net/netfilter/ipvs/ip_vs_proto_sctp.c

   1 #include <linux/kernel.h>
   2 #include <linux/ip.h>
   3 #include <linux/sctp.h>
   4 #include <net/ip.h>
   5 #include <net/ip6_checksum.h>
   6 #include <linux/netfilter.h>
   7 #include <linux/netfilter_ipv4.h>
   8 #include <net/sctp/checksum.h>
   9 #include <net/ip_vs.h>
  10
  11 static int
  12 sctp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
  13                    int *verdict, struct ip_vs_conn **cpp,
  14                    struct ip_vs_iphdr *iph)
  15 {
  16         struct net *net;
  17         struct ip_vs_service *svc;
  18         sctp_chunkhdr_t _schunkh, *sch;
  19         sctp_sctphdr_t *sh, _sctph;
  20
  21         sh = skb_header_pointer(skb, iph->len, sizeof(_sctph), &_sctph);
  22         if (sh == NULL)
  23                 return 0;
  24
  25         sch = skb_header_pointer(skb, iph->len + sizeof(sctp_sctphdr_t),
  26                                  sizeof(_schunkh), &_schunkh);
  27         if (sch == NULL)
  28                 return 0;
  29         net = skb_net(skb);
  30         if ((sch->type == SCTP_CID_INIT) &&
  31             (svc = ip_vs_service_get(net, af, skb->mark, iph->protocol,
  32                                      &iph->daddr, sh->dest))) {
  33                 int ignored;
  34
  35                 if (ip_vs_todrop(net_ipvs(net))) {
  36                         /*
  37                          * It seems that we are very loaded.
  38                          * We have to drop this packet :(
  39                          */
  40                         ip_vs_service_put(svc);
  41                         *verdict = NF_DROP;
  42                         return 0;
  43                 }
  44                 /*
  45                  * Let the virtual server select a real server for the
  46                  * incoming connection, and create a connection entry.
  47                  */
  48                 *cpp = ip_vs_schedule(svc, skb, pd, &ignored, iph);
  49                 if (!*cpp && ignored <= 0) {
  50                         if (!ignored)
  51                                 *verdict = ip_vs_leave(svc, skb, pd, iph);
  52                         else {
  53                                 ip_vs_service_put(svc);
  54                                 *verdict = NF_DROP;
  55                         }
  56                         return 0;
  57                 }
  58                 ip_vs_service_put(svc);
  59         }
  60         /* NF_ACCEPT */
  61         return 1;
  62 }
  63
  64 static void sctp_nat_csum(struct sk_buff *skb, sctp_sctphdr_t *sctph,
  65                           unsigned int sctphoff)
  66 {
  67         __u32 crc32;
  68         struct sk_buff *iter;
  69
  70         crc32 = sctp_start_cksum((__u8 *)sctph, skb_headlen(skb) - sctphoff);
  71         skb_walk_frags(skb, iter)
  72                 crc32 = sctp_update_cksum((u8 *) iter->data,
  73                                           skb_headlen(iter), crc32);
  74         sctph->checksum = sctp_end_cksum(crc32);
  75
  76         skb->ip_summed = CHECKSUM_UNNECESSARY;
  77 }
  78
  79 static int
  80 sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
  81                   struct ip_vs_conn *cp, struct ip_vs_iphdr *iph)
  82 {
  83         sctp_sctphdr_t *sctph;
  84         unsigned int sctphoff = iph->len;
  85
  86 #ifdef CONFIG_IP_VS_IPV6
  87         if (cp->af == AF_INET6 && iph->fragoffs)
  88                 return 1;
  89 #endif
  90
  91         /* csum_check requires unshared skb */
  92         if (!skb_make_writable(skb, sctphoff + sizeof(*sctph)))
  93                 return 0;
  94
  95         if (unlikely(cp->app != NULL)) {
  96                 /* Some checks before mangling */
  97                 if (pp->csum_check && !pp->csum_check(cp->af, skb, pp))
  98                         return 0;
  99
 100                 /* Call application helper if needed */
 101                 if (!ip_vs_app_pkt_out(cp, skb))
 102                         return 0;
 103         }
 104
 105         sctph = (void *) skb_network_header(skb) + sctphoff;
 106         sctph->source = cp->vport;
 107
 108         sctp_nat_csum(skb, sctph, sctphoff);
 109
 110         return 1;
 111 }
 112
 113 static int
 114 sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
 115                   struct ip_vs_conn *cp, struct ip_vs_iphdr *iph)
 116 {
 117         sctp_sctphdr_t *sctph;
 118         unsigned int sctphoff = iph->len;
 119
 120 #ifdef CONFIG_IP_VS_IPV6
 121         if (cp->af == AF_INET6 && iph->fragoffs)
 122                 return 1;
 123 #endif
 124
 125         /* csum_check requires unshared skb */
 126         if (!skb_make_writable(skb, sctphoff + sizeof(*sctph)))
 127                 return 0;
 128
 129         if (unlikely(cp->app != NULL)) {
 130                 /* Some checks before mangling */
 131                 if (pp->csum_check && !pp->csum_check(cp->af, skb, pp))
 132                         return 0;
 133
 134                 /* Call application helper if needed */
 135                 if (!ip_vs_app_pkt_in(cp, skb))
 136                         return 0;
 137         }
 138
 139         sctph = (void *) skb_network_header(skb) + sctphoff;
 140         sctph->dest = cp->dport;
 141
 142         sctp_nat_csum(skb, sctph, sctphoff);
 143
 144         return 1;
 145 }
 146
 147 static int
 148 sctp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp)
 149 {
 150         unsigned int sctphoff;
 151         struct sctphdr *sh, _sctph;
 152         struct sk_buff *iter;
 153         __le32 cmp;
 154         __le32 val;
 155         __u32 tmp;
 156
 157 #ifdef CONFIG_IP_VS_IPV6
 158         if (af == AF_INET6)
 159                 sctphoff = sizeof(struct ipv6hdr);
 160         else
 161 #endif
 162                 sctphoff = ip_hdrlen(skb);
 163
 164         sh = skb_header_pointer(skb, sctphoff, sizeof(_sctph), &_sctph);
 165         if (sh == NULL)
 166                 return 0;
 167
 168         cmp = sh->checksum;
 169
 170         tmp = sctp_start_cksum((__u8 *) sh, skb_headlen(skb));
 171         skb_walk_frags(skb, iter)
 172                 tmp = sctp_update_cksum((__u8 *) iter->data,
 173                                         skb_headlen(iter), tmp);
 174
 175         val = sctp_end_cksum(tmp);
 176
 177         if (val != cmp) {
 178                 /* CRC failure, dump it. */
 179                 IP_VS_DBG_RL_PKT(0, af, pp, skb, 0,
 180                                 "Failed checksum for");
 181                 return 0;
 182         }
 183         return 1;
 184 }
 185
 186 struct ipvs_sctp_nextstate {
 187         int next_state;
 188 };
 189 enum ipvs_sctp_event_t {
 190         IP_VS_SCTP_EVE_DATA_CLI,
 191         IP_VS_SCTP_EVE_DATA_SER,
 192         IP_VS_SCTP_EVE_INIT_CLI,
 193         IP_VS_SCTP_EVE_INIT_SER,
 194         IP_VS_SCTP_EVE_INIT_ACK_CLI,
 195         IP_VS_SCTP_EVE_INIT_ACK_SER,
 196         IP_VS_SCTP_EVE_COOKIE_ECHO_CLI,
 197         IP_VS_SCTP_EVE_COOKIE_ECHO_SER,
 198         IP_VS_SCTP_EVE_COOKIE_ACK_CLI,
 199         IP_VS_SCTP_EVE_COOKIE_ACK_SER,
 200         IP_VS_SCTP_EVE_ABORT_CLI,
 201         IP_VS_SCTP_EVE__ABORT_SER,
 202         IP_VS_SCTP_EVE_SHUT_CLI,
 203         IP_VS_SCTP_EVE_SHUT_SER,
 204         IP_VS_SCTP_EVE_SHUT_ACK_CLI,
 205         IP_VS_SCTP_EVE_SHUT_ACK_SER,
 206         IP_VS_SCTP_EVE_SHUT_COM_CLI,
 207         IP_VS_SCTP_EVE_SHUT_COM_SER,
 208         IP_VS_SCTP_EVE_LAST
 209 };
 210
 211 static enum ipvs_sctp_event_t sctp_events[255] = {
 212         IP_VS_SCTP_EVE_DATA_CLI,
 213         IP_VS_SCTP_EVE_INIT_CLI,
 214         IP_VS_SCTP_EVE_INIT_ACK_CLI,
 215         IP_VS_SCTP_EVE_DATA_CLI,
 216         IP_VS_SCTP_EVE_DATA_CLI,
 217         IP_VS_SCTP_EVE_DATA_CLI,
 218         IP_VS_SCTP_EVE_ABORT_CLI,
 219         IP_VS_SCTP_EVE_SHUT_CLI,
 220         IP_VS_SCTP_EVE_SHUT_ACK_CLI,
 221         IP_VS_SCTP_EVE_DATA_CLI,
 222         IP_VS_SCTP_EVE_COOKIE_ECHO_CLI,
 223         IP_VS_SCTP_EVE_COOKIE_ACK_CLI,
 224         IP_VS_SCTP_EVE_DATA_CLI,
 225         IP_VS_SCTP_EVE_DATA_CLI,
 226         IP_VS_SCTP_EVE_SHUT_COM_CLI,
 227 };
 228
 229 static struct ipvs_sctp_nextstate
 230  sctp_states_table[IP_VS_SCTP_S_LAST][IP_VS_SCTP_EVE_LAST] = {
 231         /*
 232          * STATE : IP_VS_SCTP_S_NONE
 233          */
 234         /*next state *//*event */
 235         {{IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_CLI */ },
 236          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_SER */ },
 237          {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
 238          {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
 239          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
 240          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
 241          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
 242          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
 243          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
 244          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
 245          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
 246          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
 247          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_CLI */ },
 248          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_SER */ },
 249          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
 250          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
 251          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
 252          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ },
 253          },
 254         /*
 255          * STATE : IP_VS_SCTP_S_INIT_CLI
 256          * Cient sent INIT and is waiting for reply from server(In ECHO_WAIT)
 257          */
 258         {{IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_CLI */ },
 259          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_SER */ },
 260          {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
 261          {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
 262          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
 263          {IP_VS_SCTP_S_INIT_ACK_SER /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
 264          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ECHO_CLI */ },
 265          {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_ECHO_SER */ },
 266          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
 267          {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
 268          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
 269          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
 270          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_CLI */ },
 271          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_SER */ },
 272          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
 273          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
 274          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
 275          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
 276          },
 277         /*
 278          * State : IP_VS_SCTP_S_INIT_SER
 279          * Server sent INIT and waiting for INIT ACK from the client
 280          */
 281         {{IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_CLI */ },
 282          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_SER */ },
 283          {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
 284          {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
 285          {IP_VS_SCTP_S_INIT_ACK_CLI /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
 286          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
 287          {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
 288          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
 289          {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
 290          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
 291          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
 292          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
 293          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_CLI */ },
 294          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_SER */ },
 295          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
 296          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
 297          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
 298          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
 299          },
 300         /*
 301          * State : IP_VS_SCTP_S_INIT_ACK_CLI
 302          * Client sent INIT ACK and waiting for ECHO from the server
 303          */
 304         {{IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_CLI */ },
 305          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_SER */ },
 306          /*
 307           * We have got an INIT from client. From the spec.“Upon receipt of
 308           * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
 309           * an INIT ACK using the same parameters it sent in its  original
 310           * INIT chunk (including its Initiate Tag, unchanged”).
 311           */
 312          {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
 313          {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
 314          /*
 315           * INIT_ACK has been resent by the client, let us stay is in
 316           * the same state
 317           */
 318          {IP_VS_SCTP_S_INIT_ACK_CLI /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
 319          /*
 320           * INIT_ACK sent by the server, close the connection
 321           */
 322          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
 323          /*
 324           * ECHO by client, it should not happen, close the connection
 325           */
 326          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
 327          /*
 328           * ECHO by server, this is what we are expecting, move to ECHO_SER
 329           */
 330          {IP_VS_SCTP_S_ECHO_SER /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
 331          /*
 332           * COOKIE ACK from client, it should not happen, close the connection
 333           */
 334          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
 335          /*
 336           * Unexpected COOKIE ACK from server, staty in the same state
 337           */
 338          {IP_VS_SCTP_S_INIT_ACK_CLI /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
 339          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
 340          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
 341          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_CLI */ },
 342          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_SER */ },
 343          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
 344          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
 345          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
 346          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
 347          },
 348         /*
 349          * State : IP_VS_SCTP_S_INIT_ACK_SER
 350          * Server sent INIT ACK and waiting for ECHO from the client
 351          */
 352         {{IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_CLI */ },
 353          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_SER */ },
 354          /*
 355           * We have got an INIT from client. From the spec.“Upon receipt of
 356           * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
 357           * an INIT ACK using the same parameters it sent in its  original
 358           * INIT chunk (including its Initiate Tag, unchanged”).
 359           */
 360          {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
 361          {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
 362          /*
 363           * Unexpected INIT_ACK by the client, let us close the connection
 364           */
 365          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
 366          /*
 367           * INIT_ACK resent by the server, let us move to same state
 368           */
 369          {IP_VS_SCTP_S_INIT_ACK_SER /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
 370          /*
 371           * Client send the ECHO, this is what we are expecting,
 372           * move to ECHO_CLI
 373           */
 374          {IP_VS_SCTP_S_ECHO_CLI /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
 375          /*
 376           * ECHO received from the server, Not sure what to do,
 377           * let us close it
 378           */
 379          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
 380          /*
 381           * COOKIE ACK from client, let us stay in the same state
 382           */
 383          {IP_VS_SCTP_S_INIT_ACK_SER /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
 384          /*
 385           * COOKIE ACK from server, hmm... this should not happen, lets close
 386           * the connection.
 387           */
 388          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
 389          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
 390          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
 391          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_CLI */ },
 392          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_SER */ },
 393          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
 394          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
 395          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
 396          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
 397          },
 398         /*
 399          * State : IP_VS_SCTP_S_ECHO_CLI
 400          * Cient  sent ECHO and waiting COOKEI ACK from the Server
 401          */
 402         {{IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_CLI */ },
 403          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_SER */ },
 404          /*
 405           * We have got an INIT from client. From the spec.“Upon receipt of
 406           * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
 407           * an INIT ACK using the same parameters it sent in its  original
 408           * INIT chunk (including its Initiate Tag, unchanged”).
 409           */
 410          {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
 411          {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
 412          /*
 413           * INIT_ACK has been by the client, let us close the connection
 414           */
 415          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
 416          /*
 417           * INIT_ACK sent by the server, Unexpected INIT ACK, spec says,
 418           * “If an INIT ACK is received by an endpoint in any state other
 419           * than the COOKIE-WAIT state, the endpoint should discard the
 420           * INIT ACK chunk”. Stay in the same state
 421           */
 422          {IP_VS_SCTP_S_ECHO_CLI /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
 423          /*
 424           * Client resent the ECHO, let us stay in the same state
 425           */
 426          {IP_VS_SCTP_S_ECHO_CLI /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
 427          /*
 428           * ECHO received from the server, Not sure what to do,
 429           * let us close it
 430           */
 431          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
 432          /*
 433           * COOKIE ACK from client, this shoud not happen, let's close the
 434           * connection
 435           */
 436          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
 437          /*
 438           * COOKIE ACK from server, this is what we are awaiting,lets move to
 439           * ESTABLISHED.
 440           */
 441          {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
 442          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
 443          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
 444          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_CLI */ },
 445          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_SER */ },
 446          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
 447          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
 448          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
 449          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
 450          },
 451         /*
 452          * State : IP_VS_SCTP_S_ECHO_SER
 453          * Server sent ECHO and waiting COOKEI ACK from the client
 454          */
 455         {{IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_CLI */ },
 456          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_SER */ },
 457          /*
 458           * We have got an INIT from client. From the spec.“Upon receipt of
 459           * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
 460           * an INIT ACK using the same parameters it sent in its  original
 461           * INIT chunk (including its Initiate Tag, unchanged”).
 462           */
 463          {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
 464          {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
 465          /*
 466           * INIT_ACK sent by the server, Unexpected INIT ACK, spec says,
 467           * “If an INIT ACK is received by an endpoint in any state other
 468           * than the COOKIE-WAIT state, the endpoint should discard the
 469           * INIT ACK chunk”. Stay in the same state
 470           */
 471          {IP_VS_SCTP_S_ECHO_SER /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
 472          /*
 473           * INIT_ACK has been by the server, let us close the connection
 474           */
 475          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
 476          /*
 477           * Client sent the ECHO, not sure what to do, let's close the
 478           * connection.
 479           */
 480          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
 481          /*
 482           * ECHO resent by the server, stay in the same state
 483           */
 484          {IP_VS_SCTP_S_ECHO_SER /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
 485          /*
 486           * COOKIE ACK from client, this is what we are expecting, let's move
 487           * to ESTABLISHED.
 488           */
 489          {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
 490          /*
 491           * COOKIE ACK from server, this should not happen, lets close the
 492           * connection.
 493           */
 494          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
 495          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
 496          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
 497          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_CLI */ },
 498          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_SER */ },
 499          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
 500          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
 501          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
 502          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
 503          },
 504         /*
 505          * State : IP_VS_SCTP_S_ESTABLISHED
 506          * Association established
 507          */
 508         {{IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_DATA_CLI */ },
 509          {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_DATA_SER */ },
 510          /*
 511           * We have got an INIT from client. From the spec.“Upon receipt of
 512           * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
 513           * an INIT ACK using the same parameters it sent in its  original
 514           * INIT chunk (including its Initiate Tag, unchanged”).
 515           */
 516          {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
 517          {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
 518          /*
 519           * INIT_ACK sent by the server, Unexpected INIT ACK, spec says,
 520           * “If an INIT ACK is received by an endpoint in any state other
 521           * than the COOKIE-WAIT state, the endpoint should discard the
 522           * INIT ACK chunk”. Stay in the same state
 523           */
 524          {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
 525          {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
 526          /*
 527           * Client sent ECHO, Spec(sec 5.2.4) says it may be handled by the
 528           * peer and peer shall move to the ESTABISHED. if it doesn't handle
 529           * it will send ERROR chunk. So, stay in the same state
 530           */
 531          {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
 532          {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
 533          /*
 534           * COOKIE ACK from client, not sure what to do stay in the same state
 535           */
 536          {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
 537          {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
 538          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
 539          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
 540          /*
 541           * SHUTDOWN from the client, move to SHUDDOWN_CLI
 542           */
 543          {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_SHUT_CLI */ },
 544          /*
 545           * SHUTDOWN from the server, move to SHUTDOWN_SER
 546           */
 547          {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_SHUT_SER */ },
 548          /*
 549           * client sent SHUDTDOWN_ACK, this should not happen, let's close
 550           * the connection
 551           */
 552          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
 553          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
 554          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
 555          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
 556          },
 557         /*
 558          * State : IP_VS_SCTP_S_SHUT_CLI
 559          * SHUTDOWN sent from the client, waitinf for SHUT ACK from the server
 560          */
 561         /*
 562          * We received the data chuck, keep the state unchanged. I assume
 563          * that still data chuncks  can be received by both the peers in
 564          * SHUDOWN state
 565          */
 566
 567         {{IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_DATA_CLI */ },
 568          {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_DATA_SER */ },
 569          /*
 570           * We have got an INIT from client. From the spec.“Upon receipt of
 571           * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
 572           * an INIT ACK using the same parameters it sent in its  original
 573           * INIT chunk (including its Initiate Tag, unchanged”).
 574           */
 575          {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
 576          {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
 577          /*
 578           * INIT_ACK sent by the server, Unexpected INIT ACK, spec says,
 579           * “If an INIT ACK is received by an endpoint in any state other
 580           * than the COOKIE-WAIT state, the endpoint should discard the
 581           * INIT ACK chunk”. Stay in the same state
 582           */
 583          {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
 584          {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
 585          /*
 586           * Client sent ECHO, Spec(sec 5.2.4) says it may be handled by the
 587           * peer and peer shall move to the ESTABISHED. if it doesn't handle
 588           * it will send ERROR chunk. So, stay in the same state
 589           */
 590          {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
 591          {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
 592          /*
 593           * COOKIE ACK from client, not sure what to do stay in the same state
 594           */
 595          {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
 596          {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
 597          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
 598          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
 599          /*
 600           * SHUTDOWN resent from the client, move to SHUDDOWN_CLI
 601           */
 602          {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_SHUT_CLI */ },
 603          /*
 604           * SHUTDOWN from the server, move to SHUTDOWN_SER
 605           */
 606          {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_SHUT_SER */ },
 607          /*
 608           * client sent SHUDTDOWN_ACK, this should not happen, let's close
 609           * the connection
 610           */
 611          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
 612          /*
 613           * Server sent SHUTDOWN ACK, this is what we are expecting, let's move
 614           * to SHUDOWN_ACK_SER
 615           */
 616          {IP_VS_SCTP_S_SHUT_ACK_SER /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
 617          /*
 618           * SHUTDOWN COM from client, this should not happen, let's close the
 619           * connection
 620           */
 621          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
 622          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
 623          },
 624         /*
 625          * State : IP_VS_SCTP_S_SHUT_SER
 626          * SHUTDOWN sent from the server, waitinf for SHUTDOWN ACK from client
 627          */
 628         /*
 629          * We received the data chuck, keep the state unchanged. I assume
 630          * that still data chuncks  can be received by both the peers in
 631          * SHUDOWN state
 632          */
 633
 634         {{IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_DATA_CLI */ },
 635          {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_DATA_SER */ },
 636          /*
 637           * We have got an INIT from client. From the spec.“Upon receipt of
 638           * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
 639           * an INIT ACK using the same parameters it sent in its  original
 640           * INIT chunk (including its Initiate Tag, unchanged”).
 641           */
 642          {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
 643          {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
 644          /*
 645           * INIT_ACK sent by the server, Unexpected INIT ACK, spec says,
 646           * “If an INIT ACK is received by an endpoint in any state other
 647           * than the COOKIE-WAIT state, the endpoint should discard the
 648           * INIT ACK chunk”. Stay in the same state
 649           */
 650          {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
 651          {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
 652          /*
 653           * Client sent ECHO, Spec(sec 5.2.4) says it may be handled by the
 654           * peer and peer shall move to the ESTABISHED. if it doesn't handle
 655           * it will send ERROR chunk. So, stay in the same state
 656           */
 657          {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
 658          {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
 659          /*
 660           * COOKIE ACK from client, not sure what to do stay in the same state
 661           */
 662          {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
 663          {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
 664          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
 665          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
 666          /*
 667           * SHUTDOWN resent from the client, move to SHUDDOWN_CLI
 668           */
 669          {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_SHUT_CLI */ },
 670          /*
 671           * SHUTDOWN resent from the server, move to SHUTDOWN_SER
 672           */
 673          {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_SHUT_SER */ },
 674          /*
 675           * client sent SHUDTDOWN_ACK, this is what we are expecting, let's
 676           * move to SHUT_ACK_CLI
 677           */
 678          {IP_VS_SCTP_S_SHUT_ACK_CLI /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
 679          /*
 680           * Server sent SHUTDOWN ACK, this should not happen, let's close the
 681           * connection
 682           */
 683          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
 684          /*
 685           * SHUTDOWN COM from client, this should not happen, let's close the
 686           * connection
 687           */
 688          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
 689          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
 690          },
 691
 692         /*
 693          * State : IP_VS_SCTP_S_SHUT_ACK_CLI
 694          * SHUTDOWN ACK from the client, awaiting for SHUTDOWN COM from server
 695          */
 696         /*
 697          * We received the data chuck, keep the state unchanged. I assume
 698          * that still data chuncks  can be received by both the peers in
 699          * SHUDOWN state
 700          */
 701
 702         {{IP_VS_SCTP_S_SHUT_ACK_CLI /* IP_VS_SCTP_EVE_DATA_CLI */ },
 703          {IP_VS_SCTP_S_SHUT_ACK_CLI /* IP_VS_SCTP_EVE_DATA_SER */ },
 704          /*
 705           * We have got an INIT from client. From the spec.“Upon receipt of
 706           * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
 707           * an INIT ACK using the same parameters it sent in its  original
 708           * INIT chunk (including its Initiate Tag, unchanged”).
 709           */
 710          {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
 711          {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
 712          /*
 713           * INIT_ACK sent by the server, Unexpected INIT ACK, spec says,
 714           * “If an INIT ACK is received by an endpoint in any state other
 715           * than the COOKIE-WAIT state, the endpoint should discard the
 716           * INIT ACK chunk”. Stay in the same state
 717           */
 718          {IP_VS_SCTP_S_SHUT_ACK_CLI /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
 719          {IP_VS_SCTP_S_SHUT_ACK_CLI /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
 720          /*
 721           * Client sent ECHO, Spec(sec 5.2.4) says it may be handled by the
 722           * peer and peer shall move to the ESTABISHED. if it doesn't handle
 723           * it will send ERROR chunk. So, stay in the same state
 724           */
 725          {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
 726          {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
 727          /*
 728           * COOKIE ACK from client, not sure what to do stay in the same state
 729           */
 730          {IP_VS_SCTP_S_SHUT_ACK_CLI /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
 731          {IP_VS_SCTP_S_SHUT_ACK_CLI /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
 732          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
 733          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
 734          /*
 735           * SHUTDOWN sent from the client, move to SHUDDOWN_CLI
 736           */
 737          {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_SHUT_CLI */ },
 738          /*
 739           * SHUTDOWN sent from the server, move to SHUTDOWN_SER
 740           */
 741          {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_SHUT_SER */ },
 742          /*
 743           * client resent SHUDTDOWN_ACK, let's stay in the same state
 744           */
 745          {IP_VS_SCTP_S_SHUT_ACK_CLI /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
 746          /*
 747           * Server sent SHUTDOWN ACK, this should not happen, let's close the
 748           * connection
 749           */
 750          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
 751          /*
 752           * SHUTDOWN COM from client, this should not happen, let's close the
 753           * connection
 754           */
 755          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
 756          /*
 757           * SHUTDOWN COMPLETE from server this is what we are expecting.
 758           */
 759          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
 760          },
 761
 762         /*
 763          * State : IP_VS_SCTP_S_SHUT_ACK_SER
 764          * SHUTDOWN ACK from the server, awaiting for SHUTDOWN COM from client
 765          */
 766         /*
 767          * We received the data chuck, keep the state unchanged. I assume
 768          * that still data chuncks  can be received by both the peers in
 769          * SHUDOWN state
 770          */
 771
 772         {{IP_VS_SCTP_S_SHUT_ACK_SER /* IP_VS_SCTP_EVE_DATA_CLI */ },
 773          {IP_VS_SCTP_S_SHUT_ACK_SER /* IP_VS_SCTP_EVE_DATA_SER */ },
 774          /*
 775           * We have got an INIT from client. From the spec.“Upon receipt of
 776           * an INIT in the COOKIE-WAIT state, an endpoint MUST respond with
 777           * an INIT ACK using the same parameters it sent in its  original
 778           * INIT chunk (including its Initiate Tag, unchanged”).
 779           */
 780          {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
 781          {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
 782          /*
 783           * INIT_ACK sent by the server, Unexpected INIT ACK, spec says,
 784           * “If an INIT ACK is received by an endpoint in any state other
 785           * than the COOKIE-WAIT state, the endpoint should discard the
 786           * INIT ACK chunk”. Stay in the same state
 787           */
 788          {IP_VS_SCTP_S_SHUT_ACK_SER /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
 789          {IP_VS_SCTP_S_SHUT_ACK_SER /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
 790          /*
 791           * Client sent ECHO, Spec(sec 5.2.4) says it may be handled by the
 792           * peer and peer shall move to the ESTABISHED. if it doesn't handle
 793           * it will send ERROR chunk. So, stay in the same state
 794           */
 795          {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
 796          {IP_VS_SCTP_S_ESTABLISHED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
 797          /*
 798           * COOKIE ACK from client, not sure what to do stay in the same state
 799           */
 800          {IP_VS_SCTP_S_SHUT_ACK_SER /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
 801          {IP_VS_SCTP_S_SHUT_ACK_SER /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
 802          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
 803          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
 804          /*
 805           * SHUTDOWN sent from the client, move to SHUDDOWN_CLI
 806           */
 807          {IP_VS_SCTP_S_SHUT_CLI /* IP_VS_SCTP_EVE_SHUT_CLI */ },
 808          /*
 809           * SHUTDOWN sent from the server, move to SHUTDOWN_SER
 810           */
 811          {IP_VS_SCTP_S_SHUT_SER /* IP_VS_SCTP_EVE_SHUT_SER */ },
 812          /*
 813           * client sent SHUDTDOWN_ACK, this should not happen let's close
 814           * the connection.
 815           */
 816          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
 817          /*
 818           * Server resent SHUTDOWN ACK, stay in the same state
 819           */
 820          {IP_VS_SCTP_S_SHUT_ACK_SER /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
 821          /*
 822           * SHUTDOWN COM from client, this what we are expecting, let's close
 823           * the connection
 824           */
 825          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
 826          /*
 827           * SHUTDOWN COMPLETE from server this should not happen.
 828           */
 829          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
 830          },
 831         /*
 832          * State : IP_VS_SCTP_S_CLOSED
 833          */
 834         {{IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_CLI */ },
 835          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_DATA_SER */ },
 836          {IP_VS_SCTP_S_INIT_CLI /* IP_VS_SCTP_EVE_INIT_CLI */ },
 837          {IP_VS_SCTP_S_INIT_SER /* IP_VS_SCTP_EVE_INIT_SER */ },
 838          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_CLI */ },
 839          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_INIT_ACK_SER */ },
 840          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_CLI */ },
 841          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ECHO_SER */ },
 842          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_CLI */ },
 843          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_COOKIE_ACK_SER */ },
 844          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_CLI */ },
 845          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_ABORT_SER */ },
 846          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_CLI */ },
 847          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_SER */ },
 848          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_CLI */ },
 849          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_ACK_SER */ },
 850          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_CLI */ },
 851          {IP_VS_SCTP_S_CLOSED /* IP_VS_SCTP_EVE_SHUT_COM_SER */ }
 852          }
 853 };
 854
 855 /*
 856  *      Timeout table[state]
 857  */
 858 static const int sctp_timeouts[IP_VS_SCTP_S_LAST + 1] = {
 859         [IP_VS_SCTP_S_NONE]         =     2 * HZ,
 860         [IP_VS_SCTP_S_INIT_CLI]     =     1 * 60 * HZ,
 861         [IP_VS_SCTP_S_INIT_SER]     =     1 * 60 * HZ,
 862         [IP_VS_SCTP_S_INIT_ACK_CLI] =     1 * 60 * HZ,
 863         [IP_VS_SCTP_S_INIT_ACK_SER] =     1 * 60 * HZ,
 864         [IP_VS_SCTP_S_ECHO_CLI]     =     1 * 60 * HZ,
 865         [IP_VS_SCTP_S_ECHO_SER]     =     1 * 60 * HZ,
 866         [IP_VS_SCTP_S_ESTABLISHED]  =    15 * 60 * HZ,
 867         [IP_VS_SCTP_S_SHUT_CLI]     =     1 * 60 * HZ,
 868         [IP_VS_SCTP_S_SHUT_SER]     =     1 * 60 * HZ,
 869         [IP_VS_SCTP_S_SHUT_ACK_CLI] =     1 * 60 * HZ,
 870         [IP_VS_SCTP_S_SHUT_ACK_SER] =     1 * 60 * HZ,
 871         [IP_VS_SCTP_S_CLOSED]       =    10 * HZ,
 872         [IP_VS_SCTP_S_LAST]         =     2 * HZ,
 873 };
 874
 875 static const char *sctp_state_name_table[IP_VS_SCTP_S_LAST + 1] = {
 876         [IP_VS_SCTP_S_NONE]         =    "NONE",
 877         [IP_VS_SCTP_S_INIT_CLI]     =    "INIT_CLI",
 878         [IP_VS_SCTP_S_INIT_SER]     =    "INIT_SER",
 879         [IP_VS_SCTP_S_INIT_ACK_CLI] =    "INIT_ACK_CLI",
 880         [IP_VS_SCTP_S_INIT_ACK_SER] =    "INIT_ACK_SER",
 881         [IP_VS_SCTP_S_ECHO_CLI]     =    "COOKIE_ECHO_CLI",
 882         [IP_VS_SCTP_S_ECHO_SER]     =    "COOKIE_ECHO_SER",
 883         [IP_VS_SCTP_S_ESTABLISHED]  =    "ESTABISHED",
 884         [IP_VS_SCTP_S_SHUT_CLI]     =    "SHUTDOWN_CLI",
 885         [IP_VS_SCTP_S_SHUT_SER]     =    "SHUTDOWN_SER",
 886         [IP_VS_SCTP_S_SHUT_ACK_CLI] =    "SHUTDOWN_ACK_CLI",
 887         [IP_VS_SCTP_S_SHUT_ACK_SER] =    "SHUTDOWN_ACK_SER",
 888         [IP_VS_SCTP_S_CLOSED]       =    "CLOSED",
 889         [IP_VS_SCTP_S_LAST]         =    "BUG!"
 890 };
 891
 892
 893 static const char *sctp_state_name(int state)
 894 {
 895         if (state >= IP_VS_SCTP_S_LAST)
 896                 return "ERR!";
 897         if (sctp_state_name_table[state])
 898                 return sctp_state_name_table[state];
 899         return "?";
 900 }
 901
 902 static inline void
 903 set_sctp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp,
 904                 int direction, const struct sk_buff *skb)
 905 {
 906         sctp_chunkhdr_t _sctpch, *sch;
 907         unsigned char chunk_type;
 908         int event, next_state;
 909         int ihl;
 910
 911 #ifdef CONFIG_IP_VS_IPV6
 912         ihl = cp->af == AF_INET ? ip_hdrlen(skb) : sizeof(struct ipv6hdr);
 913 #else
 914         ihl = ip_hdrlen(skb);
 915 #endif
 916
 917         sch = skb_header_pointer(skb, ihl + sizeof(sctp_sctphdr_t),
 918                                 sizeof(_sctpch), &_sctpch);
 919         if (sch == NULL)
 920                 return;
 921
 922         chunk_type = sch->type;
 923         /*
 924          * Section 3: Multiple chunks can be bundled into one SCTP packet
 925          * up to the MTU size, except for the INIT, INIT ACK, and
 926          * SHUTDOWN COMPLETE chunks. These chunks MUST NOT be bundled with
 927          * any other chunk in a packet.
 928          *
 929          * Section 3.3.7: DATA chunks MUST NOT be bundled with ABORT. Control
 930          * chunks (except for INIT, INIT ACK, and SHUTDOWN COMPLETE) MAY be
 931          * bundled with an ABORT, but they MUST be placed before the ABORT
 932          * in the SCTP packet or they will be ignored by the receiver.
 933          */
 934         if ((sch->type == SCTP_CID_COOKIE_ECHO) ||
 935             (sch->type == SCTP_CID_COOKIE_ACK)) {
 936                 sch = skb_header_pointer(skb, (ihl + sizeof(sctp_sctphdr_t) +
 937                                 sch->length), sizeof(_sctpch), &_sctpch);
 938                 if (sch) {
 939                         if (sch->type == SCTP_CID_ABORT)
 940                                 chunk_type = sch->type;
 941                 }
 942         }
 943
 944         event = sctp_events[chunk_type];
 945
 946         /*
 947          *  If the direction is IP_VS_DIR_OUTPUT, this event is from server
 948          */
 949         if (direction == IP_VS_DIR_OUTPUT)
 950                 event++;
 951         /*
 952          * get next state
 953          */
 954         next_state = sctp_states_table[cp->state][event].next_state;
 955
 956         if (next_state != cp->state) {
 957                 struct ip_vs_dest *dest = cp->dest;
 958
 959                 IP_VS_DBG_BUF(8, "%s %s  %s:%d->"
 960                                 "%s:%d state: %s->%s conn->refcnt:%d\n",
 961                                 pd->pp->name,
 962                                 ((direction == IP_VS_DIR_OUTPUT) ?
 963                                  "output " : "input "),
 964                                 IP_VS_DBG_ADDR(cp->af, &cp->daddr),
 965                                 ntohs(cp->dport),
 966                                 IP_VS_DBG_ADDR(cp->af, &cp->caddr),
 967                                 ntohs(cp->cport),
 968                                 sctp_state_name(cp->state),
 969                                 sctp_state_name(next_state),
 970                                 atomic_read(&cp->refcnt));
 971                 if (dest) {
 972                         if (!(cp->flags & IP_VS_CONN_F_INACTIVE) &&
 973                                 (next_state != IP_VS_SCTP_S_ESTABLISHED)) {
 974                                 atomic_dec(&dest->activeconns);
 975                                 atomic_inc(&dest->inactconns);
 976                                 cp->flags |= IP_VS_CONN_F_INACTIVE;
 977                         } else if ((cp->flags & IP_VS_CONN_F_INACTIVE) &&
 978                                    (next_state == IP_VS_SCTP_S_ESTABLISHED)) {
 979                                 atomic_inc(&dest->activeconns);
 980                                 atomic_dec(&dest->inactconns);
 981                                 cp->flags &= ~IP_VS_CONN_F_INACTIVE;
 982                         }
 983                 }
 984         }
 985         if (likely(pd))
 986                 cp->timeout = pd->timeout_table[cp->state = next_state];
 987         else    /* What to do ? */
 988                 cp->timeout = sctp_timeouts[cp->state = next_state];
 989 }
 990
 991 static void
 992 sctp_state_transition(struct ip_vs_conn *cp, int direction,
 993                 const struct sk_buff *skb, struct ip_vs_proto_data *pd)
 994 {
 995         spin_lock(&cp->lock);
 996         set_sctp_state(pd, cp, direction, skb);
 997         spin_unlock(&cp->lock);
 998 }
 999
1000 static inline __u16 sctp_app_hashkey(__be16 port)
1001 {
1002         return (((__force u16)port >> SCTP_APP_TAB_BITS) ^ (__force u16)port)
1003                 & SCTP_APP_TAB_MASK;
1004 }
1005
1006 static int sctp_register_app(struct net *net, struct ip_vs_app *inc)
1007 {
1008         struct ip_vs_app *i;
1009         __u16 hash;
1010         __be16 port = inc->port;
1011         int ret = 0;
1012         struct netns_ipvs *ipvs = net_ipvs(net);
1013         struct ip_vs_proto_data *pd = ip_vs_proto_data_get(net, IPPROTO_SCTP);
1014
1015         hash = sctp_app_hashkey(port);
1016
1017         spin_lock_bh(&ipvs->sctp_app_lock);
1018         list_for_each_entry(i, &ipvs->sctp_apps[hash], p_list) {
1019                 if (i->port == port) {
1020                         ret = -EEXIST;
1021                         goto out;
1022                 }
1023         }
1024         list_add(&inc->p_list, &ipvs->sctp_apps[hash]);
1025         atomic_inc(&pd->appcnt);
1026 out:
1027         spin_unlock_bh(&ipvs->sctp_app_lock);
1028
1029         return ret;
1030 }
1031
1032 static void sctp_unregister_app(struct net *net, struct ip_vs_app *inc)
1033 {
1034         struct netns_ipvs *ipvs = net_ipvs(net);
1035         struct ip_vs_proto_data *pd = ip_vs_proto_data_get(net, IPPROTO_SCTP);
1036
1037         spin_lock_bh(&ipvs->sctp_app_lock);
1038         atomic_dec(&pd->appcnt);
1039         list_del(&inc->p_list);
1040         spin_unlock_bh(&ipvs->sctp_app_lock);
1041 }
1042
1043 static int sctp_app_conn_bind(struct ip_vs_conn *cp)
1044 {
1045         struct netns_ipvs *ipvs = net_ipvs(ip_vs_conn_net(cp));
1046         int hash;
1047         struct ip_vs_app *inc;
1048         int result = 0;
1049
1050         /* Default binding: bind app only for NAT */
1051         if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
1052                 return 0;
1053         /* Lookup application incarnations and bind the right one */
1054         hash = sctp_app_hashkey(cp->vport);
1055
1056         spin_lock(&ipvs->sctp_app_lock);
1057         list_for_each_entry(inc, &ipvs->sctp_apps[hash], p_list) {
1058                 if (inc->port == cp->vport) {
1059                         if (unlikely(!ip_vs_app_inc_get(inc)))
1060                                 break;
1061                         spin_unlock(&ipvs->sctp_app_lock);
1062
1063                         IP_VS_DBG_BUF(9, "%s: Binding conn %s:%u->"
1064                                         "%s:%u to app %s on port %u\n",
1065                                         __func__,
1066                                         IP_VS_DBG_ADDR(cp->af, &cp->caddr),
1067                                         ntohs(cp->cport),
1068                                         IP_VS_DBG_ADDR(cp->af, &cp->vaddr),
1069                                         ntohs(cp->vport),
1070                                         inc->name, ntohs(inc->port));
1071                         cp->app = inc;
1072                         if (inc->init_conn)
1073                                 result = inc->init_conn(inc, cp);
1074                         goto out;
1075                 }
1076         }
1077         spin_unlock(&ipvs->sctp_app_lock);
1078 out:
1079         return result;
1080 }
1081
1082 /* ---------------------------------------------
1083  *   timeouts is netns related now.
1084  * ---------------------------------------------
1085  */
1086 static int __ip_vs_sctp_init(struct net *net, struct ip_vs_proto_data *pd)
1087 {
1088         struct netns_ipvs *ipvs = net_ipvs(net);
1089
1090         ip_vs_init_hash_table(ipvs->sctp_apps, SCTP_APP_TAB_SIZE);
1091         spin_lock_init(&ipvs->sctp_app_lock);
1092         pd->timeout_table = ip_vs_create_timeout_table((int *)sctp_timeouts,
1093                                                         sizeof(sctp_timeouts));
1094         if (!pd->timeout_table)
1095                 return -ENOMEM;
1096         return 0;
1097 }
1098
1099 static void __ip_vs_sctp_exit(struct net *net, struct ip_vs_proto_data *pd)
1100 {
1101         kfree(pd->timeout_table);
1102 }
1103
1104 struct ip_vs_protocol ip_vs_protocol_sctp = {
1105         .name           = "SCTP",
1106         .protocol       = IPPROTO_SCTP,
1107         .num_states     = IP_VS_SCTP_S_LAST,
1108         .dont_defrag    = 0,
1109         .init           = NULL,
1110         .exit           = NULL,
1111         .init_netns     = __ip_vs_sctp_init,
1112         .exit_netns     = __ip_vs_sctp_exit,
1113         .register_app   = sctp_register_app,
1114         .unregister_app = sctp_unregister_app,
1115         .conn_schedule  = sctp_conn_schedule,
1116         .conn_in_get    = ip_vs_conn_in_get_proto,
1117         .conn_out_get   = ip_vs_conn_out_get_proto,
1118         .snat_handler   = sctp_snat_handler,
1119         .dnat_handler   = sctp_dnat_handler,
1120         .csum_check     = sctp_csum_check,
1121         .state_name     = sctp_state_name,
1122         .state_transition = sctp_state_transition,
1123         .app_conn_bind  = sctp_app_conn_bind,
1124         .debug_packet   = ip_vs_tcpudp_debug_packet,
1125         .timeout_change = NULL,
1126 };