignored, so
896	* Mandatory is not set); we enable Send Loss Event Rate
897	* (Mandatory since the implementation does not support
898	* the Loss Intervals option of RFC 4342, 8.6).
899	* The last two options are for peer's information only.
900	*/
901	{
902	.dependent_feat = DCCPF_SEND_ACK_VECTOR,
903	.is_local = false,
904	.is_mandatory = false,
905	.val = 0
906	},
907	{
908	.dependent_feat = DCCPF_SEND_LEV_RATE,
909	.is_local = false,
910	.is_mandatory = true,
911	.val = 1
912	},
913	{ /* this CCID does not support Ack Ratio */
914	.dependent_feat = DCCPF_ACK_RATIO,
915	.is_local = true,
916	.is_mandatory = false,
917	.val = 0
918	},
919	{ /* tell receiver we are sending NDP counts */
920	.dependent_feat = DCCPF_SEND_NDP_COUNT,
921	.is_local = true,
922	.is_mandatory = false,
923	.val = 1
924	},
925	{ 0, 0, 0, 0 }
926	}
927	};
928	switch (ccid) {
929	case DCCPC_CCID2:
930	return ccid2_dependencies[is_local];
931	case DCCPC_CCID3:
932	return ccid3_dependencies[is_local];
933	default:
934	return NULL;
935	}
936	}
937
938	/**
939	* dccp_feat_propagate_ccid - Resolve dependencies of features on choice of CCID
940	* @fn: feature-negotiation list to update
941	* @id: CCID number to track
942	* @is_local: whether TX CCID (1) or RX CCID (0) is meant
943	*
944	* This function needs to be called after registering all other features.
945	*/
946	static int dccp_feat_propagate_ccid(struct list_head *fn, u8 id, bool is_local)
947	{
948	const struct ccid_dependency *table = dccp_feat_ccid_deps(ccid: id, is_local);
949	int i, rc = (table == NULL);
950
951	for (i = 0; rc == 0 && table[i].dependent_feat != DCCPF_RESERVED; i++)
952	if (dccp_feat_type(feat_num: table[i].dependent_feat) == FEAT_SP)
953	rc = __feat_register_sp(fn, feat: table[i].dependent_feat,
954	is_local: table[i].is_local,
955	mandatory: table[i].is_mandatory,
956	sp_val: &table[i].val, sp_len: 1);
957	else
958	rc = __feat_register_nn(fn, feat: table[i].dependent_feat,
959	mandatory: table[i].is_mandatory,
960	nn_val: table[i].val);
961	return rc;
962	}
963
964	/**
965	* dccp_feat_finalise_settings - Finalise settings before starting negotiation
966	* @dp: client or listening socket (settings will be inherited)
967	*
968	* This is called after all registrations (socket initialisation, sysctls, and
969	* sockopt calls), and before sending the first packet containing Change options
970	* (ie. client-Request or server-Response), to ensure internal consistency.
971	*/
972	int dccp_feat_finalise_settings(struct dccp_sock *dp)
973	{
974	struct list_head *fn = &dp->dccps_featneg;
975	struct dccp_feat_entry *entry;
976	int i = 2, ccids[2] = { -1, -1 };
977
978	/*
979	* Propagating CCIDs:
980	* 1) not useful to propagate CCID settings if this host advertises more
981	* than one CCID: the choice of CCID may still change - if this is
982	* the client, or if this is the server and the client sends
983	* singleton CCID values.
984	* 2) since is that propagate_ccid changes the list, we defer changing
985	* the sorted list until after the traversal.
986	*/
987	list_for_each_entry(entry, fn, node)
988	if (entry->feat_num == DCCPF_CCID && entry->val.sp.len == 1)
989	ccids[entry->is_local] = entry->val.sp.vec[0];
990	while (i--)
991	if (ccids[i] > 0 && dccp_feat_propagate_ccid(fn, id: ccids[i], is_local: i))
992	return -1;
993	dccp_feat_print_fnlist(fn);
994	return 0;
995	}
996
997	/**
998	* dccp_feat_server_ccid_dependencies - Resolve CCID-dependent features
999	* @dreq: server socket to resolve
1000	*
1001	* It is the server which resolves the dependencies once the CCID has been
1002	* fully negotiated. If no CCID has been negotiated, it uses the default CCID.
1003	*/
1004	int dccp_feat_server_ccid_dependencies(struct dccp_request_sock *dreq)
1005	{
1006	struct list_head *fn = &dreq->dreq_featneg;
1007	struct dccp_feat_entry *entry;
1008	u8 is_local, ccid;
1009
1010	for (is_local = 0; is_local <= 1; is_local++) {
1011	entry = dccp_feat_list_lookup(fn_list: fn, feat_num: DCCPF_CCID, is_local);
1012
1013	if (entry != NULL && !entry->empty_confirm)
1014	ccid = entry->val.sp.vec[0];
1015	else
1016	ccid = dccp_feat_default_value(feat_num: DCCPF_CCID);
1017
1018	if (dccp_feat_propagate_ccid(fn, id: ccid, is_local))
1019	return -1;
1020	}
1021	return 0;
1022	}
1023
1024	/* Select the first entry in @servlist that also occurs in @clilist (6.3.1) */
1025	static int dccp_feat_preflist_match(u8 *servlist, u8 slen, u8 *clilist, u8 clen)
1026	{
1027	u8 c, s;
1028
1029	for (s = 0; s < slen; s++)
1030	for (c = 0; c < clen; c++)
1031	if (servlist[s] == clilist[c])
1032	return servlist[s];
1033	return -1;
1034	}
1035
1036	/**
1037	* dccp_feat_prefer - Move preferred entry to the start of array
1038	* @preferred_value: entry to move to start of array
1039	* @array: array of preferred entries
1040	* @array_len: size of the array
1041	*
1042	* Reorder the @array_len elements in @array so that @preferred_value comes
1043	* first. Returns >0 to indicate that @preferred_value does occur in @array.
1044	*/
1045	static u8 dccp_feat_prefer(u8 preferred_value, u8 *array, u8 array_len)
1046	{
1047	u8 i, does_occur = 0;
1048
1049	if (array != NULL) {
1050	for (i = 0; i < array_len; i++)
1051	if (array[i] == preferred_value) {
1052	array[i] = array[0];
1053	does_occur++;
1054	}
1055	if (does_occur)
1056	array[0] = preferred_value;
1057	}
1058	return does_occur;
1059	}
1060
1061	/**
1062	* dccp_feat_reconcile - Reconcile SP preference lists
1063	* @fv: SP list to reconcile into
1064	* @arr: received SP preference list
1065	* @len: length of @arr in bytes
1066	* @is_server: whether this side is the server (and @fv is the server's list)
1067	* @reorder: whether to reorder the list in @fv after reconciling with @arr
1068	* When successful, > 0 is returned and the reconciled list is in @fval.
1069	* A value of 0 means that negotiation failed (no shared entry).
1070	*/
1071	static int dccp_feat_reconcile(dccp_feat_val *fv, u8 *arr, u8 len,
1072	bool is_server, bool reorder)
1073	{
1074	int rc;
1075
1076	if (!fv->sp.vec || !arr) {
1077	DCCP_CRIT("NULL feature value or array");
1078	return 0;
1079	}
1080
1081	if (is_server)
1082	rc = dccp_feat_preflist_match(servlist: fv->sp.vec, slen: fv->sp.len, clilist: arr, clen: len);
1083	else
1084	rc = dccp_feat_preflist_match(servlist: arr, slen: len, clilist: fv->sp.vec, clen: fv->sp.len);
1085
1086	if (!reorder)
1087	return rc;
1088	if (rc < 0)
1089	return 0;
1090
1091	/*
1092	* Reorder list: used for activating features and in dccp_insert_fn_opt.
1093	*/
1094	return dccp_feat_prefer(preferred_value: rc, array: fv->sp.vec, array_len: fv->sp.len);
1095	}
1096
1097	/**
1098	* dccp_feat_change_recv - Process incoming ChangeL/R options
1099	* @fn: feature-negotiation list to update
1100	* @is_mandatory: whether the Change was preceded by a Mandatory option
1101	* @opt: %DCCPO_CHANGE_L or %DCCPO_CHANGE_R
1102	* @feat: one of %dccp_feature_numbers
1103	* @val: NN value or SP value/preference list
1104	* @len: length of @val in bytes
1105	* @server: whether this node is the server (1) or the client (0)
1106	*/
1107	static u8 dccp_feat_change_recv(struct list_head *fn, u8 is_mandatory, u8 opt,
1108	u8 feat, u8 *val, u8 len, const bool server)
1109	{
1110	u8 defval, type = dccp_feat_type(feat_num: feat);
1111	const bool local = (opt == DCCPO_CHANGE_R);
1112	struct dccp_feat_entry *entry;
1113	dccp_feat_val fval;
1114
1115	if (len == 0 || type == FEAT_UNKNOWN) /* 6.1 and 6.6.8 */
1116	goto unknown_feature_or_value;
1117
1118	dccp_feat_print_opt(opt, feat, val, len, is_mandatory);
1119
1120	/*
1121	* Negotiation of NN features: Change R is invalid, so there is no
1122	* simultaneous negotiation; hence we do not look up in the list.
1123	*/
1124	if (type == FEAT_NN) {
1125	if (local || len > sizeof(fval.nn))
1126	goto unknown_feature_or_value;
1127
1128	/* 6.3.2: "The feature remote MUST accept any valid value..." */
1129	fval.nn = dccp_decode_value_var(bf: val, len);
1130	if (!dccp_feat_is_valid_nn_val(feat_num: feat, val: fval.nn))
1131	goto unknown_feature_or_value;
1132
1133	return dccp_feat_push_confirm(fn_list: fn, feat, local, fval: &fval);
1134	}
1135
1136	/*
1137	* Unidirectional/simultaneous negotiation of SP features (6.3.1)
1138	*/
1139	entry = dccp_feat_list_lookup(fn_list: fn, feat_num: feat, is_local: local);
1140	if (entry == NULL) {
1141	/*
1142	* No particular preferences have been registered. We deal with
1143	* this situation by assuming that all valid values are equally
1144	* acceptable, and apply the following checks:
1145	* - if the peer's list is a singleton, we accept a valid value;
1146	* - if we are the server, we first try to see if the peer (the
1147	* client) advertises the default value. If yes, we use it,
1148	* otherwise we accept the preferred value;
1149	* - else if we are the client, we use the first list element.
1150	*/
1151	if (dccp_feat_clone_sp_val(fval: &fval, val, len: 1))
1152	return DCCP_RESET_CODE_TOO_BUSY;
1153
1154	if (len > 1 && server) {
1155	defval = dccp_feat_default_value(feat_num: feat);
1156	if (dccp_feat_preflist_match(servlist: &defval, slen: 1, clilist: val, clen: len) > -1)
1157	fval.sp.vec[0] = defval;
1158	} else if (!dccp_feat_is_valid_sp_val(feat_num: feat, val: fval.sp.vec[0])) {
1159	kfree(objp: fval.sp.vec);
1160	goto unknown_feature_or_value;
1161	}
1162
1163	/* Treat unsupported CCIDs like invalid values */
1164	if (feat == DCCPF_CCID && !ccid_support_check(ccid_array: fval.sp.vec, array_len: 1)) {
1165	kfree(objp: fval.sp.vec);
1166	goto not_valid_or_not_known;
1167	}
1168
1169	return dccp_feat_push_confirm(fn_list: fn, feat, local, fval: &fval);
1170
1171	} else if (entry->state == FEAT_UNSTABLE) { /* 6.6.2 */
1172	return 0;
1173	}
1174
1175	if (dccp_feat_reconcile(fv: &entry->val, arr: val, len, is_server: server, reorder: true)) {
1176	entry->empty_confirm = false;
1177	} else if (is_mandatory) {
1178	return DCCP_RESET_CODE_MANDATORY_ERROR;
1179	} else if (entry->state == FEAT_INITIALISING) {
1180	/*
1181	* Failed simultaneous negotiation (server only): try to `save'
1182	* the connection by checking whether entry contains the default
1183	* value for @feat. If yes, send an empty Confirm to signal that
1184	* the received Change was not understood - which implies using
1185	* the default value.
1186	* If this also fails, we use Reset as the last resort.
1187	*/
1188	WARN_ON(!server);
1189	defval = dccp_feat_default_value(feat_num: feat);
1190	if (!dccp_feat_reconcile(fv: &entry->val, arr: &defval, len: 1, is_server: server, reorder: true))
1191	return DCCP_RESET_CODE_OPTION_ERROR;
1192	entry->empty_confirm = true;
1193	}
1194	entry->needs_confirm = true;
1195	entry->needs_mandatory = false;
1196	entry->state = FEAT_STABLE;
1197	return 0;
1198
1199	unknown_feature_or_value:
1200	if (!is_mandatory)
1201	return dccp_push_empty_confirm(fn_list: fn, feat, local);
1202
1203	not_valid_or_not_known:
1204	return is_mandatory ? DCCP_RESET_CODE_MANDATORY_ERROR
1205	: DCCP_RESET_CODE_OPTION_ERROR;
1206	}
1207
1208	/**
1209	* dccp_feat_confirm_recv - Process received Confirm options
1210	* @fn: feature-negotiation list to update
1211	* @is_mandatory: whether @opt was preceded by a Mandatory option
1212	* @opt: %DCCPO_CONFIRM_L or %DCCPO_CONFIRM_R
1213	* @feat: one of %dccp_feature_numbers
1214	* @val: NN value or SP value/preference list
1215	* @len: length of @val in bytes
1216	* @server: whether this node is server (1) or client (0)
1217	*/
1218	static u8 dccp_feat_confirm_recv(struct list_head *fn, u8 is_mandatory, u8 opt,
1219	u8 feat, u8 *val, u8 len, const bool server)
1220	{
1221	u8 *plist, plen, type = dccp_feat_type(feat_num: feat);
1222	const bool local = (opt == DCCPO_CONFIRM_R);
1223	struct dccp_feat_entry *entry = dccp_feat_list_lookup(fn_list: fn, feat_num: feat, is_local: local);
1224
1225	dccp_feat_print_opt(opt, feat, val, len, is_mandatory);
1226
1227	if (entry == NULL) { /* nothing queued: ignore or handle error */
1228	if (is_mandatory && type == FEAT_UNKNOWN)
1229	return DCCP_RESET_CODE_MANDATORY_ERROR;
1230
1231	if (!local && type == FEAT_NN) /* 6.3.2 */
1232	goto confirmation_failed;
1233	return 0;
1234	}
1235
1236	if (entry->state != FEAT_CHANGING) /* 6.6.2 */
1237	return 0;
1238
1239	if (len == 0) {
1240	if (dccp_feat_must_be_understood(feat_num: feat)) /* 6.6.7 */
1241	goto confirmation_failed;
1242	/*
1243	* Empty Confirm during connection setup: this means reverting
1244	* to the `old' value, which in this case is the default. Since
1245	* we handle default values automatically when no other values
1246	* have been set, we revert to the old value by removing this
1247	* entry from the list.
1248	*/
1249	dccp_feat_list_pop(entry);
1250	return 0;
1251	}
1252
1253	if (type == FEAT_NN) {
1254	if (len > sizeof(entry->val.nn))
1255	goto confirmation_failed;
1256
1257	if (entry->val.nn == dccp_decode_value_var(bf: val, len))
1258	goto confirmation_succeeded;
1259
1260	DCCP_WARN("Bogus Confirm for non-existing value\n");
1261	goto confirmation_failed;
1262	}
1263
1264	/*
1265	* Parsing SP Confirms: the first element of @val is the preferred
1266	* SP value which the peer confirms, the remainder depends on @len.
1267	* Note that only the confirmed value need to be a valid SP value.
1268	*/
1269	if (!dccp_feat_is_valid_sp_val(feat_num: feat, val: *val))
1270	goto confirmation_failed;
1271
1272	if (len == 1) { /* peer didn't supply a preference list */
1273	plist = val;
1274	plen = len;
1275	} else { /* preferred value + preference list */
1276	plist = val + 1;
1277	plen = len - 1;
1278	}
1279
1280	/* Check whether the peer got the reconciliation right (6.6.8) */
1281	if (dccp_feat_reconcile(fv: &entry->val, arr: plist, len: plen, is_server: server, reorder: 0) != *val) {
1282	DCCP_WARN("Confirm selected the wrong value %u\n", *val);
1283	return DCCP_RESET_CODE_OPTION_ERROR;
1284	}
1285	entry->val.sp.vec[0] = *val;
1286
1287	confirmation_succeeded:
1288	entry->state = FEAT_STABLE;
1289	return 0;
1290
1291	confirmation_failed:
1292	DCCP_WARN("Confirmation failed\n");
1293	return is_mandatory ? DCCP_RESET_CODE_MANDATORY_ERROR
1294	: DCCP_RESET_CODE_OPTION_ERROR;
1295	}
1296
1297	/**
1298	* dccp_feat_handle_nn_established - Fast-path reception of NN options
1299	* @sk: socket of an established DCCP connection
1300	* @mandatory: whether @opt was preceded by a Mandatory option
1301	* @opt: %DCCPO_CHANGE_L | %DCCPO_CONFIRM_R (NN only)
1302	* @feat: NN number, one of %dccp_feature_numbers
1303	* @val: NN value
1304	* @len: length of @val in bytes
1305	*
1306	* This function combines the functionality of change_recv/confirm_recv, with
1307	* the following differences (reset codes are the same):
1308	* - cleanup after receiving the Confirm;
1309	* - values are directly activated after successful parsing;
1310	* - deliberately restricted to NN features.
1311	* The restriction to NN features is essential since SP features can have non-
1312	* predictable outcomes (depending on the remote configuration), and are inter-
1313	* dependent (CCIDs for instance cause further dependencies).
1314	*/
1315	static u8 dccp_feat_handle_nn_established(struct sock *sk, u8 mandatory, u8 opt,
1316	u8 feat, u8 *val, u8 len)
1317	{
1318	struct list_head *fn = &dccp_sk(sk)->dccps_featneg;
1319	const bool local = (opt == DCCPO_CONFIRM_R);
1320	struct dccp_feat_entry *entry;
1321	u8 type = dccp_feat_type(feat_num: feat);
1322	dccp_feat_val fval;
1323
1324	dccp_feat_print_opt(opt, feat, val, len, mandatory);
1325
1326	/* Ignore non-mandatory unknown and non-NN features */
1327	if (type == FEAT_UNKNOWN) {
1328	if (local && !mandatory)
1329	return 0;
1330	goto fast_path_unknown;
1331	} else if (type != FEAT_NN) {
1332	return 0;
1333	}
1334
1335	/*
1336	* We don't accept empty Confirms, since in fast-path feature
1337	* negotiation the values are enabled immediately after sending
1338	* the Change option.
1339	* Empty Changes on the other hand are invalid (RFC 4340, 6.1).
1340	*/
1341	if (len == 0 || len > sizeof(fval.nn))
1342	goto fast_path_unknown;
1343
1344	if (opt == DCCPO_CHANGE_L) {
1345	fval.nn = dccp_decode_value_var(bf: val, len);
1346	if (!dccp_feat_is_valid_nn_val(feat_num: feat, val: fval.nn))
1347	goto fast_path_unknown;
1348
1349	if (dccp_feat_push_confirm(fn_list: fn, feat, local, fval: &fval) ||
1350	dccp_feat_activate(sk, feat_num: feat, local, fval: &fval))
1351	return DCCP_RESET_CODE_TOO_BUSY;
1352
1353	/* set the `Ack Pending' flag to piggyback a Confirm */
1354	inet_csk_schedule_ack(sk);
1355
1356	} else if (opt == DCCPO_CONFIRM_R) {
1357	entry = dccp_feat_list_lookup(fn_list: fn, feat_num: feat, is_local: local);
1358	if (entry == NULL || entry->state != FEAT_CHANGING)
1359	return 0;
1360
1361	fval.nn = dccp_decode_value_var(bf: val, len);
1362	/*
1363	* Just ignore a value that doesn't match our current value.
1364	* If the option changes twice within two RTTs, then at least
1365	* one CONFIRM will be received for the old value after a
1366	* new CHANGE was sent.
1367	*/
1368	if (fval.nn != entry->val.nn)
1369	return 0;
1370
1371	/* Only activate after receiving the Confirm option (6.6.1). */
1372	dccp_feat_activate(sk, feat_num: feat, local, fval: &fval);
1373
1374	/* It has been confirmed - so remove the entry */
1375	dccp_feat_list_pop(entry);
1376
1377	} else {
1378	DCCP_WARN("Received illegal option %u\n", opt);
1379	goto fast_path_failed;
1380	}
1381	return 0;
1382
1383	fast_path_unknown:
1384	if (!mandatory)
1385	return dccp_push_empty_confirm(fn_list: fn, feat, local);
1386
1387	fast_path_failed:
1388	return mandatory ? DCCP_RESET_CODE_MANDATORY_ERROR
1389	: DCCP_RESET_CODE_OPTION_ERROR;
1390	}
1391
1392	/**
1393	* dccp_feat_parse_options - Process Feature-Negotiation Options
1394	* @sk: for general use and used by the client during connection setup
1395	* @dreq: used by the server during connection setup
1396	* @mandatory: whether @opt was preceded by a Mandatory option
1397	* @opt: %DCCPO_CHANGE_L | %DCCPO_CHANGE_R | %DCCPO_CONFIRM_L | %DCCPO_CONFIRM_R
1398	* @feat: one of %dccp_feature_numbers
1399	* @val: value contents of @opt
1400	* @len: length of @val in bytes
1401	*
1402	* Returns 0 on success, a Reset code for ending the connection otherwise.
1403	*/
1404	int dccp_feat_parse_options(struct sock *sk, struct dccp_request_sock *dreq,
1405	u8 mandatory, u8 opt, u8 feat, u8 *val, u8 len)
1406	{
1407	struct dccp_sock *dp = dccp_sk(sk);
1408	struct list_head *fn = dreq ? &dreq->dreq_featneg : &dp->dccps_featneg;
1409	bool server = false;
1410
1411	switch (sk->sk_state) {
1412	/*
1413	* Negotiation during connection setup
1414	*/
1415	case DCCP_LISTEN:
1416	server = true;
1417	fallthrough;
1418	case DCCP_REQUESTING:
1419	switch (opt) {
1420	case DCCPO_CHANGE_L:
1421	case DCCPO_CHANGE_R:
1422	return dccp_feat_change_recv(fn, is_mandatory: mandatory, opt, feat,
1423	val, len, server);
1424	case DCCPO_CONFIRM_R:
1425	case DCCPO_CONFIRM_L:
1426	return dccp_feat_confirm_recv(fn, is_mandatory: mandatory, opt, feat,
1427	val, len, server);
1428	}
1429	break;
1430	/*
1431	* Support for exchanging NN options on an established connection.
1432	*/
1433	case DCCP_OPEN:
1434	case DCCP_PARTOPEN:
1435	return dccp_feat_handle_nn_established(sk, mandatory, opt, feat,
1436	val, len);
1437	}
1438	return 0; /* ignore FN options in all other states */
1439	}
1440
1441	/**
1442	* dccp_feat_init - Seed feature negotiation with host-specific defaults
1443	* @sk: Socket to initialize.
1444	*
1445	* This initialises global defaults, depending on the value of the sysctls.
1446	* These can later be overridden by registering changes via setsockopt calls.
1447	* The last link in the chain is finalise_settings, to make sure that between
1448	* here and the start of actual feature negotiation no inconsistencies enter.
1449	*
1450	* All features not appearing below use either defaults or are otherwise
1451	* later adjusted through dccp_feat_finalise_settings().
1452	*/
1453	int dccp_feat_init(struct sock *sk)
1454	{
1455	struct list_head *fn = &dccp_sk(sk)->dccps_featneg;
1456	u8 on = 1, off = 0;
1457	int rc;
1458	struct {
1459	u8 *val;
1460	u8 len;
1461	} tx, rx;
1462
1463	/* Non-negotiable (NN) features */
1464	rc = __feat_register_nn(fn, feat: DCCPF_SEQUENCE_WINDOW, mandatory: 0,
1465	nn_val: sysctl_dccp_sequence_window);
1466	if (rc)
1467	return rc;
1468
1469	/* Server-priority (SP) features */
1470
1471	/* Advertise that short seqnos are not supported (7.6.1) */
1472	rc = __feat_register_sp(fn, feat: DCCPF_SHORT_SEQNOS, is_local: true, mandatory: true, sp_val: &off, sp_len: 1);
1473	if (rc)
1474	return rc;
1475
1476	/* RFC 4340 12.1: "If a DCCP is not ECN capable, ..." */
1477	rc = __feat_register_sp(fn, feat: DCCPF_ECN_INCAPABLE, is_local: true, mandatory: true, sp_val: &on, sp_len: 1);
1478	if (rc)
1479	return rc;
1480
1481	/*
1482	* We advertise the available list of CCIDs and reorder according to
1483	* preferences, to avoid failure resulting from negotiating different
1484	* singleton values (which always leads to failure).
1485	* These settings can still (later) be overridden via sockopts.
1486	*/
1487	if (ccid_get_builtin_ccids(ccid_array: &tx.val, array_len: &tx.len))
1488	return -ENOBUFS;
1489	if (ccid_get_builtin_ccids(ccid_array: &rx.val, array_len: &rx.len)) {
1490	kfree(objp: tx.val);
1491	return -ENOBUFS;
1492	}
1493
1494	if (!dccp_feat_prefer(preferred_value: sysctl_dccp_tx_ccid, array: tx.val, array_len: tx.len) ||
1495	!dccp_feat_prefer(preferred_value: sysctl_dccp_rx_ccid, array: rx.val, array_len: rx.len))
1496	goto free_ccid_lists;
1497
1498	rc = __feat_register_sp(fn, feat: DCCPF_CCID, is_local: true, mandatory: false, sp_val: tx.val, sp_len: tx.len);
1499	if (rc)
1500	goto free_ccid_lists;
1501
1502	rc = __feat_register_sp(fn, feat: DCCPF_CCID, is_local: false, mandatory: false, sp_val: rx.val, sp_len: rx.len);
1503
1504	free_ccid_lists:
1505	kfree(objp: tx.val);
1506	kfree(objp: rx.val);
1507	return rc;
1508	}
1509
1510	int dccp_feat_activate_values(struct sock *sk, struct list_head *fn_list)
1511	{
1512	struct dccp_sock *dp = dccp_sk(sk);
1513	struct dccp_feat_entry *cur, *next;
1514	int idx;
1515	dccp_feat_val *fvals[DCCP_FEAT_SUPPORTED_MAX][2] = {
1516	[0 ... DCCP_FEAT_SUPPORTED_MAX-1] = { NULL, NULL }
1517	};
1518
1519	list_for_each_entry(cur, fn_list, node) {
1520	/*
1521	* An empty Confirm means that either an unknown feature type
1522	* or an invalid value was present. In the first case there is
1523	* nothing to activate, in the other the default value is used.
1524	*/
1525	if (cur->empty_confirm)
1526	continue;
1527
1528	idx = dccp_feat_index(feat_num: cur->feat_num);
1529	if (idx < 0) {
1530	DCCP_BUG("Unknown feature %u", cur->feat_num);
1531	goto activation_failed;
1532	}
1533	if (cur->state != FEAT_STABLE) {
1534	DCCP_CRIT("Negotiation of %s %s failed in state %s",
1535	cur->is_local ? "local" : "remote",
1536	dccp_feat_fname(cur->feat_num),
1537	dccp_feat_sname[cur->state]);
1538	goto activation_failed;
1539	}
1540	fvals[idx][cur->is_local] = &cur->val;
1541	}
1542
1543	/*
1544	* Activate in decreasing order of index, so that the CCIDs are always
1545	* activated as the last feature. This avoids the case where a CCID
1546	* relies on the initialisation of one or more features that it depends
1547	* on (e.g. Send NDP Count, Send Ack Vector, and Ack Ratio features).
1548	*/
1549	for (idx = DCCP_FEAT_SUPPORTED_MAX; --idx >= 0;)
1550	if (__dccp_feat_activate(sk, idx, is_local: 0, fval: fvals[idx][0]) ||
1551	__dccp_feat_activate(sk, idx, is_local: 1, fval: fvals[idx][1])) {
1552	DCCP_CRIT("Could not activate %d", idx);
1553	goto activation_failed;
1554	}
1555
1556	/* Clean up Change options which have been confirmed already */
1557	list_for_each_entry_safe(cur, next, fn_list, node)
1558	if (!cur->needs_confirm)
1559	dccp_feat_list_pop(entry: cur);
1560
1561	dccp_pr_debug("Activation OK\n");
1562	return 0;
1563
1564	activation_failed:
1565	/*
1566	* We clean up everything that may have been allocated, since
1567	* it is difficult to track at which stage negotiation failed.
1568	* This is ok, since all allocation functions below are robust
1569	* against NULL arguments.
1570	*/
1571	ccid_hc_rx_delete(ccid: dp->dccps_hc_rx_ccid, sk);
1572	ccid_hc_tx_delete(ccid: dp->dccps_hc_tx_ccid, sk);
1573	dp->dccps_hc_rx_ccid = dp->dccps_hc_tx_ccid = NULL;
1574	dccp_ackvec_free(av: dp->dccps_hc_rx_ackvec);
1575	dp->dccps_hc_rx_ackvec = NULL;
1576	return -1;
1577	}
1578