x25: Validate incoming call user data lengths
[linux-2.6-block.git] / net / x25 / x25_facilities.c
CommitLineData
1da177e4
LT
1/*
2 * X.25 Packet Layer release 002
3 *
4 * This is ALPHA test software. This code may break your machine,
5 * randomly fail to work with new releases, misbehave and/or generally
f8e1d201 6 * screw up. It might even work.
1da177e4
LT
7 *
8 * This code REQUIRES 2.1.15 or higher
9 *
10 * This module:
11 * This module is free software; you can redistribute it and/or
12 * modify it under the terms of the GNU General Public License
13 * as published by the Free Software Foundation; either version
14 * 2 of the License, or (at your option) any later version.
15 *
16 * History
17 * X.25 001 Split from x25_subr.c
f8e1d201 18 * mar/20/00 Daniela Squassoni Disabling/enabling of facilities
1da177e4 19 * negotiation.
ebc3f64b
SP
20 * apr/14/05 Shaun Pereira - Allow fast select with no restriction
21 * on response.
1da177e4
LT
22 */
23
24#include <linux/kernel.h>
25#include <linux/string.h>
26#include <linux/skbuff.h>
27#include <net/sock.h>
28#include <net/x25.h>
29
95c30430 30/**
31 * x25_parse_facilities - Parse facilities from skb into the facilities structs
32 *
33 * @skb: sk_buff to parse
25985edc 34 * @facilities: Regular facilities, updated as facilities are found
95c30430 35 * @dte_facs: ITU DTE facilities, updated as DTE facilities are found
36 * @vc_fac_mask: mask is updated with all facilities found
37 *
38 * Return codes:
39 * -1 - Parsing error, caller should drop call and clean up
40 * 0 - Parse OK, this skb has no facilities
41 * >0 - Parse OK, returns the length of the facilities header
42 *
1da177e4 43 */
a64b7b93
SP
44int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
45 struct x25_dte_facilities *dte_facs, unsigned long *vc_fac_mask)
1da177e4
LT
46{
47 unsigned char *p = skb->data;
f5eb917b 48 unsigned int len;
1da177e4
LT
49
50 *vc_fac_mask = 0;
51
a64b7b93
SP
52 /*
53 * The kernel knows which facilities were set on an incoming call but
54 * currently this information is not available to userspace. Here we
55 * give userspace who read incoming call facilities 0 length to indicate
56 * it wasn't set.
57 */
58 dte_facs->calling_len = 0;
59 dte_facs->called_len = 0;
60 memset(dte_facs->called_ae, '\0', sizeof(dte_facs->called_ae));
61 memset(dte_facs->calling_ae, '\0', sizeof(dte_facs->calling_ae));
62
f5eb917b
JH
63 if (skb->len < 1)
64 return 0;
65
66 len = *p++;
67
68 if (len >= skb->len)
69 return -1;
70
1da177e4
LT
71 while (len > 0) {
72 switch (*p & X25_FAC_CLASS_MASK) {
73 case X25_FAC_CLASS_A:
5ef41308 74 if (len < 2)
95c30430 75 return -1;
1da177e4
LT
76 switch (*p) {
77 case X25_FAC_REVERSE:
ebc3f64b
SP
78 if((p[1] & 0x81) == 0x81) {
79 facilities->reverse = p[1] & 0x81;
80 *vc_fac_mask |= X25_MASK_REVERSE;
81 break;
82 }
83
84 if((p[1] & 0x01) == 0x01) {
85 facilities->reverse = p[1] & 0x01;
86 *vc_fac_mask |= X25_MASK_REVERSE;
87 break;
88 }
89
90 if((p[1] & 0x80) == 0x80) {
91 facilities->reverse = p[1] & 0x80;
92 *vc_fac_mask |= X25_MASK_REVERSE;
93 break;
94 }
95
96 if(p[1] == 0x00) {
97 facilities->reverse
98 = X25_DEFAULT_REVERSE;
99 *vc_fac_mask |= X25_MASK_REVERSE;
100 break;
101 }
102
1da177e4
LT
103 case X25_FAC_THROUGHPUT:
104 facilities->throughput = p[1];
105 *vc_fac_mask |= X25_MASK_THROUGHPUT;
106 break;
a64b7b93
SP
107 case X25_MARKER:
108 break;
1da177e4
LT
109 default:
110 printk(KERN_DEBUG "X.25: unknown facility "
111 "%02X, value %02X\n",
112 p[0], p[1]);
113 break;
114 }
115 p += 2;
116 len -= 2;
117 break;
118 case X25_FAC_CLASS_B:
5ef41308 119 if (len < 3)
95c30430 120 return -1;
1da177e4
LT
121 switch (*p) {
122 case X25_FAC_PACKET_SIZE:
123 facilities->pacsize_in = p[1];
124 facilities->pacsize_out = p[2];
125 *vc_fac_mask |= X25_MASK_PACKET_SIZE;
126 break;
127 case X25_FAC_WINDOW_SIZE:
128 facilities->winsize_in = p[1];
129 facilities->winsize_out = p[2];
130 *vc_fac_mask |= X25_MASK_WINDOW_SIZE;
131 break;
132 default:
133 printk(KERN_DEBUG "X.25: unknown facility "
134 "%02X, values %02X, %02X\n",
135 p[0], p[1], p[2]);
136 break;
137 }
138 p += 3;
139 len -= 3;
140 break;
141 case X25_FAC_CLASS_C:
5ef41308 142 if (len < 4)
95c30430 143 return -1;
1da177e4
LT
144 printk(KERN_DEBUG "X.25: unknown facility %02X, "
145 "values %02X, %02X, %02X\n",
146 p[0], p[1], p[2], p[3]);
147 p += 4;
148 len -= 4;
149 break;
150 case X25_FAC_CLASS_D:
5ef41308 151 if (len < p[1] + 2)
95c30430 152 return -1;
a64b7b93 153 switch (*p) {
f8e1d201 154 case X25_FAC_CALLING_AE:
a6331d6f 155 if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1)
95c30430 156 return -1;
a64b7b93
SP
157 dte_facs->calling_len = p[2];
158 memcpy(dte_facs->calling_ae, &p[3], p[1] - 1);
159 *vc_fac_mask |= X25_MASK_CALLING_AE;
160 break;
161 case X25_FAC_CALLED_AE:
a6331d6f 162 if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1)
95c30430 163 return -1;
a64b7b93
SP
164 dte_facs->called_len = p[2];
165 memcpy(dte_facs->called_ae, &p[3], p[1] - 1);
166 *vc_fac_mask |= X25_MASK_CALLED_AE;
167 break;
168 default:
169 printk(KERN_DEBUG "X.25: unknown facility %02X,"
5ef41308 170 "length %d\n", p[0], p[1]);
a64b7b93
SP
171 break;
172 }
1da177e4 173 len -= p[1] + 2;
a64b7b93 174 p += p[1] + 2;
1da177e4
LT
175 break;
176 }
177 }
178
179 return p - skb->data;
180}
181
182/*
183 * Create a set of facilities.
184 */
185int x25_create_facilities(unsigned char *buffer,
a64b7b93
SP
186 struct x25_facilities *facilities,
187 struct x25_dte_facilities *dte_facs, unsigned long facil_mask)
1da177e4
LT
188{
189 unsigned char *p = buffer + 1;
190 int len;
191
192 if (!facil_mask) {
193 /*
194 * Length of the facilities field in call_req or
195 * call_accept packets
196 */
197 buffer[0] = 0;
198 len = 1; /* 1 byte for the length field */
199 return len;
200 }
201
202 if (facilities->reverse && (facil_mask & X25_MASK_REVERSE)) {
203 *p++ = X25_FAC_REVERSE;
ebc3f64b 204 *p++ = facilities->reverse;
1da177e4
LT
205 }
206
207 if (facilities->throughput && (facil_mask & X25_MASK_THROUGHPUT)) {
208 *p++ = X25_FAC_THROUGHPUT;
209 *p++ = facilities->throughput;
210 }
211
212 if ((facilities->pacsize_in || facilities->pacsize_out) &&
213 (facil_mask & X25_MASK_PACKET_SIZE)) {
214 *p++ = X25_FAC_PACKET_SIZE;
215 *p++ = facilities->pacsize_in ? : facilities->pacsize_out;
216 *p++ = facilities->pacsize_out ? : facilities->pacsize_in;
217 }
218
219 if ((facilities->winsize_in || facilities->winsize_out) &&
220 (facil_mask & X25_MASK_WINDOW_SIZE)) {
221 *p++ = X25_FAC_WINDOW_SIZE;
222 *p++ = facilities->winsize_in ? : facilities->winsize_out;
223 *p++ = facilities->winsize_out ? : facilities->winsize_in;
224 }
225
a64b7b93
SP
226 if (facil_mask & (X25_MASK_CALLING_AE|X25_MASK_CALLED_AE)) {
227 *p++ = X25_MARKER;
228 *p++ = X25_DTE_SERVICES;
229 }
230
231 if (dte_facs->calling_len && (facil_mask & X25_MASK_CALLING_AE)) {
6bf1574e 232 unsigned bytecount = (dte_facs->calling_len + 1) >> 1;
a64b7b93
SP
233 *p++ = X25_FAC_CALLING_AE;
234 *p++ = 1 + bytecount;
235 *p++ = dte_facs->calling_len;
236 memcpy(p, dte_facs->calling_ae, bytecount);
237 p += bytecount;
238 }
239
240 if (dte_facs->called_len && (facil_mask & X25_MASK_CALLED_AE)) {
241 unsigned bytecount = (dte_facs->called_len % 2) ?
242 dte_facs->called_len / 2 + 1 :
243 dte_facs->called_len / 2;
244 *p++ = X25_FAC_CALLED_AE;
245 *p++ = 1 + bytecount;
246 *p++ = dte_facs->called_len;
247 memcpy(p, dte_facs->called_ae, bytecount);
248 p+=bytecount;
249 }
250
1da177e4
LT
251 len = p - buffer;
252 buffer[0] = len - 1;
253
254 return len;
255}
256
257/*
258 * Try to reach a compromise on a set of facilities.
259 *
260 * The only real problem is with reverse charging.
261 */
262int x25_negotiate_facilities(struct sk_buff *skb, struct sock *sk,
a64b7b93 263 struct x25_facilities *new, struct x25_dte_facilities *dte)
1da177e4
LT
264{
265 struct x25_sock *x25 = x25_sk(sk);
266 struct x25_facilities *ours = &x25->facilities;
267 struct x25_facilities theirs;
268 int len;
269
270 memset(&theirs, 0, sizeof(theirs));
271 memcpy(new, ours, sizeof(*new));
272
a64b7b93 273 len = x25_parse_facilities(skb, &theirs, dte, &x25->vc_facil_mask);
f5eb917b
JH
274 if (len < 0)
275 return len;
1da177e4
LT
276
277 /*
278 * They want reverse charging, we won't accept it.
279 */
ebc3f64b 280 if ((theirs.reverse & 0x01 ) && (ours->reverse & 0x01)) {
d2e7543c 281 SOCK_DEBUG(sk, "X.25: rejecting reverse charging request\n");
1da177e4
LT
282 return -1;
283 }
284
285 new->reverse = theirs.reverse;
286
287 if (theirs.throughput) {
ddd0451f
JH
288 int theirs_in = theirs.throughput & 0x0f;
289 int theirs_out = theirs.throughput & 0xf0;
290 int ours_in = ours->throughput & 0x0f;
291 int ours_out = ours->throughput & 0xf0;
292 if (!ours_in || theirs_in < ours_in) {
293 SOCK_DEBUG(sk, "X.25: inbound throughput negotiated\n");
294 new->throughput = (new->throughput & 0xf0) | theirs_in;
295 }
296 if (!ours_out || theirs_out < ours_out) {
297 SOCK_DEBUG(sk,
298 "X.25: outbound throughput negotiated\n");
299 new->throughput = (new->throughput & 0x0f) | theirs_out;
1da177e4
LT
300 }
301 }
302
303 if (theirs.pacsize_in && theirs.pacsize_out) {
304 if (theirs.pacsize_in < ours->pacsize_in) {
d2e7543c 305 SOCK_DEBUG(sk, "X.25: packet size inwards negotiated down\n");
1da177e4
LT
306 new->pacsize_in = theirs.pacsize_in;
307 }
308 if (theirs.pacsize_out < ours->pacsize_out) {
d2e7543c 309 SOCK_DEBUG(sk, "X.25: packet size outwards negotiated down\n");
1da177e4
LT
310 new->pacsize_out = theirs.pacsize_out;
311 }
312 }
313
314 if (theirs.winsize_in && theirs.winsize_out) {
315 if (theirs.winsize_in < ours->winsize_in) {
d2e7543c 316 SOCK_DEBUG(sk, "X.25: window size inwards negotiated down\n");
1da177e4
LT
317 new->winsize_in = theirs.winsize_in;
318 }
319 if (theirs.winsize_out < ours->winsize_out) {
d2e7543c 320 SOCK_DEBUG(sk, "X.25: window size outwards negotiated down\n");
1da177e4
LT
321 new->winsize_out = theirs.winsize_out;
322 }
323 }
324
325 return len;
326}
327
328/*
f8e1d201 329 * Limit values of certain facilities according to the capability of the
1da177e4
LT
330 * currently attached x25 link.
331 */
332void x25_limit_facilities(struct x25_facilities *facilities,
333 struct x25_neigh *nb)
334{
335
336 if (!nb->extended) {
337 if (facilities->winsize_in > 7) {
338 printk(KERN_DEBUG "X.25: incoming winsize limited to 7\n");
339 facilities->winsize_in = 7;
340 }
341 if (facilities->winsize_out > 7) {
342 facilities->winsize_out = 7;
343 printk( KERN_DEBUG "X.25: outgoing winsize limited to 7\n");
344 }
345 }
346}