[SCTP] More param handling, mostly handling hostname parm (jgrimm)

Per RFC, ABORT the peer if you don't want to support hostname parm.
Found/fixed potential div by zero.
Changed process_init to return error code, so its clients can do error handling.

include/net/sctp/sctp.h

@@ -3,41 +3,41 @@
  * Copyright (c) 1999-2001 Motorola, Inc.
  * Copyright (c) 2001 International Business Machines, Corp.
  * Copyright (c) 2001 Intel Corp.
- * 
+ *
  * This file is part of the SCTP kernel reference Implementation
- * 
- * The base lksctp header. 
- * 
- * The SCTP reference implementation is free software; 
- * you can redistribute it and/or modify it under the terms of 
+ *
+ * The base lksctp header.
+ *
+ * The SCTP reference implementation is free software;
+ * you can redistribute it and/or modify it under the terms of
  * the GNU General Public License as published by
  * the Free Software Foundation; either version 2, or (at your option)
  * any later version.
- * 
- * The SCTP reference implementation is distributed in the hope that it 
+ *
+ * The SCTP reference implementation is distributed in the hope that it
  * will be useful, but WITHOUT ANY WARRANTY; without even the implied
  *                 ************************
  * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
  * See the GNU General Public License for more details.
- * 
+ *
  * You should have received a copy of the GNU General Public License
  * along with GNU CC; see the file COPYING.  If not, write to
  * the Free Software Foundation, 59 Temple Place - Suite 330,
- * Boston, MA 02111-1307, USA.  
- * 
+ * Boston, MA 02111-1307, USA.
+ *
  * Please send any bug reports or fixes you make to the
  * email address(es):
  *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- * 
+ *
  * Or submit a bug report through the following website:
  *    http://www.sf.net/projects/lksctp
  *
- * Written or modified by: 
+ * Written or modified by:
  *    La Monte H.P. Yarroll <piggy@acm.org>
  *    Xingang Guo           <xingang.guo@intel.com>
  *    Jon Grimm             <jgrimm@us.ibm.com>
  *    Daisy Chang	    <daisyc@us.ibm.com>
- * 
+ *
  * Any bugs reported given to us we will try to fix... any fixes shared will
  * be incorporated into the next SCTP release.
  */
@@ -52,10 +52,10 @@
  *       structs
  *       prototypes
  *       macros, externs, and inlines
- * 
- *   Move test_frame specific items out of the kernel headers 
+ *
+ *   Move test_frame specific items out of the kernel headers
  *   and into the test frame headers.   This is not perfect in any sense
- *   and will continue to evolve.  
+ *   and will continue to evolve.
  */
 
 
@@ -78,7 +78,7 @@
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 #include <net/ipv6.h>
 #include <net/ip6_route.h>
-#endif 
+#endif
 
 #include <asm/uaccess.h>
 #include <asm/page.h>
@@ -105,19 +105,19 @@
 #endif
 
 
-/* Certain internal static functions need to be exported when 
+/* Certain internal static functions need to be exported when
  * compiled into the test frame.
  */
 #ifndef SCTP_STATIC
 #define SCTP_STATIC static
 #endif
 
-/* 
- * Function declarations. 
+/*
+ * Function declarations.
  */
 
 /*
- * sctp_protocol.c 
+ * sctp_protocol.c
  */
 extern sctp_protocol_t sctp_proto;
 extern struct sock *sctp_get_ctl_sock(void);
@@ -421,14 +421,15 @@ static inline size_t get_user_iov_size(struct iovec *iov, int iovlen)
 /* Walk through a list of TLV parameters.  Don't trust the
  * individual parameter lengths and instead depend on
  * the chunk length to indicate when to stop.  Make sure
- * there is room for a param header too. 
+ * there is room for a param header too.
  */
 #define sctp_walk_params(pos, chunk, member)\
-_sctp_walk_params(((union sctp_params)(pos)), (chunk), member)
+_sctp_walk_params((pos), (chunk), ntohs((chunk)->chunk_hdr.length), member)
 
-#define _sctp_walk_params(pos, chunk, member)\
-for (pos.v = (void *)&chunk->member;\
-     pos.v <= (void *)chunk + ntohs(chunk->chunk_hdr.length) - sizeof(sctp_paramhdr_t);\
+#define _sctp_walk_params(pos, chunk, end, member)\
+for (pos.v = chunk->member;\
+     pos.v <= (void *)chunk + end - sizeof(sctp_paramhdr_t) &&\
+     pos.v <= (void *)chunk + end - WORD_ROUND(ntohs(pos.p->length)); \
      pos.v += WORD_ROUND(ntohs(pos.p->length)))
 
 /* Round an int up to the next multiple of 4.  */

include/net/sctp/structs.h

@@ -3,34 +3,34 @@
  * Copyright (c) 1999-2001 Motorola, Inc.
  * Copyright (c) 2001 Intel Corp.
  * Copyright (c) 2001 International Business Machines Corp.
- * 
+ *
  * This file is part of the SCTP kernel reference Implementation
- * 
- * The SCTP reference implementation is free software; 
- * you can redistribute it and/or modify it under the terms of 
+ *
+ * The SCTP reference implementation is free software;
+ * you can redistribute it and/or modify it under the terms of
  * the GNU General Public License as published by
  * the Free Software Foundation; either version 2, or (at your option)
  * any later version.
- * 
- * The SCTP reference implementation is distributed in the hope that it 
+ *
+ * The SCTP reference implementation is distributed in the hope that it
  * will be useful, but WITHOUT ANY WARRANTY; without even the implied
  *                 ************************
  * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
  * See the GNU General Public License for more details.
- * 
+ *
  * You should have received a copy of the GNU General Public License
  * along with GNU CC; see the file COPYING.  If not, write to
  * the Free Software Foundation, 59 Temple Place - Suite 330,
- * Boston, MA 02111-1307, USA.  
- * 
+ * Boston, MA 02111-1307, USA.
+ *
  * Please send any bug reports or fixes you make to the
  * email addresses:
  *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- * 
+ *
  * Or submit a bug report through the following website:
  *    http://www.sf.net/projects/lksctp
  *
- * Written or modified by: 
+ * Written or modified by:
  *    Randall Stewart       <randall@sctp.chicago.il.us>
  *    Ken Morneau           <kmorneau@cisco.com>
  *    Qiaobing Xie          <qxie1@email.mot.com>
@@ -41,8 +41,8 @@
  *    Hui Huang             <hui.huang@nokia.com>
  *    Sridhar Samudrala     <sri@us.ibm.com>
  *    Daisy Chang	    <daisyc@us.ibm.com>
- *    Dajiang Zhang         <dajiang.zhang@nokia.com> 
- * 
+ *    Dajiang Zhang         <dajiang.zhang@nokia.com>
+ *
  * Any bugs reported given to us we will try to fix... any fixes shared will
  * be incorporated into the next SCTP release.
  */
@@ -250,7 +250,7 @@ typedef struct sctp_func {
 					 sockaddr_storage_t *saddr);
 	int		(*cmp_saddr)	(struct dst_entry *dst,
 					 sockaddr_storage_t *saddr);
-	__u16		net_header_len;	
+	__u16		net_header_len;
 	int		sockaddr_len;
 	sa_family_t	sa_family;
 	struct list_head list;
@@ -374,7 +374,7 @@ typedef union {
  */
 union sctp_params {
 	void *v;
-	sctp_paramhdr_t *p;	
+	sctp_paramhdr_t *p;
 	sctp_cookie_preserve_param_t *life;
 	sctp_hostname_param_t *dns;
 	sctp_cookie_param_t *cookie;
@@ -475,7 +475,7 @@ struct SCTP_chunk {
 	__u8 ecn_ce_done;      /* Have we processed the ECN CE bit? */
 	__u8 pdiscard;	  /* Discard the whole packet now? */
 	__u8 tsn_gap_acked;	  /* Is this chunk acked by a GAP ACK? */
-	__u8 fast_retransmit;    /* Is this chunk fast retransmitted? */ 
+	__u8 fast_retransmit;    /* Is this chunk fast retransmitted? */
 	__u8 tsn_missing_report; /* Data chunk missing counter. */
 
 	/* What is the origin IP address for this chunk?  */
@@ -914,7 +914,7 @@ int sctp_addr_is_valid(const sockaddr_storage_t *addr);
 typedef enum {
 	SCTP_EP_TYPE_SOCKET,
 	SCTP_EP_TYPE_ASSOCIATION,
-} sctp_endpoint_type_t; 
+} sctp_endpoint_type_t;
 
 /*
  * A common base class to bridge the implmentation view of a
@@ -1062,22 +1062,11 @@ int sctp_verify_init(const sctp_association_t *asoc,
 		     sctp_init_chunk_t *peer_init,
 		     sctp_chunk_t *chunk,
 		     sctp_chunk_t **err_chunk);
-int sctp_verify_param(const sctp_association_t *asoc,
-		      union sctp_params param,
-		      sctp_cid_t cid,
-		      sctp_chunk_t *chunk,
-		      sctp_chunk_t **err_chunk);
-int sctp_process_unk_param(const sctp_association_t *asoc,
-			   union sctp_params param,
-			   sctp_chunk_t *chunk,
-			   sctp_chunk_t **err_chunk);
-void sctp_process_init(sctp_association_t *asoc, sctp_cid_t cid,
-		       const sockaddr_storage_t *peer_addr,
-		       sctp_init_chunk_t  *peer_init, int priority);
-int sctp_process_param(sctp_association_t *asoc,
-		       union sctp_params param,
-		       const sockaddr_storage_t *peer_addr,
-		       sctp_cid_t cid, int priority);
+int sctp_process_init(sctp_association_t *asoc, sctp_cid_t cid,
+		      const sockaddr_storage_t *peer_addr,
+		      sctp_init_chunk_t *peer_init, int priority);
+int sctp_process_param(sctp_association_t *asoc, union sctp_params param,
+		       const sockaddr_storage_t *peer_addr, int priority);
 __u32 sctp_generate_tag(const sctp_endpoint_t *ep);
 __u32 sctp_generate_tsn(const sctp_endpoint_t *ep);
 
@@ -1164,10 +1153,10 @@ struct SCTP_association {
 		sctp_transport_t *primary_path;
 
 		/* Cache the primary path address here, when we
-		 * need a an address for msg_name. 
+		 * need a an address for msg_name.
 		 */
 		sockaddr_storage_t primary_addr;
-		
+
 		/* active_path
 		 *   The path that we are currently using to
 		 *   transmit new data and most control chunks.
@@ -1268,7 +1257,7 @@ struct SCTP_association {
 
 	/* Overall     : The threshold for this association that if
 	 * Error       : the Overall Error Count reaches will cause
-	 * Threshold   : this association to be torn down. 
+	 * Threshold   : this association to be torn down.
 	 */
 	int overall_error_threshold;
 
@@ -1314,13 +1303,13 @@ struct SCTP_association {
 	 */
 	__u32 next_tsn;
 
-	/* 
+	/*
 	 * Last Rcvd   : This is the last TSN received in sequence.  This value
 	 * TSN         : is set initially by taking the peer's Initial TSN,
 	 *             : received in the INIT or INIT ACK chunk, and
 	 *             : subtracting one from it.
 	 *
-	 * Most of RFC 2960 refers to this as the Cumulative TSN Ack Point. 
+	 * Most of RFC 2960 refers to this as the Cumulative TSN Ack Point.
 	 */
 
 	__u32 ctsn_ack_point;

net/sctp/input.c

@@ -568,7 +568,7 @@ sctp_association_t *sctp_lookup_association(const sockaddr_storage_t *laddr,
 	sctp_local_bh_disable();
 	asoc = __sctp_lookup_association(laddr, paddr, transportp);
 	sctp_local_bh_enable();
-	
+
 	return asoc;
 }
 
@@ -614,13 +614,11 @@ static sctp_association_t *__sctp_rcv_initack_lookup(struct sk_buff *skb,
 	sockaddr_storage_t *paddr = &addr;
 	struct sctphdr *sh = (struct sctphdr *) skb->h.raw;
 	sctp_chunkhdr_t *ch;
-	__u8 *ch_end, *data;
-	sctp_paramhdr_t *parm;
+	union sctp_params params;
+	sctp_init_chunk_t *init;
 
 	ch = (sctp_chunkhdr_t *) skb->data;
 
-	ch_end = ((__u8 *) ch) + WORD_ROUND(ntohs(ch->length));
-
 	/* If this is INIT/INIT-ACK look inside the chunk too. */
 	switch (ch->type) {
 	case SCTP_CID_INIT:
@@ -646,24 +644,17 @@ static sctp_association_t *__sctp_rcv_initack_lookup(struct sk_buff *skb,
 	/* Find the start of the TLVs and the end of the chunk.  This is
 	 * the region we search for address parameters.
 	 */
-	data = skb->data + sizeof(sctp_init_chunk_t);
-
-	/* See sctp_process_init() for how to go thru TLVs. */
-	while (data < ch_end) {
-		parm = (sctp_paramhdr_t *)data;
-
-		if (!parm->length)
-			break;
+	init = (sctp_init_chunk_t *)skb->data;
 
-		data += WORD_ROUND(ntohs(parm->length));
+	/* Walk the parameters looking for embedded addresses. */
+	sctp_walk_params(params, init, init_hdr.params) {
 
 		/* Note: Ignoring hostname addresses. */
-		if ((SCTP_PARAM_IPV4_ADDRESS != parm->type) &&
-		    (SCTP_PARAM_IPV6_ADDRESS != parm->type))
+		if ((SCTP_PARAM_IPV4_ADDRESS != params.p->type) &&
+		    (SCTP_PARAM_IPV6_ADDRESS != params.p->type))
 			continue;
 
-		sctp_param2sockaddr(paddr, (sctp_addr_param_t *)parm, 
-				    ntohs(sh->source));
+		sctp_param2sockaddr(paddr, params.addr, ntohs(sh->source));
 		asoc = __sctp_lookup_association(laddr, paddr, transportp);
 		if (asoc)
 			return asoc;